Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×

Comment WoSign's issues not just political... (Score 2) 57

The thing everyone jumped on WoSign for was doing a customer a favour. Some significant Australian customer wasn't ready for SHA1 certificates being phased out and asked if WoSign could help them out. WoSign issued back-dated SHA1 certificates for the customer.

Yep - and I'm pretty sure we know who that customer was. There are still major institutions still using SHA1 certs internally - and if they get moved to newer ones by the end of the year then I'd be shocked. The reality is, this stinks of a scapegoat - the industry in question would face *MASSIVE* disruption for the everyday Australian because of the relatively quick move to higher level certs. A lot of these are still contained within embedded devices that cannot upgrade so easily.

Instead, let's execute the CA for political reasons. Don't pretend its anything else.

Looking through the list on Mozilla's list of WoSign Issues it looks like WoSign not just issued

  • long lived SHA1 certs
  • identical certs other than the notbefore date
  • certs with identical serials
  • certs that violate the "Baseline Requirements"
  • certs using unapproved cryptographic settings

but their setup also violated a number of other best practices and security measures too (such as unpatched servers). However I'll note that on the political front folks were unhappy that the Startcom acquisition wasn't made public earlier. Outside that though there are a lot of different technical complaints.

CA's have been dropped in the past for non-political problems (see DigiNotar) so I don't think it's fair to attribute WoSign's woes to purely political motivations as you alleged.

Comment Re:Easily Thwarted (Score 1) 270

It's a bit more elaborate because if you need a visa (citizens of some countries can get visa waivers) at application time you MIGHT be asked to give up all this extra information if they deem it necessary. It's not clear that every visa application will force the applicant to cough up all this information right away or only if you trigger some extra checks required tripwire (e.g. "name contains non-even number of letters, full information required"). Also note this presumably happens once per visa so if your visa lasts a year and you were pressured into having to do this you'll have done it once for that year even though you may fly many times...

Comment Re:Hit Job on Google? (Score 3, Interesting) 301

No, News Corp has been doing this for years. The reason is Murdoch thinks Google and Google News specifically is killing the news industry, and that the iPad will save it (or at least he thought that a few years ago). It's pure inter-corporate warfare being played out through manipulation of public opinion. The WSJ in particular are experts at it.

Comment Mod parent up? (Score 1) 235

It's hard to know for sure because the account that posted the parent comment seems to be new and it's unclear who the commenter is in real life but this seems to be a well written complaint about the outcome of WebAssembly. I did a quick search and it doesn't immediately look like a copy/paste of critique from elsewhere so it seems a shame to see this slip below the waves. Sadly, I suspect few will see it because this story has passed the "breaking news" point...

Comment Re:Finally (Score 2) 540

Software development can be a high skilled job but entry level skills can be obtained in months, which is not coincidentally, how much training time seems to be involved with learning to be a long haul truck driver in the USA (I see quotes of about two months of full time study for the formal exam around the internet so maybe call that three months when employer training time is included). Three months of full time study isn't going to make you a well paid programmer but that's plenty of time to learn basic web development skills, and another two or three after that with a good course will get someone writing basic CRUD business web apps if they want to. Of course, it's the start of the journey, but now think how many clueless developers you've encountered who are earning good money.

Can the software development world absorb millions of new developers? Sure, it has done in the past, think dotcom boom. Trucking won't disappear over night, nor will taxi drivers, if only because of limited capacity to upgrade vehicle fleets even assuming the technology becomes perfect (which it isn't), and not all drivers will become software developers.

Comment Re:Ataturk would be spinning in his grave (Score 2) 99

Well, Ataturk tried to forcibly reform Turkey into a western style country through a dictatorship. He was always in favour of democracy ... in the future, knowing full well that he hadn't built any real support amongst the people for his plan but betting that over time the culture would change. Seems like he lost that bet.

Submission + - Bandcamp: the Holy Grail of online record stores (rocknerd.co.uk)

David Gerard writes: Is Bandcamp the Holy Grail of online record stores? Hell yes. Unencumbered downloads in any format you like, excellent discoverability and a ridiculously better experience than any other download store. Musicians too: "The interface and the available tools are all so well-thought-out it’s genuinely a pleasure to use." They also like that they straight-up get 85% of the take.

Submission + - The timing of error messages contributes to them being ignored (byu.edu)

sandbagger writes: A new study from BYU, in collaboration with Google Chrome engineers, finds the status quo of warning messages appearing haphazardly — while people are typing, watching a video, uploading files, etc. — results in up to 90 percent of users disregarding them.

Researchers found these times are less effective because of "dual task interference," a neural limitation where even simple tasks can't be simultaneously performed without significant performance loss. Or, in human terms, multitasking.

Submission + - Kim Dotcom's Mega 3, with Bitcoin: two bad ideas that go worse together (rocknerd.co.uk)

David Gerard writes: "Colourful racing identity" Kim Dotcom has a scheme for his third Mega enterprise: combining MegaUpload with Bitcoin. It is entirely unclear how anything about this makes sense, but I'm sure that with a trustworthy soul with an impeccable track record like Dotcom at the helm, nothing can possibly go badly for anyone involved.

Submission + - Ask Slashdot: Handling Windows Updates after October 2016 (slashdot.org)

An anonymous reader writes: We've read about the changes coming to Windows Update in October 2016. Average Joe and Grandma Flo will end up getting the cumulative update via WU each month which includes non-security updates. For more discerning users with existing Win 7 / 8.1 systems, one can disable WU and download the security-only update each month. But what happens when it's time to wipe and reload the OS? Or what about installing Windows on different hardware? Admittedly, there are useful non-security updates worth having, but plenty to avoid (e.g. telemetry).

How does one handle this challenge? Set up a personal WSUS box before October to sync all desired updates through October 2016? System images can work if you don't change primary hardware, but what if you do?

Or should one just bend the knee to Microsoft, go to the nearest drug store, and stock up on KY?

Slashdot Top Deals

"Everything should be made as simple as possible, but not simpler." -- Albert Einstein

Working...