Forgot your password?
typodupeerror

Comment Re:Plausible deniability is better (Score 1) 205

They don't usually do this at a border check, but if they use a forensics terminal it's not running the OS, they basically do a backdoor boot and look at what the hardware reports.

The key point here is that data's security isn't enforced by the OS, but rather by the encryption algorithm itself. A non-OS forensics terminal would see the raw contents of the hard drive, which is to say, blocks of random-looking bytes that might be encrypted data or might just be truly random; without the corresponding password, there is no way to to tell.

Without any password (and assuming a robust encryption implementation), that's as far as they'd get. With a password, they'd be able to decrypt the blocks associated with that password and view the files for that account, but not any of the other blocks/accounts.

At that point, the FBI's nerds might well suspect that there are other accounts on the phone that they don't know about, but short of coercing the phone's owner into providing additional passwords, that's as far as they could get.

Comment Re:Plausible deniability is better (Score 1) 205

If they plugged it into a forensics terminal they'd likely see right away that the device OS isn't reporting the correct blocks.

The goal would be to have a device OS with no concept of "correct blocks", i.e. there are only a bunch of blocks, all equally correct, and the OS uses some subset of them based on the password that was entered. Ideally the OS wouldn't even have the ability to tell anyone how many viable subsets there are.

Comment Re:Plausible deniability is better (Score 1) 205

Not doable with any reliability. This is a fantasy many have and that completely fails in reality.

There's nothing like saying "it can't be done" to make a nerd's imagination fire...

I'd start with a filesystem that stores all data encrypted, so that without the proper decryption key, there's no way to tell whether a given block of storage contains encrypted data or random noise. We'd overwrite the entire drive with random noise on install, of course.

Then on top of that, add a layer that determines which subset of the physical blocks to use based on a hash of the decryption key; so if you log in with password A you get a particular filesystem, but with password B you get a completely different/unrelated filesystem, and so on. Repeat as necessary for as many accounts as you like; all accounts which are equally real/valid; the only downside is additional drive space required.

The tricky bit would be coming up with an algorithm that tells each account which storage-blocks it is allowed to overwrite, but doesn't simultaneously provide a hint to the police that those other not-to-be-written-to blocks might actually contain hidden data rather than just noise. Well, that and the fact that just having this software installed would look suspicious, if they were able to recognize that it was present :)

Comment Re:Probably just AI (Score 2) 92

LLMs have two effects here:

1. They help the white hats find and fix bugs
2. They help the black hats find and exploit bugs

These two effects cancel each other out to some extent (depending on which "team" is more proactive in its bug-discovery and consequent activities).

Eventually all of the low-hanging-fruit will be picked, and the current deluge of AI-induced CVEs will be reduced to only those bugs that were subtle enough not to be noticeable by anyone except the latest-and-greatest AI models.

Comment Re: AI (Score 1) 133

That's why you keep the field small. Handle one kind of error at a time. Have it debug every change and look again for more errors. Loop this until it can't find any. Get it to report exactly what it did in words and confirm it looks reasonable to you. Loop again if it isn't reasonable. That is way faster than doing it manually.

Is it faster? It sounds really tedious and error-prone to me. If someone were to suggest I quit writing code and instead spend the rest of my career supervising the intern as he writes code for me to review and correct, I'd feel the same way about that.

Comment Re:An AMAZING number of flaws (Score 1) 76

The whole effort of design of software systems is ultimately the effective management of complexity. Complexity of features that provide real world value is the developers problem to manage. If "technical debt just keeps compounding" it is probably best to find a better developer.

I love scapegoating individual developers as much as the next guy, but if you take a look at the Win32 API, you'll find loads of fun "features" such as:

- Every single function that takes a string has two implementations: one that ends with the letter A (and takes its strings as ASCII) and one that ends with the letter W (and takes its strings as UCS-16). And then it has a preprocessor-define (with no suffix) that gets expanded to either one implementation or the other, based on your compiler settings.

- windows.h defines preprocessor-tokens for min() and max(), which means any C++ program that ever calls std::min() or std::max() will error out with a very strange compile-time error, if it included windows.h first; the work-around is to define NOMINMAX first to prevent windows.h from polluting the namespace.

- Modern windows is perfectly capable of arbitrary-length file-paths, but ships by default with a 260-character filepath limit anyway, "to preserve backwards compatibility with older software that expects that limitation to be enforced". To get correct behavior you have to hand-modify your registry; otherwise you find out about this limitation when you go to unzip a .zip file and the unzip mysteriously fails even though the .zip file is valid.

These are all defects that other OS's simply don't suffer from, either because the other OS's were designed correctly from the beginning, or because the people in charge of the other OS's long ago took the hit (in short-term breakage) and fixed the problems rather than letting them linger forever to preserve backwards compatibility.

All Windows developers (good and bad) have to deal with these issues, probably forever, and every line of code they add to work around these problems has to be supported and debugged and tested as well, hence the damage compounds.

Comment Re:Can I pay him not to post? (Score 5, Insightful) 215

That is, isn't this illegal? Or is it just that no other presidency thought of doing this particular cash grab?

Before Trump, it was a cultural norm that a President of the United States was expected to follow ethical and moral guidelines as well as laws; not only because anything less would be dishonorable and a disservice to his country, but also because otherwise he would pay a steep political price for his unethical behavior. Trump's most significant political innovation has taken the form of figuring out how to convince a plurality of the American public that the only real standard for Presidential behavior is "whatever you can get away with".

Comment Re:An AMAZING number of flaws (Score 1) 76

Part of it may be a dysfunctional corporate culture, but a lot of it is a consequence of Microsoft's business decision to maintain backwards compatibility at all costs. When you're committed to retaining every design mistake, forever, the complexity of the codebase just keeps rising, which means that less and less of it can fit into anyone's mind at one time, which means more mistakes are made going forward, and the technical debt just keeps compounding.

Comment Re:It's bots and ragebait, thats why (Score 2) 107

Perhaps the real problem is that there is simply no reliable way to tell a real human's post from a generative AI's post anymore, since by the AIs are trained on the posts of real humans and are asymptotically becoming indistinguishable from them. You certainly can't simply go by post-quality, since the some of the smarter bots are better posters than some of the, err, less-well-informed humans.

Because of that, it's hard to feel good about putting any real effort into a social media conversation, because in the back of your mind you're always wondering: am I engaged in any kind of constructive activity here, or am I just unknowingly humping a rubber doll that Zuckerberg (or somebody) has provided for my amusement?

Slashdot Top Deals

Take care of the luxuries and the necessities will take care of themselves. -- Lazarus Long

Working...