Forgot your password?
typodupeerror

Comment Re:Unauthorized? (Score 2) 18

If they're "operating inside" user's accounts, they're authorized. Does someone need to explain to banks what authorized means?

Consider a human analogy: In many cases, people give financial advisors access to one or more of their accounts so that the advisor can make trades or other transactions for the benefit of their clients. However, if an advisor suddenly starts making transactions that do not benefit the clients or are contrary to their agreed instructions, then that activity is unauthorized, even if they have login credentials.

Comment Mitigations work (Score 2) 69

See, this is a case of mitigations working. ASLR makes the exploit substantially harder weaponise. There are plenty of other mitigations you can use to reduce the chance of a bug being successfully exploited. Examples include:

  • Ensure PHP (and mod_wsgi, and mod_lua, and whatever else) can't be invoked on servers and/or vhosts where it isn't necessary. You don't want stuff being inadvertently executed as scripts.
  • Don't allow PHP (or other server side scripting languages) to run from any directory the web server user has write access to. This protects you from a whole class of exploits that involve uploading a file and then tricking a vulnerable web application into making the web server treat it as as server side script. Yes, this prevents WordPress from auto-updating, but it protects you from most known WordPress exploit kits. Same applies to other CMS, wikis, etc.
  • Use at least a basic selinux policy to constrain the web server and associated processes. A separate out-of-band whitelist of what the web server is allowed to access can block successful exploitation of vulnerabilities.

You need to be paranoid and assume the network is hostile.

Comment Re:Times have changed (Score 1) 104

That website is cool but it's not really convincing, since the presentation gives a much higher precision and confidence than their data actually allows.

Other estimates say more oil is flowing through the strait now than before the war. Of course, that isn't the same as the strait being open, but for most of us, it's what we care about. Ships filled with iPhone shipments to Kuwait don't affect us much.

Submission + - Ask /. : For devs having AI write most their code, do bots know your domain?

Tablizer writes: A recent Slashdot poll showed roughly 15% said bots write most their code. I generally find bots don't and can't understand very specific domains in my experience, the rules often come from institutional habits and/or arbitrary-seeming gov't polices & regulations. So what are the bots doing for you exactly? If there are regular patterns they are milking, why can't those patterns be factored into modules & functions rather than repeated so that you are mostly passing simple parameters. I'm skeptical of "AI writes most". Something smells off. Thank You!

Comment Re:Not surprising (Score 0) 30

The preliminary results that previously sent their stock soaring "only" showed a 49% reduction. 42% over a much larger population still ain't bad!

I'm honestly stumped why the market reacted as badly as it did to this news - That's still a 100% viable product, and it targets people desperate for any reduction in recurrence! Exactly 0 people will turn down 42% who would have been thrilled with 49%.

Comment You'll own nothing and you'll be happy (Score 4, Insightful) 18

it's no longer possible to create new Arc accounts as of today

Why does using a browser depend on an "account"? And why is an already-installed application (not tied to a single service provider) going to stop working ever? I might not have a very good time with it, but I could still run a 29 year old copy of NCSA Mosaic if I really wanted to.

Then again, both of those pretty much are the answers to my other top question, "what the hell are Arc and Dia, and why have I never heard of them": Proprietary garbage whose continued use depends on the Chief Sociopath having a good quarter. Nope, and good riddance!

Slashdot Top Deals

Some of my readers ask me what a "Serial Port" is. The answer is: I don't know. Is it some kind of wine you have with breakfast?

Working...