Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror

Comment Re:Commies (Score 1) 190

I have no idea how you got there when I explicitly said "Trumpistas". If I meant Reaganites, I would have said that.

The fascist clownshow still wears that skinsuit, though, and needling them about it makes other Republicans uncomfortable, so I consider it useful.

Trump is basically a 1980s Democrat

Right, I can vividly remember the horror of Geraldine Ferarro shipping all those poor souls to gulags after establishing her own network of paramilitary brownshirts.

Comment Sure you can (Score 1) 26

If you build a dangerous theme park and I buy it from you, I take responsibility when kids get mangled.

And PE is absolutely a terrible model for any software with a security aspect. They will always strip maintenance to the bone and PE backwater shops don't exactly have the best and brightest banging on their doors anyway.

After we were bought by a massive firm, one of the (many) things that bugged me was losing control of my vendors. Instead of making our own deals, now I tell a centralized procurement department what I need. It still causes problems and bugs me, but one thing they do is evaluate vendor capabilities. And they really don't like PE-owned software, for exactly this sort of reason. SolarWinds kicked them in the nuts on that one and they're not eager for a repeat.

This isn't a fluffy hippy saying "I don't like breakers and takers", this is a Dow 50 CTO saying "PE's business model is not compatible with security-critical software".

Comment Re:Because magic (Score 1) 84

I'm not talking about Joe Random's laptop, I'm talking about systems involved in commerce that are exposed to attack. You want at least 60 bits of entropy right now; if you're monitoring competently you'll notice the attack well before there's significant risk of success. Better not to expose an access path at all, of course, but sometimes it can't be avoided.

Diceware or whatever is fine, I guess, but in our environment I don't care about typability. End user passwords only have to be entered once a week or so. Access to accounts with elevated privileges is not an everyday thing here, and is gated.

But hey, do what you want, I don't manage your machines.

Comment Re:Because magic (Score 1) 84

Password storage is the same whether or not you use a robot-poop password.

I use Hashicorp Vault at home, because I tend to dogfood the services I run at work. But that's a bit ridiculous, I don't recommend it.

We also run a local Bitwarden installation at work, that's generally for nontechnical users and the dedicated programming staff (although I repeat myself).

For normal people, I recommend some password manager with local storage not tied to a browser, and ideally not tied to your OS. But it depends on how competent the user is.

Why are you using four character passwords? I don't know what your threat model looks like, but a cat might "guess" that, bouncing on your keyboard.

Comment Because magic (Score 4, Interesting) 84

Because people don't know how things work, and treat the robots like oracles.
"But ChatGPT said..." is the new "I saw it on television, it must be true."

If you're not doing something like

< /dev/urandom tr -dc _A-A-a-z-0-9 | head -c30

or some tool that does something similar, you already have problems.

Comment More like (Score 2) 21

Plain old faceplant failure.

If you want to troll, at least be entertaining.

The thing that makes this so utterly stupid is, "all resources" of what? That embedded system in the pregnancy tester that troll will never have a use for, or the huge distributed clusters they're not smart enough to know what to do with?

And I guess it also thinks operating systems should not use available resources?

Anyway, the story telling is good. History always is, but this is also useful for pointing out how contingent things like this are - if Theo hadn't mirrored early versions, or if Linus got possessive at the wrong time, something else may have ended up in the "Linux" niche.

Small actions can have major downstream effects, but you can't know in advance which ones matter. There are several different lessons in there, depending on what you want to focus on.

Comment No more build your own (Score 1) 33

I suspect this is the beginning of the end for building your own rig for most folks.

Manufacturers prefer locked down, soldered RAM machines for obvious reasons. Microsoft would be happy with fewer, more predictable builds they could lean on people over. Businesses already mostly treat machines as "no user serviceable parts" inside.

That leaves gamers, nerds and hardware hobbyists (but I repeat myself).

Parts of the gamer segment can be peeled off in various ways. Nerds are forced to retreat to Ebay and other sources of trash hardware. Accessing anything of interest will require remote attestation support, and your machine is officially no longer your machine, you just get to pay for it. Anyone who complains gets a litany of "but you can still can have an AWS VM or Raspberry Pi, what's your problem?"

Comment Rug pull (Score 2) 26

Broadcom found a great niche to run their game - virtualization is one of the harder foundational tools to move out from under. It is like they found a way to tax data center floor space.

But that only lasts until people can move. Long enough to earn Tan a really nice chunk of change, and probably also long enough to make VMWare a tiny niche player.

Slashdot Top Deals

The difference between reality and unreality is that reality has so little to recommend it. -- Allan Sherman

Working...