Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×

Comment Re:Um, so? (Score 1) 197

I think the point is that major corporations are using US bonds as a tax shelter, and if they had paid taxes instead of investing in US debt, the US debt might not be at it's present level of 100% of GDP.

Well, if the US Federal Govt. didn't keep spending so fscking much.....more than it takes in, we'd not have the debt in the first place.

If they learned to live more within their means, they'd be much better off.

The Feds get PLENTY of tax revenue coming in each year already.

Comment Re:So the next botnet will be Audi cars (Score 1) 84

My biggest concern is...

How do you turn this car-to-anything-external comunication the fuck OFF?!?!?

Geez, I mean, I don't want this crap on my car, to aid in tracking etc.

Hell, its difficult enough to disable OnStar or any other myriad of car to base communications as it is....this sounds like even more potentially intrusive software/hardware reporting to authorities on the road.

Hell...I guess I am going to just stick to in the future...70's muscle cars, and other older 'fun' cars to ride in, without all this crap.

Hell, I'd pay EXTRA on a new car to get it without all this external to car communication.

Comment Re:Well... (Score 1) 101

No, what he is referring to is that you get into a command shell, you can invoke an unsigned PowerShell script with PowerShell.exe -file. But that's not much different than source in bash.

But it's hard to imagine a social engineering attack that would get a user to download a file and then get them into a CLI session to override execute flags or signing to invoke the script file.

Comment Re:Not that big a leap (but I doubt OOP @ times) (Score 1) 101

This is one of the reasons micro kernels have a much more manageable security model. The problem being microkernels have some performance penalties that, at least in previous generations of CPUs, lead most OS developers to work in monolithic or mixed models. Yes, there are user space device drivers, so there has been a lot of work done to move device drivers a lot further away from Ring 0 and Ring 1, but even this simply makes monolithic kernels even more complex, and complexity is always the enemy of security.

Comment Re:(bash|sh|ksh|zsh) && !PowerShell (Score 1) 101

The kinds of vulnerabilities that PowerShell suffers would be suffered by any operating system that has a fairly comprehensive scripting language. The issue simply is if you can automate OS functions like creating, altering or deleting files and other system resources, someone can write a malicious script that, if run even in an non-super user context, can wreak havoc, but if run in a super user or similar higher access context can lead to enormous damage or to compromised systems. There are ways to mitigate this for both Windows and *nix, but more often than not you have to be proactive about it.

Comment Re:Microsoft Bash to the rescue (Score 1) 101

They're not, and suffer the same inherent vulnerability that Powershell or any other executable scripting language does; that even if you have core network and system resources ringfenced, malicious scripts can still play havoc with anything even regular users have access to (like shared file resources and the like).

The reality is, and this has been known for a couple of decades now, email and web clients simply should not be able to execute code. But since executable code, whether macros or scripts, show up in so many file formats it's all but impossible to fully enforce such a regime.

Comment Re:Replacing CMD (Score 3, Interesting) 101

Some of the nastier scripts out there nowadays aren't really about gaining elevated privileges. Some of them, like the encrypting ransomware requires no special privileges at all, but simply access to user files, and to network files that the user has read/write access to. So while the critical aspects of a computer or a network are protected by execution and system resource access limitations, you need to prevent execution of unauthorized scripts completely.

I have to admit I've found signing Powershell scripts to be a mighty pain in the arse, but it does provide some protection against external scripts running when you maintain the blocking of execution of unsigned scripts. It isn't a complete protection, unfortunately, and Powershell is only one route by which this kind of ransomware could end up on a system. Vulnerabilities in Java, MS-Office files, and even the execution of Windows Scripting Host files (vbscript and jscript) seem more common from my experience.

The one bit of ransomware I saw got loose through a vbscript file attached to an email. For whatever reason, Outlook allowed it to be executed, and the user clicked the dialog that might have prevented it, and then the script went to town encrypting files on the user's own folders and the share. Fortunately there's a good backup regime in place, so there was very little actual loss, but it demonstrated that along with some vulnerabilities in Windows' execution protection schemes, the real weak link as always is users themselves.

Comment Re:Quit taxing EVs (Score 1) 224

Really? Only rich ppl drive cars?
Last time I was in Europe, I saw PLENTY of regular ppl driving cars.
However, unless you get those ICE off the road, nothing will change. And making public transportation free will NOT change things. The reason why they are not taken is that they are no convenient and were poorly designed.

Comment I'm kind of surprised they don't do more tie-ins. (Score 1) 299

I'm not talking advertising tie-ins, but why not do additional story lines available for streaming purchase? Especially in those big ensemble superhero movies that are always so narratively cluttered because they have to give you a thin slice of so many characters.

Comment Re:I Would Rather Go To Theatres (Score 5, Insightful) 299

As would I. I actually prefer the theater experience, providing you don't have a theater full of assholes. When I went to The Force Awakens last year on its opening day, that old communal experience I remember from theaters when I was a kid came back. There was cheering and clapping when the Star Wars theme played and in general it really was a wonderful experience. My experience with Deadpool was even better, as people laughed at the jokes through the whole thing. And there's the big screen, which I really do love. Can't reproduce that at home.

Slashdot Top Deals

Coding is easy; All you do is sit staring at a terminal until the drops of blood form on your forehead.

Working...