Slashdot Mirror

← Back to Stories (view on slashdot.org)

Whom Must You Trust?

Posted by Soulskill on from the mainly-just-late-night-infomercial-spokepeople dept.

CowboyRobot writes: 'In ACM's Queue, Thomas Wadlow argues that "Whom you trust, what you trust them with, and how much you trust them are at the center of the Internet today." He gives a checklist of what to look for when evaluating any system for trustworthiness, chock full of fascinating historical examples. These include NASA opting for a simpler, but more reliable chip; the Terry Childs case; and even an 18th century "semaphore telegraph" that was a very early example of steganographic cryptography. From the article: "Detecting an anomaly is one thing, but following up on what you've detected is at least as important. In the early days of the Internet, Cliff Stoll, then a graduate student at Lawrence Berkeley Laboratories in California, noticed a 75-cent accounting error on some computer systems he was managing. Many would have ignored it, but it bothered him enough to track it down. That investigation led, step by step, to the discovery of an attacker named Markus Hess, who was arrested, tried, and convicted of espionage and selling information to the Soviet KGB."'

120 comments

  1. I would trust me.... by Petron · · Score: 4, Funny

    But I know what I've been up to...

    --
    if (it != oneThing) it = another;
    1. Re:I would trust me.... by Anonymous Coward · · Score: 0

      Sorry boss, but there's only two men I trust. One of them's me. The other's not you.

    2. Re:I would trust me.... by Anonymous Coward · · Score: 0

      ACM and IEEE are technical and academic organizations. Trust me, I'm a member of both. They do HUGE things for research and for relatively cheaply you can have access to both their digital libraries (well worth the cost of admission if you're into reading a wide range of research papers). They also provide job boards and other useful services if you are a member that is looking for new employment.

      That said, they are still technical and academic organizations and the closest thing we have to a union. As on of my co-workers says: "we make ore IT stuff, HR makes more HR stuff, Management makes more management stuff." In other words, everyone thinks that their hammer will fix all problems. ACM and IEEE see problems and as groups devoted to technology they say "more is better!" This article has nothing to do with H1-B visas or "everyone should be a programmer" so your post is fairly irrelevant in this conversation.

      Don't paint yourself stupid by throwing out a well written article.

    3. Re:I would trust me.... by reboot246 · · Score: 1

      "But I know what I've been up to..."

      So does the NSA and they don't trust you either. In fact, they don't trust any of us. To them we're the (potential) enemy.

  2. Uplink was visionary by Anonymous Coward · · Score: 0

    Trust is a weakness.

    1. Re:Uplink was visionary by Opportunist · · Score: 5, Insightful

      Trust is a necessity. People do not have infinite time and skill available. At some point, I must trust someone or something. I must trust my mechanic that he doesn't cut my brakes. I must trust the pizza delivery guy that he doesn't sprinkle his pizza with E605. Of course you can opt to trust NOBODY, but, bluntly, that would indeed leap over the border to paranoia.

      But just as you have to pick your battles, you have to pick who to trust and who not to. A good starting point is usually the "cui bono" approach. What's in it for my pizza guy to kill me? Nothing. So I guess it's safe to assume that he wants to continue bringing me pizza because he wants more of my money.

      OTOH, with the current situation, I wouldn't trust any government any further than I can throw up.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Uplink was visionary by Anonymous Coward · · Score: 0

      OTOH, with the current situation, I wouldn't trust any government any further than I can throw up.

      Like.. a baseball up into the air? Or like.. projectile vomiting?

    3. Re:Uplink was visionary by Opportunist · · Score: 1

      Given how I feel about governments, it is most likely the second.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    4. Re:Uplink was visionary by Stardner · · Score: 0

      Trust is a weakness when gigaquads of data are at stake!

    5. Re:Uplink was visionary by Anonymous Coward · · Score: 2, Informative

      Bruce Schneier has an excellent 2012 book-length treatment of trust called Liars and Outliers: Enabling the Trust that Society Needs to Thrive .
      https://en.wikipedia.org/wiki/...

      It makes many of the same arguments as the previous post in a rigorous way, drawing on social science research and game theory for support. Well worth reading for those interested in trust and security.

      Posting anonymously to not loose my mods.

    6. Re:Uplink was visionary by mrchaotica · · Score: 1

      OTOH, with the current situation, I wouldn't trust any government any further than I can throw up.

      Like.. a baseball up into the air? Or like.. projectile vomiting?

      Like a mixed metaphor whooshing over an Anonymous Coward's head.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    7. Re:Uplink was visionary by Anonymous Coward · · Score: 0

      It isn't really a "whoosh" if I'm pointing out the duality, now is it? :P

    8. Re:Uplink was visionary by Opportunist · · Score: 1

      Interesting how Bruce and I tend to have the same ideas. :)

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  3. Correct usage? by bluefoxlucid · · Score: 2, Informative

    The predicate comes first in this sentence?

    --
    Support my political activism on Patreon.
    1. Re:Correct usage? by Aighearach · · Score: 2, Funny

      Off the lawn you will get. Put up with this I will not!

    2. Re:Correct usage? by Opportunist · · Score: 1, Funny

      You need to stop using RPL, that reverse polish notation is not good for you.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:Correct usage? by Anonymous Coward · · Score: 1

      No, the actual article says Who. The moron changed it to Whom because grammar is so hard.

    4. Re:Correct usage? by gewalker · · Score: 1

      Use this simple test for 99% of the who/whom selection cases. Rephrase the sentence use Thee or Thou. If Thou is correct, use Who, When Thee is indicated, use whom -- The article title is the 1% case when you actually have to understand the grammar enough to distinguish subject vs. object usage.

      The rules for selecting Thee vs. Thou are the same, Thou=subject, Thee=object.

      For those of you not raised on Thee & Thou, can use the more modern Him and He. He=Who, Him=whom.

    5. Re:Correct usage? by Livius · · Score: 0

      Yes. Interrogative word movement is very common in English. As in practically every non yes-no question.

    6. Re:Correct usage? by Anonymous Coward · · Score: 0

      > Rephrase the sentence use Thee or Thou.

      Huh? Probably fewer people know how to use "thee" and "thou" than know how to use "who/whom."

      Simplify it: "he/she/who" and "him/her/whom."

    7. Re:Correct usage? by Anonymous Coward · · Score: 0

      Ack! Mod me down... I didn't read your last line before replying. Sorry.

    8. Re:Correct usage? by Anonymous Coward · · Score: 0

      Thee Thou Though Thumb

  4. Whom you trust ... ? by jamesl · · Score: 3, Informative

    Who vs. Whom

    This rule is compromised by an odd infatuation people have with whom -- and not for good reasons. At its worst, the use of whom becomes a form of one-upmanship some employ to appear sophisticated. The following is an example of the pseudo-sophisticated whom.
    http://www.grammarbook.com/gra...

    1. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      Oh my, thank you for that. My boss is constantly trying to correct people and he's usually wrong. This is perfect.

    2. Re:Whom you trust ... ? by XanC · · Score: 0

      But in the case of the title of this article, "whom" is entirely correct.

    3. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      It's entirely correct, but it's pretty pompous and it's rather outdated.

      Pro tip: use 'whom' when it's merited at the end of a sentence:

      "Who did you send this to?" -- 'wrong' but completely normal colloquial speech and writing; a simplification more than it is an error.

      "You sent this to who?" -- wrong, but crucially also sounds wrong

      "You sent this to whom?" --- right and sounds better

    4. Re:Whom you trust ... ? by Charliemopps · · Score: 0

      Watch the first 60 seconds of this:
      https://www.youtube.com/watch?...

      I know the quality is terrible, but you'll get the idea.

    5. Re:Whom you trust ... ? by nine-times · · Score: 0

      Pro tip: use 'whom' when it's merited at the end of a sentence

      That's a bad tip. First, that's not how the usage is determined, and second, you haven't cleared up the issue of "when is it merited?"

      I believe the rule is that you use "whom" when it's the direct object of a verb or preposition.

    6. Re:Whom you trust ... ? by X-Ray+Artist · · Score: 2

      I was reading this to find out how to determine whom to trust. I didn't learn much on that topic (Basically, trust no one.) I did, however, learn plenty about "who vs whom."

      --
      I would have a sig but I am too busy updating programs and restarting my computer
    7. Re:Whom you trust ... ? by Chris+Mattern · · Score: 0

      I don't know what this "grammarbook" you're using is, but I suggest you stop using it, 'cause it's crap. "Whom" is used when the word the object of a sentence, as it is here. Its position in the sentence as such is irrelevant. The title is completely correct.

    8. Re:Whom you trust ... ? by XanC · · Score: 1

      Exactly. Like, for example, in the title of this article.

    9. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      Actually the article is titled properly with "who".

      Simply OTFA and you would have seen that. (Open the fucking article.)

    10. Re:Whom you trust ... ? by real+gumby · · Score: 0

      I think you misread the grammarbook entry.

      All but the very end of her description is an unremarkable explanation of the accusative of “who”, which is a perfectly ordinary word.

      Only at the end did she write, "This rule is compromised by an odd infatuation people have with whom”. And there she described a pretentious and incorrect usage. This is similar to people using “myself” when they mean “me” (then again, Emily Dickenson did this too).

      I find it odd you would consider “whom” an unusual word. It’s certainly more common than, say, “frog”.

    11. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      Did I claim that is how the usage is determined? I did not.

      Also, I didn't clear up the issue of when it is merited because basically if you don't know when 'whom' is correct, you shouldn't use it at all!

      If you do know when it is correct, I would suggest to use it only at the end of a sentence like that, and mostly when you are also using 'who' in the sentence or seeking clarification.

      Otherwise, in modern writing, you read/sound like a pretentious dick.

    12. Re:Whom you trust ... ? by Nidi62 · · Score: 0

      Pro tip: use 'whom' when it's merited at the end of a sentence

      That's a bad tip. First, that's not how the usage is determined, and second, you haven't cleared up the issue of "when is it merited?"

      I believe the rule is that you use "whom" when it's the direct object of a verb or preposition.

      My simpe rule of thumb is this: does a "to" in front of who/whom in the sentence fit? If so, then "whom" is the more proper word. For example "(to) Whom did you give this?" sounds more correct than "(to)Who did you give this?". So in the case of the title, "who" sounds more correct than "whom" (now, if the title had said in whom must you place your trust, it would be more correct). I know this is basically what you said, I just felt like resaying it without all those fancy English terms :)

      --
      The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
    13. Re:Whom you trust ... ? by nine-times · · Score: 1

      Actually, we apparently disagree. I believe that between "Who do you trust?" and "Whom do you trust?" it is more correct to use "whom". "Whom" is the direct object of "trust". The standard test applies: when you answer the question, would you use "he" or "him"?

      Who is trustworthy?

      He is trustworthy.

      Whom do you trust?

      I trust him.

      Now, that's the issue of which is more correct. I wouldn't jump down your throat for asking, "Who do you trust?" but I think "whom" is actually more correct, so I wouldn't correct someone for saying it either.

    14. Re:Whom you trust ... ? by Nidi62 · · Score: 1

      I agree with you on that that "whom" sounds more correct in that instance, because there is an implied "in" at the beginning of the sentence (since it is the DO), ie "In whom do you trust". In that case "whom" sounds both correct and more fluid than it does in the summary title, where is sounds klunky, forced, and (as someone somewhere else here said) kind of pompous. But it might just be a colloquial quirk that I have regarding the phrasing "whom must" with the concurrent "m"s, so that "who must" sounds better than "whom must".

      --
      The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
    15. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      As used in the title, it is correct.

      Those of us who speak English, know that "whom" is used in the objective case while "who" is used in the subjective case.

      Those of us who speak American know that words mean what we want them to mean.

    16. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      > It's entirely correct, but it's pretty pompous and it's rather outdated.

      Not really. It's a bit formal, but it's neither pompous nor outdated in the context of formal writing.

      Unless formal writing is intrinsically pompous?

    17. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      > Actually the article is titled properly with "who".

      Improperly, you mean.

      "Whom" is equivalent to "I trust him," not "I trust he."

    18. Re:Whom you trust ... ? by Anonymous Coward · · Score: 0

      What I see here is a non-native English speaker using "whom" based on a rule in a British English textbook/grammar book. Thus, the "must" as well. In American English we would say "Who should you trust?"

  5. Yes I'm here by istartedi · · Score: 2

    What do you want?

    --
    For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
  6. Trust is a virgin by fustakrakich · · Score: 1

    Once it's gone, it's gone.

    --
    “He’s not deformed, he’s just drunk!”
    1. Re:Trust is a virgin by ArcadeMan · · Score: 4, Funny

      You could have phrased that better, such as "Trust is like virginity. Once you get fucked, it's gone."

      --
      Get free satoshi (Bitcoin) and Dogecoins
    2. Re:Trust is a virgin by Anonymous Coward · · Score: 0

      And unfortunately, trust is a lot easier to lose...

  7. Are you guys too young or what? by ArcadeMan · · Score: 1

    TRUST NO ONE

    --
    Get free satoshi (Bitcoin) and Dogecoins
    1. Re:Are you guys too young or what? by Chris+Mattern · · Score: 2

      TRUST NO ONE

      Keep your laser handy.

  8. Why 'must' I trust? by jkrise · · Score: 1, Interesting

    The headline indicates a necessity to trust anybody or any entity. There is no necessity to trust anyone. Least of all myself, because time plays tricks with me and I keep changing all the while.

    --
    If you keep throwing chairs, one day you'll break windows....
    1. Re:Why 'must' I trust? by canadiannomad · · Score: 1

      Depends on semantics.

      I must trust everyone on this bus not to pull out a gun and steal my tablet. Otherwise I wouldn't have taken it out.

      I must trust the guy at the corner store, because I believed that after I paid for some goods, he wouldn't come running after me calling me a thief.

      On the other hand, must I trust anyone or any entity to do the same thing they did in the past? Well only to the extent that it fits with their own best interests. Unfortunately the more removed they are from my circle of influence, the less likely that their best interests coincide with mine.
      Still I must trust that the sky wont fall, otherwise I'd never get out of the house.

      --
      Hmm, the humour and sarcasm seem to have been be lost on you.
    2. Re:Why 'must' I trust? by Opportunist · · Score: 1

      You must have a LOT of time on your hands. I have to trust a lot of people and organizations. The guy delivering my pizza that he abstains from putting poison on it, the garage that services my car that they actually service and not wreck it, the manufacturer of my door lock that they don't keep a spare key, the water company that they don't lace it with LSD or send H2SO4 instead of H2O, and of course every single person I meet on my way to work that they don't pull out a gun and kill me.

      When you think about it, you'll notice that you trust a LOT of people, all day, every day. Either that or your level of paranoia beats mine by some leagues.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re:Why 'must' I trust? by penguinoid · · Score: 1

      Of course you have to trust a bunch of people, most of whom you don't know. You put your life in their hands every time you use certain items (eg your assumption that your new appliance is not laced with explosives). When it comes to knowledge, you can't verify everything yourself and trust that what you were told isn't wildly inaccurate (eg most of science).

      --
      Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
    4. Re:Why 'must' I trust? by iluvcapra · · Score: 1

      There is no necessity to trust anyone.

      Well, you're commenting on slashdot, so firstly, even if you've validated all your apps and system software against certificates, you're trusting a hardware vendor.

      You're also trusting Dice Media not to /dev/null arbitrary comments.

      --
      Don't blame me, I voted for Baltar.
  9. To quote The Wizard's doorman by Chas · · Score: 2

    NOT NOBODY!
    NOT NOHOW!

    --


    Chas - The one, the only.
    THANK GOD!!!
  10. Trust networks can fix this by MarkPNeyer3416 · · Score: 5, Interesting

    imagine something like linkedin's 'how are you connected to this person' - except instead of 'we worked together' the edges are all of the form 'i trust this person to this extent.'

    you take a bunch of statements of this form (node X trusts node Y with level 0.4), all signed by private keys. if you meet someone else, you can see all of the trust paths from you to them, to decide how much you trust them, and to what extent.

    then, instead of having to personally know someone else personally, i can say 'there are 300 paths from me to this woman. 250 of them are strictly positive with trust levels over 0.7 which is my default threshold for comfort. all of the negative ones turn negative over two hops from me, and only three are intensely negative. i already had weak trust levels for intermediary nodes between myself and the negative inbound edges to her. she's fine, and i have more confidence in my negative assessment of those intermediary nodes.'

    this could be huge. it would let us have more trust in strangers, and it would let us do things like this:

    • 'this lawyer has 50 inbound links from people i'm relatively close to, that all rated him as an asshole. i wont work with him'
    • 'this guy i'm serving at the restaurant has 30 level-4 links out who've said he helped them when they didn't offer anythign in return. i'll service him better than this other guy over where who's been rated as rude and elitist by some closer level links to me'
    • lets look at the yelp reviews of these restaurants, weighted by the trust scores i give users who've left the reviews. hmm, all of these reviews are from identities i only have a few paths to, with all of those paths passing through my SEO friend, who i thought might be black hat. drop this guy's trust level to negative and mark all of those reviews as untrusted by me. don't want my friends to waste their time with that.
    1. Re:Trust networks can fix this by Anonymous Coward · · Score: 0

      Which would work well if you could trust people to consistently submit "trust statements" truthfully and accurately. Sometimes people lie when they tell you who they trust and who they don't.

    2. Re:Trust networks can fix this by mrchaotica · · Score: 1

      Wouldn't you just lower your trust level between you and that person, then? In other words, if you have a trust network A - B - C where B reports trusting C 100% but A thinks B is lying, then A reduces his trust in B to zero and the amount that B trusts C no longer matters.

      --

      "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz

    3. Re:Trust networks can fix this by jdunn14 · · Score: 1

      God this sounds familiar..... and that's because I wrote a PhD thesis about building a system to do something a lot like this. It involved a fairly mediocre web interface wrapping a database of trust relationships specified by end users. A trusts B for 0.7 and B trusts C for 0.6 then you can put together a trust level between A and C by multiplying those together with some user-tweakable distance dropoff. Those trust levels were then measured against the levels required for access to shared data. Maybe you would allow anyone with a 0.7 or higher to read a given document and a 0.9 or higher to contribute to it. It was an interesting idea, but man did I get tired of it by the end. If for some bizarre reason anyone wants to read bits of it google books has some indexed and I probably have a pdf laying around somewhere....

      I figured it could be quite useful, but I was so fed up with the work in mid-2007 that I never looked back at it.

    4. Re:Trust networks can fix this by inflamed · · Score: 1

      Which would work well if you could trust people to consistently submit "trust statements" truthfully and accurately. Sometimes people lie when they tell you who they trust and who they don't.

      People lie but no so much when their lies are detremental to them. Such a web of trust could only be conned by 'fake' nodes which would have a very hard time developing any links to 'real' nodes.

    5. Re:Trust networks can fix this by inflamed · · Score: 1

      God this sounds familiar..... and that's because I wrote a PhD thesis about building a system to do something a lot like this. It involved a fairly mediocre web interface wrapping a database of trust relationships specified by end users. A trusts B for 0.7 and B trusts C for 0.6 then you can put together a trust level between A and C by multiplying those together with some user-tweakable distance dropoff. Those trust levels were then measured against the levels required for access to shared data. Maybe you would allow anyone with a 0.7 or higher to read a given document and a 0.9 or higher to contribute to it. It was an interesting idea, but man did I get tired of it by the end. If for some bizarre reason anyone wants to read bits of it google books has some indexed and I probably have a pdf laying around somewhere....

      I figured it could be quite useful, but I was so fed up with the work in mid-2007 that I never looked back at it.

      Thanks for laboring through a thesis on the topic, it's an occasional daydream of mine and I would love a copy. :-)

  11. Cliff Stoll & "The Cuckoo's Egg" by Anonymous Coward · · Score: 0

    That's a great one, should be required reading for anyone into computer security. As far as "trust"? Trust NO one, not even yourself (@ times).

    * Especially online - over the years, for example, I've been on forums (majorgeeks or its predecessor 3dFiles, where some dude posed as a woman, & TONS of "drooling geeks" fell for it (not myself of course, lol) - but "Lo & BEHOLD" - it turned up a guy! Another dude there was selling PC parts that were all busted, & the site owner + the affected ripped off parties sicked the law on them... that's just 1 site I've seen that happen at, there HAVE been others, with the EXACT same thing going on...

    Of course, as I am SURE you all know (ala Barbara, not Barbie = TomHudson OR TrollingForHostsFiles = Zontar The Mindless) MANY here use "sockpuppets" to attack opponents, seemingly DIFFERENT PEOPLE but only fake accounts used to mod themselves up, & their opoonents down with etc. - et al...

    Pretty sad - those are just 2 examples, literally HERE ON THIS FORUMS, where I caught those people doing what I just noted, red-handed, sockpuppeterring...

    THAT has a cure: Allowing users to CONFRONT who downmodded them... of course, THAT will NEVER happen here... why?

    Look who designed that system... it speaks WORLDS of THEIR OWN DECEITFUL NATURE & it allows "the way of the weasel" as I call it... sure, it MAY work out well for spurring debate & thus, posts + views, but it speaks worlds!

    (How? Simply by not allowing you to confront a detractor etc. (pretty sad, but when you make software folks? Part of YOUR CHARACTER goes into it, & IT SHOWS, like it or not.... YOUR GHOST? It truly IS, in the machine...))

    APK

    P.S.=> Pretty sad I had to close it that way, but 1/2 a century of life's taught me that much @ least unfortunately... wish it didn't have to be that way, but "there 'tis": There's the way it OUGHT to be, & then, there's the way it really is... oh well! Gotta keep on, keeping on anyhow until we all go 6 ft. under is all...

    ... apk

  12. Whom you trust ... ? by Anonymous Coward · · Score: 1, Funny

    I see that alot.

  13. On trust by wonkey_monkey · · Score: 1

    Arthur remained very worried.

    "But can we trust him?" he said.

    "Myself I'd trust him to the end of the Earth," said Ford.

    "Oh yes," said Arthur, "and how far's that?"

    "About twelve minutes away," said Ford, "come on, I need a drink."

    --
    systemd is Roko's Basilisk.
  14. That's all fine and everything. by Anonymous Coward · · Score: 0

    But one has to take precautions. And one does get surprised.

    You don't invite the pizza guy into your house.

    And since this crappy economy started, I have been doing my own car repairs and the things that mechanics have done really pisses me off.

    Damage, shoddy repairs, and other things were done to my car.

    I do not trust business. The profit motive makes people evil.

  15. Bruce Schneier by nitehawk214 · · Score: 1

    Seriously, if Bruce Schneier can't be trusted, who can?

    --
    I'm a good cook. I'm a fantastic eater. - Steven Brust
  16. "must" trust? by ChipMonk · · Score: 1

    Anyone demanding my trust, automatically loses it. Same goes for respect.

    1. Re:"must" trust? by Anonymous Coward · · Score: 0

      A doctor demands your trust to operate on you, A valet demands your trust to park your car (safely and not steal it), an airline demands you trust their pilot. I could go on, but the point is that there are numerous people who implicitly "demand" our trust to use their services and we give it without thinking. I would challenge you to truthfully say and prove that everyone/everything you trust has earned it from a zero trust level.

  17. Who by rossdee · · Score: 2

    Who do you serve, and who do you trust? - Galen

  18. Trust the Computer by fivepan · · Score: 1

    The Computer is your friend.

  19. No good comments? Not a comment worthy article. by qubezz · · Score: 1

    The linked article, which I did read, seems to have no thesis. It meanders from "C compilers can be subverted" to "see if people leave their purses out to judge if a neighborhood is safe". It is as if a high schooler had to write a paper on trust, and cut a paragraph out of each of the top 20 web search results.

    1. Re:No good comments? Not a comment worthy article. by AHuxley · · Score: 1

      Its like many ideas presented to top US intelligence students.
      Just enough history on todays enemy, the tech to do the work needed and the correct collection of happy short tech stories from the past.
      Thanks to the work of whistleblowers the world now understands:
      https://www.eff.org/deeplinks/...
      Different govs, the US, UK have total mastery of the 'net' via local shared facilities and people.
      http://www.theregister.co.uk/2... (3 Jun 2014) http://www.nytimes.com/2014/04... (APRIL 23, 2014) The standard crypto offered is junk.
      Entire generations have to rethink what the 'net' really is: predictive and trackable:
      "US Secret Service wants sarcasm-detection tool for Twitter" (05 Jun 2014)
      http://www.telegraph.co.uk/tec...
      People read the headline but a bit further down is the fun part: "real-time" and the ability to identify 'influencers'.
      Tech that was once at a budget level of a few nations agencies is now more wide spread at a federal level with a domestic role.

      --
      Domestic spying is now "Benign Information Gathering"
  20. Well, yes, I was there... by Cliff+Stoll · · Score: 5, Interesting

    It's been a quarter century since I chased down those hackers. Hard to think back that far: 2400 baud modems were rarities, BSD Unix was uncommon, and almost nobody had a pocket pager. As an astronomy postdoc (not a grad student), I ran a few Unix boxes at Lawrence Berkeley Labs. When the accounting system crashed, my reaction was curiosity: How come this isn't working? It's an attitude you get from physics -- when you don't understand something, it's a chance to do research. And oh, where it led...

    Today, of course, everything's changed: Almost nobody has a pocket pager, 2400 baud modems are a rarity, and Berkeley Unix is, uh, uncommon. What started out as a weirdness hiding in our etc/passwd file has become a multi-billion dollar business. So many stories to tell ...

    I've since tiptoed away from computer security; I now make Klein bottles and work alongside some amazing programmers at Newfield Wireless in Berkeley. Much fun debugging code and occasionally uncorking stories from when Unix was young.

    Warm cheers to m'slashdot friends,
    -Cliff

    1. Re:Well, yes, I was there... by Anonymous Coward · · Score: 0

      Cheers!

      Your book and the Morris worm were my first introductions to internet security and were a big part in setting me down the path of my career.

    2. Re:Well, yes, I was there... by Anonymous Coward · · Score: 0

      Cliff, If you read this, thanks from someone who stayed up all night to read the Cookoo's Nest when it came out. One of the best experiences in my early days. Great telling of the experience. I'm still in the industry, managing firewalls and IPS systems for a university. Nothing as exciting here.

    3. Re:Well, yes, I was there... by Cliff+Stoll · · Score: 1

      And my thanks back to you, oh Anonymous Coward: The 15 cents in royalties from your purchase of m'book is now helping my kids attend college. Uh, it'll last about 1.3 minutes.

      You say that you're managing firewalls - all sorts of possibilities! I had the honor of working with Van Jacobson at LBL when he first researched TCP/IP traffic jams and compression. I was amazed at how much could be done by looking at traffic and thinking about the interaction of traffic, buffers, routers, and network congestion. Wonderful stuff - what looks like a boring problem may be an opportunity for research.

      With that in mind, here's my encouragement to you: Go and sharpen your tcpdump & wireshark tools. Figure out what's really happening to those packets. Who knows what you'll uncover?

    4. Re:Well, yes, I was there... by cpghost · · Score: 1

      It's been a quarter century since I chased down those hackers.

      I saw a translation of The KGB, the Computer, and Me that aired back then on German TV, and it was fascinating! Great to see you here on Slashdot Cliff!

      --
      cpghost at Cordula's Web.
    5. Re:Well, yes, I was there... by Cliff+Stoll · · Score: 1

      Thanx!

      I saw a short section of the German version of that Nova show ... apparently I speak fluent German in the that version!

      Mit den besten Wünschen,
      -Cliff

    6. Re:Well, yes, I was there... by starseeker · · Score: 1

      I still remember the fascination from when I first watched The KGB, the Computer, and Me. It was many years later that I finally read The Cuckoos Egg, and I found that even more enjoyable - a fascinating story, well told. I still have it on my bookshelves today.

      I also have one of the Klein bottles - a very nifty product, entertaining and educational at the same time.

      Thank you for making such rich contributions to the world.

      --
      "I object to doing things that computers can do." -- Olin Shivers, lispers.org
    7. Re:Well, yes, I was there... by yanyan · · Score: 1

      Hello Cliff, awesome to see you on here. I read "The Cuckoo's Egg" at least once every two years. Never gets old and it's truly a story for the ages. :-)

    8. Re:Well, yes, I was there... by Anonymous Coward · · Score: 0

      Today, of course, everything's changed: Almost nobody has a pocket pager, 2400 baud modems are a rarity, and Berkeley Unix is, uh, uncommon.

      Uncommon?? It's on every iPhone, iPad and iPod in the world. It's not your grandfather's BSD, but it's an evolved direct descendant.

  21. IF you are the REAL Cliff Stoll? by Anonymous Coward · · Score: 0

    I'd like to say your book & your work (+ PERSISTENCE) were a REAL inspiration to me (big fan of yours, by the by): NOBODY would believe you in law enforcement (amazing) until you pointed out MILITARY INSTALLATION were being hit (iirc, it's been decades since I read your book "The Cuckoos Egg" -> http://it.slashdot.org/comment... & it set me on the path/road to getting into computing (well, along with RUSH2112 the album before it/around same time).

    * Thank you Sir!

    APK

    P.S.=> You're an inspiration to us all & IF for anything? Making your point, & following thru on it + doing well... apk

    1. Re:IF you are the REAL Cliff Stoll? by Cliff+Stoll · · Score: 1

      (blush). Thanks!

      Now it's your turn: Go forth and make our networked community friendlier, stronger, more trustworthy, and more useful.

      Best wishes,
      -Cliff

      PS: Of course, you raise a fascinating, self-referential question. How can you tell if this posting is from the real Cliff Stoll? I know it's me - and it's easy to prove in person, but difficult online. For the best proof, well, stop by for coffee. Way more fun than posting online.

  22. You had me going there by jeffmeden · · Score: 1

    ACM seems like a reputable publication so I was going in to it thinking I was about to read some interesting stuff, and then this happened:

    Even the time of day can be exploited. In 2013 a network attack known as NTP Amplification used Network Time Protocol servers across the Internet in a distributed denial-of-service attack. By spoofing the IP address of a requester, an ever-larger stream of packets could be aimed at a target, swamping the target's ability to respond to TCP/IP requests.

    lolwut. The time of day was not exploited, not even a little. The boneheaded "Feature" of having a command to recall a large chunk of data via unauthenticated UDP was exploited. They go on to explain a basic denial of service attack and finish it off by misusing a term as basic as TCP/IP (it doesn't matter what protocol you are using when you are the target of a DDOS, your pipe is blocked period). I will go ahead and stop reading now.

    1. Re:You had me going there by Anonymous Coward · · Score: 0

      The point he was trying to make with that paragraph was that no matter how innocuous your service is (e.g. time of day) it can still be used maliciously/exploited. The wording wasn't the best and confused me too at first, but if you don't want to put effort into understanding something then that's your prerogative I guess.

  23. Get your "hooked on phonics" lessons out by Anonymous Coward · · Score: 0

    Learn to read - when Wladimir Palant of AdBlock did, after he emailed me 1st stating "hosts are a shitty solution", I asked him to show us that "Almost All Ads Blocked" (crippled by default's why) can do MORE than custom hosts files do, + that AdBlock can do it more efficiently?

    HE OUTRIGHT RAN!

    APK

    P.S.=> So much for your "hero" (or is that YOU again, Wladimir?) - See, there's New Zealander ingenuity (pretty bad on CPU & RAM @4++gb extra in FireFox https://blog.mozilla.org/nneth...

    THEN, there's AMERICAN INGENUITY (by "yours truly") & it outright BEATS THE HELL out of his blatantly INFERIOR handiwork (imagine that - all those "Open SORES" eyes couldn't outthink OR outprogram "little ole' me" doing MORE with FAR LESS, better) -> http://start64.com/index.php?o...

    ... apk

  24. I am (see inside) by Anonymous Coward · · Score: 0

    Using "the OLD" you'll certainly know about that works FAR better on more levels, more efficiently, than "the new" in browser addons & even shores up redirect deficiencies in security in DNS -> http://it.slashdot.org/comment...

    APK

    P.S.=> Thanks for the further inspiration, & I've done "pretty ok" via some of my personal "favorites":

    ----

    Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue, page 61

    (&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row 2000-2002, in its HARDEST CATEGORY: SQLServer Performance Enhancement).

    WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)

    PC-WELT FEB 1998 - page 84, again, my work is featured there

    WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there

    PC-WELT FEB 1999 - page 83, again, my work is featured there

    CHIP Magazine 7/99 - page 100, my work is there

    GERMAN PC BOOK, Data Becker publisher "PC Aufrusten und Repairen" 2000, where my work is contained in it

    HOT SHAREWARE Numero 46 issue, pg. 54 (PC ware mag from Spain), 2001 my work is there, first one featured, yet again!

    Also, a British PC Mag in 2002 for many utilities I wrote, saw it @ BORDERS BOOKS but didn't buy it... by that point, I had moved onto other areas in this field besides coding only...

    Being paid for an article that made me money over @ PCPitstop in 2008 for writing up a guide that has people showing NO VIRUSES/SPYWARES & other screwups, via following its point, such as THRONKA sees here -> http://www.xtremepccentral.com...

    It's also been myself helping out UltraDefrag64 project (a 64-bit defragger for Windows), in showing them code for how to do Process Priority Control @ the GUI usermode/ring 3/rpl 3 level in their program (good one too), & being credited for it by their lead dev & his team... see here -> http://ultradefrag.sourceforge... or here http://sourceforge.net/tracker...

    ... apk

  25. My 2 cents by Cro+Magnon · · Score: 1

    I generally don't trust anyone who says "Trust me".

    --
    Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
  26. Why trust ACM? by Anonymous Coward · · Score: 0

    ACM can go fuck themselves. They snail mail SPAM people.

  27. Re:This fixes THAT (better than anything else) by Anonymous Coward · · Score: 0

    wear do i edit hosts file on mah iphone? I don't wanna unlock it. I just want no ads when i read slashdot with my iphone. APK? wear on the iphone for the hosts file?

  28. As Fox Mulder says... by antdude · · Score: 1

    "Trust no one." :P

    --
    Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
  29. Take your own advice Wladimir by Anonymous Coward · · Score: 0

    Why? Just because you f'd yourself running like a scared rabbit, Wladimir?? See subject-line, but your own bad coding & stupidity did you in, totally...

    Yes - in fact??? Hey - you just KNOW that I've just GOTTA say it, now don't you???? Ah, but of COURSE you do:

    THIS? This was just "too, Too, TOO EASY - just '2ez' & it always is...

    APK

    P.S.=> After all - it's ALL here in black & white truth -> http://it.slashdot.org/comment...

    ALL THE DOWNMODS IN THE WORLD CAN'T HIDE IT & YOUR "REACTION" TO TRUTH (nothing hurts like it, does it) TELLS IT ALL...

    (or should I forward the email to anyone asking? I can do that you know... wouldn't look TOO good for you, & it doesn't already considering your "ware" is a bloated memory hog + tears up CPU like mad too, lol!)... apk

  30. Do it like you do on ANDROID by Anonymous Coward · · Score: 0

    Per my subject-line, a devtool like ADB & its 'pull' command will do.... check your devtools for IPhones I suppose!

    For your reference: ADB = "Android Debugging Bridge"...

    APK

    P.S.=> Since MacOS X is BSD based, it has hosts - not sure on IPhone (never looked into it, but it's most likely there, ASSUMING (which I don't *like* doing) it's close enough to the BSD based MacOS X, which I suspect it MAY be)... &, there ya go! Good luck...

    ... apk

    1. Re:Do it like you do on ANDROID by Anonymous Coward · · Score: 0

      check your devtools for IPhones I suppose

      The difference between Android and iOS in this respect is that iOS dev tools cost $599 for a Mac mini (instead of being able to use the Windows PC you are far more likely to already own if you don't already develop OS X applications) plus $99 per year for the certificate.

      ASSUMING (which I don't *like* doing) it's close enough to the BSD based MacOS X

      The difference between OS X and iOS in this respect is that the owner of a Mac has root on OS X, whereas the owner of an iPhone or iPad doesn't have root on iOS.

  31. hosts is on a read-only file system by tepples · · Score: 1

    [To configure Android's DNS resolver], a devtool like ADB and its 'pull' command will do

    But when I try to adb push a file back, I get an error "Read-only file system". Google apparently doesn't want end users to be able to specify whom to trust. Apparently I have to back everything up, wipe the device, and pray that everything restores properly before I'm allowed to edit system files.

  32. I did that on my nephews Android by Anonymous Coward · · Score: 0

    Perhaps they changed things? Look into OTHER commands like chmod existing in the ADB commandset then, & good luck!

    APK

    P.S.=> All I know is, I did ADB 'pull' on my nephews phone (RIT graduate CSC/CIS/Info. Security) & HE WORKS @ APPLE no less now (odd that, considering he used ANDROID's forever, eh?) - we DID have to delete some files to make room for the HUGE hosts I put in there though - but the performance was better when we used a LESSER SIZED hosts than mine (2.5 million entries, 72mb size)... apk

    1. Re:I did that on my nephews Android by tepples · · Score: 1

      Look into OTHER commands like chmod existing in the ADB commandset then

      chmod won't do anything if a whole file system is read-only. To make /system writable, it must be remounted, and only root can do that. The key difference between GNU/Linux and Android is that on GNU/Linux, the owner of the PC has root by default.

      All I know is, I did ADB 'pull' on my nephews phone

      Was it rooted? That's what I meant by the backup requirement: to root a Nexus 7 tablet, you need to unlock the bootloader (fastboot oem unlock), and that wipes the device.

    2. Re:I did that on my nephews Android by Anonymous Coward · · Score: 0

      fuck off and die you fucking spamming asshole.

      sick of reading your shit in every goddamn story.

    3. Re:I did that on my nephews Android by Anonymous Coward · · Score: 0

      Oh, stfu. We're sick of you, you trolling crybaby wuss.

    4. Re:I did that on my nephews Android by Anonymous Coward · · Score: 0

      We're not sick of seeing apk constantly kick your anonymous trolling ass every time though!

  33. Oh well, unlock time for him then! by Anonymous Coward · · Score: 0

    That's probably PART of the reason why ANDROID's in the lead now as far as usership - free devtools per what you state.

    APK

    P.S.=> Nothing I can do about that though... but, it's most likely "doable" via what the original ac poster asked ('wear' one above) - unlocking it... apk

  34. I said "like" chmod (not that specifically) by Anonymous Coward · · Score: 0

    My nephew's ANDROID, afaik back then (2010 iirc) wasn't (but it's HIS phone, not mine - I just knew what had to be done)... & my hosts "way back then" wasn't 72mb as it is now currently (my bad for NOT specifying that earlier, details matter, but they're hazy for me now too), but more around 20-30mb maybe @ most? Not sure anymore.

    I do however know we had to delete things like "Angry Birds" (was huge) to make room for it even @ that smaller size.

    APK

    P.S.=> I'm not sure anymore but I do KNOW we had to make storage room using ADB & also using the "pull" command from my Windows 7 PC + ADB to do it... worked pretty alright & BETTER with a more "optimized" (meaning current data only so it's MUCH smaller (& iirc, we only used hpHosts data - best one there is for hosts imo & experience, which is pretty vast here on THIS topic of hosts @ least), not decades of it like I have because of "FastFlux" botnets reusing hostnames over & over again via "bogus" hosting providers etc.)

    ... apk

  35. Re:Get your "hooked on phonics" lessons out by yacc143 · · Score: 1

    Well, have fun blocking only on specific urls, basically every time something "unwanted" and "wanted" share a hostname.

    OTOH, a hosts file does have it's own use, you can apply it easily enough for a WLAN, while filtering on http urls is way uglier, without running an application level proxy on your router, which again is far from trivial.

    The APK link on the other hand looks a little bit like spam to me.

  36. Need he say more? by Anonymous Coward · · Score: 0

    "Distrust and fear are the parents of security". Benjamin Franklin.

    Before you answer who you trust, think about that.
    In other words, with trust and lack of fear you have given up security. No answer the question of who you trust?

    1. Re:Need he say more? by Anonymous Coward · · Score: 0

      "Distrust and fear are the parents of security". Benjamin Franklin.

      Before you answer who you trust, think about that.
      In other words, with trust and lack of fear you have given up security. No answer the question of who you trust?

      Actually, it is Distrust and Caution, but fear is a much better defense than caution.

  37. Trust networks can fix this by Anonymous Coward · · Score: 0

    Isn't that the idea behind the European-type notary public? (as opposed to the US-type)

  38. This fixes THAT (better than anything else) by Anonymous Coward · · Score: 0

    Hosts are better, by FAR, on multiple levels in efficiency + added speed, security, reliability, & anonymity:

    APK Hosts File Engine 9.0++ 32/64-bit:

    http://start64.com/index.php?o...

    (Details of hosts' benefits enumerated in link)

    Summary:

    ---

    A. ) Hosts do more than AdBlock ("souled-out" 2 Google/Crippled by default) + Ghostery (Advertiser owned) - "Fox guards henhouse", or Request Policy -> http://yro.slashdot.org/commen...

    B. ) Hosts add reliability vs. downed or redirected DNS + secure vs. known malicious domains too -> http://tech.slashdot.org/comme... w/ less added "moving parts" complexity + room 4 breakdown,

    C. ) Hosts files yield more speed (blocks ads & hardcodes fav sites - faster than remote DNS), security (vs. malicious domains serving mal-content + block spam/phish & trackers), reliability (vs. downed or Kaminsky redirect vulnerable DNS, 99% = unpatched vs. it & worst @ ISP level + weak vs FastFlux + DynDNS botnets), & anonymity (vs. dns request logs + DNSBL's).

    ---

    Hosts do more w/ less (1 file) @ a faster level (ring 0) vs redundant browser addons (slowing up slower ring 3 browsers) via filtering 4 the IP stack (coded in C, loads w/ OS, & 1st net resolver queried w\ 45++ yrs.of optimization).

    * Addons are more complex + slowup browsers & in message passing (use a few concurrently - you'll see)

    ** Addons slowdown SLOWER usermode browsers layering on MORE - & bloating memory consumption too + hugely excessive CPU usage (4++gb extra in FireFox https://blog.mozilla.org/nneth...)

    SO - Instead, I work w/ what you have in kernelmode, via hosts (A tightly integrated PART of the IP stack itself)

    APK

    P.S.=> "The premise is, quite simple: Take something designed by nature & reprogram it to make it work FOR the body, rather than against it..." - Dr. Alice Krippen "I AM LEGEND"

    ...apk

  39. Re:Get your "hooked on phonics" lessons out by Anonymous Coward · · Score: 0

    If something unwanted is on a particular domain, that entire domain is suspect and ought to be blocked until it is proven absolutely clean and free of malicious code threats. Apk's program's rated best of its kind by its hoster, a respected source in the security community (malwarebytes' hpHosts) too http://hosts-file.net/?s=Downl... and it's a far more efficient solution than adblock is tearing up 5gb of RAM and tons of CPU https://blog.mozilla.org/nneth... and hosts do far more than any single browser addon for more speed, security, reliability, and anonymity as well. Can't beat that.