Slashdot Mirror
Whom Must You Trust?
CowboyRobot writes: 'In ACM's Queue, Thomas Wadlow argues that "Whom you trust, what you trust them with, and how much you trust them are at the center of the Internet today." He gives a checklist of what to look for when evaluating any system for trustworthiness, chock full of fascinating historical examples. These include NASA opting for a simpler, but more reliable chip; the Terry Childs case; and even an 18th century "semaphore telegraph" that was a very early example of steganographic cryptography. From the article: "Detecting an anomaly is one thing, but following up on what you've detected is at least as important. In the early days of the Internet, Cliff Stoll, then a graduate student at Lawrence Berkeley Laboratories in California, noticed a 75-cent accounting error on some computer systems he was managing. Many would have ignored it, but it bothered him enough to track it down. That investigation led, step by step, to the discovery of an attacker named Markus Hess, who was arrested, tried, and convicted of espionage and selling information to the Soviet KGB."'
But I know what I've been up to...
if (it != oneThing) it = another;
The predicate comes first in this sentence?
Support my political activism on Patreon.
Who vs. Whom
This rule is compromised by an odd infatuation people have with whom -- and not for good reasons. At its worst, the use of whom becomes a form of one-upmanship some employ to appear sophisticated. The following is an example of the pseudo-sophisticated whom.
http://www.grammarbook.com/gra...
What do you want?
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Once it's gone, it's gone.
“He’s not deformed, he’s just drunk!”
TRUST NO ONE
Get free satoshi (Bitcoin) and Dogecoins
The headline indicates a necessity to trust anybody or any entity. There is no necessity to trust anyone. Least of all myself, because time plays tricks with me and I keep changing all the while.
If you keep throwing chairs, one day you'll break windows....
NOT NOBODY!
NOT NOHOW!
Chas - The one, the only.
THANK GOD!!!
imagine something like linkedin's 'how are you connected to this person' - except instead of 'we worked together' the edges are all of the form 'i trust this person to this extent.'
you take a bunch of statements of this form (node X trusts node Y with level 0.4), all signed by private keys. if you meet someone else, you can see all of the trust paths from you to them, to decide how much you trust them, and to what extent.
then, instead of having to personally know someone else personally, i can say 'there are 300 paths from me to this woman. 250 of them are strictly positive with trust levels over 0.7 which is my default threshold for comfort. all of the negative ones turn negative over two hops from me, and only three are intensely negative. i already had weak trust levels for intermediary nodes between myself and the negative inbound edges to her. she's fine, and i have more confidence in my negative assessment of those intermediary nodes.'
this could be huge. it would let us have more trust in strangers, and it would let us do things like this:
Trust is a necessity. People do not have infinite time and skill available. At some point, I must trust someone or something. I must trust my mechanic that he doesn't cut my brakes. I must trust the pizza delivery guy that he doesn't sprinkle his pizza with E605. Of course you can opt to trust NOBODY, but, bluntly, that would indeed leap over the border to paranoia.
But just as you have to pick your battles, you have to pick who to trust and who not to. A good starting point is usually the "cui bono" approach. What's in it for my pizza guy to kill me? Nothing. So I guess it's safe to assume that he wants to continue bringing me pizza because he wants more of my money.
OTOH, with the current situation, I wouldn't trust any government any further than I can throw up.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I see that alot.
Arthur remained very worried.
"But can we trust him?" he said.
"Myself I'd trust him to the end of the Earth," said Ford.
"Oh yes," said Arthur, "and how far's that?"
"About twelve minutes away," said Ford, "come on, I need a drink."
systemd is Roko's Basilisk.
Seriously, if Bruce Schneier can't be trusted, who can?
I'm a good cook. I'm a fantastic eater. - Steven Brust
Given how I feel about governments, it is most likely the second.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Anyone demanding my trust, automatically loses it. Same goes for respect.
Who do you serve, and who do you trust? - Galen
The Computer is your friend.
The linked article, which I did read, seems to have no thesis. It meanders from "C compilers can be subverted" to "see if people leave their purses out to judge if a neighborhood is safe". It is as if a high schooler had to write a paper on trust, and cut a paragraph out of each of the top 20 web search results.
It's been a quarter century since I chased down those hackers. Hard to think back that far: 2400 baud modems were rarities, BSD Unix was uncommon, and almost nobody had a pocket pager. As an astronomy postdoc (not a grad student), I ran a few Unix boxes at Lawrence Berkeley Labs. When the accounting system crashed, my reaction was curiosity: How come this isn't working? It's an attitude you get from physics -- when you don't understand something, it's a chance to do research. And oh, where it led...
Today, of course, everything's changed: Almost nobody has a pocket pager, 2400 baud modems are a rarity, and Berkeley Unix is, uh, uncommon. What started out as a weirdness hiding in our etc/passwd file has become a multi-billion dollar business. So many stories to tell ...
I've since tiptoed away from computer security; I now make Klein bottles and work alongside some amazing programmers at Newfield Wireless in Berkeley. Much fun debugging code and occasionally uncorking stories from when Unix was young.
Warm cheers to m'slashdot friends,
-Cliff
Bruce Schneier has an excellent 2012 book-length treatment of trust called Liars and Outliers: Enabling the Trust that Society Needs to Thrive .
https://en.wikipedia.org/wiki/...
It makes many of the same arguments as the previous post in a rigorous way, drawing on social science research and game theory for support. Well worth reading for those interested in trust and security.
Posting anonymously to not loose my mods.
Like a mixed metaphor whooshing over an Anonymous Coward's head.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
ACM seems like a reputable publication so I was going in to it thinking I was about to read some interesting stuff, and then this happened:
Even the time of day can be exploited. In 2013 a network attack known as NTP Amplification used Network Time Protocol servers across the Internet in a distributed denial-of-service attack. By spoofing the IP address of a requester, an ever-larger stream of packets could be aimed at a target, swamping the target's ability to respond to TCP/IP requests.
lolwut. The time of day was not exploited, not even a little. The boneheaded "Feature" of having a command to recall a large chunk of data via unauthenticated UDP was exploited. They go on to explain a basic denial of service attack and finish it off by misusing a term as basic as TCP/IP (it doesn't matter what protocol you are using when you are the target of a DDOS, your pipe is blocked period). I will go ahead and stop reading now.
(blush). Thanks!
Now it's your turn: Go forth and make our networked community friendlier, stronger, more trustworthy, and more useful.
Best wishes,
-Cliff
PS: Of course, you raise a fascinating, self-referential question. How can you tell if this posting is from the real Cliff Stoll? I know it's me - and it's easy to prove in person, but difficult online. For the best proof, well, stop by for coffee. Way more fun than posting online.
I generally don't trust anyone who says "Trust me".
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
"Trust no one." :P
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
[To configure Android's DNS resolver], a devtool like ADB and its 'pull' command will do
But when I try to adb push a file back, I get an error "Read-only file system". Google apparently doesn't want end users to be able to specify whom to trust. Apparently I have to back everything up, wipe the device, and pray that everything restores properly before I'm allowed to edit system files.
Look into OTHER commands like chmod existing in the ADB commandset then
chmod won't do anything if a whole file system is read-only. To make /system writable, it must be remounted, and only root can do that. The key difference between GNU/Linux and Android is that on GNU/Linux, the owner of the PC has root by default.
All I know is, I did ADB 'pull' on my nephews phone
Was it rooted? That's what I meant by the backup requirement: to root a Nexus 7 tablet, you need to unlock the bootloader (fastboot oem unlock), and that wipes the device.
Interesting how Bruce and I tend to have the same ideas. :)
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Well, have fun blocking only on specific urls, basically every time something "unwanted" and "wanted" share a hostname.
OTOH, a hosts file does have it's own use, you can apply it easily enough for a WLAN, while filtering on http urls is way uglier, without running an application level proxy on your router, which again is far from trivial.
The APK link on the other hand looks a little bit like spam to me.