Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror

Comment Re:So what? (Score 4, Informative) 36

FUD over Huawei?! I thought it was politics, but I did some digging...

After *five years*, Huawei still haven't been able to address severe security concerns the UK had (below is just a subset of problems from the report I link, any one of which would make infosec get up and leave the room). I would imagine *all* agencies have access to a Huawei device within seconds of access.

And note: This is just looking at their cell-tower switch product, with their cooperation:

The report analyzed the use of the commonly used and well maintained open source component OpenSSL. OpenSSL is often security critical and processes untrusted data from the network and so it is important that the component is kept up to date.

  In the first version of the software, there were 70 full copies of 4 different OpenSSL versions, ranging from 0.9.8 to 1.0.2k (including one from a vendor SDK) with partial copies of 14 versions, ranging from 0.9.7d to 1.0.2k, those partial copies numbering 304.
  Fragments of 10 versions, ranging from 0.9.6 to 1.0.2k, were also found across the codebase, with these normally being small sets of files that had been copied to import some particular functionality.
  There were also a large number of files, again spread across the codebase, that had started life in the OpenSSL library and had been modified by Huawei.

And then the bit about memcopy... holy heck...
  There were over 5000 direct invocations of 17 different safe memcpy()-like functions and over 600 direct invocations of 12 different unsafe memcpy()-like functions. Approximately 11% of the direct invocations of memcpy()-like functions are to unsafe variants.
  There were over 1400 direct invocations of 22 different safe strcpy()-like functions and over 400 direct invocations of 9 different unsafe strcpy()-like functions. Approximately 22% of the direct invocations of strcpy()-like functions are to unsafe variants.
  There were over 2000 direct invocations of 17 different safe sprintf()-like functions and almost 200 direct invocations of 12 different unsafe sprintf()-like functions. Approximately 9% of the direct invocations of sprintf()-like functions are to unsafe variants.

These numbers do not include any indirect invocation, such as through function pointers and the like. It is worth noting these unsafe functions are present in the binary and therefore pose real risk.

  Analysis of relevant source code worryingly identified a number pre-processor directives of the form “#define SAFE_LIBRARY_memcpy(dest, destMax, src, count) memcpy(dest, src, count)”, which redefine a safe function to an unsafe one, effectively removing any benefit of the work done to remove the unsafe functions in the source code. There are also directives which force unsafe use of potentially safe functions, for example of the form “#define ANOTHER_MEMCPY(dest,src,size) memcpy_s((dest),(size),(src),(size))”

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/790270/HCSEC_OversightBoardReport-2019.pdf

Comment Re:Most expensive rocks (Score 3, Informative) 24

Given the $1.16 billion estimated total cost of the project, those 60 grams of rocks are officially the most expensive stuff we have had humanity.

... I'm thinking Stardust gives that a run on the money? It was cheaper, sure ($0.2 billion), but it returned a *total* mass of just 0.000000000000001g (source). Which means that material is worth 10^16 more than OSIRIS-REx's material.

Comment Re:Maybe they can't be detected (Score 2, Informative) 553

This is why the laser is split, and sent down two perpendicular paths. Sure, a wave might stretch the spacetime of the X axis... but that same stretching wouldn't effect a similar increase in the return time of the Y axis. This very stretching of the measuring device itself against one axis(thus modifying the round-trip time of the split laser as compared to a perpendicular path) is the very thing that they are measuring.

Your pet theory, and their experiment, match. :)

Comment No difference (Score 1) 9

The way I've seen this approached is that, if it's a good interview setup you are not the only one interviewing him and there is reasonable coverage with people who can interview on that level.

So interview him as you would someone on your level, this will atleast give coverage on deeper issues they may not get with 'higher ups'

Also you could think of an issue that you personally had trouble with and ask them about that. How they answer it should give you some idea of if they are in fact above your level.

Comment Re:There is only one true keyboard... (Score 2, Informative) 713

I highly recommend the Microsoft Ergonomic 4000. Everything that started going wrong with keyboards has been overturned with this model. I know I sound like a shill, but I bought two myself for both home and for work. Inverted T arrows, 3x2 home keys, number pad, and media buttons. Throw in the fact that they finally support tilting it *forward* (think of your piano teacher telling you to have a ball in the palm of your hand... tilting the keyboard so that the hands rest naturally is a good thing), and it's been heaven.
http://www.microsoft.com/hardware/mouseandkeyboard/productdetails.aspx?pid=043

Security

Graph of Linux Vs. Windows System Calls 302

cgrayson recommends Richard Stiennon's blog on ZDNet — a post titled Why Windows is less secure than Linux shows a compelling graphical comparison between system calls on the two operating systems. The blogger tips Sana Security for the images. Quoting: "In its long evolution, Windows has grown so complicated that it is harder to secure... [T]hese images... are a complete map of the system calls that occur when a web server serves up [the same] single page of [HTML] with a single picture."

Easy Throw-Away Email Addresses 297

netbuzz writes, "A fellow teaching himself Seam has come up with a clever Web app called 10 Minute Mail. It gives you a valid e-mail address — instantly — for use in registering at Web sites. Ten minutes later (more if you ask), it's gone. You can read mail and reply to it from the page where you create the throw-away address. Limited utility, yes, but easy and free."
User Journal

Journal Journal: doolb

When I was much much younger I wrote two parts of a story for English class. The first embodied rebellion, and the second revenge; that was the gist of the assignments for the year. The stories were pretty horrible as I look them over now. While I had quite the imagination the effort wasn't there, but I'm happy to blame that on the fact that is was an assignment for a class I didn't like.

User Journal

Journal Journal: Politiks 2

My "Republicans For Voldemort" shirt is in the mail, elections are coming soon, so it seemed like a good time to say a thing or two about the issues.

Stem Cell Research

i think the easiest way to approach this issue is to reduce it down. I'll start with the man himself, President Bush and his policy in 2001 governing the last set of stem cells that were usable.

A Nerdcore Hip-Hop Halloween Album 108

High-C writes, "A bunch of us nerdcore hip-hop artists have gotten together and released a Halloween-themed CD. Seventeen creepy, darker-than-they-should-be songs from total nerds, with seven different CD covers. What's not to love? The perfect soundtrack for tonight's Halloween parties. And of course, the track listings are in hex."
User Journal

Journal Journal: capitulare

It seemed like a good time to go through some randomness of late.

Slashdot Top Deals

"Well, if you can't believe what you read in a comic book, what *can* you believe?!" -- Bullwinkle J. Moose

Working...