Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×
Communications

Exposed SSH Key Means US Emergency Alert System Can Be Hacked 86

wiredmikey writes "Recently discovered security flaws in the Emergency Alerting System (EAS) which is widely used by TV and radio stations across the United States, has made the systems vulnerable to remote attack. The vulnerability stems from an SSH key that is hard-coded into DASDEC-I and DASDEC-II devices made by Monroe Electronics. Unless the default settings were altered during deployment, impacted systems are using a known key that could enable an attacker with full access if the systems are publicly faced or if they've already compromised the network. By exploiting the vulnerability, an attacker could disrupt a station's ability to transmit and/or could send out false emergency information. 'Earlier this year we were shown an example of an intrusion on the EAS when the Montana Television Network's regular programming was interrupted by news of a zombie apocalypse. Although there was no zombie apocalypse, it did highlight just how vulnerable the system is,' said Mike Davis, a principal research scientist at IOActive. The DHS issued an alert on the vulnerability, and IOActive, the firm that discovered the flaw, has published additional technical details (PDF) on the security issue."
Firefox

Firefox 23 Makes JavaScript Obligatory 778

mikejuk writes "It seems that Firefox 23, currently in beta, has removed the option to disable JavaScript. Is this good for programmers and web apps? Why has Mozilla decided that this is the right thing to do? The simple answer is that there is a growing movement to reduce user options that can break applications. The idea is that if you provide lots of user options then users will click them in ways that aren't particularly logical. The result is that users break the browser and then complain that it is broken. For example, there are websites that not only don't work without JavaScript, but they fail in complex ways — ways that worry the end user. Hence, once you remove the disable JavaScript option Firefox suddenly works on a lot of websites. Today there are a lot of programmers of the opinion that if the user has JavaScript off then its their own fault and consuming the page without JavaScript is as silly as trying to consume it without HTML."

Comment Because everybody is a spam recipient (Score 1) 65

Yes, SEO is a business term. The technical term for it is "lying to search engine robots so they'll tell people your page is more interesting than it actually is."

There are other people who can help make your web site more interesting, or make it more accessible to search engine robots. Most of those people call themselves web designers or editors or content specialists or people who've spent 15 minutes reading Google's advice.

Comment Blackface minstrels (Score 1) 334

There are some variants on Morris dancing that are traditionally done in blackface. It's not African blackface, it's English coal-miner blackface.

On the other hand, I also play old-timey American music. There's a really good group called the Carolina Chocolate Drops who talk about the African-American roots of much of that style of music (obviously banjos, but other aspects as well), and they've said that they're probably the first generation of African-Americans who could play that style of music without their parents smacking them for doing something related to the old minstrel shows. Stephen Foster wrote some really good tunes, but you just have to play many of them as instrumentals and not try to fix the lyrics...

Comment Interop is still around? (Score 1) 334

I last went to one of those 20 years ago. It had stopped being an actual interoperability demo a few years earlier, but there were still some techies there as well as marketers in suits. It was the smaller Atlanta version of the show, and I was in town for a class. I ended up having dinner with the folks from a small East Coast software company that I knew a few of from Usenet, and they appreciated being able to refer to something that had happened at Pennsic without having to explain what Pennsic was (I hadn't actually been to it, but SCA was part of common techie culture.)

Comment Re:Unprofessional reverse-sexism (Score 1) 334

It's not whether they're physically attractive, it's whether they're dressed to be professional or attention-getting. The person in the booth-babe dress doesn't know your product, though neither does the guy doing the magic-show shill and giving out yet another iPod to the person who picks the card with the correct three buzzwords on it. (And neither does the restaurant worker running the espresso machine, but after dragging all over a trade-show floor I'll still appreciate your company for giving out coffee instead of making me go out and wait in line at the snack bar.)

Comment Re:Marketing, engineers, and trolls (Score 1) 334

Trolls are smelly cave dwellers. Most engineers have enough sense to wash ourselves, and if the marketers want us to do multiple shifts they'll provide multiple sets of whatever company-logo shirt they want us to wear this show, or tell us to wear basic blue shirts. (And the last time I was "unshaved" was decades ago; since then I've had a beard.)

How do you make your engineer or developer seem credible? Have booth staff who make sure that everybody at the booth knows everybody else, so if a visitor wants to talk to a sales person they get the right sales person and if they want an engineer they get the right engineer (either directly or brought over by the sales person.) And, y'know, make sure that the product you're trying to sell is appropriate for the convention you're trying to sell it at.

Comment Dr Who t-shirts are cool, ok? (Score 1) 334

(And I won't ask about fezzes.)

Ok, earlier today there probably were more men wearing dresses and high heels around here than women wearing Dr Who t-shirts. But that's because the gay pride parade was today and "here" is the San Francisco Bay Area. Normally, I'd guess there are more women wearing Dr Who shirts.

Comment Depends on the show (Score 1) 334

And sometimes the professionally dressed woman is the lead developer, not just a marketer. And sometimes the professionally dressed man is a professional booth shill, and he's surprisingly good at it.

I've worked trade shows also (usually when I've been a sales engineer, developer, or sometimes consultant; $DAYJOB's trade show people usually use some local employees, some headquarters marketing people, and some speakers from headquarters.) Some of the marketing people know the products, some are logistics folks who are good at getting the booth to the show, working with the local union to get it assembled, making sure that everybody who's scheduled to work the show knows what we're presenting, etc. There are shows where the target audience is C-levels, and shows where it's the technology people who are going to build your products into their products. I've seen more of the latter, but that's the kind of show I'm more likely to go to.

Comment Re:Not really sexist, just good psychology (Score 1) 334

Last time I bought a car there was one sales woman who was really attractive, but much more importantly she could talk about engines. Unfortunately for her, I didn't like the way the car handled (and next year's engine was going to be better, but I needed a car right then.) The dealer across the street had another car I was considering, basic fast-talking stereotype car sales guy, and while they didn't have the one I wanted in stock (they were trickling in randomly to dealers at that time of year), he gave me a price. Unfortunately for them, the next week when the one I wanted came in, the manager tried to jack up the price $500; I bought it from a different dealer.

Comment Why booth babes are counterproductive (Score 1) 334

>>Who cares?? > c) Female geeks at tech conferences.
And their friends and coworkers. And people who don't like being pandered to. And people who might have actually been interested in the product. And people who'd rather deal with companies that made an effort to understand who their customers are (unlike the company who had booth babes at the RSA trade show.) If you want an effective booth babe, have her be the lead developer for the interesting product you brought, not somebody in a tight dress.

If you want to sell me your product, you'll bring somebody who can tell me why it's interesting, and ideally somebody who can answer my technical questions about it or at least point me at the information. If you aren't doing that that, I may waste your time and seating space trying to win an iPad after I've seen the booths I care about at a show, but otherwise the best you'll do is get me to pick up a tchochke with your name on it.

I'm fine with booths that have people who are there for entertainment value, as long as you can also get me information, whether that's the noisy shill show or the technical celebrity (it was fun to see Ron Rivest at the RSA show some years ago, and Dan Kaminsky's always broken something important recently.) But if you've got professional booth staff, make sure they know at least a couple of sentences about your products and can point customers to the right people, whether that's the sales rep or the techie, and make sure your display has enough information that I can decide whether to find out more or move on without wasting your time. The kinds of companies that hire booth babes somehow never respect them enough to give them that much training.

Comment Knoppix? Obscure? (Score 1) 53

Get off my lawn, punk! I mean, if you're trolling, fine, have fun, and Ubuntu livecds have been good enough to use them instead of Knoppix for the last few years, but it was THE standard save-your-ass repair tool to keep around.

Comment Removing HPA? W00t! (Score 1) 53

I probably won't get around to using it, but a couple of years ago I had a disk get its Host Protected Area set (by a maliciously well-intentioned external drive enclosure), and after I couldn't fix it, I went to my friend the late Hugh Daniel, and he and I spent a long evening trying to get the Linux HPA tools to work, rebuilt Linux kernels a couple of times, consumed lots of pizza, and only succeeded in making the HPA bigger, never smaller. The tools just weren't good enough, and the documentation on HPA was deliberately unavailable. Fixing a 500 GB PATA drive is probably not worth it at this point, but it'd be a fun hack to do in memory of Hugh.

For those of you who've never met HPA before, it's a different set of BIOS interrupts for talking to disk drives which let you allocate space that Windows can't touch, so you can do things like hide a system-restore partition on the drive, or turn a 200 GB drive into a 128 GB drive (so an old computer that can't read LBA can at least use the 128 GB it understands), or turn a 250 GB drive with bad blocks into a 200 GB drive without them (so you can sell the stuff that didn't pass quality control.) In my case, I had an old Maxtor 200GB external USB drive that was failing from too many bad blocks, so I replaced the disk with a new 500GB one. The drive enclosure didn't recognize the disk, so it wrote a 300 GB HPA to knock it down to the same 200 GB size of the original one.

Comment Re:What about those home security systems? (Score 1) 136

I've generally asked them whose services they're selling, and strung them along for a little while getting information about them - where they do business from, etc. Be sure to get the name of the person you're talking to, so they think you're friendly. And then I either ask them how I know they're not actually burglars trying to find victims, or tell them to put me on their Do Not Call List, or ask if they'd like the FTC's $50,000 reward for violations of the Do Not Call list. (It was actually for recommendations on how to stop violations, but I'm willing to bend the truth a bit to get somebody to rat out Rachel From Cardholder Services.)

Slashdot Top Deals

BLISS is ignorance.

Working...