Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Comment Re: What? (Score 3, Interesting) 33

The loss of the Gentoo wiki was terrible. Fortunately itâ(TM)s mostly back now. In the intervening years though Arch documentation and users have become the best source of technical information for configuring and troubleshooting. And I say this as a diehard Gentoo user for 20(!) years. I donâ(TM)t think this is because Gentoo users are any less technical, but they seem vastly outnumbered by Arch users.

Comment Re:Legacy aircraft (Score 1) 140

Except the avionics have have not undergone that much change in quite a while. The MAX uses the same Smiths (now GE) FMC that 737's have used for well over a decade (the 2907C1). They use either the Rockwell-Collins CMU-900 or Honeywell MKIII to manage external RF-sourced messages. They all use the same TWLU for Gatelink. Yes there are differences between the software releases (e.g., U13 for the FMS on the MAX) but most of the code in these LRUs is the same from release to release.

Comment Re:Misleading Attention Grabbers (Score 4, Informative) 161

Sorry, I have contrary empirical evidence. On multiple different cars we have manipulated appropriate ECUs with the effect that you can push on the brake pedal with no impact on forward velocity (see autosec.org and also the paper this post refers to). I'll personally attest that it is so and that no matter how hard you step on the pedal that nothing is happening wrt braking. I believe that Charlie and Chris also accomplished the same thing with the vehicles they addressed in the first and most recent presentations.

Comment No completely accurate algorithm exists (Score 1) 736

Progress bars are all about using past history to predict future performance. The problem is that past history doesn't always say anything about what will happen in the future.

If you only use very recent history then you can usually better predict the very near future but it also makes the progress prediction and remaining time prediction very unstable and jump all over.

You're a human so use your own intuition to predict progress in part on what the program tells you and in part based on your knowledged of the work involved and the work yet-to-be-done.

Comment Re:IPv6 Internet is "here" for some of us (Score 4, Informative) 327

It's very nice. I was in the process of setting up a tunnel between my home gateway and a Linode machine (Linode provides native v6) and making Linode my publicly visible exit point to the Internet. A few weeks into the project Comcast implimented v6 making my tunneling efforts redundant.

Comcast currently allocates a /64 to each customer but they say they'll hand out shorter prefixes later.

I currently use "privacy addressing" with my Linux machine which I do with:
# IPv6 privacy stuff
echo 209600 > /proc/sys/net/ipv6/conf/wlan0/temp_valid_lft
echo 10800 > /proc/sys/net/ipv6/conf/wlan0/temp_prefered_lft
echo 128 > /proc/sys/net/ipv6/conf/wlan0/max_addresses
echo 2 > /proc/sys/net/ipv6/conf/wlan0/use_tempaddr

This is mostly so that I'm trying out the most extreme end of IPv6 where I'm going through addresses quickly and have up to 128 at a time.

Comment PARI/GP for arbitrary precision (Score 1) 254

I use the "gp" calculator which is a programmable front-end to the PARI library of functions. See https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FPARI%2FGP

It's great for number theory and discrete math. I primarily use it for cryptography. My TI 86 and TI 89 used to be sitting on my desk at all times but after I discovered gp I don't have any use for them.

Comment Re:They should be scared (Score 2) 47

Nonsense. It is still unknown if it is possible (even theoretically) to scale this up. One of the main reasons is quantum decoherence which seems to introduce errors faster than you can scale the machine.

There are plenty of reasons to abandon RSA (which assumes factoring to be hard) in favor of elliptic curves but these quantum factoring advances are not one of them. RSA keys must be huge in order to provide similar security that symmetric and elliptic curve algorithms provide with small keys. Also, it's somewhat likely that the NSA has 1) improved GNFS or another factoring algorithm and 2) has built dedicated cracking hardware. I fully except the NSA to be able to factor 1024 bit numbers today (perhaps even at a rate of one or more a month).

Comment Re:Pointless - takes too long (Score 1) 140

Actually the economics here are not favorable to the scammer. For the class of goods being discussed here, most of the affiliate programs are fairly long lived (necessary precisely because they rely on independent contractors paid on commission to advertise their wares) and, as they advertise broadly, their storefronts are well known. Its simply not difficult to keep up with the top programs in any niche. It does indeed seem to take 2-4 weeks between the generation of a complaint and the merchant account shutdown, but the loss on the account is significant. First, accounts in some niches (notably pharma) have become extremely hard to come by. If you don't have a history of high turnover, you won't get boarded in this sectors and you'll need to go for third-party processing (at discount rates that can go up to 25%). Second, due to high risk, merchants can expect 10% holdback on 180 days revenue as collateral against future liabilities. Anecdotally, scammers report that this money goes out the window when they lose their account. Finally, empirically we see account replacement take a month or more and there's lost opportunity cost on missed sales. When you compare this against the cost of the test purchase... this is a huge asymmetry that does not favor the scammer.

Finally, in the course of our studies we've placed over 800 purchases on distinct credit cards (from pharma, software, replica goods and fakeav) and we have only a small handful of fraudulent charges (almost all associated with a data breach of a large online pharmacy) so our experience does not support the theory that all of these cards are being defrauded post facto.

Comment Re:Bad. Wrong. Evil. (Score 2) 140

In fact, even the company spokesperson admitted it's an extra-judicial process: "âoeIt doesnâ(TM)t require a judge, a law-enforcement officer or even much in the way of sophisticated security capabilities. If you can purchase a product, then thereâ(TM)s a record of it and that record points back to the merchant account getting the money,' Savage said."

So... you might want to read more closely. As the aforementioned Savage, I can assure you that I am not a company spokesperson, but rather an academic :-) Brian's article is based on a study we completed looking at how this particular intervention is taking place.

You are correct that none of this is being done through law enforcement. The relevant mechanism is that the card association contracts with acquiring banks stipulate that their boarded merchants may not sell goods that are illegal in their country or that into which they are being sold. The complaints from brand holders represent assertions that such a contract violation is taking place. The card networks investigate with the acquiring bank and, if indeed a violation of their contract terms has taken place, then they can levy the penalties in their contracts. There is nothing extra-legal here in the sense that this is straight up contract enforcement. In principal the card associations could refuse to investigate or enforce a contract violation without the brand holders suing them, but that position seems extreme no? This kind of action happens in countless contexts, from manufacturing to real estate, without any judicial involvement unless one side contests the facts (and even then this would typically be a civil issue and not a criminal one) .

Submission + - Visa/MC Take fight to Scammers (krebsonsecurity.com)

An anonymous reader writes: In his latest story, Brian Krebs reports on a collaboration between brand holders and credit card companies to shut down payment processing for rogue online pharmacies, pirate software sellers and fake anti-virus scams. By conducting test purchases, they map out which banks are being used to accept payments for which scams. Writes Krebs, "Following the money trail showed that a majority of the purchases were processed by just 12 banks in a handful of countries, including Azerbaijan, China, Georgia, Latvia, and Mauritius." These results are then fed to Visa and Mastercard who typically shut down the merchant accounts "within one month after a complaint was lodged." If you can't accept payments, you can't make money and without money you can't pay the spammers who advertise your product. This effort is apparently quite effective and has led to much concern by those running such sites. Summing up this position is one rogue pharmacy affiliate who writes on a Russian-speaking underground forum, "IMHO, there is a general sad picture, fucking Visa is burning us with napalm.”

Comment Hmmm... sounds familiar (Score 5, Informative) 216

Seems like this was demonstrated four years ago, no?

Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses.
D. Halperin, T.S. Heydt-Benjamin, B. Ransford, S.S. Clark, B. Defend, W. Morgan, K. Fu, T. Kohno, and W.H. Maisel.
IEEE Symposium on Security and Privacy, May 18-21, 2008.

See: http://www.secure-medicine.org/icd-study/icd-study.pdf

Slashdot Top Deals

In the sciences, we are now uniquely priviledged to sit side by side with the giants on whose shoulders we stand. -- Gerald Holton

Working...