Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×

Comment Re:Um, so? (Score 1) 157

I think the point is that major corporations are using US bonds as a tax shelter, and if they had paid taxes instead of investing in US debt, the US debt might not be at it's present level of 100% of GDP.

Well, if the US Federal Govt. didn't keep spending so fscking much.....more than it takes in, we'd not have the debt in the first place.

If they learned to live more within their means, they'd be much better off.

The Feds get PLENTY of tax revenue coming in each year already.

Comment Re:So the next botnet will be Audi cars (Score 1) 73

My biggest concern is...

How do you turn this car-to-anything-external comunication the fuck OFF?!?!?

Geez, I mean, I don't want this crap on my car, to aid in tracking etc.

Hell, its difficult enough to disable OnStar or any other myriad of car to base communications as it is....this sounds like even more potentially intrusive software/hardware reporting to authorities on the road.

Hell...I guess I am going to just stick to in the future...70's muscle cars, and other older 'fun' cars to ride in, without all this crap.

Hell, I'd pay EXTRA on a new car to get it without all this external to car communication.

Comment Re:Well... (Score 1) 82

No, what he is referring to is that you get into a command shell, you can invoke an unsigned PowerShell script with PowerShell.exe -file. But that's not much different than source in bash.

But it's hard to imagine a social engineering attack that would get a user to download a file and then get them into a CLI session to override execute flags or signing to invoke the script file.

Comment Re:Not that big a leap (but I doubt OOP @ times) (Score 1) 82

This is one of the reasons micro kernels have a much more manageable security model. The problem being microkernels have some performance penalties that, at least in previous generations of CPUs, lead most OS developers to work in monolithic or mixed models. Yes, there are user space device drivers, so there has been a lot of work done to move device drivers a lot further away from Ring 0 and Ring 1, but even this simply makes monolithic kernels even more complex, and complexity is always the enemy of security.

Comment Re:(bash|sh|ksh|zsh) && !PowerShell (Score 1) 82

The kinds of vulnerabilities that PowerShell suffers would be suffered by any operating system that has a fairly comprehensive scripting language. The issue simply is if you can automate OS functions like creating, altering or deleting files and other system resources, someone can write a malicious script that, if run even in an non-super user context, can wreak havoc, but if run in a super user or similar higher access context can lead to enormous damage or to compromised systems. There are ways to mitigate this for both Windows and *nix, but more often than not you have to be proactive about it.

Comment Re:Microsoft Bash to the rescue (Score 1) 82

They're not, and suffer the same inherent vulnerability that Powershell or any other executable scripting language does; that even if you have core network and system resources ringfenced, malicious scripts can still play havoc with anything even regular users have access to (like shared file resources and the like).

The reality is, and this has been known for a couple of decades now, email and web clients simply should not be able to execute code. But since executable code, whether macros or scripts, show up in so many file formats it's all but impossible to fully enforce such a regime.

Comment Re:Replacing CMD (Score 3, Interesting) 82

Some of the nastier scripts out there nowadays aren't really about gaining elevated privileges. Some of them, like the encrypting ransomware requires no special privileges at all, but simply access to user files, and to network files that the user has read/write access to. So while the critical aspects of a computer or a network are protected by execution and system resource access limitations, you need to prevent execution of unauthorized scripts completely.

I have to admit I've found signing Powershell scripts to be a mighty pain in the arse, but it does provide some protection against external scripts running when you maintain the blocking of execution of unsigned scripts. It isn't a complete protection, unfortunately, and Powershell is only one route by which this kind of ransomware could end up on a system. Vulnerabilities in Java, MS-Office files, and even the execution of Windows Scripting Host files (vbscript and jscript) seem more common from my experience.

The one bit of ransomware I saw got loose through a vbscript file attached to an email. For whatever reason, Outlook allowed it to be executed, and the user clicked the dialog that might have prevented it, and then the script went to town encrypting files on the user's own folders and the share. Fortunately there's a good backup regime in place, so there was very little actual loss, but it demonstrated that along with some vulnerabilities in Windows' execution protection schemes, the real weak link as always is users themselves.

Comment Re:Why are larger humans a good thing? (Score 1) 248

Yes, physical size allows for larger cranial volume which is directly linked to intelligence across all primates.

Is it? You do not cite anything to support this claim... At best, the notion is controversial...

This directly allows for greater intelligence later.

So, whales are smarter than us? Men — smarter than women?

Comment Re:I Would Rather Go To Theatres (Score 5, Insightful) 271

As would I. I actually prefer the theater experience, providing you don't have a theater full of assholes. When I went to The Force Awakens last year on its opening day, that old communal experience I remember from theaters when I was a kid came back. There was cheering and clapping when the Star Wars theme played and in general it really was a wonderful experience. My experience with Deadpool was even better, as people laughed at the jokes through the whole thing. And there's the big screen, which I really do love. Can't reproduce that at home.

Slashdot Top Deals

The only difference between a car salesman and a computer salesman is that the car salesman knows he's lying.

Working...