Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment Re:So what? (Score 4, Informative) 36

FUD over Huawei?! I thought it was politics, but I did some digging...

After *five years*, Huawei still haven't been able to address severe security concerns the UK had (below is just a subset of problems from the report I link, any one of which would make infosec get up and leave the room). I would imagine *all* agencies have access to a Huawei device within seconds of access.

And note: This is just looking at their cell-tower switch product, with their cooperation:

The report analyzed the use of the commonly used and well maintained open source component OpenSSL. OpenSSL is often security critical and processes untrusted data from the network and so it is important that the component is kept up to date.

  In the first version of the software, there were 70 full copies of 4 different OpenSSL versions, ranging from 0.9.8 to 1.0.2k (including one from a vendor SDK) with partial copies of 14 versions, ranging from 0.9.7d to 1.0.2k, those partial copies numbering 304.
  Fragments of 10 versions, ranging from 0.9.6 to 1.0.2k, were also found across the codebase, with these normally being small sets of files that had been copied to import some particular functionality.
  There were also a large number of files, again spread across the codebase, that had started life in the OpenSSL library and had been modified by Huawei.

And then the bit about memcopy... holy heck...
  There were over 5000 direct invocations of 17 different safe memcpy()-like functions and over 600 direct invocations of 12 different unsafe memcpy()-like functions. Approximately 11% of the direct invocations of memcpy()-like functions are to unsafe variants.
  There were over 1400 direct invocations of 22 different safe strcpy()-like functions and over 400 direct invocations of 9 different unsafe strcpy()-like functions. Approximately 22% of the direct invocations of strcpy()-like functions are to unsafe variants.
  There were over 2000 direct invocations of 17 different safe sprintf()-like functions and almost 200 direct invocations of 12 different unsafe sprintf()-like functions. Approximately 9% of the direct invocations of sprintf()-like functions are to unsafe variants.

These numbers do not include any indirect invocation, such as through function pointers and the like. It is worth noting these unsafe functions are present in the binary and therefore pose real risk.

  Analysis of relevant source code worryingly identified a number pre-processor directives of the form “#define SAFE_LIBRARY_memcpy(dest, destMax, src, count) memcpy(dest, src, count)”, which redefine a safe function to an unsafe one, effectively removing any benefit of the work done to remove the unsafe functions in the source code. There are also directives which force unsafe use of potentially safe functions, for example of the form “#define ANOTHER_MEMCPY(dest,src,size) memcpy_s((dest),(size),(src),(size))”

https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fassets.publishing.service.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile%2F790270%2FHCSEC_OversightBoardReport-2019.pdf

Comment Re:Most expensive rocks (Score 3, Informative) 24

Given the $1.16 billion estimated total cost of the project, those 60 grams of rocks are officially the most expensive stuff we have had humanity.

... I'm thinking Stardust gives that a run on the money? It was cheaper, sure ($0.2 billion), but it returned a *total* mass of just 0.000000000000001g (source). Which means that material is worth 10^16 more than OSIRIS-REx's material.

Comment Re:Maybe they can't be detected (Score 2, Informative) 553

This is why the laser is split, and sent down two perpendicular paths. Sure, a wave might stretch the spacetime of the X axis... but that same stretching wouldn't effect a similar increase in the return time of the Y axis. This very stretching of the measuring device itself against one axis(thus modifying the round-trip time of the split laser as compared to a perpendicular path) is the very thing that they are measuring.

Your pet theory, and their experiment, match. :)

Slashdot Top Deals

The most delightful day after the one on which you buy a cottage in the country is the one on which you resell it. -- J. Brecheux

Working...