Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Comment "Nobody told me", huh? Didn't read, did you? (Score 4, Informative) 253

tl;dr: I did read; and had that thing sent back to the hell that spawned it.

A family member bought one of those things just before Christmas, and bribed me with dinner to come over and set it up.

I read the documentation that came with it and the installation screens. They clearly stated that the ink included inside the box could only be used with the subscription, only while the subscription service was active, that the printer must have always-on access to the internet and that if the subscription was canceled, the printer would stop working immediately, unless you installed a more expensive ink cartridge. It also said their cheapest plan was some really low number per month, but only applied if it printed a tiny number of pages in a month. The overage charges were excessive.

"Always on, always connected" is a terrible idea. Someone will hack those things eventually, and will start spewing advertising prints ... all the while chewing up the page limited count and triggering the equivalent of overdraft fees.

I told my family member that I was embarrassed that someone like HP would do this, and convinced them to box up and send that pile of manure back where it was purchased. HP has fallen very, very far from their Laserjet 4 days. And that steaming pile burned all my goodwill I once had for the company.

Incidentally, if you rage-quit midway through the installation process, and then restart to show your family member the text that caused you to rage quit ... their installer isn't able to complete on the second pass without restoring to an O/S savepoint.

Brother seems to have act together, so I went and picked one of their models as a replacement.

Comment "Move Fast and Break Things" is really awful ... (Score 1) 256

... when the thing being broken is several thousand pounds of metal, glass and plastic moving at 65 miles per hour.

In 1988, some idiot got drunk, climbed behind the wheel of his pick up, drove on the wrong side of the interstate at high speed and had a head-on collision with a school bus, which killed 27. (cite: Carrollton Bus Crash, 1988)

The manufacturer of the school bus was sued over the deaths, mainly due to deficiencies in the design. That bus has been built to an older (but legal at the time it was built), standard.

Anyone in the industry with an awareness of what happened will look at the concept of "move fast and break things" as an existential threat - for the passengers in the vehicle, for the designers that approved the change and/or for the company itself.

A statement like, "the automotive industry should adapt," should scare the semiconductor industry ... because they may very well adapt, by dumping the current round of semiconductor manufacturers and starting up their own semiconductor manufacturer. Also known as, "fully funded upstart competition."

Comment Anyone who said that 8 years ago was a fool (Score 2) 139

Linux can be secure-ish, but it takes work, monitoring and maintenance. Or as one professor put it some 31 years ago:

The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then I have my doubts.

-- Gene Spafford, 1989.

Anyone looking for a computer that they can set up and then forget can be breached.

Comment Re:What Failed? (Score 4, Insightful) 241

I know of two things:

VISA and Mastercards failed to be processed ... except that happened when the first "expires in 2000" versions were issues way back in 1996.

The manufacturing plant I worked at had all the engineering data for the model year 1998 vehicle vanish due to a poorly written purge process when the data for the first Model Year 2000 vehicles were pre-released .. but that took place in 1998 (I spent weeks rebuilding that data).

People freaked out so much about "bad data goes in must lead to the end of the world." That ignored that fact that bad data goes in ALL THE FRACKING TIME ... and that we just deal with it.

Comment "Faster" can actually be a security hole (Score 2) 213

One of the attacks against encryption systems is to see how long it takes to fail to decrypt in various circumstances.

If every single decryption failure takes the same amount of time, no information is leaked when someone starts battering the library. However, if it fails faster when the first character of the key is bad, then all an attacker has to do is try combinations until they get a fast response ... and now they have the first part of the key. Repeat on the second, then the third, and so on.

In that scenario, cracking the key drops from X**N (some time raised to the power of how long the key is) down to X*N (the same time multiplied by the length of the key).

I have no idea if this particular Rust library has that problem. But I am skeptical of anything so utterly focused on speed. Just ask Intel about Specter.

Comment Re:SecureID on a chip? (Score 4, Interesting) 53

Almost.

The MIT solution, as described, appears to do away with the clock-based system that RSA uses, and instead has the server and the chip stay in lock-step as transactions occur.

What happens when the two drift out of synchronization will be the key to disrupting the technology.

If the server and chip stop talking to each other when they get out of synch, then the whole system is vulnerable to a wide scale DOS simply by corrupting the server's database of keys.

Imagine an industrial plant manager's reaction when 1000 different devices brick themselves due to a hacker's attack. If it takes a day to replace and reset everything so it all works again, that manager will rip out the technology so that his or her plant is never down that long, ever again.

On the other hand, if the server and chip and re-synchronize after a glitch, then a hacker can emulate that resynchronization process.

I wonder if a Man in the Middle attack would work where the MiM and server exchange one set of keys, while the MiM and chip exchange a second set of keys. Would either side know that it was talking to a fraudulent data source?

Comment Isn't 1080p enough?" (Score 2) 333

No.

1080p is fine for watching movies - but that is not the only thing that I use my laptop for.

I need a mobile workstation, and when I dropped $3k on a laptop last year, finding a major brand with a resolution better/taller than 1920x1080 would have been the deciding factor.

It looks like some of the major manufacturers have figured it out, finally.

Slashdot Top Deals

Your program is sick! Shoot it and put it out of its memory.

Working...