Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
Security

Submission + - SSL Cert Weaknesses Exposed By Comodo Breach (infoworld.com)

snydeq writes: "InfoWorld's Woody Leonhard delves deeper into the Comodo SSL scandal and finds the breach calling into question the integrity of the SSL certification process itself. 'While the press has focused on the sensational fact that Comodo's site was hacked from an Iranian IP address, we really should be asking three questions: How did somebody working with an Iranian IP address get a username and password from Comodo with enough clearance to create SSL certificates? Why did Comodo issue SSL certificates for google.com, live.com, yahoo.com, mozilla.org, and skype.com? Why are browser updates used to revoke SSL certificates?'"
Books

Submission + - PostgreSQL 9.0 High Performance (packtpub.com)

eggyknap writes: Thanks in large part to the oft-hyped "NoSQL" movement, database performance has received a great deal of press in the past few years. Organizations large and small have replaced their traditional relational database applications with new technologies like key-value stores, document databases, and other systems, with great fanfare and often great success. But replacing a database system with something radically different is a difficult undertaking, and these new database systems achieve their impressive results principally because they abandon some of the guarantees traditional database systems have always provided.

For those of us who need improved performance but don't have the luxury of redesigning our systems, and even more for those of us who still need traditional transactions, data integrity, and SQL, there is an option. Greg Smith's book, "PostgreSQL 9.0 High Performance" takes the reader step-by-step through the process of building an efficient and responsive database using "the world's most advanced open source database".

Greg Smith has been a major contributor to PostgreSQL for many years, with work focusing particularly on performance. In "PostgreSQL 9.0 High Performance", Smith starts at the lowest level and works through a complete system, sharing his experience with systematic benchmarking and detailed performance improvement at each step. Despite the title, the material applies not only to PostgreSQL's still fairly new 9.0 release, but to previous releases as well. After introducing PostgreSQL, briefly discussing its history, strengths and weaknesses, and basic management, the book dives into a detailed discussion of hardware and benchmarking, and doesn't come out for 400 pages.

Databases vary, of course, but in general they depend on three main hardware factors: CPU, memory, and disks. Smith discusses each in turn, and in substantial detail, as demonstrated in a sample chapter available from the publisher, Packt Publishing. After describing the various features and important considerations of each aspect of a database server's hardware, the book introduces and demonstrates powerful and widely available tools for testing and benchmarking. This section in particular should apply easily not only to administrators of PostgreSQL databases, but users of other databases, or indeed other applications as well, where CPU, memory, or disk performance is a critical factor. Did you know, for instance, the difference between "write-through" and "write-back" caching in disk, and why it matters to a database? Or did you know that disks perform better depending on which part of the physical platter they're reading? How does memory performance compare between various common CPUs through the evolution of their different architectures?

At every step, Smith encourages small changes and strict testing, to ensure optimum results from your performance efforts. His discussion includes methods for reducing and correcting variability, and sticks to easily obtained and interpreted tools, whose output is widely understood and for which support is readily available. The underlying philosophy has correctly been described as "measure, don't guess," a welcome relief in a world where system administrators often make changes based on a hunch or institutional mythology.

Database administrators often limit their tools to little more than building new indexes and rewriting queries, so it's surprising to note that those topics don't make their appearance until chapters 9 and 10 respectively, halfway through the book. That said, they receive the same detailed attention given earlier to database hardware, and later on to monitoring tools and replication. Smith thoroughly explains each of the operations that may appear in PostgreSQL's often overwhelming query plans, describes each index type and its variations, and goes deeply into how the query planner decides on the best way to execute a query.

Other chapters cover such topics as file systems, configuration options suitable for various scenarios, partitioning, and common pitfalls, each in depth. In fact, the whole book is extremely detailed. Although the tools introduced for benchmarking, monitoring, and the like are well described and their use nicely demonstrated, this is not a book a PostgreSQL beginner would use to get started. Smith's writing style is clear and blessedly free of errors and confusion, as is easily seen by his many posts on PostgreSQL mailing lists throughout the years, but it is deeply detailed, and the uninitiated could quickly get lost.

This is also a very long book, and although not built strictly as a reference manual, it's probably best treated as one, after an initial thorough reading. It covers each topic in such detail that each must be absorbed before further reading can be beneficial. Figures and other non-textual interruptions are, unfortunately, almost nowhere to be found, so despite the author's clear and easy style, it can be a tiring read.

It is, however, one of the clearest, most thorough, and best presented descriptions of the full depth of PostgreSQL currently available, and doubtless has something to teach any frequent user of a PostgreSQL database. Those planning a new database will welcome the straightforward and comprehensive presentation of hardware-level details that are difficult or impossible to change after a system goes into production; administrators will benefit from its discussion of configuration options and applicable tools; and users and developers will embrace its comprehensive description of query planning and optimization. "PostgreSQL 9.0 High Performance" will be a valuable tool for all PostgreSQL users interested in getting the most from their database.

Open Source

Submission + - Linux 2.6.37 released

diegocg writes: Version 2.6.37 of the Linux kernel has been released. This version includes SMP scalability improvements for Ext4 and XFS, the removal of the Big Kernel Lock, support for per-cgroup IO throttling, a networking block device based on top of the Ceph clustered filesystem, several Btrfs improvements, more efficient static probes, perf support to probe modules, LZO compression in the hibernation image, PPP over IPv4 support, several networking microoptimizations and many other small changes, improvements and new drivers for devices like the Brocade BNA 10GB ethernet, Topcliff PCH gigabit, Atheros CARL9170, Atheros AR6003 and RealTek RTL8712U. The fanotify API has also been enabled. See the full changelog for more details.
Microsoft

Submission + - France Plans Tablet Tax Except If They Run Windows (techdirt.com)

An anonymous reader writes: Lots of countries around the world have private copying "levies," which are effectively taxes on products that store data, which is put into a pool to be handed out to copyright holders, as a sort of payment for the "copying" that individuals do. This was quite popular with blank CDRs for example, but has been expanded in certain countries to cover hard drives, iPods and other such devices. Over in France, they're looking to expand the levy to tablet computers, but apparently if that tablet computer is running Microsoft Windows, it will be exempted from the tax. iPads and Android-powered tablets will have the tax. Why? Well, the argument is that if a tablet is running Windows, it's really a "computer." But if it's running one of those "mobile" operating systems, suddenly it's a brand new category. Not surprisingly, makers of Android tablets — including the French company Archos — are not at all happy about this.
Censorship

Submission + - The French government can now censor the internet (google.com)

Psychophrenes writes: A new episode in french internet legislation.
French ministers have passed a bill (original in french) allowing the government to add any website to a black list, which access providers will have to enforce. This black list will be defined by the government only, without requiring the intervention of the legal system.
Although originally intended against pedo-pornographic websites, this bill is already outdated, as was hadopi in its time, and instead paves the way for a global censorship of the "french internet".

HP

Hidden Backdoor Discovered On HP MSA2000 Arrays 197

wiredmikey writes "A hardcoded password-related security vulnerability has been discovered which apparently affects every HP MSA2000 G3, a modular large scale storage array. According to the alert, a hidden user exists that doesn't show up in the user manager, and the password cannot be changed, creating a perfect 'backdoor' opportunity for an attacker to gain access to potentially sensitive information stored on the device, as well as systems it is connected to."
Botnet

Submission + - ATTACKS BY "ANONYMOUS" WIKILEAKS PROPONENTS NOT AN (utwente.nl) 2

Giovane Moura writes: "For a number of days the websites of MasterCard, Visa, PayPal and others are attacked by a group of WikiLeaks supporters (hacktivist). Although the group calls itself "Anonymous", researchers at the DACS group of the University of Twente (UT), the Netherlands, discovered that these hacktivists are easy traceable, and therefore anything but anonymous. The LOIC (Low Orbit Ion Cannon) software, which is used by the hacktivists, was analyzed by UT researchers, who concluded that the attacks generated by this tool are relatively simple and unveil the identity of the attacker. If hacktivists use this tool directly from their own machines, instead of via anonymization networks such as Tor, the Internet address of the attacker is included in every Internet message being transmitted. In the tools no sophisticated techniques are used, such as IP-spoofing, in which the source address of others is used, or reflected attacks, in which attacks go via third party systems. The current attack technique can therefore be compared to overwhelming someone with letters, but putting your address at the back of the envelop. In addition, hacktivists may not be aware that international data retention laws require that commercial Internet providers store data regarding Internet usage for at least 6 months. This means that hacktivists can still be traced easily after the attacks are over.

A full report can be found at: http://www.simpleweb.org/reports/loic-report.pdf"

Java

Oracle Asks Apache To Rethink Java Committee Exit 266

CWmike writes "Oracle has asked the Apache Software Foundation to reconsider its decision to quit the Java SE/EE Executive Committee, and is also acknowledging the ASF's importance to Java's future. In a message released late Thursday, an Oracle executive made conciliatory gestures to Apache. At least for now, the ASF doesn't seem eager to rejoin the committee. 'Give us a reason why the ASF should reconsider other than "please,"' ASF president Jim Jagielski said in a Twitter post on Thursday. The Java Community Process is 'dead,' Jagielski said in a blog post, also on Thursday. 'All that remains is a zombie, walking the streets of the Java ecosystem, looking for brains.'"
Intel

Submission + - Goodbye, VGA (intel.com)

jones_supa writes: "Leading PC companies have expressed their will to finally start kicking out legacy display interfaces. Intel plans to end support of LVDS in 2013 and VGA in 2015 in its PC client processors and chipsets. While the large installed base of existing VGA monitors and projectors will likely keep VGA on PC back panels beyond 2015, PC and display panel makers are in strong support of this transition. The DisplayPort connector interface provides backwards and forwards compatibility by supporting VGA and DVI output via certified adapters, while also providing new capabilities such as single connector multi-monitor support."

Submission + - Ellsberg supports wikileaks (ellsberg.net)

wierd_w writes: Daniel Ellsberg: “EVERY attack now made on WikiLeaks and Julian Assange was made against me and the release of the Pentagon Papers at the time.”

Due to the recent debates over the pros and cons between the wikileaks releases and those of the historic "Pentagon papers", Journalist Daniel Ellsberg, who released the pentagon papers in 1971, has written an editorial on the subject declaring that he rejects the mantra of “Pentagon Papers good; WikiLeaks material bad", and that further “That’s just a cover for people who don’t want to admit that they oppose any and all exposure of even the most misguided, secretive foreign policy. The truth is that EVERY attack now made on WikiLeaks and Julian Assange was made against me and the release of the Pentagon Papers at the time.”

Submission + - MasterCard hit by WikiLeaks payback attacks (netcraft.com) 1

An anonymous reader writes: MasterCard's website has been hit by a distributed denial of service attack. Netcraft describes how the attack uses a voluntary botnet of LOIC (low orbit ion cannon) users to swamp sites with traffic. PostFinance, the PayPal blog and Swedish prosecutors have been targetted previously.
Facebook

Facebook Messaging Blocks Links 143

jhigh writes "With the launch of the new Facebook messaging system designed to encourage account holders to utilize Facebook for all of their messaging needs, one would think that Facebook would recognize that it cannot continue to block content that it disagrees with. However, Wired reports that Facebook messaging, like the rest of the social networking application, continues to block links to torrents and other file sharing sites, even when users are sending messages via their facebook.com email address. Say what you want about the morality of using file sharing services to share copyrighted material, if Facebook wishes to become a player in the email market, they cannot block content."

Submission + - Guy Fined For Posting Links To Official Broadcast (techdirt.com) 1

hcs_$reboot writes: Over in Sweden, it appears that a guy has been fined for linking to an online broadcast of a hockey game. We've heard stories of people getting in trouble merely for linking to unauthorized content, but this story is even more ridiculous. The guy wasn't linking to unauthorized content. He was linking to an online video feed from the official broadcaster, Canal Plus.
The issue was that Canal Plus was apparently technically incompetent in how they set up the feeds, and never intended to make the feeds public.

Slashdot Top Deals

Real Users never know what they want, but they always know when your program doesn't deliver it.

Working...