Slashdot is powered by your submissions, so send in your scoop


Forgot your password?

Comment Here's what's affected (Score 1) 130

The impact of this is actually pretty wide. Crypt_blowfish has been gaining popularity as a hashing algorithm in PHP thanks to Openwall's PHPass framework. Four years ago most PHP projects that I know were still using MD5 or SHA1 to hash passwords. Today those MD5 and SHA1 hashes can be brute-force cracked by free software running on a $200 GPU in a matter of days if not hours. So even a buggy version of Blowfish is still better by far.

So yeah, it's a wide-ranging bug but not a world breaking one. For starters it only affects passwords that use 8-bit characters, so passwords typed by anyone using a US-English keyboard still produce the same hashes as the correct Blowfish implementation.

For passwords of length n*4-1 (3, 7, 11, 15, ...), 8-bit characters in certain positions will result in some characters being ignored by the hash function. This makes it possible (though still not easy) to produce a collision, i.e. multiple different passwords that result in the same hash.

It's bad, but I want to stress that using even a buggy crypt_blowfish for password hashing is still a quantum leap over the single-hashed MD5 or SHA1 that you were seeing literally everywhere in the PHP world just a few years ago.

Comment Re:crypt_blowfish (Score 2) 130

Anyone care to speculate on the likelyhood of widespread blowfish use by public sites?

Wide. Many major PHP projects have been moving toward Openwall's PHPass algorithm that uses Blowfish as its preferred hashing algorithm. Note that even with this bug it's still better than the unsalted MD5 or SHA1 hashes that most projects were using previously. Today any of those old hashes can be brute-force cracked by a $200 GPU in about a day.

Comment Please don't block on Acid3 (Score 1) 481

Let me fix that for you:

As a side note, it's unlikely that Firefox 4 final will pass the Acid3 test, despite this being a very popular demand amongst silly people who don't understand web development.

The Acid tests are demos, not unit tests of HTML compliance. I would rather see real progress in areas where FF is truly weak (like, say, the crappy SVG renderer) than worry about those last three pips on Acid3.

Comment Re:also he may be a liar (Score 2, Interesting) 542

Except that his story isn't that hard to believe. I can remember busting out 20-page papers overnight when I was in college and I'm not a particularly fast writer. It's easy to imagine that someone with enough practice and motivation could churn out papers like this for a living.

Today I code web applications and I recognize the process he describes. He has essentially built a research paper "framework" that lets him quickly build products that fit a baseline set of requirements. In fact it sounds like he rarely even has to come up with a true finished product, essentially building one proof-of-concept after another. It's amazing how fast you can work when you honestly don't care about the details.

How many code geeks will spends hours and days and weeks over meaningless bullshit projects just because they can? This guy does the same thing with words and he found a way to get paid for it.

Comment Re:No science? (Score 4, Insightful) 542

The writer of TFA clearly specializes in writing. He/she probably has a good academic prose style, and good research skills, along with a jstor subscription or nearby university library. Quite possibly, he did a liberal arts or social science degree, which gave him the necessary practice; but found the job market unexciting with those credentials.

Go back and read TFA. I'm saying this not to be an asshole but because it's genuinely fascinating.

The author states that:

* He went to college to be a writer and found out that there's more than one way to get paid for what you write.

* He uses mainly Wikipedia (for background), Amazon for the free pages, and Google Academics for the abstracts. Everything else he spins from educated guesswork and outright bullshit with lots and lots of filler.

* He doesn't edit his work at all, this helps him work faster and heads off requests for him to "dumb it down".

* His clients often thank him for making typos (presumably because it looks more authentic that way).

He's not producing high quality work for top honors, he's producing "good enough" work for the sake of graduating at all. It may pay to get A's but C's get degrees, etc.

I've said for years that not everybody needs a college degree. I would guess (I would hope) that this guy is helping along the raft of mediocre graduates who won't ever really use their degree except as resume fodder. Unfortunately this just devalues college degrees even more so that employers keep on requiring degrees for jobs that don't really need special training.

He's right about one thing, blame the colleges that are more interested in collecting tuition fees than in producing actual, competent scholars.


Justice Department Seeks Ebonics Experts 487

In addition to helping decipher their Lil Wayne albums, the Justice Department is seeking Ebonics experts to help monitor, translate and transcribe wire tapped conversations. The DEA wants to fill nine full time positions. From the article: "A maximum of nine Ebonics experts will work with the Drug Enforcement Administration’s Atlanta field division, where the linguists, after obtaining a 'DEA Sensitive' security clearance, will help investigators decipher the results of 'telephonic monitoring of court ordered nonconsensual intercepts, consensual listening devices, and other media.'”

Comment Re:Confusing symbols (Score 1) 1268

(TFA doesn't say if there were directions, like "Solve for the missing quantity in parentheses" or something like that.) I bet more people would have understood if they used something like x. Maybe they were trying to avoid "scary" variables for middle schoolers, but that's actually exactly when I remember learning what they were--if not, the year before.

Proper directions make all the difference.

When I was a kid math classes weren't on different tracks until middle school. Near the end of sixth grade I was given a test to see if I could handle the highest track which taught algebra. But of course, I had never seen algebra before so the test itself had to explain some basic concepts. Which it did. In surprisingly clear and simple language that had me solving for "x" in minutes. Each page introduced a new algebraic concept and I was eating it up.

The test was designed to be more work than a kid could finish in the time limit but I got pretty damn far. The irony is that I spent the next year in a basic algebra class that taught me very little I hadn't already learned from that tracking test.

I wish I still had that test. Whoever wrote it deserved a medal.

Comment Re:They just need to treat it like it's a privileg (Score 1) 312

For Jimmy's Indie Brewz, locations 1, the wifi is probably just some router on a DSL line. Integrating a code system would either mean forking over $$$$ to his POS vendor, if they even offer that, or hoping that his cousin is one of those "linux hackers".

If Jimmy doesn't know how to run his WiFi then why is he trying to sell it? I know nothing about coffee; if I tried to sell coffee I would go bankrupt. Even if you "sell" WiFi access for free as a loss leader, it's still a product. Stick to products you understand or hire someone who knows the product you're trying to sell. That's Business 101.

Comment So how does Ridley Scott feel? (Score 1) 506

"Do Androids Dream of Electric Sheep?" is a wretched book. Nobody but the hardest-core SF geek would give a shit about it today if David Peoples and Ridley Scott hadn't turned it into a movie that was 100x better. So just who is riding who's coattails?

It's not as if only PKD's brilliant, visionary mind could have come up with putting a number after the word "nexus" to make a cool-sounding name.

Comment Kill your cable (Score 5, Insightful) 345

I finally got tired of the $75/month, the cable box meltdowns every three months (Scientific Atlanta FTL), and the generally craptastic quality of over-compressed video from Brighthouse. Six months ago I told them where to shove it and never looked back. Now I get TV series on DVD from Netflix, occasionally catch a new show on Hulu, and use some good ol' rabbit ears to get my local channels (which look great in over-the-air digital, better than they ever did through the cable).

Screw cable. I'm done with paying for a raft of crap I don't need to subsidize their other businesses. And I'm certainly done with their obsessive consumer lock-in.


Want to Eat Chocolate Every Day For a Year? 158

Scientists from the University of East Anglia are studying the potential health benefits of dark chocolate, and need 40 female volunteers who would like to eat chocolate every day for a year. The chocolate loving 40 must be post-menopausal and have type 2 diabetes so it can be determined if the flavonoid compounds in chocolate can reduce the risk of heart disease. Dr Peter Curtis, of the UEA's School of Medicine, said, "Our first volunteers are about to return for their final visit to see if the markers of heart health - such as blood pressure and cholesterol levels — have changed. A successful outcome could be the first step in developing new ways to improve the lives of people at increased risk of heart disease."

Comment The Model M is much more than a keyboard (Score 4, Interesting) 519

It's a geek badge of honor. I own a few and I love them like my children (okay not really, maybe like my pets) but part of that comes from the effort I put in to scrounge them and clean them up myself. I do like the feel of typing on a Model M but what I love is the feeling of gravitas (figuratively and literally, it's really heavy).

Vintage hardware is neat but most of it is of no practical use today. Is there any other part of a 20-year-old computer that you could still use for day-to-day tasks? A Model M lets you feel old-school without actually having to live in the bad old days of floppy disks and 300 baud modems.

I type on my wife's Mac keyboard and it's fine. I type on a rubber dome keyboard at work and it does the job too. Maybe I would feel differently if my job required pumping out hundreds of thousands of words very quickly, but for most people (and, I suspect, most Model M owners) that's not the case.

Nostalgia is fun. It's okay to have a "throwback" keyboard if that's what you want. Not every technological choice we make has to be justified by greater efficiency or superior ergonomics. Relax and feel the Model M love.

Comment Or perhaps they just aren't good (Score 1) 753

I love Joss Whedon and I still carry a huge torch for Firefly but I watched two episodes of Dollhouse and they just weren't very good. The characters are totally one-dimensional, the action is boring and the dialogue isn't funny. Compared to Firefly it's hard to believe they came from the same guy.

And I'm sorry, but you lost me at the word "Terminator". I have zero interest in seeing yet another retread of that franchise. Find another stone to squeeze blood from.

Slashdot Top Deals

You will be successful in your work.