Forgot your password?
typodupeerror

Comment Re:Smart move. (Score -1, Troll) 93

What you have to hand to SpaceX is that they managed to drain US taxpayer money and NASA expertise to build a private enterprise.

It was necessary at the time for a bunch of reasons. But to make it seem like this is a SpaceX achievement is misleading. Signficant funds and expertise was funnelled into SpaceX to make this possible. At best, it's a joint effort.

And for a variety of political reasons, it's not a great situation for Europe to be in. Ariadne 6 really does need to happen, and soon.

Submission + - Hackers Stole Access Tokens from Okta's Support Unit; Stock Drops 11% (krebsonsecurity.com)

An anonymous reader writes: Okta, a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a “very small number” of customers, however it appears the hackers responsible had access to Okta’s support platform for at least two weeks before the company fully contained the intrusion. In an advisory sent to an undisclosed number of customers on Oct. 19, Okta said it “has identified adversarial activity that leveraged access to a stolen credential to access Okta’s support case management system. The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases.”

Okta explained that when it is troubleshooting issues with customers it will often ask for a recording of a Web browser session (a.k.a. an HTTP Archive or HAR file). These are sensitive files because in this case they include the customer’s cookies and session tokens, which intruders can then use to impersonate valid users. “Okta has worked with impacted customers to investigate, and has taken measures to protect our customers, including the revocation of embedded session tokens,” their notice continued. “In general, Okta recommends sanitizing all credentials and cookies/session tokens within a HAR file before sharing it.”

Okta has published a blog post about this incident that includes some “indicators of compromise” that customers can use to see if they were affected. But the company stressed that “all customers who were impacted by this have been notified. If you’re an Okta customer and you have not been contacted with another message or method, there is no impact to your Okta environment or your support tickets.”

Submission + - OpenBSD 7.4 has been released (openbsd.org)

Noryungi writes: As announced officially on the official site OpenBSD 7.4 has been officially released. The 55th release of this BSD operating system, known for being security oriented brings a lot of new things, including dynamic tracer, pfsync improvements, loads of security goodies and virtualization improvements. Grab your copy today!

Comment Re: Rust band wagon garbage (Score 1) 463

Hear, hear. Having spent a few months with rust now, it's mostly hype. And a stupidly slow compiler.

I mean, you can do "safe", but who shat in the brains of the person who thought it was good to throw compiler errors for trying to assign a small integer type value to a large integer type variable. It's bloody ridiculous!

Comment Re:Isn't it cute... (Score 1) 171

Sure. Another commenter said as much, and I agree.

It's just a fairly narrow use case, IMHO, where the word applies. And it's basically devoid of information. It's the equivalent to your computer saying "you can't access that file".

What does the computer mean? Read? Write? Execute? What roles or permissions do I need to access it? The moment the file is relevant to me, "can't access" is beyond useless.

Comment Re:Isn't it cute... (Score 1) 171

So many things are correct, and yet useless.

Let me pose the question differently: when your computer doesn't let you do something "for security reasons", and you need to do it for your job, what do you do?

Do you say "oh well" and watch porn? Or do find out what access rights you need to do your job? Bonus question: what if it's watching porn that's not possible?

What do you call classified information that you and the person you speak to both have access to?

Comment Re:Isn't it cute... (Score 1) 171

Why do people read everything in absolutes? Nobody claimed it was made up.

Not disclosing classification level is actually a good use case. I hadn't encountered that.

I'm not encountering the term much, period. It's usually a classification level or another short hand, most often "can't share". YMMV.

Comment Re:Isn't it cute... (Score 1) 171

You're not wrong. That doesn't make the usage much better, though.

Other than "unclassified" is part of the point. Information has to undergo the classification process (is classified) before it can be known that it's unclassified information, ironically. While the article clearly states that "unclassified" is not strictly speaking a classification level, information still has to be classified as "unclassified" in order to be shared.

The other part of the point is that once information is "classified", it really, really, really becomes important what its classification level is. Without that, you can't know who can access it. So "classified" on it's own is practically a useless term outside of this one scenario here of somebody talking to the press.

Still, it exists as a trope: http://tvtropes.org/pmwiki/pmw...

Comment Isn't it cute... (Score 5, Interesting) 171

... how life imitates art?

"Classified" does not mean secret. It merely means that it got assigned a classification level. https://en.wikipedia.org/wiki/...

But films in particular seem to find it using "classified" instead of the actual classification level much cooler. And now people use it for real.

Comment Qt? (Score 4, Informative) 240

"Couldn't Google just switch to Qt, which is becoming an industry standard?"

It is? I haven't seen evidence of that. Trolltech/Digia have been working on that for a long time, and have in fact gained significant market share, but I don't see many projects outside of the KDE sphere of influence or very specific embedded platforms adopting Qt. In fact, the popularity of entirely new mobile platforms that did not adopt Qt is a great counter-argument (i.e. iOS, Android, ChromeOS).

Mind you, that's no argument against using Qt - I just don't see evidence of it becoming an industry standard.

Comment Re:As Frontalot says (Score 1) 631

The mathematics are sound enough, but that doesn't make BitCoin sound.

After the MtGox situation, I tried to understand what exactly the transaction malleability problem they're blaming is. The best (?) starting point I've found is https://en.bitcoin.it/wiki/Tra..., but while that gives you a high level overview, it also raises more questions. Why are there three distinct issues with BitCoin that share the same name? Why did the BitCoin designers ever think it's a good idea to take a signature over part of a message as verifying the entire message?

Mostly, though, I asked myself what it was they were signing and for what purpose, before going on to the previously stated questions. Several hours later, and I concluded that BitCoin is the single worst documented software system I've seen in a 15 year software engineering career.

Yes, I managed to get the information I wanted. No, it wasn't straightforward. Documentation is distributed amongst this wiki, forum posts (which are then badly copy & pasted into the wiki) and source code. Oh, and external sites like reddit or stackexchange. The wiki is very badly cross-linked, and the terrible naming choices (see above) mean it's not easy to search. Some vital information is effectively hidden from sight in image files, which wikis currently don't tend to index at all. And that's just about the stuff I was interested in at the time.

You should never trust a crypto system whose authors can't explain it cohesively and concisely.

If nothing else, it makes a security audit a nightmare.

That said, of course the BitCoin devs aren't stupid, and they plugged the holes documented in the transaction malleability page as best they could. The wiki still states they exist, incidentally, and since it's the de-facto documentation on BitCoin, it's IMHO fair enough to conclude that the BitCoin specifications are still broken even if the reference implementation is fixed.

None of which should mean that BitCoin itself did worse that MtGox - the latter certainly screwed up royally, and their screwup doesn't mean BitCoin is doomed.

But nothing I've seen of BitCoin so far goes to convince me it's trustworthy.

Comment I've found... (Score 1) 627

... that all the work other programmers do in the IDE, I do by hand whilst my mind solves the next problem.

So far I haven't encountered an IDE that lets me habituate these tasks as easily as my plain old text editor does. That means no IDE so far lets me parallelize my efforts in the same way as my text editor. Though I would be the first to admit that habituation is also - but not exclusively - a question of how long one tries.

It's not that IDEs are bad, it's that in my experience they're in the way of my being effective. In part, it's because they rely on the use of a gesture device so heavily - anything that lets me use the keyboard tends to be better for me. Insert obligatory personal/anecdotal evidence warning here.

I think there is an argument to be made that IDEs with fairly complex UIs will resist habituation, and many IDEs fall into that trap. Whether or not that's true should be examined carefully rather than debated aimlessly, though - and even if it's found to be true, then an entirely different question would be whether better habituation *generally* leads people to parallelize tasks, as I described above.

Slashdot Top Deals

Adapt. Enjoy. Survive.

Working...