Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment Re:Link to paper (Score 1) 76

The year is 1992. You are an undergrad in physical science at a pretty good school (but certainly not Ivy league). In a freshmen chemistry class final, you use wild extrapolation from a small data set to make significant extrapolation of the x-axis. Your professor gives heavy sigh, and gives out yet-another F. You go on to become a climate scientist and continue to do this because you never understood why it is bad. Your now dead professor can only roll over in his grave.

A number of the PM 2.5 studies I've seen do exactly this. They gather air quality data and run the figures based on preexisting models of health impacts to entire populations or even the entire planet and surprise out comes insane figures.

I just want to know how they came to radically different figures in a later revision of the same work. This is well outside the range of the CI in the version published in nature.

Comment Link to paper (Score 1) 76

Prior version of this work here:
https://www.nber.org/system/fi...

It states: "We project that climate-driven increases in future smoke PM2.5 could result in 27,800 excess deaths per year by 2050 under a high warming scenario, a 76% increase relative to estimated 2011-2020 averages. "

From abstract published in nature:

"We project that smoke PM2.5 could result in 71,420 excess deaths (95% CI: 34,930 - 98,430) per year by 2050 under a high warming scenario (SSP3-7.0) - a 73% increase relative to estimated 2011-2020 average annual excess deaths from smoke."

Comment Would anything be different this time? (Score 1) 191

This study applies model of lighting conditions throughout the country to a circadian health model and draws conclusions about health impacts of each of the three scenarios from model evaluation alone.

I am personally skeptical of these types of extrapolations from models generally. Numbers being bandied about in this study seem unreasonably large. I would be far more interested in learning about studies that actually managed to find real world health signals in real world data following time policy changes elsewhere in the world.

A previous well advertised study focusing on transition itself found statistically significant signals for increased heart attacks that magically vanished when averaged over the week. Basically there was a fleeting temporal shift of a few days over when events would occur.

In the absence of compelling evidence and the fact this was already tried in the 70s where this experiment ended in popular rejection I prefer to keep the current policy the way it is.

Comment Re:No agreement (Score 1) 191

The US has 6 timezones already. It couldn't be much worse if you just let each state decide.

There are three time zones across the 48 contiguous states.

I opted out of this bullshit years ago.

How does one "opt out"? What does this even mean? Does everyone else now organize their time around your schedule?

Comment Re:Microsoft could avoid a lot of this.... (Score 4, Informative) 137

Define "works fine". From what I can see core features of Windows 11 fail without TPM, and bonus points your local system credentials are stored locally on your drive, on a drive that can't be encrypted.

There are no "core features" that depend on TPM. Not even bitlocker requires TPM. Personally I do not want and have no use for Microsoft FDE. Ditto for Hello and similar BS.

An encrypted disk provides no useful security benefit and represents an unnecessary additional vector for data loss. The tying of keys to a physical computer .. keys wiped whenever you so much as update bios is a bad idea and a waste of my time.

I use class 0 to protect storage on my laptop against physical theft which has no overhead or OS dependencies whatsoever. I trust this solution far more than bitlocker /w Microsoft's shady auto upload of encryption keys to Microsoft.

It works fine as much as a car which doesn't have functioning locks on it "works fine".

Car locks can be easily bypassed. Designing car locks in such a way it becomes meaningfully difficult to bypass serves no useful purpose. People who care will just break the glass to gain entry.

Slashdot used to criticise Microsoft for lax security, and now they are criticising them for mandating hardware security measures despite being the last popular OS to do so.

Slashdot is not a monolith neither are individual needs and value judgements. Personally I want security features that protect me from attackers rather than conspiring against me or seeking to protect systems from users. I have a laundry list of useful basic security features Microsoft has spectacularly failed to deliver on.

Comment Re:Technological progress (Score 1) 52

Did the loom make it so a clothier only works 1 day a week instead of 6?
Did the tractor make it so a farmer only needs to work a fraction of the time?
Automation gives a person leverage to multiply their labor. So one excavator operator can do the work of 40 shovel ditch diggers.
At the company I work at, we automate tasks all the time and we've never worked less for it, it just means we do other things.
I don't think anything different will happen with AI. Some jobs might be eliminated, workers will be able to do more with less, and they'll either still be asked to work 40 hours a week because that's what they're being paid for, or they'll only be paid for what's needed (24 hours a week, say) which may not be enough to make ends meet. Oh, they thought they were going to get paid not to work those extra two days when AI is doing the job? How quaint.
And most of us have to do something to make ends meet because we're slaves to banks and debt.

What sets AI apart from historical precedence is the immortalization of "dead labor". When it can do everything living labor can do and for free the whole technology creating opportunity thing goes out the window. While this is far from what AI currently is a system that lives up to the hype sure as hell would be.

Comment Re:If you voted for Trump (Score 1) 104

You voted for this. The Democrats have long since started curtailing these abuses because they are extremely unpopular with their base of minority, specifically black and latino, voters. For obvious reasons since over policeing is basically wrecking their communities.

TSA started using naked body scanners / rape scan (e.g. Rapiscan) machines under the Obama administration. I stopped flying after that so for me the data sale thing is moot.

Again the Democrats are objectively better for the economy and for your pocketbook. That is not a point anyone can argue in good faith.

At this point anything is better than the MAGA cult lead by an incompetent treasonous insurrectionist rapist murderer but this isn't saying much. Democrats have a track record of willingly selling out on privacy and liberty.

Comment Re:I knew a programmer once (Score 1) 39

That 1000x cost in resources isn't as insignificant as you make it out to be. Password cracking is *all* about the cost.

Password cracking is all about results. 1000x is thermal noise in regimes where exponents protect systems. So a password takes hours instead of minutes or days instead of hours and you have to throw more cores at the problem than you would otherwise. At the end of the day outcomes and expenditures do not meaningfully change.

Comment Re:I knew a programmer once (Score 1) 39

No, the two are not equivalent in security, not even close.

Your reference is irrelevant, you still don't understand the problem. Hashcat isn't breaking RC4 what it is actually doing is running a dictionary attack. It doesn't matter how shitty RC4 is when the weakest link is entropy not crypto.

See RFC4757 section 2.

"The RC4-HMAC string to key function is defined as follows:
String2Key(password)
K = MD4(UNICODE(password))"

The key to the HMAC or the stream cipher is the goddamn windows password (NTOWF). This means if you take an HMAC or encrypt a known plaintext with this key an attacker is able to brute force the windows password.

From memory the AES mode is still password based only using an amplification scheme so technically it takes some multiplier of additional resources say 1000x or so to accomplish the same task as the RC4 variant. Operationally the difference between RC4 and AES are irrelevant with regards to kerberoasting.

Comment Re:I knew a programmer once (Score 1) 39

The hackers employed a technique known as âoeKerberoasting,â which exploits an insecure encryption technology from the 1980s known as âoeRC4â that is still supported by Microsoft software in its default configuration

But Microsoft's own blogs claim that RC4 was disabled in Edge and Internet Explorer in 2016. https://blogs.windows.com/msed...
It was eliminated from Active Directory and Kerberos in 2022. https://www.dell.com/support/k...
That year, it was also removed from the SSL/TLS stack. https://support.microsoft.com/...?

So it's not at all clear that the claim is true or has merit.

Kerberoasting is independent of RC4. For example hashcat supports brute forcing AES as well. The problem is entropy not algorithm selection.

Slashdot Top Deals

"God is a comedian playing to an audience too afraid to laugh." - Voltaire

Working...