Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:250kbytes in 2003 (Score 5, Insightful) 110

Many sites continue to limit lists to about 5 items, forcing the user to click next pages dozens of times to see everything. All to save a few kilobytes in a web that is many megabytes.

Uhh, did you not realize those listicles are limited so that you have to generate clicks? They measure engagement and harvest your eyeball-attention-usage data from those clicks. Even with JavaScript they don’t get much data from you scrolling through a page, but make it clickable and they can behaviorally profile your interest, consumption, and maybe even the person using the mouse, depending on whether we’re thinking Cambridge Analytica/Palintir level magic, or just make a good guess if you don’t believe in the BS. Either way listicles have not a single thing to do with data/bandwidth saving.

Comment Re:garbage software is in use in HR (Score 2, Interesting) 98

What’s the alternative though? Those same HR drones are maybe even _worse_ at resume analysis than a grep search, or they were the last time I had to work with one (hr drone) - they could not (or would not) tell the difference between a MS in Comp Eng. from a diploma mill and a 20 year veteran with a high school music cert (pro tip, the 20 year veteran was hands down the best software artist I’ve ever hired), they kept feeding me “highly qualified” people who were great at doing tests and paying tuition, but lousy at anything requiring independent thought, but then the HR drones were themselves bad at independent thought which is why they were in HR in the first place.

Humans are very bad at judging other people from paper resumes, computers are literal algorithms, even LLMs are limited by their training data, hiring is a risky business full of ways to do it wrong. Maybe we should do a better job teaching mid level developers to be talent scouts and ditch both the CV scanners and the basket-weaving degree holding HR drones?

Comment You mad bro? (Score 3, Interesting) 109

Valve COO Scott Lynch simply offered up a sardonic "You mad bro?"

Not sure if Lynch is somewhere on the spectrum (as in neurologically unable to judge his correspondent's attitude) or just as much of a scumbag as Sweeny (as the great statesman once said "Pity they can't both lose"), but apparently yes, yes he was mad, very mad. Mad enough to go to war with one of the largest companies on earth, lose epically (*snort*) in Federal Court, and keep on digging [cf: EU regulations of late]. At this point Sweeny is going to bankrupt Epic out of sheer spite against all the parties that seem hostile to him, and I'm not sure he's really wrong, just going about it in the most phyrric way possible.

So that begs the question, was Valve aware of how bad Sweeny is at persuasion and winning the long-game and they chose to purposely enrage him, or were they just as clueless about why all this rent-seeking makes the rest of the world hate them?

Submission + - Watch: SpaceX 3rd Starship Launch Attempt a Success (youtube.com)

sixoh1 writes: On the third attempt, SpaceX's SuperHeavy Booster lofted the StarShip vehicle to space and a sub-orbital parabolic trajectory. The test was successful for nearly all of the objectives, including payload delivery functions on StarShip that will be used for Starlink deployment, and in-space fuel transfers. Unfortunately the booster did not soft-land, and the StarShip vehicle was destroyed during re-entry, likely due to unspecified issues with re-starting the Raptor engine, and then maintaining attitude control during re-entry.

Submission + - Tiny sea creatures could help unravel flight MH370's mysterious disappearance. (wionews.com)

Press2ToContinue writes: The mysterious disappearance of Malaysia Airlines Flight MH370 continues to baffle the aviation world, making it one of the most perplexing incidents in history. Departing from Kuala Lumpur en route to Beijing on March 8, 2014, the aircraft vanished from radar screens, carrying 239 passengers and crew members. Despite extensive multinational efforts spanning a decade, involving the scanning of a vast 46,300 square mile area, the aircraft remains missing.

Recent developments have thrust tiny sea creatures, known as barnacles, into the spotlight of scientific inquiry, offering a potential breakthrough in the search for MH370's wreckage.

These barnacles were discovered clinging to the initial piece of debris conclusively linked to MH370—a flaperon bearing the distinctive marking "657 BB," which washed ashore on Reunion Island, situated off the coast of Africa, a year following the event.

Barnacles have earlier also helped researchers in tracking "ghost nets" posing threats to marine life to locating missing vessels.

Submission + - How should we understand Genetics vs. "Lived Experience" (astralcodexten.com)

sixoh1 writes: Astral Codex Ten looks at a case of possible cultural appropriation by professor Elizabeth Hoover, who understood herself to be Mi'kmaq and built her life around Native American identity, but found out via 23-and-me that she wasn't. The consequences to her, including lying about the genetics to try and retain this identity, highlight some large questions about the nature of racial-identity, and genetics vs "lived experience" . A rationalist/effective-altruism approach to this leads to a funny observation:

This is weirdly tolerant (okay, aside from the Jewish conspiracy thing) compared to anyone in the Hoover story. In Bizarro-America, the only people who don’t think people’s value as human beings depends on their genetically-determined race are the white nationalists!


Submission + - Starlink cuts P99 latency by 60%, deploys FQ_Codel on WiFi (starlink.com)

mtaht writes: Starlink has set itself a goal of 20ms latency across their entire LEO network, and published an update as to how far they have come, and how far they are going, tackling "Dumb stuff driven by non-physical limitations in our system" – "unneeded processing delays, unoptimized buffers, or unnecessary packet drops that force retries. Buffers across our network have been right sized to reduce bufferbloat, and queueing algorithms have been improved to increase capacity on our gateway links from the ground to satellites. Our WiFi latency has been improved, with the addition of active queue management, fq_codel, to the Starlink WiFi router. With active queue management enabled, when one person on your WiFi is downloading a big file, and another is playing a game, the game latency will not be affected by the download".

Submission + - All you need to know about the April Total Eclipse (usatoday.com)

techno-vampire writes: On April 8, skygazers along the wide-sweeping arc of the Great North American Eclipse's path will step outside to catch a rare glimpse of the sun while the Earth becomes shrouded in darkness.

For just the second time in seven years, day will suddenly become night for a few brief, wondrous minutes as the orbiting moon blocks the sun's light along a southwest-to-northeast path across the continent.

Comment Re:bogus (Score 1) 70

TFA

Recession-induced mortality declines are driven primarily by external effects of reduced aggregate economic activity on mortality, and recession-induced reductions in air pollution appear to be a quantitatively important mechanism.

The authors mathematically correlate the recession with a reduction in mortality, this is non-controversial (that is if we agree that the mortality statistics are valid). What happens next is where I agree with Junta - this conclusion is some pretty broad hand waiving speculation that is certainly persuasive, but not actually justified as a proven fact:

(1) from Page5 of the article, the source data is CDC (for young people and all cause mortality) and Medicare data (for retiree mortality), Bureau of Labor Statistics for actual employment, EPA Air Quality data as a proxy for drivers of mortality from pollution, Behavioral Risk Factor Surveillance Survey (BRFSS) to identify mortality driven by work activities, and Medicare Health and Retirement Survey for 2002-2014 to account for drivers of mortality amongst nursing home residents.

(2) they (page 10) then attempt to measure the "Shock" impact of the Great Recession in terms of mortality overall, in an attempt to remove confounders, they look at regional variations (between states) and level them out so as to approximate only the median effect of the recession upon Mortality (the claimed reduction),

(3) finally by page 20 the authors begin to make hypothesis about the causation of the decline (which pre-supposes their math in the above sections are sufficiently robust, as I am not a statistician I'll leave that debunking to others). The authors report first on "internal" effects which is about non-aggregate single-person behavior, like seeing your own doctor and eating healthily:

Moreover, when we look directly for evidence of internal effects, we find no evidence of a substantive role for these channels. We find no evidence of a statistically significant impact of the Great Recession on self-reported health behaviors

Then they look at external effects, communicable diseases, quality of healthcare, and then _finally_ pollution. They only consider these factors based on prior papers that suggest correlation, they don't provide a rational in the paper itself as to why you discount other possible sources of the change in mortality, so here's the first point where I think this is quite broad speculation masquerading as "hard statistical analysis":

We find little support for a role for the first two classes of external effects, but evidence consistent with a quantitatively important role for recession-induced reductions in air pollution in explaining over one-third of the recession-induced mortality declines.

Essentially they restrict the analysis to three possible causes, and with lack of proof of either of the first two analyzed causes they pull a Sherlock Holmes and "ergo the cause must be item number 3". While we can agree that there is correlation, and it seems valid to assume pollution does in fact lead to mortality, the nature of the causation is left as an "a-priori" statement and they proceed immediately to calculation of the magnitude of the connection.

 

Comment Re: Critical missing context - UEFI (Score 1) 51

If I mis-spoke let me re-state, I agree this is not a "bug" in UEFI, its a gaping giant hole in the entire security model of UEFI and secure-boot, and it is enabled (in my opinion strongly encouraged) by the UEFI execution model.

Re-read the original justification for the shim and tell me we didn't intentionally imeplement an insecure "Secure boot" mechanism in order to compete with Microsoft?

Reference: https://www.linux-magazine.com...

Comment Re:Not a bug in UEFI itself (Score 1) 51

No UEFI hasn't included anything. UEFI's job ends when it executes and validates the signature of the shim.

From the original article the faulty shim code has valid UEFI signatures, but that code is allowed to load other remote code which is not signature tested!!!

Worse, this happens "before ExitBootServices" - meaning UEFI his technically still in total control of the CPU. UEFI loads the shim and jumps into the shim code, the shim can be forced to load and execute unsecure/unknown code. Since UEFI has not exited, and there is no "user" context here with reduced privileges and privilege separation that occurs after the jump to OS code, the exploit has essentially full access any non-volatile storage (including 'CMOS', attached disks), RAM, cpu microcode, and everything else that runs after this point. The only thing you probably cant compromise is whatever is running in IME or TPM devices.

Comment Re:Not a bug in UEFI itself (Score 2) 51

The bug has nothing to do with UEFI per se. You could end up with the same bug in a BIOS boot option ROM or bootlader for network booting.

I don't think that's quite possible, you would have to literally re-program the BIOS option ROM (usually EEPROM/FLASH connected to the Ethernet MAC device) in order to change the PCI Option-ROM code. It's been a while but I don't recall many Ethernet card vendors allowing you to arbitrarily rewrite PCI Option-ROM addresses from the OS without some pretty special tools (and every vendor was different). Here UEFI includes an explicit mechanism to execute non-OEM supplied code during the boot process, which is generic across any UEFI client OS (Linux or Windows), from OS writable disk locations. That makes it a rather large target considering the install base.

Comment Re:Critical missing context - UEFI (Score 3, Interesting) 51

OMFG jump to conclusions much? TFA and Ars explicitly place the cause/responsibility on "Linux developers", but as others below point out the issue is in "shim.efi" which technically isn't Linux (and absolutely is not the kernel!), though I'm probably also wrong to state that it is "UEFI" - more like a piece of code that is jointly-terrible, a bad compromise forced on the Linux community by Intel/Microsoft through the UEFI architecture. Its a direct outcome of trying to code a perfect boot security system (SecureBoot) while ignoring many many many years of experience that screams "NEVER TRUST THE INTERNET"... actually it's worse, secure boot turns that on it's head and says "NEVER TRUST THE OWNER OF THE HARDWARE, WE KNOW BETTER"...

I stand by my original point, if your personal non-enterprise, non-cloud computer, can be fooled into looking at insecure internet addresses for boot artifacts (before a single ASM instruction of the Linux kernel itself executes by the way) without requiring evil-maid access to the firmware/FLASH on the motherboard, then the upstream boot processes architects (again Intel/Microsoft and the PCOEMs) are the source of your problem, not "the Linux community".

Comment Critical missing context - UEFI (Score 5, Insightful) 51

This is not a Linux vulnerability, this is a UEFI vulnerability exposed by a bug in Linux's boot code. Undoubtedly the exact same mechanism might exist in Windows boot code.

The real lesson - network booting is a nifty thing for specialized circumstances for use only by experienced security-aware administrators, and should not be a default install on any consumer grade hardware...

Comment Re:That's not what "race to the bottom" means (Score 1) 70

The free ride was nice while it lasted, but nobody complaining has a leg to stand on.

Except TFA is not talking about password sharing, the entire point is repricing, rebranding and re-selling something you already thought you were paying for, kind of like BMW setting "heated seats subscription" ... its entirely immoral and unethical to bait and switch by taking an established functionality that was part of the marketing campaign which convinced you to sign up for a service tier, and then arbitrarily change the tiers. That used to be called false advertising, but its not like everyone didn't just accept the shrink wrap license agreements and one-sided service contracts... no, wait they did, never-mind, guess it must be ok then.

Slashdot Top Deals

UNIX is hot. It's more than hot. It's steaming. It's quicksilver lightning with a laserbeam kicker. -- Michael Jay Tucker

Working...