Slashdot Mirror

← Back to Stories (view on slashdot.org)

Former Microsoft Privacy Chief Doesn't Trust Company, Uses Open Source Software

Posted by timothy on from the takes-one-to-know-one dept.

MojoKid writes "Microsoft's onetime Chief Privacy Advisor, Caspar Bowden, has come out with a vote of no-confidence in the company's long-term privacy measures and ability or interest to secure user data in the wake of the NSA's PRISM program. From 2002 — 2011, Bowden was in charge of privacy at Microsoft, and oversaw the company's efforts in that area in more than 40 countries, but claims to have been unaware of the PRISM program's existence while he worked at the company. In the two years since leaving Microsoft, Bowden has ceased carrying a cell phone and become a staunch open source user, claiming that he no longer trusts a program unless he can see the source."

131 of 199 comments (clear)

  1. Now, also make it understandable by d33tah · · Score: 5, Funny

    The next obvious step is not to use it unless you can understand it.

    1. Re:Now, also make it understandable by Zero__Kelvin · · Score: 1

      I understand it perfectly. It sounds like a matter of education on your part.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    2. Re:Now, also make it understandable by DogDude · · Score: 1

      The next obvious step is not to use it unless you can understand it.

      Amish-style living, here we come!

      --
      I don't respond to AC's.
    3. Re:Now, also make it understandable by d33tah · · Score: 2

      DIdn't mean that. Complexity is usually a sign of bad design. Actually, most of concepts in CS are pretty straightforward and if you get stuff complicated, it's more prone to bugs and thus, security problems. For example, take ECDSA and RSA. Modular exponentation is a pretty simple concept while the whole elliptic-curve thing was complicated enough for guys smarter than us to insert a backdoor into the equations. We should definitely go for simple and transparent designs.

    4. Re:Now, also make it understandable by stanlyb · · Score: 1

      Nope, the next obvious step is to use only compiler which you compiled by yourself.

    5. Re:Now, also make it understandable by cellocgw · · Score: 2

      DIdn't mean that. Complexity is usually a sign of bad design. Actually, most of concepts in CS are pretty straightforward ...

      Counterargument: the Rubik's Cube is a pretty snazzy, simple design. Try to solve it.

      --
      https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
    6. Re:Now, also make it understandable by d33tah · · Score: 1

      I'm not sure it's really that simple design. Don't you think it really takes a lot of imagination to actually visualise the inner state of the cube?

    7. Re:Now, also make it understandable by egamma · · Score: 2

      The next obvious step is not to use it unless you can understand it.

      So you're not going to use your car because you don't understand internal combustion engines or the chemical properties of gasoline?

      --
      Battlemaster--Game with friends in medival realms
    8. Re:Now, also make it understandable by njnnja · · Score: 2

      Actually, gp is a little right, although most people misunderstand the Amish relationship with technology. They don't ban all technology; rather, they make a conscious decision about whether to adopt or not adopt a new technology, based upon their values. In the same way, instead of using every new technology that someone tries to sell to us, we should evaluate it using non-technical metrics to determine whether using it is really the right thing to do. Much of social media, cloud storage, and proprietary crypto would have a very difficult time passing this test, and we would probably be better off being more Amish-like and avoiding technologies that are not consistent with the way we want to live rather than jump onto every new shiny shiny that's put in front of us.

    9. Re:Now, also make it understandable by mjwalshe · · Score: 1

      Would certainly reduce congestion on the roads - I can just see Cpatain Slow and the hampster trying to coach Jeremy Clarkson through that part of the driving test :-)

    10. Re:Now, also make it understandable by egamma · · Score: 1

      Would certainly reduce congestion on the roads - I can just see Cpatain Slow and the hampster trying to coach Jeremy Clarkson through that part of the driving test :-)

      Quick question--do you know how your mouse or trackpad works? :-)

      --
      Battlemaster--Game with friends in medival realms
    11. Re:Now, also make it understandable by Vanderhoth · · Score: 1

      No, it's just a ball in the middle with six rotatable pegs, one for each side of the cube, sticking out.

      It's an incredibly simple design with an easy algorithm of simple steps for solving it. It's the person that complicates the process of solving the cube by over thinking it.

      Simplicity is the sign of a genius while fools stay lost in complexity.

    12. Re:Now, also make it understandable by Synerg1y · · Score: 1

      Right...

      why don't you teach your grandma how to understand it? Do you even know what you're saying?

    13. Re:Now, also make it understandable by mjwalshe · · Score: 1

      Yep and I know which end of a soldering iron gets hot to

    14. Re:Now, also make it understandable by wrygrin · · Score: 1

      Understanding is "horizonal" - there's always, always further, beyond wherever you reach. Thus, there's almost never the luxury of understanding everything that's relevant. Instead, you can only identify what may be sufficient for your purposes, and aim to understand enough for adequate confidence about the risks.

      --
      everything leaks
    15. Re:Now, also make it understandable by VortexCortex · · Score: 1

      The next obvious step is not to use it unless you can understand it.

      So you're not going to use your car because you don't understand internal combustion engines or the chemical properties of gasoline?

      That's easy to understand. What's hard to understand is why you fools let the car manufacturers convince you that they should be capable of getting 100 MPG standard by now, that's why I don't drive you. In the 70's my dad worked for Shell, and they demoed a car at a company picnick that got 70 MPG. What I don't understand is why they would put a remote kill switch in the onboard computer.... So I don't drive those kind of cars....

    16. Re:Now, also make it understandable by rusty0101 · · Score: 1

      Actually solving a Rubics cube can be done the way most problems are solved, a piece at a time, and selecting a starting point to work from there.
        1. Pick a side to start with and get all the squares of that side the same. (e.g. put all the blue sides on one face of the cube.)
        2. Check the corners of each side and move them around until each corner is correct. (e.g. the blue side is put back intact, but now the two blue/red corners have red on the same side, the two blue/green corners have green on the same side, the two blue/yellow are together, and the blue/orange are together.)
        3. Now move around the edge pieces of the starting face are with the corner pieces just set. (e.g. blue/greens are together, blue/orange, blue/yellow and blue/red.)
        4. Move the centers coresponding to the four 'sides' as needed. (not going to explain moving green to green, etc.)
        5. Start solving the next layer of the cube. There are patterns of moves that allow you to move, and flip, pieces around, and when the piece is in place, the starting side is back to 'complete', which you will have to learn.
        6. Do the same for the four corners of the side opposite of your starting side, Again there are patterns of movements that allow you to move, and rotate, corners.
        7. More patterns allow you to move around the edges of the final side.

      Alternatively you can 'solve' for all 8 corners first, then start filling in edge pieces on opposing layers, leaving the 'middle' layer to solve last.

      Both of these are the methods used in the 80's for people to solve a cube in under a minute. I was doing that then. The methods used to solve the cube in under 15 seconds require significantly more processing power, and while there are people who can do so, I'm not one of them.

      --
      You never know...
  2. Good for him by techsoldaten · · Score: 5, Insightful

    Without assigning any kind of reason to his shift in attitudes - it's refreshing to see a privacy officer come out like this. I can't think of a reason any CPOs should act differently.

    1. Re:Good for him by Anonymous Coward · · Score: 1

      I can't think of a reason any CPOs should act differently.

      Since when does a CPO have a choice? If the DoD says run Microsoft then the Chief Petty Officer is stuck with Microsoft.

    2. Re:Good for him by ArcadeMan · · Score: 1

      C3PO can only act according to his program.

      --
      Get free satoshi (Bitcoin) and Dogecoins
    3. Re:Good for him by Anonymous Coward · · Score: 1

      Without assigning any kind of reason to his shift in attitudes...

      That's because he can no longer see the source for MS products. See, they might have something like that


          if ((uid != "billg") & (uid != "melindag") & (uid != "steveb") & (uid != "casparb")){
              startSpyingForNSA();
          }

      And he might not be so sure that the last part is still there.

    4. Re:Good for him by CastrTroy · · Score: 2

      He seems to have gone a little too "tinfoil-hat" for my tastes. He doesn't carry a cell phone anymore. I think that says a lot more than becoming an open source user.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    5. Re:Good for him by Lumpy · · Score: 1

      Unfortunately the write protect bit was set. Thank god that the Evil bit was not.

      --
      Do not look at laser with remaining good eye.
    6. Re:Good for him by Melipone · · Score: 1

      Neither does RMS...is he a bit tinfoil-hat too?

    7. Re:Good for him by intermodal · · Score: 2

      I think it says more about mobile networks than it does about him.

      That said, once upon a time I worked at Microsoft, back in the just-after-9/11 days. Seeing how the place worked is one of the reasons that I haven't owned a system that ran Microsoft since 2001.

      --
      In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
    8. Re:Good for him by CastrTroy · · Score: 1

      RMS is very "Tinfoil-Hat". Some people will most likely disagree, or take offense with a statement like that. But I think that things like that are going a bit too far. I mean, you can even load your own software onto certain cell phones if you want. Sure, there could always be some kind of covert stuff hidden in the firmware, but the same could be done with your laptop, network card, or TV. I think that open source is a good idea, not because I think all the other companies are out to get me, but because it's a good way of disseminating information, and to ensure the knowledge of how these systems work is not lost. Most people don't even compile the source themselves, and instead just take the binaries handed to them by their distro maintainers, which isn't really any safer than using closed source software anyway.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    9. Re:Good for him by smash · · Score: 1

      Yeah, much as i dislike RMS, being nutty when compared to the population at large doesn't make him wrong. Most people are stupid.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    10. Re:Good for him by Anonymous Coward · · Score: 1

      A phone is a device that, by design, constantly tells its current position to the phone network, and which additionally is equipped with the hardware needed to spy on you (again, by design; if it didn't have a microphone it wouldn't be a phone). Moreover, people voluntarily carry it around with them all the time, usually switched on.

      If you think about it, you'll notice that the cell phone is a spy's wet dream come true.

    11. Re:Good for him by SteveFoerster · · Score: 2

      It does indeed say more, but it doesn't say that he's crazy.

      --
      Space game using normal deck of cards: http://BattleCards.org
    12. Re:Good for him by mcgrew · · Score: 1

      More tinfoil than me... I at least carry a phone. I do use open source when possible (which is almost always when I'm not at work). A landline can be tapped, too, so unless he has no land line he hasn't thought it through. If the feds want in, they'll get in.

      Except not today! The tea party shut the whole damned government down (which is always their #1 priority anyway).

      --
      Free Martian Whores!
    13. Re:Good for him by bill_mcgonigle · · Score: 1

      The tea party shut the whole damned government down (which is always their #1 priority anyway).

      If only ... all the Tea Partiers I know want to Pledge their Allegiance to a strong constitutional republic.
        As if that experiment hasn't already been run...

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    14. Re:Good for him by bill_mcgonigle · · Score: 5, Insightful

      He seems to have gone a little too "tinfoil-hat" for my tastes. He doesn't carry a cell phone anymore. I think that says a lot more than becoming an open source user.

      If the government mandated that everybody carry a tracking device, keep it on at all times, and that they'd be storing the tracking data in perpetuity, there'd be a goddamn revolution.

      But when they do so voluntarily, and the NSA steals all that data - leading to the exact same end point - people are all like, "oh, look, Walter White is twerking again."

      At least this guy is being true to his privacy milieu.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    15. Re:Good for him by jones_supa · · Score: 1

      That uses bitwise AND instead of '&&', so it has all the bugs in place to be authentic Microsoft code. ;)

    16. Re:Good for him by Voyager529 · · Score: 1

      If the government mandated that everybody carry a tracking device, keep it on at all times, and that they'd be storing the tracking data in perpetuity, there'd be a goddamn revolution.

      Yes, because the primary, explicitly stated purpose of the device is to take away your privacy. Cell phones are primarily intended to facilitate communication independent of physical location. Cell phones do need to have an idea of your location, but that data doesn't NEED to be stored. Storing the data is done for corporate/government convenience, and it is indeed done in poor taste and generally against the wishes of the user...but no one owns a cell phone for the intent of getting tracked by the government.

      But when they do so voluntarily, and the NSA steals all that data - leading to the exact same end point - people are all like, "oh, look, Walter White is twerking again."

      The fact that the NSA is using the data is a point of contention for just about everyone, regardless of political affiliation. You'll find a relatively small minority of people that view it as a good thing. Again, cell phones are not purchased for the intent of being tracked by corporations or governments. The alternative to being tracked via cell phone is giving up one's cell phone. While you're right in that plenty of people are all "I don't care, for I have nothing to hide, for only terrorists have anything to hide, and I am not a terrorist", many of those people are also dependent on their cell phones for legitimate reasons. I perform on-site tech support for a living. If I don't have my cell phone, I don't know who is having a problem until I start my laptop, which must be online. To provide this level of service to customers requires a cell phone; if they have to wait for hours to even make me aware that there are problems with their systems, they won't be my clients for very long, which means that bills don't get paid, which means that not having a cell phone is the least of my worries.

      Again, for many it's "zomg then I can't instagram my lunch!!!111", but for others, our society has built itself in such a way that we are dependent on constant communication...which almost seems to lend credence to the thought that someone, somewhere, planned that all along....

    17. Re:Good for him by gmhowell · · Score: 2

      Neither does RMS...is he a bit tinfoil-hat too?

      I think he's the next level up: toe cheese canapes.

      --
      Jesus was all right but his disciples were thick and ordinary. -John Lennon
    18. Re:Good for him by zbaron · · Score: 1

      That, and 'OR' would be a lot more useful in that context as well.

    19. Re:Good for him by zbaron · · Score: 2

      Erg, no it wouldn't. Excuse coffee deprived brain.

    20. Re:Good for him by intermodal · · Score: 1

      As far as software itself, one coworker whose family member was a Windows kernel hacker informed me upon seeing my Linux laptop that there were also a fair number of Windows kernel hackers running Linux. This last bit sent up a lot of red flags in my head.

      Beyond that, I will be vague out of respect for the fact that my knowledge comes from time working there. The notable lack of controls, wide-open resources (to the worldwide network of employee sites), and the sheer number of known-term contractors constantly cycling out who were in positions of significant responsibility with access to a massive amount of internal data was very unsettling from a security standpoint. If Microsoft was that lax with their own data, I cannot imagine them being any better with mine.

      --
      In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
  3. Routing Connections from Point A to Point B by jiadran · · Score: 5, Interesting

    The article mentions that a connection from one point to anohter within Europe would likely stay within Europe. Maybe technically... On a recent trip to Paris I did a traceroute to an e-mail server in Switzerland, and essentially what I saw was: Paris (F) -> London (UK) -> Paris (F) -> London (UK) -> Paris (F) -> Lyon (F) -> Geneva (CH). There might be good reasons why the connection would go through London, but twice, and then come back? Considering that the UK is closely collaborating with the US in its data gathering, I have a feeling that this routing was not entirely by accident.

    1. Re:Routing Connections from Point A to Point B by StripedCow · · Score: 5, Funny

      There might be good reasons why the connection would go through London, but twice, and then come back?

      Perhaps the packet forgot its toothbrush?
      Never attribute to malice what can be adequately explained by stupidity.

      --
      If Pandora's box is destined to be opened, *I* want to be the one to open it.
    2. Re:Routing Connections from Point A to Point B by Thanshin · · Score: 1, Funny

      I see you did make an effort by specifying that London is in the UK and Paris in France, but I think it will still be a confusing post for Americans.

      You could have tried with:
      - Paris (Not USA) -> London (also not USA) -> Paris (Still not USA) -> London (Nope) -> Paris (You guessed it.) -> Lyon (Don't even try to guess) -> Geneva (Narnia).

    3. Re:Routing Connections from Point A to Point B by Anonymous Coward · · Score: 3, Funny

      If you didn't tell me I would have assumed:

      Paris (Maine) -> London (Ohio) -> Paris (Pennsylvania) -> London (Minnesota) -> Paris (Texas) -> Lyon (Mississippi) -> Geneva (New York).

    4. Re:Routing Connections from Point A to Point B by SSpade · · Score: 4, Informative

      I'm pretty sure that you don't really know where the physical hardware using the intermediate IP addresses shown in the traceroute actually was. Reverse DNS tends to show who owns it, *not* which country it's in. And geoip services are doing well if they can identify the right country in Europe, let alone anything more accurate than that.

      Even if you did see routing like that, and it really did go to the cities you claim, it still wouldn't be that odd - when routing is optimized at all it's optimized for cost, rather than distance. For long-haul the two tend to go together, but for relatively short distances in the well-connected first world they don't.

    5. Re:Routing Connections from Point A to Point B by heypete · · Score: 1

      I'm pretty sure that you don't really know where the physical hardware using the intermediate IP addresses shown in the traceroute actually was. Reverse DNS tends to show who owns it, *not* which country it's in. And geoip services are doing well if they can identify the right country in Europe, let alone anything more accurate than that.

      Even if you did see routing like that, and it really did go to the cities you claim, it still wouldn't be that odd - when routing is optimized at all it's optimized for cost, rather than distance. For long-haul the two tend to go together, but for relatively short distances in the well-connected first world they don't.

      Not all network providers provide useful rDNS, but many (like Level3, Hurricane Electric, etc.) do -- their reverse DNS clearly indicates the location of that particular node (HE uses three letter abbreviations of city names, like "sjc" for "San Jose, California" or "ash" for "Ashburn, Virginia". Level3 includes the full name of the city.).

      I've also seen odd routing paths. Usually they're transient and clear up at some later point.

    6. Re:Routing Connections from Point A to Point B by smash · · Score: 1

      Could be a million different reasons, for example it is entirely possible that ISP A's link was congested or down, and the packet was routed via a suboptimal path via a peering arrangement with ISP B to get off-continent via an alternative route.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    7. Re:Routing Connections from Point A to Point B by smash · · Score: 1

      Even figuring out where the IP block was allocated to doesn't necessarily show where it is geographically. If it's a global corporation, they could be routing their public address space anywhere on the internet.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    8. Re:Routing Connections from Point A to Point B by fph+il+quozientatore · · Score: 1

      There's worse than that. Traceroute packages are special packages with some options set so that you can check which way they go through. Who guarantees you that *all the other* packages are not taking a different path? Who guarantees you that your packages do not take one or two more hops through modified routers whose IP stack does not decrease the TTL variable as it should?

      --
      My first program:

      Hell Segmentation fault

    9. Re:Routing Connections from Point A to Point B by citizenr · · Score: 1

      You might of saw packets still inside LINX.

      --
      Who logs in to gdm? Not I, said the duck.
    10. Re:Routing Connections from Point A to Point B by Terrasque · · Score: 1

      Who guarantees you that *all the other* packages are not taking a different path?

      http://linux.die.net/man/1/tcptraceroute

      http://manpages.ubuntu.com/manpages/gutsy/man1/paratrace.1.html

      --
      It's The Golden Rule: "He who has the gold makes the rules."
    11. Re:Routing Connections from Point A to Point B by xatr0z · · Score: 1

      Or maybe your or their provider has some issues with their upstream provider, or they have some weird routing issues, ... It could be anything, but not an indication of NSA data gathering. That still might happen, but even if they do need to change your route it's not like your going to see 'nsa-logging.gchq.gov.uk' in your traceroute.

  4. The next obvious step is to ... by Taco+Cowboy · · Score: 5, Insightful

    ... use caution in everything we do.

    There is no way we can understand everything. There are just too many things out there that we use daily - even software alone consist of so many layers ( from the spreadsheet software program that we use, to the device drivers, the OS, to the embedded firmwares residing inside the chips, to the myriad mix of software that keep the Net humming.

    Yes, I know, it is no fun.

    The paranoids have a point, after all --- BIG BROTHERS (plural) want to know everything about us.

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:The next obvious step is to ... by Fnord666 · · Score: 5, Insightful

      even software alone consist of so many layers ( from the spreadsheet software program that we use, to the device drivers, the OS, to the embedded firmwares residing inside the chips, to the myriad mix of software that keep the Net humming.

      Don't forget the compilers and linkers that build the software. The source may look fine, but where did the compiler come from?

      --
      'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
    2. Re:The next obvious step is to ... by coinreturn · · Score: 1

      Open source compilers... that compile themselves.

    3. Re:The next obvious step is to ... by Anonymous Coward · · Score: 5, Informative

      There's still the trick described by Ken Thompson which involves a compiler taking the source code of a compiler but also injecting a backdoor into the binary at the same time. This means that there can be a trojan replicating itself over multiple generations even though it never shows up in the source.

    4. Re:The next obvious step is to ... by disposable60 · · Score: 2

      Someone around here mentioned an attack on this supposed haven. The upshot was that in the first set of source, compromizing code was inserted and compiled, instructing the compiler to compile that bit, then remove it from the source. In subsequent compiles of the compiler, if the compromizing source was not found, the code would still be inserted. Anything compiled by that compiler would then be compromized, but no review of the source would reveal it - you would have to walk the binary.

      --
      You're looking for quotes? See my journal.
    5. Re:The next obvious step is to ... by Thanshin · · Score: 5, Funny

      Open source compilers... that compile themselves.

      It's compilers all the way down.

    6. Re:The next obvious step is to ... by sconeu · · Score: 1

      That was Ken Thompson, co-developer of Unix, in "Reflections on trusting trust".

      http://cm.bell-labs.com/who/ken/trust.html

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
    7. Re:The next obvious step is to ... by Pope · · Score: 4, Funny

      Open source compilers... that compile themselves.

      It's compilers all the way down.

      My god, it's even worse: Turtle Logo compilers!

      --
      It doesn't mean much now, it's built for the future.
    8. Re:The next obvious step is to ... by Anonymous Coward · · Score: 1

      Even if you know that all your compilers are good (maybe you disassembled and analysed the binary), you still have to run the initial compiler on some operating system. Who tells you that the operating system doesn't check any file you write, and writes compromised versions for key binaries it detects? In that case, even copying known-clean binaries on your disk won't help because they would be compromised the very moment you write them.

      And BTW, the same could be done at the firmware level of the hard disk.

    9. Re:The next obvious step is to ... by Anonymous Coward · · Score: 1

      Good thing there's a workaround to that as well.

    10. Re:The next obvious step is to ... by allamericancomp · · Score: 1

      They need to get this guy on the Alex Jones show.

      --
      www.allamericancomputerrepair.com
    11. Re:The next obvious step is to ... by 10101001+10101001 · · Score: 1

      It's called a quine compiler. :)

      --
      Eurohacker European paranoia, gun rights, and h
    12. Re:The next obvious step is to ... by mcgrew · · Score: 2, Insightful

      There is no way we can understand everything.

      True, but one can understand everything about something, and enough of everything to get by. If you know how electricity and electronic components work, how logic gates and ALUs work, know assembly and higher level languages you can pretty much understand enough.

      The secret is reading LOTS of books and then practicing. Unfortunately, 97% of the population are aliterate -- they can read, but don't. I don't understand those people! Probably never will.

      --
      Free Martian Whores!
    13. Re:The next obvious step is to ... by mcgrew · · Score: 1

      Funny, but incorrect. Somewhere at the bottom is the assembler that the first compiler was written in, and the hand-assembled machine code the first assembler was written in... then you have to trust Intel and AMD to not install NSA back doors in their chips. Build your own computer out of discrete components and it will cost a fortune, take a large building to hold, and be very slow compared to chips.

      We're screwed.

      --
      Free Martian Whores!
    14. Re:The next obvious step is to ... by dead_user · · Score: 2, Funny

      aliterate

      The other 3% can't spell illiterate. ;)

    15. Re:The next obvious step is to ... by X0563511 · · Score: 1

      Every Intel CPU since Sandy has a nice cellular link built in. You can't even trust your processor these days.

      Sure you can. Just don't buy Intel.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    16. Re:The next obvious step is to ... by Anonymous Coward · · Score: 1

      Aliteracy and illiteracy are different. The GP used the correct term. I assume the parent is joking, but I actually had not heard the term aliterate before, so I looked it up.

    17. Re:The next obvious step is to ... by idontgno · · Score: 1

      I suspect some small fraction of that 3% isn't actively illiterate, but simply unread enough to not recognize the difference between aliterate and illiterate... or to recognize that aliterate is a legitimate word which is not merely another synonym for "illiterate".

      --
      Welcome to the Panopticon. Used to be a prison, now it's your home.
    18. Re:The next obvious step is to ... by Khashishi · · Score: 1

      Does slashdot count as reading?

    19. Re:The next obvious step is to ... by Windwraith · · Score: 2

      ...and what SIM card does it use? Because you don't get 3G without a SIM card, and 3G is not free to use. You get the bill for it, or does Intel have some form of international superserver?

      It's true that paranoia turned out to be real, but come on.

    20. Re:The next obvious step is to ... by Bert64 · · Score: 1

      Depends which governments you trust the least...
      There are various ARM cores designed by the british, and other implementations of the instruction set designed elsewhere...
      Then you have some MIPS cores developed by the chinese...

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    21. Re:The next obvious step is to ... by dimeglio · · Score: 1

      Does Brain F*ck count as programming?

      --
      Views expressed do not necessarily reflect those of the author.
    22. Re:The next obvious step is to ... by Xtifr · · Score: 2

      A trick that relies on the compiler recognizing its own code, which, as the code is edited over the years, would require truly amazing AI. Thompson had it fairly easy, because he was dealing with a relatively simple and fairly static compiler, and could use simple pattern matching to identify the places to insert his trojan. GCC, on the other hand, has undergone some major rewrites over the years.

      Of course, if you really want to be sure, you can load the compiler source into something completely different. I once built GCC using a C interpreter, and then used the interpreted version to compile the compiler again, and got identical binaries, so I'm pretty confident that GCC has no such trojans lurking. But you're welcome to try the same trick yourself.

    23. Re:The next obvious step is to ... by aztracker1 · · Score: 3, Interesting

      I really wish we had a -1 Misinformation mod. We have a +1 Informative.. but there are actual posts, like the parent that are just plain inaccurate, wrong and misleading.

      --
      Michael J. Ryan - tracker1.info
    24. Re:The next obvious step is to ... by gmhowell · · Score: 1

      aliterate

      The other 3% can't spell illiterate. ;)

      Irony?

      --
      Jesus was all right but his disciples were thick and ordinary. -John Lennon
    25. Re:The next obvious step is to ... by VortexCortex · · Score: 1

      Unless all your CPU chips have the Ken Thompson Hack in the Microcode. Then they could all evaluate the same even if they were differently tailored to your specific system.

      What you have to do is fabricate your own chips. Mine are the size of a garage wall perimeter, made out of contactor units, emulating MIPS at just under 0.01 cycles per second, and noisy enough to end three relationships.

    26. Re:The next obvious step is to ... by AHuxley · · Score: 1

      Re "inaccurate, wrong and misleading":
      The 3g side can be seen as another security option for: power is connected, a computer of interest is networked: ~wake up and authorized administrator commands sent.
      http://www.tomshardware.com/news/sandy-bridge-vpro-core-i7,12353.html

      --
      Domestic spying is now "Benign Information Gathering"
    27. Re:The next obvious step is to ... by lennier · · Score: 1

      If you know how electricity and electronic components work, how logic gates and ALUs work, know assembly and higher level languages you can pretty much understand enough

      ... to be really scared.

      Like they say, if you want to sleep at night you don't actually want to know how sausages, laws or semiconductor devices are made.

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
    28. Re:The next obvious step is to ... by Shirley+Marquez · · Score: 1

      We have no guarantees that processors from other companies don't have backdoors. Information about them just hasn't come out publicly yet.

    29. Re:The next obvious step is to ... by mcgrew · · Score: 1

      Indeed.

      --
      Free Martian Whores!
    30. Re:The next obvious step is to ... by mcgrew · · Score: 1

      No, books (whether paper or e-books) count as reading. The National Enquirer and People don't count, either,

      --
      Free Martian Whores!
    31. Re:The next obvious step is to ... by mcgrew · · Score: 1

      To paraphrase Twain, an aliterate has no advantage over an illiterate.

      --
      Free Martian Whores!
  5. Bowden? by Anonymous Coward · · Score: 1

    Snowden? If your name is *owden, you are automatically privacy-minded, apparently.

  6. Message received by Tokolosh · · Score: 5, Insightful

    Recent history teaches us that he knows things that he is not allowed to talk about. This is his way of legally signalling that all is not well.

    We have congresscritters trying to send the same message, without being labeled "traitors". See http://www.wyden.senate.gov/news/press-releases/wyden-udall-statement-on-reports-of-compliance-violations-made-under-nsa-collection-programs

    --
    Prove anything by multiplying Huge Number times Tiny Number
    1. Re:Message received by turgid · · Score: 4, Insightful

      You're not thinking cynically enough.

      With my Slashdot ubiquitous Microsoft Shill hat on consider the following.

      If you don't like/trust/use Microsoft, you are immature and stupid and a stinking long-haired communist FOSS hippy.

      Someone from the company you HATE leaves the company and announces that they don't trust their former employer which also happens to be the company you HATE, and that they have converted to the FOSS way.

      That means what you suspected all along is true! Right?

      Ah but, it's a trap! You see, the FOSS is back-doored to high heaven as well and all this is a psychological trick to make you feel secure and validated in your own mind.

      Muhahahhahahhahah! Elop will soon rule the galaxy.

      --
      Stick Men
    2. Re:Message received by Walterk · · Score: 1

      Sounds like the Congress could use something like Parliamentary privilege principle:

      it allows members of the House of Lords and House of Commons to speak freely during ordinary parliamentary proceedings without fear of legal action on the grounds of slander, contempt of court or breaching the Official Secrets Act.[1][2] It also means that members of Parliament cannot be arrested on civil matters for statements made or acts undertaken as an MP within the grounds of the Palace of Westminster, on the condition that such statements or acts occur as part of a proceeding in Parliamentâ"for example, as a question to the Prime Minister in the House of Commons. This allows Members to raise questions or debate issues which could slander an individual, interfere with an ongoing court case or threaten to reveal state secrets

      --

      "If anyone needs me, I'm in the angry dome."
    3. Re:Message received by zzottt · · Score: 1

      my thoughts exactly

    4. Re:Message received by smash · · Score: 2

      They're in the firmware/hardware anyway. That 87 megabyte NVIDIA blob you're running? HAHA! That intel microcode update? Guess what!

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    5. Re:Message received by turgid · · Score: 1

      I run my own homebrew X server with OpenGL compatible 3D library on a home-made OpenRISC board. And I never ever connect it to the Internet. No siree.

      --
      Stick Men
    6. Re:Message received by bill_mcgonigle · · Score: 1

      Ah but, it's a trap! You see, the FOSS is back-doored to high heaven as well and all this is a psychological trick to make you feel secure and validated in your own mind.

      That's exactly what they want you to think! /turtles

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  7. I'm surprised MS had a Chief Privacy Advisor... by jkrise · · Score: 5, Funny

    that itself is more newsworthy. At first glance I thought Piracy Advisor; who suggests making things difficult to pirate.

    Why would MS appoint somebody to advise them on privacy of their customer's data? How does it benefit the shareholders?

    --
    If you keep throwing chairs, one day you'll break windows....
    1. Re:I'm surprised MS had a Chief Privacy Advisor... by stewsters · · Score: 1

      If you read the headline carefully, you will see that he is the former privacy chief. Management at MS realized that his salary could go into stacks of more surface units and quickly canned him.

    2. Re:I'm surprised MS had a Chief Privacy Advisor... by Gibgezr · · Score: 1

      They are a mega-corporation whose main business involves selling software that interoperates with both their own and other software, and there is a lot of data exchange involved, covering the scale from OS's to apps to large networked DBs. Practically everything they do either directly impacts user data or has the potential to do so, so of course they are concerned about user privacy issues. Whether they are concerned enough to say no the NSA is...well, it seems in light of recent news that we can say they are not concerned enough.

    3. Re:I'm surprised MS had a Chief Privacy Advisor... by SirGarlon · · Score: 1

      Why would MS appoint somebody to advise them on privacy of their customer's data? How does it benefit the shareholders?

      Vaguely, by maintaining customers' loyalty and trust. Specifically, by keeping Microsoft out of the court battles that some other companies are fighting.

      --
      [Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
    4. Re:I'm surprised MS had a Chief Privacy Advisor... by Thanshin · · Score: 1

      Practically everything they do either directly impacts user data or has the potential to do so, so of course they are concerned about user privacy issues.

      Facebook?

    5. Re:I'm surprised MS had a Chief Privacy Advisor... by Gibgezr · · Score: 1

      Hehe, Facebook is concerned as well, but their concern is more along the lines of "private data is valuable, so sell all we can without getting sued or driving away all the product (users)". I'm sure they have lawyers who spend all day talking about privacy, 24/7.

    6. Re:I'm surprised MS had a Chief Privacy Advisor... by bill_mcgonigle · · Score: 1

      Why would MS appoint somebody to advise them on privacy of their customer's data? How does it benefit the shareholders?

      It helps people trust them and buy their software. Probably while they should do neither.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  8. Former Employee Uses Competing Product by rodrigoandrade · · Score: 3, Funny

    News at 11.

  9. Re:Worthless by larry+bagina · · Score: 1

    There is plenty of closed source software that is very easy to verify (assuming you know how to read assembly, of course).

    --
    Do you even lift?

    These aren't the 'roids you're looking for.

  10. Should have just kept quiet by Barlo_Mung_42 · · Score: 1

    Now that he's opened his mouth he's on their radar for sure.

    1. Re:Should have just kept quiet by Kardos · · Score: 1

      They can't put everybody on their radar!

  11. C The Source by konohitowa · · Score: 1

    #define P(X)j=write(1,X,1)
    #define C 39
    int M[5000]={2},*u=M,N[5000],R=22,a[4],l[]={0,-1,C-1,-1},m[]={1,-C,-1,C},*b=N,
    *d=N,c,e,f,g,i,j,k,s;main(){for(M[i=C*R-1]=24;f|d>=b;){c=M[g=i];i=e;for(s=f=0;
    s=0&&k=16!=M[k]>=16))a[f++
    ]=s;if(f){f=M[e=m[s=a[rand()/(1+2147483647/f)]]+g];j=jb++?b[-1]:e;}P(" ");for(s=C;--s;P("_")
    )P(" ");for(;P("\n"),R--;P("|"))for(e=C;e--;P("_ "+(*u++/8)%2))P("| "+(*u/4)%2
    );}

    shapiro.c from IOCC 1985

  12. Caspar Bowden is kidding himself. by Anonymous Coward · · Score: 1

    Has he also gotten rid of any Speedpass toll device he has ?

    Has he gotten rid of any tire pressure monitoring system in his vehicles ?

    Has he gotten rid of his license plates which are read by numerous cameras
    in any weather, day or night, and which allow his movements to be added to
    a database ?

    Has he gotten rid of all his bank accounts and credit cards ?

    Has he quit using any internet tools for any communications ?

    The above is merely the basics. Switching to open source OS doesn't
    give real privacy any more than watertight doors guaranteed the Titanic
    would not sink.

    /

    1. Re:Caspar Bowden is kidding himself. by Lumpy · · Score: 1

      Do need to get rid of your speedpass, Just randomly steal a neighbors unit off their dash every morning.
      TPMS is a joke anyways.
      Same for the plates, snag the car's plate at the same time. Bonus points of you attach them magnetically and swap with your own so they never know and your data is used to create noise in the system.

      Bank accounts and CC is also easy to spoof/ use non attached if you know where to look.
      And you can easily communicate safely via the internet if you have an IQ over 100. I assume he does.

      All of the basis are easily retooled to create a useless pattern of noise to hide in.

      --
      Do not look at laser with remaining good eye.
    2. Re:Caspar Bowden is kidding himself. by Anonymous Coward · · Score: 1

      TPMS is a joke anyways.

      It may be a joke to you, but each transmitter has a unique identifier and that makes it very useful for
      tracking vehicles.

      "Same for the plates, snag the car's plate at the same time."

      Stealing license plates on a daily basis ? That's not a good strategy because
      sooner or later you will be caught either stealing the plates or using the incorrect
      plates. This is not a video game, and your ideas are not sound in the real world.

      "And you can easily communicate safely via the internet if you have an IQ over 100."

      How exactly does IQ make it possible to defeat surveillance when that surveillance is
      designed by people who have nothing else to do but make sure your communications
      are intercepted and read ? Again, you are not being realistic. My guess is that you are maybe
      16 years old and that your undeveloped brain imagines that the world is like a video game
      in which all you need is the right "cheats" and you can get away with anything. The truth is that
      there are plenty of people out there who are just as smart as you are and probably smarter and
      they will be working against your desire to use "cheats". You will lose, and if you have been doing
      anything significantly wrong during your little games, you will lose big.

      /

  13. Re:Worthless by jones_supa · · Score: 1

    That is true, but there is usually too much work involved to make it feasible in practice.

  14. Read this FA ... by Taco+Cowboy · · Score: 3, Informative

    http://scienceblogs.com/goodmath/2007/04/15/strange-loops-dennis-ritchie-a/

    Both AC and disposable60 were trying to explain to you the concept outlined by Mr. Thompson.

    Read, and ponder.

    --
    Muchas Gracias, Señor Edward Snowden !
  15. Not all programs can be dis-assembled correctly by Taco+Cowboy · · Score: 1

    There is plenty of closed source software that is very easy to verify (assuming you know how to read assembly, of course).

    It is easier said, than done.

    As an ASM programmer myself (and I have been doing assembly and machine language since the 1970's) I can tell you that not all programs can be successfully dis -assembled.

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:Not all programs can be dis-assembled correctly by FrankSchwab · · Score: 1

      Being as there is a deterministic hardware state machine that successfully executes the instruction sequence that you're interested in disassembling, I'd have to disagree with your assertion that "not all programs can be successfully dis-assembled.". If the processor can execute it, the code can be disassembled.

      --
      And the worms ate into his brain.
    2. Re:Not all programs can be dis-assembled correctly by lennier · · Score: 1

      Being as there is a deterministic hardware state machine that successfully executes the instruction sequence

      There's a Mr Shroedinger and a Mr Bohr here to see you about that statement. Oh - sorry. A single Mr Shroedinger-and/or-Bohr.

      And a Mr Murphy, who just set both their beards afire to, and I quote, "see what would be the worst that could happen."

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
  16. Caspar Bowdens testimony in the EU Parliament by Christian+Engstrom · · Score: 4, Informative

    Last week, Caspar Bowden testified at a hearing in the European Parliament, and presented a report on the NSA surveillance to the European Parliament's Committee for Fundamental Rights LIBE.

    Link to the report: http://www.europarl.europa.eu/meetdocs/2009_2014/documents/libe/dv/briefingnote_/briefingnote_en.pdf

    Link to the Youtube-video with Bowden's statement and the following Q&A (63 min): http://youtu.be/qa83l2_ZzEo

    --
    Christian Engström, Former Member of the European Parliament 2009-2014 for The Pirate Party, Sweden
  17. Re:Worthless by Virtucon · · Score: 4, Informative

    He doesn't have too, it appears that the Key exchange protocols were weakened and it's not necessary to break AES but extract the keys during KEP negoitiation. http://www.zdnet.com/has-the-nsa-broken-ssl-tls-aes-7000020312/

    You also have to remember that it's a negotiation and unless you set your browsers up and websites to use more secure protocols you could default to say RC4-RSA under SSLv2.0. There's acknowledged flaws in TLS 1.0 (SSLv3.0) but it wasn't until a couple of months ago that Firefox supported TLS 1.1 and it still doesn't support TLS 1.2. Chrome (Version 30+) and IE (9+) support TLS 1.1 and TLS 1.2. So you should see more and more websites turning on TLS 1.2 support and turning off TLS 1.0 and 1.1 if they can. http://en.wikipedia.org/wiki/Transport_Layer_Security

    I've already had change requests come in from customers to get away from AES and to push more TLS 1.2 out there and you're already seeing companies and other government agencies distancing themselves from NIST blessed standards and that's lamentable but the credibility of the organization has been irreparably compromised by NSA influence. As a result, may see more ChaCha or more TwoFish implementations start to come into the mix over this, which is a good thing because it means that we have diversity in ciphers and less reliance on NIST and its standards processes.

    --
    Harrison's Postulate - "For every action there is an equal and opposite criticism"
  18. Two ways this guy is silly, or naive by jodido · · Score: 1

    It's utopian, and silly, to think that 1. everyone can so carefully inspect all software they use that you can keep snoopers out and 2. that this makes any difference anyway. There's nothing in what he says that will do anything to protect his privacy, nor will following his example protect yours. Repeat after me: this is not an engineering/programming/technical problem, it's a political problem.

    1. Re:Two ways this guy is silly, or naive by david672orford · · Score: 2

      It's utopian, and silly, to think that 1. everyone can so carefully inspect all software they use that you can keep snoopers out and 2.

      True, but the risk is still greater if no one can inspect it.

  19. Recall Ubuntu/Shuttleworth: "You trust us already" by G3ckoG33k · · Score: 1

    Recall Ubuntu's Mark Shuttleworth (http://www.markshuttleworth.com/archives/1182):

    "Your anonymity is preserved because we handle the query on your behalf. Don’t trust us? Erm, we have root. You do trust us with your data already. You trust us not to screw up on your machine with every update. You trust Debian, and you trust a large swathe of the open source community."

    I trust Debian, even if the server breaches from ten years ago had me "worried" (http://www.internetnews.com/dev-news/article.php/3112551):

    "Within the past 36 hours, four of the Debian Project's main Web servers for bug tracking, mailing lists, security and Web searches were breached, the open-source group said. Joey Schulze, Debian Project stable release manager, e-mailed members of the organization's discussion list explaining that the machines were being taken down. The Debian Project servers run on its own operating system, version 3.0/i386, with current security updates. Some services provided by the servers have been mirrored at other sites, but Schulze told internetnews.com he doesn't expect the original machines to be running before Monday, with the possible exception of the security.debian.org and master servers."

    Here is the Slashdot story http://linux.slashdot.org/story/03/11/28/050232/more-info-on-debianorg-security-breach

    Maybe there have been more. How would we know?

  20. There's still the solution to that. by Anonymous Coward · · Score: 1

    However, those insistent on trashing open source will still forget that the issue is a solved one for anyone willing to do a little work.

    I guess it's the entitlement culture in the USA and spread by their international business globally that insists that everything be known by them without having to put any effort into it.

    1. Re:There's still the solution to that. by UneducatedSixpack · · Score: 1

      However, those insistent on trashing open source will still forget that the issue is a solved one for anyone willing to do a little work.

      Yeah, like reading couple millions lines of code... Good luck with that. I have seen 100 line magic functions that could not be understood in couple of days. I bet in a bigger code base the number of such magic functions could be quite significant. Open source only gives us illusion.

    2. Re:There's still the solution to that. by lennier · · Score: 2

      I guess it's the entitlement culture... that insists that an infinite number of things be known by them without having to put an infinite amount of time into it.

      Maxwell's Information Demon says: "Hi! It looks like you're trying to enumerate an infinite number of uncountably infinite sets in your head! Would you like me to read to you from the collected works of Kurt Godel and Georg Cantor while you're waiting to finish that? Aleph-1 Klein bottles of beer on the wall, Aleph-1 Klein bottles of beer, take one down, pass it around, Aleph-2 Klein bottles of beer, hey! Darn, I broke one. Now there's Koch snowflakes all over the Sierpinski carpet. Got a Menger sponge?"

      --
      You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
  21. Re:Worthless by smash · · Score: 1

    Pretty much sums it up. Unless you can analyse the CPU microcode and block diagram, sorry, but you're boned.

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  22. Re:Worthless by TheCarp · · Score: 1

    I know that word, and I do not think it means what you think it means.

    --
    "I opened my eyes, and everything went dark again"
  23. Re:Recall Ubuntu/Shuttleworth: "You trust us alrea by smash · · Score: 1

    Do you trust them to audit their random number generator?

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  24. Scroogled by Microsoft! by technomom · · Score: 1

    So, Microsoft's been scroogling us all along. Funny how these things work out.

  25. Not to worry... by unimind · · Score: 2

    This ought to lay everyone's concerns to rest:

    Azure certified by DOD

    Obviously, this guy is just disgruntled. Nothing to see here..

    --
    The following statement is true: The previous statement is false.
  26. citizen or no by sacrilicious · · Score: 3, Insightful

    As Bowden goes on to point out, if you aren't a US citizen, you have no protection whatsoever from PRISM.

    Um, and if I'm a citizen, I'm protected from prism? Nuh uh.

    --
    - First they ignore you, then they laugh at you, then ???, then profit.
  27. Re:Worthless by ObsessiveMathsFreak · · Score: 1

    The ENIGMA system is so complicated that no-one will be able to break it.

    --
    May the Maths Be with you!
  28. Re:Yes, it is. So what? by bill_mcgonigle · · Score: 1

    Is it that if something requires more effort than merely wishing on a star that not only will you not do it, you will refuse to believe anyone will?

    The technology may some day exist to decompile a binary into a set of comprehensible source files that elicidates the architecture of an arbitrarily complex code base, but today that does not exist.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  29. I don't need to be able to understand the source c by DadLeopard · · Score: 1

    I am not, and never will be, a programmer or one that is able to go through the source code and assure myself that all is well. I do have to depend on the Thousands of people out there that have this ability, to get my peace of mind with my chosen OS and the Software that runs on it! This is a lot more assurance than anyone using a closed source OS can say! Not perfect for me, but way better than the alternatives!

  30. Re:Then how're you posting on SLASHDOT?!?!?!? by gmhowell · · Score: 1

    I don't remember the exact string of characters, but I think your reply should include in part 'NO CARRIER' :)

    +++
    ATH0

    --
    Jesus was all right but his disciples were thick and ordinary. -John Lennon
  31. I did not work at microsoft and this guy was up. by ralphaostrander · · Score: 1

    There and he just now wakes up 17 years behind me on open source. I dont understand how it can be.

  32. Re:Recall Ubuntu/Shuttleworth: "You trust us alrea by smash · · Score: 1

    Yeah 2 years is ok between vulnerability introduction by the maintainer and the fix, right? It's not like openSSL is used for anything important?

    Open source is peer reviewed and secure, right?

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  33. Re:Maybe yours was the dumbest by Synerg1y · · Score: 1

    Immature? You're the one that believes everything he reads on the internet. Prove it or get back in your hole troll.

    Embedding a 3g chip / SIM / carrier selection technology... i'm sure there's a few obstacles i'm missing too, would be at technological marvel on a processor, i'd be putting my proc into any device i want internet on. It doesn't make sense from a commercial or power consumption process either. I think someone mistook wake on lan for 3g in some of these articles and then it spread like internet troll stories often do.