Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Unexplained: door plug manufactured for another AC (Score 1) 114

Not only is it unknown to the FAA who botched the remounting of the door plug and forgot the 4 bolts. It's not known, at least publicly, why that particular door plug is the one that was remounted.

Fact: The door plug that fell out from the sky bears the marking "LINE UNIT:8799" (source: press photo).
Fact: Tthe NTSB preliminary report states the accident aircraft has Fuselage Line 8789 (notice the one-digit discrepancy). And fuselage Line 8799 is that of a later aircraft delivered a month later.

Hence, the door that fell was manufactured with the intention of fitting it to an aircraft earlier in the assembly line (or is marked wrong).

We also know from a whistleblower that at one point, the door seal was found to be damaged. And no replacement door seal was immediately available. That creates an incentive to swap the door, solving the seal problem, which would perfectly fit the the above evidence.

It's common practice in manufacturing to “cannibalize” parts up in the assembly line to finish the unit that's next to be delivered. I know no reason why it would have been objectionable in the circumstance, subject to
- proper paperwork documenting the swap
- remounting the screws properly
- duly inspecting that.

But it looks like these three steps have have been skipped. And that should be a big deal.

Comment Further raises the antivirus carbon footprint (Score 4, Insightful) 66

According to WetFinger, 1/3 of the electricity consumed by computers with pay-for antivirus software is for the antivirus to do it's things: slow down the machine to a crawl, and emits messages aimed at justifying the purchase of a renewal or upgrade.

This new feature will dramatically increase that energy share, thus hastening the certain demise of humanity.

Comment Computers are antagonist to voting security (Score 2) 433

I design Smart-Card based payment systems. Like many applied cryptographers, I believe cryptography and computers are antagonist to voting security if we want to keep vote secret.

The most important goals of a voting system are that
1) voters will trust the result
2) massive fraud by few individuals is impossible
3) voting under duress or bribery can not get massive.

Requirement 3 is why vote is cast in the secret of a booth, and shall remain secret. Experience has proved secrecy is important, and straight antagonist with vote-by-mail, and by extension vote-at-home or vote-on-one's-mobile.

And once we accept most voters should vote secretly (with duly justified exception for vote by proxy and remote locations), we just do not know a cryptography-based system that meets either 1 or 2.

The reasonable layperson does not understand how cryptography and computers really work, thus is more likely to trust their cote is counted when they have put a paper in an envelope, have seen it fall in a transparent box, and have confidence that it is watched by observers until and when the envelopes are opened and hand-counted locally (and counts at each voting places made public, which makes alteration of these counts detectable by observers). Sure, this is subject to local manipulation. But that can't lead to massive undetected fraud on a large scale.

And the reasonable layperson is right! Cryptography does not guard against the risk that the voter's intention is disclosed and/or changed between the button pressed and the computerized treatment made of that, by way of a hardware or software modification made by the makers or guardians of a voting device. The more knowledgeable, the more reluctant security experts are to tell no such disclosure or alteration is possible.

No countermeasure exists against "we spy on the voting machine to know how you voted, so you'd better vote as we instruct"; and that can actually be true for virtually all voting machine design (by Van Eck phreaking, and so many other ways). And voters can't check the vote they cast on a machine are counted in the right direction (for any verification mean could be used to prove how the vote was cast, making bribery/threatening effective), unless the check they make is from an unalterable audit trail (like paper) that ultimately is what defines the vote cast.

Security

Modern RAM Used For Computers, Smartphones Still Vulnerable To Rowhammer Attacks (zdnet.com) 13

An anonymous reader quotes a report from ZDNet: According to new research published today, modern RAM cards are still vulnerable to Rowhammer attacks despite extensive mitigations that have been deployed by manufacturers over the past six years. These mitigations, collectively referred to as Target Row Refresh (TRR), are a combination of software and hardware fixes that have been slowly added to the design of modern RAM cards after 2014 when academics disclosed the first-ever Rowhammer attack. But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh," a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.

Comment Re:Change the cipher... (Score 2) 50

I wonder what supports:

in fact because of this [key scheduling] weakness, AES-256 may be even less secure than AES-192

No attack that I know makes AES-256 weaker than AES-192, or anything close to that (unless some rounds are trimmed).

Beside, attacks on AES key scheduling make the assumption that the adversary can impose some transformation of the key that she chooses, when the standard and practically relevant assumption is that the adversary can not influence the choice of key. Under that assumption, as far as I know, all three variants of AES are within 3 bit of its original security goal.

Comment TAOCP is a great reference, I still often use it (Score 1) 381

I like TAOCP, a lot; mainly, because the material is so coherent, precise, well justified, and understandable enough. I spent many weeks reading sections of TAOCP; especially volume 2, on Semi-numerical algorithms; my copy has several post-it marks on techniques useful in my field (applied cryptography): wide multiplication algorithms, modular arithmetic including exponentiation, statistical tests.
I also had significant uses of volume 1 (Fundamental Algorithm), which covers things such a tree, and hash tables; even purchasing the third edition, on top of the second.

That said,
- _reading_ TAOCP from start to end is not something to consider lightly; perhaps if one has a year to spend.
- I never caught on the use of MIX in some programs; I just skip this, and advise contemporary readers to do so, even if that's missing a part of the beauty.

Comment Information Sharing & Analysis Organization?! (Score 1) 29

The actual FCC noticel [FCC notice] has:
(6) Plans With Information Sharing and Analysis Organizations.
Plans to incorporate relevant outputs from Information Sharing and Analysis Organizations (ISAOs) as elements of the licensee's security architecture. Plans should include comment on machine-to-machine threat information sharing, and any use of anticipated standards for ISAO-based information sharing.

What's an ISAO? Here's what the DHS has to say. Short summary: Big Brother.

Comment Is what the FBI ask Apple feasible, or not ? (Score 2, Insightful) 400

There is something that does not add up in Apple's discourse at http://www.apple.com/customer-...

Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor.

I read what the FBI asks as: install a piece of code that allows the phone's content to be examined. I see no middle ground between

1) running such piece of code (probably: after getting it signed by Apple) is possible without the owner's passcode; the iPhone is in fact already backdoored, with Apple holding the key, the FBI wants Apple to exploit the vulnerability/open the backdoor, and Apple does not want to bow, because that's against their policy.

2) running a piece of code signed by Apple also requires he owner's passcode; then the solution pushed by the FBI just can't work.

If the facts where 2, Apple could just state this to the FBI, showing the source code as proof. The FBI would have no choice but take it as fact (perhaps they would ask a change in the future, but it would not help immediately for this iPhone). I conclude the true story is 1, and Apple slightly misrepresents things stating the FBI wants the creation of a backdoor, when there's already one, only well locked and never previously used for nefarious purposes.

Slashdot Top Deals

Truly simple systems... require infinite testing. -- Norman Augustine

Working...