Forgot your password?
typodupeerror

Comment Re:Can someone help explain "perfect" randomness? (Score 2) 140

I'm assuming that when they do one of those distribution plots of the output values (the ones that show clear patterns for pseudo random generators when run for long enough) they can prove that the distribution is totally uniform, and with time as a further axis, every attempt achieves that even distribution in a different sequence. That implies they can account for, or negate the impact of, every potential variable in the system.

Lava lamps (like Cloudflare actually use as part of their RNG, IIRC) might be just as good, but mathematically proving that could be a little more challenging, and there may be any number of corner case effects, such as the temperature on either side of the glass or minute variations in the heating coils, that cause an almost imperceptable bias towards the denser coloured fluid in the lamp being in certain parts of the lamp than others for short periods of time.

As to whether we need this, quite probably not. However, TFS does propose use as a kind of "master clock" to regulate other systems that would be less precise (or random, in this case) on their own. Whether that's more cost effective or practical than just combining multiple sources of randomness together to get a single output data stream I guess will be determined by any users that really, really, need a truly random data stream, and how the realities of a post-quantum world eventually play out. If you are in some kind of situation where an adversary can keep retrying at a suitable rate and only needs to predict/guess the next in sequence correctly once to "win", then perfect randomness over a sufficiently large search area is something you are going to be all over.

Comment Re:Taking action against phishing reports (Score 4, Informative) 17

See my post above for a bit more detail, but this looks like it could be an SPF include failure. They have included "_spf-ssg-a.microsoft.com" in the SPF, which in turn includes "spf.protection.outlook.com". AFAIK, that's basically the Outlook.com webmail service, so quite possibly at least some, and possibly any, users of that service could impersonate "microsoftonline.com" and get an SPF pass.

If so then yeah, that's *totally* the kind of lack of attention to detail you tend to expect from Microsoft.

Comment Re:Spoofing from address? (Score 3, Informative) 17

It was (and still is), but this is the problem that SPF was designed to solve (as opposed to being the FUSSP some made it out to be). If you have a critical domain that you use for sensitive stuff, like "microsoftonline.com", or any bank's domain, etc, then you need to be very specific on your SPF record's contents and make sure it has an "-all" in there to force a reject for failures, rather than the looser "~all" or (heaven forbid) "+all" which is really only intended for testing. Spammers know this, and seldom waste their time trying to spoof domains that will cause a failure; every domain I have setup SPF with "-all" on has seen Joe-Job bounces drop to zero pretty much overnight. DKIM works slightly differently, but adds another layer to this. Microsoft for sure knows this too and does indeed do both, but that doesn't mean you can't slip up and leave a hole somewhere.

So, taking a quick look, as things stand, the SPF record for "microsoftonline.com" is:

"v=spf1 ip4:216.32.180.228 include:spfa.microsoftonline.com include:spf-exacttarget.microsoftonline.com include:spf-msods.microsoftonline.com include:spf-mfa.microsoftonline.com include:_spf-ssg-a.microsoft.com -all"

They've got the "-all" in there, which is good, but also a whole bunch of "include" directives, including one that refers to ExactTarget a third party MSP, but the one that appears like it could possibly be the problem is the last one. That contains a further include, and in there is "spf.protection.outlook.com". All the includes do have "-all" but, AFAIK, that domain covers the outbound mail gateways for a least some parts of the Outlook.com webmail service, so if the spammers have been able to a suitable account using a server within one of the many IP ranges listed in that include that doesn't properly restrict the domains able to send their mail, then they are good to go.

Slashdot Top Deals

The system was down for backups from 5am to 10am last Saturday.

Working...