Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 Internet speed test! ×

Comment Re:One big mess (Score 1) 386

One of my biggest hates in modern trends in UX was to have hidden controls, magic corners and symbols with overloaded meanings.

You had to have magical knowledge to use these controls. Windows 8 being the biggest offender with magic corners with no visual indicator that lead to essential controls needed for normal operation. Windows 8 made my blood boil the instant I tried to use it. Unity was near useless unless you knew the name of the application you wanted, and for those of us with dyslexia it was a near impossible interface to use.

This none-sense of form over function resulting in hiding function in obscure locations was always a doomed model. There was also the none-sense drive to unify touch interfaces and keyboard mouse interfaces as one UX experience. The fundamental issue here is the UX form grew out of the input devices we had.
punch cards -> card loader and status lights.
keyboard -> terminal interfaces
keyboard + mouse -> graphical windowed UI's
touch -> tiled interfaces with gesture controls.

The UX world was in love with the touch interface and believed it would be the only interface. "There can only be one." Basically every UX went this path. Windows, IOS, Windows mobile, Win 8.x/10, Gnome, Unity. OSX almost fell into this trap as well but at least Apple product tested this option and realised it sucked for certain device types.

When Ubuntu/Canonical decided they were going after the mobile market, tablet and phone they decided to completely ditch the ageing X system and rebuild the whole UX technology stake and model it around touch. In the Linux world the reaction was swift. Gnome3 with similiar ideas at around the same time. Over night MATE and Cinnamon were born. Linux Mint distro shot up the popularity charts to become arguably the most popular desktop distro. Gnome felt the hit the hardest with a mass defection of developer talent into the MATE and Cinnamon camps. This ultimately hurt Canonical as well developers simply avoided Unity.

Hopefully people will come to realise that the UX is tied to the input methodology/technology. Having two UX shells on a system is not the end of the world as a matter of fact I would prefer this model. Where the shell is tied to input device and or user preference.

Comment Never use the host for Development. (Score 1) 360

Now the first piece of the puzzle is what kind of developer are you? Because requirements and needs will vary dramatically. More generally where will you code or content run?
- The browser?
- Mobile device as an app?
- Server side on a scaled web platform?
- Backoffice processing?
- Are you a Platform specialist as oppose to Software specialist? EG PaaS or SaaS.

Does your organisation need to mix and match these skills in order to deliver? These question are actually the requirements that drive setting up you development environment. I could give you what I think is the gold standard of environments. With out a doubt it would most likely not at all meet you needs. So what I'm going to do is lay out some of my requirements and some of the solutions I use. But I'm not going to actually reveal what it is that I develop.

1. My golden rule is never use the host OS on your machine for development. Development is basically an exercise of increasing disk clutter as you try new things work on this and that etc. It basically drags your host OS to a fast rebuild and lost downtime while you get the host backup to a working state for development. The host OS is generally reserved for the corp stuff. So all the apps they require etc. Generally developers hate those restricted environments of the corp OS anyway.

I have a laptop I still use everyday for tasks that has never been rebuilt. It's now 5 years old. It runs windows 7 as the host OS. I do almost everything in VM's on this box.

2. Generally I use virtualbox but vmware is good as well. Now I tend to establish a VM build that gets me up and running with my core tools via some flavor of automation. Vagrant has been king here for ages. Now when I mean I use these environments I mean I run my IDE and build pipelines in them. I never produce code on my host OS.

3. Each branch of code is a new VM set of hosts. I never re-use vm hosts. The hosts must come up to a spec that is useful quickly. All artefacts I need must come out of repo's as required. So if a branch closes I nuke the vm's associated with it.

4. VM generally are two disk volumes. The first volume is always the OS build. The second volume is used for all artefacts and development. 3rdparty tools are aimed at the first volume. In house tools come from the second volume. This allows me to have nice small and tight vm's on the limited laptop but actually mount the disk sucking volumes over the network. Where speed is required I set the OS to do a lot of caching of the remote volume. This spreads the network hit out over time and doesn't hurt me.

5. I stick to the rule that all software installs come from OS specific packages. NO BROWN BAG / TAR / ZIP transfer BS. Every piece of code must go through to a package in order to be installed for even the most basic testing. No shortcuts. Always iterate the whole pipeline.

6. Optional, I run a private network with in my host for the VM's. That I either have bridged or nat'd to the corp network. My gateway host runs bind, a firewall, and any other service I require. This way I do not violate the corp policies for unsanctioned hosts on the network.

So in general I only use Linux as my development host OS. But this may not work for everyone. Certain app builder environments just don't work in Linux, for example.

Note it is very easy to do this on a middle spec'd machine. The VM's are small. Very small actually the disk foot print is generally about 4Gig up to 10Gig per OS volume. I can run most of the VM's headless thus next to nothing in graphics resources. The RAM footprint is usually the big ones hit about 2Gig. But more often than not they are sitting around 750Meg. So I can run a lot of VM's comfortably on an 8Gig laptop. The big disk storage comes from NAS type devices on the corp network so I can operate OK on as little as 128Gig of disk. But I tend to want 512GB or 1TB locally.

One of the really nice things about using VM environments is when you are giving this call. Hey can you quickly run up here and demo product XYZ for some suits? A complex product that needs lots of supporting services etc. This is generally easy now. I can spin up vm's in minutes and I can install ever package I need in a few more minutes. I make sure the automation around config management is working and I also make sure the automation pipeline has tests built in. Generally I can do this on a laptop as well.

( Note the big data stuff is a royal pain in the backside however. Generating datasets can be a real chore. )

Comment Re:expose them to man-in-the-middle attacks (Score 1) 102

Actually that's not true and the man in the middle design is horrible for many reasons.

The better inspection tools will use a lollipop design where the terminating https device spans than traffic to another device for traffic analysis. Traffic that requires modification can then be routed through the lollipop device on a case by case basis.

Comment Win7 was my last Windows OS. (Score 5, Interesting) 353

Ok this is going to sound like a shameless plug for Linux.

Win 7 was my last used OS from MS. I do have a win 8.1 VM I use on very rare occasions. ( Win 10 won't install as an upgrade on it. ) Win 8.1 was possibly the worst operating system I have ever worked with. What's with these invisible hot spots on the screen that you must magically know exist. Hot spots that just happen to be where the close on a window is. The tiles that are of No use to anyone that every used a computer. And the nightmare navigation of tiles menus and dialogues that essentially have no flow. The command line still after all these years is so utterly broken that only professional that live in the OS would understand it.

Now you have a Windows 10 that is like the article points out is simply and ad machine. Ad's which I expressly do not want to see. Do not want to have at all. Ads that eat resources. Ads that are yet another vector for infection and attack on my computers.

I want none of this garbage. Over the years I have used well probably all the major OS's out there. Some minor forks probably not. I have basically migrated everything to a Linux OS of some flavor. ( Some BSD in there ) And I've automated all of them. All my hosts do automatic updates, All hosts are scanned for the bad dudes. Even my routers and modems are now Linux. I've implemented a DNS blackhole for ads and malware. I've implemented backups and snap shots of all hosts. And I have built a central Network/Device health status that monitors basically everything.

All for the cost of the hardware alone.

Most of the shops I work in the first thing I do with the corp issued laptop is to clone the horrible MS OS nightmare they have on it to a VM image and run it as a VM on the same host. I then replace the original OS with a Linux variant. Now all of a sudden I have the ability to do all the corp BS stuff but I also have the ability to run my own development and test lab on that corp issued laptop.

Windows has gone down this path of making my computing life a royal pain in the backside. Where as Linux in the last few years has become fantastic OS for small tasks, server tasks, and even as a desktop. It's almost like MS doesn't want our business. Without MS as the OS there is very little if anything compelling me to purchase and use the other MS office tools. MS office tools are pretty horrible but since they don't play well at all with the whole computing eco system these days I really have no need to use them. So if the OS is annoying as hell and the alternatives aren't and the apps I use run on all OS's and/or browsers why do I need MS anymore?

( Excuse the typo's I'm dyslexic so it's difficult to see errors. )

Comment You can drive? You might become a bank robber! (Score 1) 154

Good lord this is fear based propaganda. Good lord the English speaking world is being overrun by right wing fear mongers AGAIN.

Yes anyone that mods a game would have just SOME of the skills requisite to performing cyber crime. Those same skills would most likely be applied to just being blue/white collar wage earning paying taxes worrying about the mortgage in 15 years time.

The missing piece of this puzzle is simple morals. How about just teaching respect and morality to children. I dare say this will have a far more positive impact on society and crime rates than this fear non-sense.

Comment The head phone jack is universal but not needed (Score 1) 536

The head phone jack has been great. It did the trick. And for a lot of people if not most it still does. To change to another jack format is just stupid. It'll be excessively costly for consumers and frankly a waste.

I however have switched to wireless I use standard headphones with a bluetooth wireless receiver. And I love it. Why? Well my phone has become so much more than an audio device (phone,music,books). It's now my credit card, subway pass, door key etc. My phone is constantly being removed and put back into a pocket. The number of time my head phone wires have gotten caught on the odd thing here and there and caused my phone to go flying me to look like I have been yanked by the back of my head and have had my headphones ripped forcibly from my head are countless. All this stopped instantly once I went to a bluetooth receiver. I use the headphones I like and the controls for my audio and phone are now on the receiver. I don't even have to bring my phone out for audio tasks. They are so small I can place the receiver on my sleeve, in my pocket, clipped to my jeans where ever. I can move it around so that it doesn't get in the way of what I am doing.

And the best part is the receiver is only $25. I have a couple of them. One extra in the bag just in case the batteries die. But they rarely do.

Comment Re:Users View Updates from Apple as Risky (Score 4, Insightful) 320

I have to completely agree.

Apple software installs effectively trash your carefully configured machine. How many WTF moments have I had just after a simple update and realise that my personal content has now magically moved. To where? Pictures and Videos I take of the family all of a sudden are assimilated into the Apple sphere. My preferences for video audio, homepage, picture, editing etc all trashed.

And in most case it's damn near impossible to remove. Thus being relegated to un-used software that is slowly dying in a dark corner of the hard-drive.

Comment Re:I don't get it (Score 2) 170

Do you have any concept of how much 2.5 billion is? The average person in the United States will make a grand total of $3.4 million in just one life time. That's 735 lifetimes of money. All upfront. 1% interest on $2.5 billion is $25,000,000. This guy makes more on 1% interest in a year than the average person makes working in 7 lifetimes. That's 1%. Do you know how hard it is to only make 1% interest. Banks are going to borrow from this guy. He he were to covert this into 1 dollar bills and stack them in a single pile. The pile would be: 895000 feet 169.5 miles. This guy could achieve low earth orbit by simple stacking money and standing on it. NFL players make on average 1.9 million. This make Mr. Minecraft equal to 24 NFL pro teams. Yep this guy makes as much a 2/3 of the entire league. Sorry he made that in one pay day. What exactly is there to horde? This guy isn't an idiot. He's stupidly rich. Like Richie Rich rich. $70,000,000 our of $2,500,000,000 is still $2,430,000,000. That's multiple billions here still. Most countries if they had 2.5 billion could pay off the entire countries debt. If you think this guy is still an idiot I suggest you look in a mirror first.

Comment Too Late for Aus (Score 3, Interesting) 336

NFC has taken off in Aus in a big way. With most retail outlets having terminals that take Paypass/Tap&Go ( NFC payment brand names here ) accepted across competing financial institutions. There is zero chance Apple will make any headway here asking retailers to forgo the already established infrastructure. Also basically asking retailers to stump up money to install another payment network. Given the existing network was no additional cost to them. Apple is making a mistake here. I don't think it will hurt them too much but Apple Pay will certainly not be a reason for market share growth of the platform. The larger screens most certainly will give them some growth but not this ridiculous shackle.

Comment Re:No Excuse really these days. (Score 1) 348

Do you mean the position that we need firewalls?

Yes, was curious to understand reasoning behind position.

I would have thought that that the need for firewalls was self evident.

The industry is full of bad ultimately harmful ideas which see widespread adoption for locally optimal reasons. It is far from self-evident to me firewalls do not fall squarely into this category.

You are stating that firewalls are harmful. What back this statement up?

The smart devices we use today all tend to have a variation on mainstream OS's. All of which come with some form of host based firewall. Thus the management of these devices from a firewall perspective is even easier. So much so that it is now possible for most marginally technical people to ensure they are properly configured at least at the time of device activation / installation.

I think today anything claiming to be a "smart device" needs no firewall because it accepts no incoming connections. It operates by calling home to the vendor. If you want to access your "smart device" you connect to the vendors server and ask nicely to please access your own gear. A mega ultra cloud firewall...!!1!!!!1!

More generally would be interested in understanding why a device with a specific purpose is more secure when it listens for commands through an internal firewall vs the same listener without? Is a bluetooth headset more secure behind a Bluetooth firewall? Perhaps a concrete example...

Smart device do not only initiate connections. If you use a stock OS as a base for you smart device you are also accepting the fact that these devices will also implement service listeners. You may have a crack team of coders that does a very good job of inspecting each service and only allowing the bare minimum and none that have rogue listeners. But your developers are not always able to review each line of code that is used in patches moving forward. Things change. And they should change. As things improve a good vendor will patch these devices. So Where am I going to invest my effort. I'm going to invest effort into making sure my product works perfectly. If I spend a tiny amount of time ensuring that things are blocked with a firewall I don't have to worry if some changes in apps and services that I'm not in total control of all of a sudden have listeners. I could care less if the firewall is blocking them. This means I'm investing far less effort into on going maintenance and getting the same secure result. Easy win for me.

The interesting thing is you do have a firewall on bluetooth. You do if you use bluetooth to carry IP traffic. This is of course if you use a firewall. So yah you are more secure from bad blue tooth devices if you have a firewall.

Why do you feel firewalls are effective? There seems to be an implicit assumption that firewalls are effective... what makes that true?

What if all the worlds firewalls were thrown in the trash heap and in their place systems were configured to accept only Authenticated, Authorized, Integrity protected, Encrypted inquiries from acceptable locations?

Would that world have better or worse security outcomes than todays world? I think no question it would be better.

No more making security decisions by ports and trivially spoofed address headers or checking worthless boxes on a compliance chart only to have the whole house of cards collapse when Debbie in accounting clicks on the wrong untrusted email message with spoofed from header.

Instead of administrators configuring ports and addresses in firewalls what if they instead spent that same time managing the only thing that means squat in a secure system ... TRUST

It is not like the technology does not exist. People ignore it because it is easier to hide behind their precious firewalls. So they allow it and by extension allow their suppliers to continue to supply them with crap.

So how do you think acceptable locations are defined in this age? It's usually the firewall. It's almost always the firewall. Authetication and authorization are a different part of the comms stack.

Firewalls are not the end all and be all of protection. They are a part of the protections you should have in place. No one should ever feel completely safe with only a firewall. But you can feel safer with one. So Debbie does down load a bad file. And the file goes nuts. One of the common things these trogans do is they start to test other devices on the local network looking for more holes. Well if you do have firewalls in place this attack vector is stopped. Debbies machine is still probably cooked. You file shares are probably toast. But direct access to local machines is protected. Again this is only part of the solution. Corp AV software should also be present on all nodes. Intercepting viruses when they do start to infect things. And so on.

All of my builds have firewalls. It really is a no brainer. It costs me nothing in cash, time, or effort. I'm also religious about ssl which is far harder to enforce. I also enforce design patterns that use API's rather than RPC metaphors. All payloads that exit my applications are scanned for virus's. aka something that hits disk. In addition to all this I try to use NoSQL over SQL stores. Which mitigates most of the SQL injection issues.

There are a lot of bad trends in tech. Being security conscience is not one of them. Use the tools that are given you to secure a system. Simply because the people you hire are never going to be as smart of a globe full of resources that may want to harm you. Why not draw from this same pool of people to help secure your systems. Use firewalls. Use AV. Use IDS if you can.

Note: IDS is now starting to become mainstream. Thank goodness. With out it our home networks would be over run in ms.

Comment Re:No Excuse really these days. (Score 1) 348

Do you mean the position that we need firewalls?

I would have thought that that the need for firewalls was self evident. Especially in a business context. Even more so in this context were financial transactions are being processed.

The smart devices we use today all tend to have a variation on mainstream OS's. All of which come with some form of host based firewall. Thus the management of these devices from a firewall perspective is even easier. So much so that it is now possible for most marginally technical people to ensure they are properly configured at least at the time of device activation / installation.

How many times have we heard stories about POS terminals at places like McDonald's being compromised and the bad guys scoop tons of customer data. Far too many is the answer. These devices had little to no protection at all from would be bad guys. Simple protections put in place like firewalls go a long way to addressing these vulnerabilities. Are they perfect. Of course not. But they are a lot better than having nothing. Today these protections can be implemented in a manor that has almost no impact on how people do business. Which means that when implemented correctly they will not cause any additional labor on the part of the end user in order to ensure that they remain secure.

Since it cause none or very little impact on the way you do business why wouldn't you implement these simple safe guards?

Data breaches and losses are a significant threat to companies. Small one more so than the large ones. Small companies fold when bad things happen. It's a trivial insurance policy that shockingly very few actually implement.

Comment No Excuse really these days. (Score 1) 348

I do a ton of infrastructure builds. From a few boxes to 1000's of VM's. There is no excuse for no firewalls.

If a vendor is disabling the firewall then they should absolutely be approached. If the clown you are talking to says that's the way it's done then go over his head. Tell your boss.

Be gently of course. Doing the run around my hair is on fire dance is not going to win any one over.

You can even help the vendor. There are a ton of tools for all OS's that will help you determine the port that need to be open. Simply run up the software and scan the open ports. Tada you have a simple set of fire wall rules at least. Are they perfect? Of course not they can be improved on. But it's something at the very least. I'm not overly a fan of point to point rules in firewalls as they are self defeating in the long run. ( This is a longer story )

So yes host firewalls should always be enabled. And the rules you use better be documented.

Slashdot Top Deals

"We learn from history that we learn nothing from history." -- George Bernard Shaw