US CTO Tries To Wean the White House Off Floppy Disks

schnell writes: MIT grad and former Google exec Megan J. Smith is the third Chief Technical Officer of the United States and the first woman to hold the position created five years ago by President Obama. But, as a New York Times profile points out, while she fights to wean the White House off BlackBerries and floppy disks, and has introduced the President to key technical voices like Tim Berners-Lee and Vint Cerf to weigh in on policy issues, her position is deliberately nebulous and lacking in real authority. The President's United States Digital Service initiative to improve technology government-wide is run by the Office of Management and Budget, and each cabinet department has its own CIO who mandates agency technical standards. Can a position with a direct access to the President but no real decision-making authority make a difference?

Comments

Troll Tries To Wean Slashdot Off Bennett Haselton

[Anonymous Coward]

without success :(

So, what do you do with your college degree?

[Anonymous Coward]

"I'm trying to get the president to stop using floppy disks."

Wat?

Re:So, what do you do with your college degree?

[__aaclcg7560]

Floppy disks are well-known weapons of mass destruction, especially the eight-inch floppy disk.

Re:So, what do you do with your college degree?

[Anonymous Coward]

You do need an advanced degree to give rudimentary advice to people with other advanced degrees. They don't listen to you otherwise. And yes, you do additionally need to dress up as their esteemed college professors, Santa Claus, baby Jesus or Vishnu to get their attention.

Re:So, what do you do with your college degree?

[Cramer]

Well, seeing as no one makes them anymore, that problem will fix itself in due time.

Seriously?

[Anonymous Coward]

We've surpassed floppies by CD-ROM, DVD, Dual-layer DVD, HD-DVD, and Blu-Ray, but the US Government is still stuck in the 1980s using floppy disks? No wonder they're screwed.

Re:Seriously?

[K. S. Kyosuke]

It's high time to launch the "Don't floppy that copy!" campaign aimed at White House staffers.

Re:Seriously?

[91degrees]

Well, I was using floppies well into the 90's. CD-ROMs were nice for large chunks of data but until I had broadband, sneakernet+floppies was usually a lot more efficient. Really the modern replacement is USB sticks, although they're not quite cheap enough to give away as floppies were.

Re:Seriously?

[Culture20]

I was using boot floppies until about 2006. Currently CDs and USB thumb drives. I can see how govt would hate using thumb drives (a rogue thumb drive could mimic any USB device), but all the optical drives should be fine. Securely erasing them is impossible, so shred & melt...

Re:Seriously?

[__aaclcg7560]

I went back to school to learn computer programming on a part-time basis from 2002 to 2007. Assignments were turned in on floppies for the first few years. Emailing assignments and online classes became common towards the end. I turned in my final project -- creating an XML parser from scratch in Java without using any existing XML APIs -- on a CD because the source code, executable and documentation file were too big to email as a zip file. After five years of attending classes while working full-time, the dean handed back a floppy that I submitted for my very first class that he forgot to give back and found in his office. A month after I graduated with my A.S. degree, I made the president's for maintaining a 4.0 GPA in my major.

Re: Seriously?

[link-error]

Where did you go to school? My school had an automated submission system in 1988.

Re: Seriously?

[__aaclcg7560]

San Jose City College in the heart of Silicon Valley. When I graduated in 2007 with a second associate degree, the Records & Admission office were still scheduling classes on the same mainframe and 9600 baud serial terminals from when I went there in the early 1990's.

Re: Seriously?

[Anonymous Coward]

San Jose City College in the heart of Silicon Valley. When I graduated in 2007 with a second associate degree, the Records & Admission office were still scheduling classes on the same mainframe and 9600 baud serial terminals from when I went there in the early 1990's.

You should have gone to an actual university and gotten a real degree.

Re:Seriously?

[DivineKnight]

Nonsense. All they need to do is label the floppies accordingly, and all manner of fun could be had.

"We've lost our 'WMDs.'"

"'North Korea' has proven incompatible with current reforms."

The jokes write themselves.

Re:Seriously?

[Anonymous Coward]

We've surpassed floppies by CD-ROM, DVD, Dual-layer DVD, HD-DVD, and Blu-Ray, but the US Government is still stuck in the 1980s using floppy disks? No wonder they're screwed.

For developing small toy operating systems a floppy diskette is still the best target medium provided you can find a computer supporting floppy diskettes these days.

Re:Seriously?

[AK Marc]

They are about 10x the cost of floppies for one about 10x the size. If you want to "give" information, the CD is still the cheapest way (even cheaper than floppies for most people). And if you go to a convention, training, or anything like that, chances are the material will be provided on USB stick. It may cost more than a floppy, but is cheaper than paper, and cheaper than floppies (for the amount of information stored). Plus, unlike floppies, people will be able to use them when they get home.

Re:Seriously?

[AK Marc]

That's why they need brilliant people in the government.

I can see how govt would hate using thumb drives (a rogue thumb drive could mimic any USB device),

The government is large. A demand that any driver be signed by the maker (with the proper key loaded into the government PKI) would eliminate 99% of such attacks. All USB storage must have a key.txt in the root with a valid key.

Problems getting manufacturers going along with it? You are the US government. "Do what I ask, or we'll eliminate your stuff from procurement for someone that does. And if you complain publicly, we'll refuse to buy from anyone who uses your stuff."

Security doesn't happen until someone demands it (and pays for it). The government should be leading the charge, not NSA-style trying to hold everyone back. Double DES is good enough for anyone.

Re:Seriously?

[arkenian]

I was using boot floppies until about 2006. Currently CDs and USB thumb drives. I can see how govt would hate using thumb drives (a rogue thumb drive could mimic any USB device), but all the optical drives should be fine. Securely erasing them is impossible, so shred & melt...

The reason the government hates thumb drives is because they are very small, and can store LOTS of data. Even in unclassified areas, the government tends not to want them around anything even the slightest bit sensitive. I would be surprised if they're permitted anywhere near the white house, and wouldn't be surprised if most of the computers in the white house are configured to disallow them. A floppy is harder to smuggle, and carries less per disk. Enough floppies to store a gigabyte of data is nearly impossible to hide from the secret service (well, so one would hope, but then . . . )

Re: Seriously?

[Frosty Piss]

Thumb drives have been banned on Air Force networks - even Nipernet - for 4 or 5 years.

Re:Seriously?

[eneville]

I'm still using boot floppies, but they're virtual and mounted via an HP ILO... Not touched an actual floppy since, no, I can't remember when. They were great until you got pocket fluff/grit behind the gate and transferred it unto the drive. SD cards are a suitable replacement, though easily lost and are perhaps on par bad block wise.

One thing we should commend though, well done on keeping your files small enough to fit on floppies. That's pretty much impossible after a few revisions of a Word document after it collects all that system information.

Re:Seriously?

[cfalcon]

This gets trotted out, but it isn't the reason. Small and stores lots of data is GOOD.

Here's the problems with thumb drives. This is why they can't be trusted:

1)- NO READ-ONLY MODE
Unlike CDs, which are read only without giant hoops to jump through, there's no write-protect switch for thumb drives, or ability to trivially make them read-only.

2)- USB drive, or viral keyboard?
Nothing inside a USB drive can make sure it's actually a damned USB drive. An infected CD won't run without autorun, but an infected USB stick could reasonably and actually become a keyboard and launch a binary itself by TYPING IN ITS OWN COMMANDS (this can really happen, easily). Since the U in USB is universal, and there's no reasonable way to force it to behave as a passive drive in a physically inspectable manner, it can't be trusted.

3)- Terrible OS design (mostly gone)
For whatever reason, most OSes properly treat removable media as removable, but often have a soft spot in their hearts for USB sticks. This is mostly fixed by now, but was absolutely an issue for years and until the older conception is gone, who knows.

tl;dr: Thumb drives being small and holding a lot isn't the issue, the idea of them secretly being generic USB devices (aka, absolutely anything) that are generally auto-trusted and can reasonably press OK to their own confirmation dialogs is, as is their entire lack of hardware accountability. Unlike a floppy or a CD, a USB stick can always be written to and can actually be any goddamned thing at all.

Re:Seriously?

[cfalcon]

And I should clarify that by "infected" I don't mean just software, like a boot sector virus. I don't think a commercially purchased USB stick can act like a keyboard via viral infection (though the fact that this is even theoretically considerable is a flaw too), but a custom hardware piece can absolutely do this.

Re:Seriously?

[BitterOak]

1)- NO READ-ONLY MODE Unlike CDs, which are read only without giant hoops to jump through, there's no write-protect switch for thumb drives, or ability to trivially make them read-only.

That's a very good point. Floppy disks had write protect tabs, and the 3.5" ones had a little write protect slider switch. I don't know why thumb drive manufacturers don't include a similar feature on their drives. I think there'd be a real market for such a thing.

Re: Seriously?

[__aaclcg7560]

I went to San Jose State University for a year before I got kicked out and stuck with a $2,500 student loan for ten years. I spent my scholarship money on setting up a Wildcat! BBS to be the beginning of my online media empire. And then something called the Internet became really big in 1995. I was a dot com bust before the dot coms existed.

Uncle Sam picked up the tab to learn computer programming with a $3,000 tax credit after the dot com bust in 2001. I made a successful career transition from being a video game tester to being an I.T. support technician. No regrets, no student debts.

Re: Seriously?

[Anonymous Coward]

They did years ago but probably cut it for more profit.

Re:Seriously?

[cfalcon]

The following fundamental security features are missing:

IDE/SATA/SAS/USB: Write protection, physical.
IDE/SATA/SAS/USB: Write light (NOT read/write light, access light, or "I have power" light) with minimum duration of half a second per write
USB: Physical switch to force mode (media only, keyboard/mouse only, etc. on a given physical USB switch)

Re:Seriously?

[gtall]

While I agree with the sentiment, the Tea Party will whine and complain it is government pushing around the private sector, and then the effected companies will lobby their favorite Tea Party members for special exemptions. The cry will be that it should be the industry response to competitive conditions that produces security, blah, burble, furble, yadda, yadda, yadda.

I put security in the same bag as clean air and water. It requires a government mandate and constant vigilance. Companies are still trying to get Congress to allow them to pollute to their little black hearts' content all the name of "jobs" or whatever gas Limbaugh is passing this week.
 

Re:Seriously?

[Rich0]

That's why they need brilliant people in the government.

I can see how govt would hate using thumb drives (a rogue thumb drive could mimic any USB device),

The government is large. A demand that any driver be signed by the maker (with the proper key loaded into the government PKI) would eliminate 99% of such attacks. All USB storage must have a key.txt in the root with a valid key.

USB keys don't contain drivers. The attack is that when you aren't looking your thumb drive presents itself as a Logitech USB keyboard and then proceeds to type in a rootkit or whatever. Since the government probably does buy Logitech USB keyboards the computer already has the signed logitech driver installed. Sure, the drive can only do things that you could do with a keyboard, but you'd be amazed just what you can do with only a keyboard.

Re:Seriously?

[AK Marc]

While I agree with the sentiment, the Tea Party will whine and complain it is government pushing around the private sector,

Why is it that those who claim they want the most efficient government do all they can to make the government as inefficient as possible?

Re:Seriously?

[AK Marc]

USB keys don't contain drivers. The attack is that when you aren't looking your thumb drive presents itself as a Logitech USB keyboard and then proceeds to type in a rootkit or whatever.

To be an HID, it must announce itself as one (called "driver" even when it just announces itself and requests the default OS driver). To do so, it must authenticate with the host OS. If not, the HID functionality will be disabled.

Sure, the drive can only do things that you could do with a keyboard, but you'd be amazed just what you can do with only a keyboard.

I've been told the problem is when the USB drive is actually a storage device, but leaches power (but no connectivity to the host computer) to broadcast the contents of the device on WiFi to a listening attack machine outside (but in WiFi range). That would be theoretically undetectable, unless you have scanners and Faraday cages up all over the place. And my thought for signing is to sign per device, not that one keyboard would allow anything that announces itself as that keyboard (but without authentication) would get "root" access.

Re: Seriously?

[Anonymous Coward]

What is it about mistaking a government that fulfills the contract needed to provide, and sustain stability with a cry for efficiency ?

Re: Seriously?

[AK Marc]

So you are asserting that the Teabaggers don't want an efficient government? That's consistent with their actions, but I don't think that's consistent with their statements.

Re: Seriously?

[Anonymous Coward]

McDonalds in Canada already scan for rogue Wi-Fi networks and send an alarm if one is found trying to mimic the RFID of the restaurant. In such a closed environment, you could easily adapt this to search for any network that isn't white listed and solve this particular attack.

Re:Seriously?

[Rich0]

USB keys don't contain drivers. The attack is that when you aren't looking your thumb drive presents itself as a Logitech USB keyboard and then proceeds to type in a rootkit or whatever.

To be an HID, it must announce itself as one (called "driver" even when it just announces itself and requests the default OS driver). To do so, it must authenticate with the host OS. If not, the HID functionality will be disabled.

As far as I'm aware USB does not have any kind of strong authentication built into it. It can announce itself as an HID, and label itself as whatever it wants to.

Even if they did authenticate, the necessary private keys would be in every logitech USB keyboard out there, to use my example.

Re:Seriously?

[AK Marc]

As far as I'm aware USB does not have any kind of strong authentication built into it. It can announce itself as an HID, and label itself as whatever it wants to.

No, it doesn't. But if the US government announced the standard it would accept, and it was backward compatible, it would become the de facto standard. If the Government OS required auth, and the auth present on the device in no way stopped it from working with any previous USB controller, then auth would be pervasive in a few years. Then it's a question of market, for whether the consumers would demand it.

Even if they did authenticate, the necessary private keys would be in every logitech USB keyboard out there, to use my example.

Yes. Is that a problem?

Re:Seriously?

[MouseTheLuckyDog]

Well, I was using floppies well into the 90's. CD-ROMs were nice for large chunks of data but until I had broadband, sneakernet+floppies was usually a lot more efficient. Really the modern replacement is USB sticks, although they're not quite cheap enough to give away as floppies were.

CD's always seemed impractical. Probably because they are in a way more fragile.

I still use ZIP drives for some backups ( say my password manager ).

USB sticks are OK but I really don't like their form factor.

microSD cards in an SD card adaptor ( if needed ), seem best. and most easily stored. I just wish they had binder inserts similar to the ones they had for floppies.

Re: Seriously?

[Anonymous Coward]

What on earth are you talking about? 99% of attacks stopped by a txt file. No such thing mate you know nothing about usb technology or drivers.

Re: Seriously?

[Anonymous Coward]

They do. I buy them on amazon all the time. This is nothing new, the general public just doesn't see a need for it.

Re: Seriously?

[Anonymous Coward]

McDonalds in Canada already scan for rogue Wi-Fi networks and send an alarm if one is found trying to mimic the RFID of the restaurant.

The RFID of the restaurant, eh? You don't have a fucking clue what you are talking about.

Re:Seriously?

[datavirtue]

You can open powershell and enter, compile, and run a program with just a keyboard.

Re:Seriously?

[EndlessNameless]

To be an HID, it must announce itself as one (called "driver" even when it just announces itself and requests the default OS driver). To do so, it must authenticate with the host OS. If not, the HID functionality will be disabled.

What? USB devices in general, and HIDs in particular, do not authenticate with the OS when plugged in.

You plug it in, and it negotiates with the host controller automatically. The host controller notifies the OS that the device is there, and then the OS queries the device for its properties. The device is perfectly capable of lying about what it is and what it does.

If the device identifies as a keyboard, mouse, Smart Card reader, or removable storage, by default the OS will load its native drivers and handle the device seamlessly. The device could have nefarious functionality, but the OS has no way of knowing about that.

Various OS security tools and third-party utilities can attempt to restrict the use of USB devices. None of them are pleasant to use---from the standpoint of either the administrator or the end user.

I've been told the problem is when the USB drive is actually a storage device, but leaches power (but no connectivity to the host computer) to broadcast the contents of the device on WiFi to a listening attack machine outside (but in WiFi range).

Not terribly practical or interesting. This idea probably came from someone who watches too many "hacker" movies. Anyone who is concerned about restricting USB devices probably already has a solution for detecting rogue Wifi clients and APs. If not, they can buy one off the shelf. This is something I would expect to see in a Hollywood movie.

Rogue USB devices are not something a hacker is going to use against some random citizen in hopes of scoring access to their checking account. This is something enterprises and governments are going to be worried about, and they have options for mitigating the threat.

Re:Seriously?

[EndlessNameless]

Yes. Is that a problem?

If you don't see a problem with PRIVATE KEYS being distributed inside mass-produced hardware, I do not even know where to begin criticizing your position.

Every piece of equipment would need significant anti-tampering measures because as soon as the keys are retrieved from one device, it is game over.

This is why DRM software keeps getting cracked over and over in spite of the billions of dollars being spent on developing it. If your scheme requires a secret that the user needs to operate the device, it will be compromised.

People crack stuff like this for fun. We've seen it happen year after year. Do you think there will be more or less cracking attempts when there are serious espionage or financial incentives?

Re:Seriously?

[AK Marc]

What? USB devices in general, and HIDs in particular, do not authenticate with the OS when plugged in.

I said that. I also said that if the US government required it, then USB devices would authenticate when plugged in.

The device is perfectly capable of lying about what it is and what it does.

Not if the host OS has some means to authenticate it. Or did you get the point and decide to go all Devil's advocate?

Re:Seriously?

[AK Marc]

If you don't see a problem with PRIVATE KEYS being distributed inside mass-produced hardware, I do not even know where to begin criticizing your position.

It's clear you don't know where to begin criticizing it. DVDs do it (very poorly) and Blu-Ray do it (less poorly). A similar system would be trivial. As would be putting the PRIVATE KEYS on the mass produced hardware (encrypted and signed, of course). You do know how PKI works, don't you? You don't send someone your private key for them to authenticate you. You encrypt their public key with your private key and send that encrypted PRIVATE KEY derivative. So, burn that encrypted key into the USB device as part of the driver.

That you are too dumb to understand an idea doesn't mean the idea is dumb.

Re:Seriously?

[EndlessNameless]

It's clear you don't know where to begin criticizing it. DVDs do it (very poorly) and Blu-Ray do it (less poorly).

You identify two systems as examples of your new "security" feature, but both of them have been laughably compromised. Neither scheme lasted more than a year in the wild, and with a PC security standard you'd need to manage a bit more than that.

A similar system would be trivial. As would be putting the PRIVATE KEYS on the mass produced hardware (encrypted and signed, of course). You do know how PKI works, don't you? You don't send someone your private key for them to authenticate you. You encrypt their public key with your private key and send that encrypted PRIVATE KEY derivative. So, burn that encrypted key into the USB device as part of the driver.

I bolded the part that is problematic. How does one burn a key into the device as part of a driver, exactly? With security, the devil is in the details, and your proposed system sounds no better than similar systems which have failed in the past.

That you are too dumb to understand an idea doesn't mean the idea is dumb.

Nice ad hominem, but maybe you should have provided a substantive argument instead.

I believe your explanation rather than my intelligence is at fault here. You identify two systems as functional examples of your new "security" feature---neither of which is effective in practice. AACS has been compromised repeatedly, which shows that simply revoking the exposed keys and hoping new equipment fares better is not an effective strategy.

Can you explain, clearly, how your system differs in such a way as to render it immune to similar attacks? If not, then there is absolutely no reason to take your proposal seriously.

Re:Seriously?

[AK Marc]

You claim it can't work. I claim it can. Since you can't prove it can't, there's nothing to day. You are assuming the worst possible implementation and indicating that wouldn't work. Obviously. Captain Obious called, he wants his uniform back. That you are too dumb to imagine a system that could work doesn't mean it can't. It just means you have no imagination or problem solving skills.

Also, you forget. In the case of the DVD/Blu-Ray, the user didn't want the system to work. For someone getting safe USB, both the manufacturer and user want it to work. That you don't know the difference further proves your incompetence. Since you've said nothing substantive that contradicts anything I've said...

Re:Seriously?

[Anonymous Coward]

That's why they need brilliant people in the government.

The problem is that brilliant people don't want to work with mind-numbingly-stupid people... you know, the kind that are typically attracted to government work?

Re: Seriously?

[AK Marc]

So "signed drivers" don't exist?

Re:Seriously?

[AK Marc]

The problem is that the people elect based on a popularity contest, rather than evaluating the people running. It's like I'm back in the 8th grade voting dot student body president. At the time, I though it a joke popularity contest that was a warning for when we were adults voting. Now I now it was actual practice, and more like reality than anyone would like to admit.

Re:Seriously?

[Rich0]

It's clear you don't know where to begin criticizing it. DVDs do it (very poorly) and Blu-Ray do it (less poorly). A similar system would be trivial.

DVDCSS was cracked ages ago, largely due to a poor design. The Blu Ray system had a better design, but every Blu Ray player contains a key that can be used to read any Blu Ray disk. The only reason they aren't routinely cracked is that nobody cares to bother - there are a bazillion other ways to do it. If a country doing espionage wanted a Blu Ray key they'd just go to the local Walmart, buy one, and extract the key from it.

As would be putting the PRIVATE KEYS on the mass produced hardware (encrypted and signed, of course). You do know how PKI works, don't you? You don't send someone your private key for them to authenticate you. You encrypt their public key with your private key and send that encrypted PRIVATE KEY derivative. So, burn that encrypted key into the USB device as part of the driver.

Your valid USB device needs to authenticate itself. That means that ALL the necessary credentials necessary to do so MUST be stored on the USB device. That means it can be duplicated. That is all there is to it. You can certainly make it tamper-resistant, but against something like an intelligence agency I would not trust that to work.

Sure, you can encypt the key on the USB device, but then how does the USB device use that key? If the key needs to be decrypted to use it, then the device has to have the decryption keys burned into it as well. If the key doesn't need to be decrypted to use it, then the attacker doesn't need to decrypt it either.

Public key cryptography is about protecting messages from interception. We're talking about protecting the keys from interception.

Re: Seriously?

[Rich0]

There is nothing wrong with the drivers. The problem is with the device impersonating another device. If I plug a keyboard into your computer and it uses the signed RedHat keyboard driver it doesn't help you when I type rm -rf /* into an open shell. The same is true if I plug a USB flash drive and then after 10 minutes it disconnects itself, reconnects as a USB keyboard, and does the same thing.

Re:Seriously?

[Rich0]

You can open powershell and enter, compile, and run a program with just a keyboard.

Absolutely. Back in the days of DOS Laplink let you clone a PC onto another by just connecting a null-modem cable between them and typing "stty COM1:" into the remote computer. That simply redirected the DOS prompt console to the serial port, and laplink would install a receiving program via keyboard input and then have it do the copy. I don't know how it did it - could have used debug.exe to hexedit the file in, or for all I know it it just did "copy CON: filename" and just sent the binary over the wire.

Re: Seriously?

[AK Marc]

The same is true if I plug a USB flash drive and then after 10 minutes it disconnects itself, reconnects as a USB keyboard, and does the same thing.

When it connects as a USB keyvoard, it would be challenged for its driver. If it doesn't have one, it must authenticate with a null driver, properly signed, or the OS will disconnect it.

That's easy. Most OSs already handle signed drivers. It's just a change to *require* them for USB devices used by the federal government. When that happens, your problem goes away.

Re:Seriously?

[AK Marc]

So, is the tl;dr "if you just copy the key from one USB to another, that will let you authenticate an insecure device".

I want to make sure the question is clear when I answer. I'm amazed by the number of people who say "security is hard, it's better to not even try."

Re: Seriously?

[Rich0]

The same is true if I plug a USB flash drive and then after 10 minutes it disconnects itself, reconnects as a USB keyboard, and does the same thing.

When it connects as a USB keyvoard, it would be challenged for its driver. If it doesn't have one, it must authenticate with a null driver, properly signed, or the OS will disconnect it.

That's easy. Most OSs already handle signed drivers. It's just a change to *require* them for USB devices used by the federal government. When that happens, your problem goes away.

USB devices don't contain drivers - the OS does. The device just identifies itself.

But, if USB devices did contain signed drivers, then somebody would just copy the signed driver from a valid device. Encryption doesn't prevent copying - a copy of valid encrypted data is just valid encrypted data.

Re:Seriously?

[Rich0]

So, is the tl;dr "if you just copy the key from one USB to another, that will let you authenticate an insecure device".

I want to make sure the question is clear when I answer. I'm amazed by the number of people who say "security is hard, it's better to not even try."

So, the tl; dr of your proposal is: "put the device driver on the USB device instead of in the OS, and put a signature of the driver on the device as well" if so, then the tl;dr of my response is "fine, just copy the driver and the corresponding signature, that will let you authenticate an insecure device"

If I'm misunderstanding your proposal, feel free to state it clearly so that I can answer clearly. I'm amazed by the number of people who think that public key cryptography is some kind of magical thing that lets you give somebody a physical object that is impossible to copy.

Re: Seriously?

[AK Marc]

USB devices don't contain drivers

Reality proves you wrong. The HP I use has a read-only flash drive in it with the drivers for the printer on it.

Besides, your arguement is invalid anyway. "It can't be done because it is currently done differently" has been said millions of times by millions of people. Everyone one of them proved wrong by progress.

Oh, and if you are wondering, the drivers in the printer are signed.

Re:Seriously?

[AK Marc]

So, the tl; dr of your proposal is: "put the device driver on the USB device instead of in the OS, and put a signature of the driver on the device as well"

The driver for my USB printer is already on the USB device and already signed.

, then the tl;dr of my response is "fine, just copy the driver and the corresponding signature, that will let you authenticate an insecure device"

Sure, you can get an insecure printer running on that driver, but when it starts sending HID commands, the OS will turn it off.

If I'm misunderstanding your proposal, feel free to state it clearly so that I can answer clearly. I'm amazed by the number of people who think that public key cryptography is some kind of magical thing that lets you give somebody a physical object that is impossible to copy.

You are correct only if a signed printer driver will work with a keyboard, as its only driver. Otherwise your objection is "swap stuff, and magic happens". Encrpytion ensures that the driver authenticates (already in use). So why can't you encrypt the UID of the device as well? Sure, a well crafted attack could get you fake devices with UID/driver from a real one. But at that point, you are in the "hide an AP and USB drive inside a keyboard" level, which is 100% allowed today on any system that allows USB keyboards. Or should the government use AT keyboards only? Or is PS/2 more secure than AT? After all your PS/2 mouse could send keyboard commands, right? And with AT for keyboard and serial for mouse, you are more secure. Unless your serial mouse contains a serial modem, and serial killer.

No, I haven't given this 5 years of thought and put it to committee. It was an off-the-cuff response that eliminates 99.9% of the attacks being described. But 0.1% of the attacks could still work, so we should never attempt security is the number one response. The rest are "when I deliberately mis interpret your statements, they sound silly."

Re: Seriously?

[Rich0]

USB devices don't contain drivers

Reality proves you wrong. The HP I use has a read-only flash drive in it with the drivers for the printer on it.

Besides, your arguement is invalid anyway. "It can't be done because it is currently done differently" has been said millions of times by millions of people. Everyone one of them proved wrong by progress.

Oh, and if you are wondering, the drivers in the printer are signed.

And if I had the money I could duplicate that USB device, signed drivers and all. Signatures don't prevent copying, only tampering. There is no need to tamper with the drivers to do the kinds of exploits that have been discovered for USB devices. The modified HP printer will connect using the signed HP printer driver and work just fine as a printer. Then in the middle of the night when you aren't at your PC it will disconnect and connect using the signed logitech keyboard driver and work just fine as a keyboard, and use keyboard input to run a rootkit on your PC. Then it will disconnect and connect as a printer again so that you never realize what happened.

Sure, locking your PC at night or turning it off would mitigate that particular attack, but you get the general idea.

Re:Seriously?

[Rich0]

, then the tl;dr of my response is "fine, just copy the driver and the corresponding signature, that will let you authenticate an insecure device"

Sure, you can get an insecure printer running on that driver, but when it starts sending HID commands, the OS will turn it off.

The printer will disconnect from the USB bus. Then it will reconnect using a signed keyboard driver which the OS trusts. Then it will send keyboard input (the driver doesn't create the keystrokes - the user does - so a keyboard driver HAS to accept arbitrary input from the hardware). The OS has no way to know that the plug wasn't physically removed from the bus - the hardware can just disconnect and reconnect electronically.

It would be possible to mitigate this using a sensor on the plug to test for physical insertion/removal. Of course, that wouldn't work if you plugged a hub in unless you trusted the hub to tell you the truth. Plus, I could see that sensor wearing out like disk drive change sensors tended to ages ago.

The thing you're missing in your replies is that these attacks have hardware-level support. They actually disconnect electronically from the host and re-connect. That means that they can re-authenticate as an entirely different device. It could even emulate a USB hub and connect as 14 different devices at various times - some simultaneously.

There is no question that when it is connected as a printer that the OS would reject keyboard input (not that keyboard input would really be possible - the driver wouldn't interpret anything sent as keyboard input anyway).

Re:Seriously?

[AK Marc]

The thing you're missing in your replies is that these attacks have hardware-level support.

Yes, and if the person who wins the contract to deliver the computers is attacked by Al Qaeda, and they replace all the computers with identical ones, save one minor intentional "flaw", that would be undetectable under today's process.

Your argument is "because security is not 100%, there's no reason to try."

I'm saying "it's better than today" which you are leaving unargued.

Re: Seriously?

[AK Marc]

Then in the middle of the night when you aren't at your PC it will disconnect and connect using the signed logitech keyboard driver and work just fine as a keyboard, and use keyboard input to run a rootkit on your PC. Then it will disconnect and connect as a printer again so that you never realize what happened.

With USB hubs, the printer could identify as a hub, and then you wouldn't need to disconnect the printer to "plug in" the Logitech keyboard.

That attack should work no more than once, once discovered. You revoke the signature for those keyboards. And get more security than doing nothing.

Re: Seriously?

[Rich0]

Then in the middle of the night when you aren't at your PC it will disconnect and connect using the signed logitech keyboard driver and work just fine as a keyboard, and use keyboard input to run a rootkit on your PC. Then it will disconnect and connect as a printer again so that you never realize what happened.

With USB hubs, the printer could identify as a hub, and then you wouldn't need to disconnect the printer to "plug in" the Logitech keyboard.

That attack should work no more than once, once discovered. You revoke the signature for those keyboards. And get more security than doing nothing.

If you do that a ton of keyboards stop working. Then you have to buy all new keyboards. Then the attacker just updates their hacks to identify itself as the new keyboard.

It is about as likely to be effective as trying to revoke HDCP keys if somebody extracts a key from a TV set. You tick off a bunch of TV owners, and the pirates just switch to a new key.

Re:Seriously?

[Rich0]

The thing you're missing in your replies is that these attacks have hardware-level support.

Yes, and if the person who wins the contract to deliver the computers is attacked by Al Qaeda, and they replace all the computers with identical ones, save one minor intentional "flaw", that would be undetectable under today's process.

Your argument is "because security is not 100%, there's no reason to try."

I'm saying "it's better than today" which you are leaving unargued.

They already have this level of security today. You can configure most OSes to only accept USB devices that identify themselves with acceptable identifiers. You just want to make the length of the identifier longer (the length of a signed driver file). Either way you can identify yourself as something else.

As you point out, you're fine if you only plug in USB devices from trusted sources. However, I doubt anybody paid to safeguard IT for the US government is going to be satisfied with that.

Re: Seriously?

[AK Marc]

You are assuming the worst possible implementations of what I say, rather than a "normal" implementation, or even the best. I've said before there's no reason you can't have a unique signature per device. One cert can generate an infinite number of hashes (though no more unique than the length of the key). So with a 4096 bit key, you are looking at a collision every 10^1233 keyboards. So yes, when one signature is copied, revoke it. You'll affect no more than one keyboard. And there are plenty of ways to do it better than you discuss, and none to do it worse.

It is about as likely to be effective as trying to revoke HDCP keys if somebody extracts a key from a TV set. You tick off a bunch of TV owners, and the pirates just switch to a new key.

They do it today, not with DHCP but with game keys. If you register a game and your key has been used, then you can't register your game. I had to take one back when that happened once. Not a big deal. Some cracker who guessed a valid algorithm for keys had a collision for the "unique" one that came with my game. And again, you are comparing a system to get users who want DRM and hardware makers who want DRM with the consumer DRM where the hardware makers want DRM, but nobody else does. Consumer DRM is not wanted by the user. Secure hardware is wanted by the user. Businesses and such want it enough that Intel and others have already done it. But then, the consumers didn't want it to the point it never got implemented, becuase it broke home user's ability to tinker. What I'm proposing is doing it the other way, so that the home user can still tinker, but someone who wants a locked-down PC can get it.

You are so opposed to hardware verification that you are deliberately taking the obtuse and argumentative stance.

Re: Seriously?

[Rich0]

They do it today, not with DHCP but with game keys. If you register a game and your key has been used, then you can't register your game

Sure, but that is fairly different to what you initially proposed. It would only work with online verification, so the first time you plugged in a keyboard with a unique ID your laptop would have to go out to some trusted server to authenticate it. That wouldn't stop somebody from later cloning that specific keyboard, but it would prevent them from cloning another keyboard and plugging it into your PC. Then again, if they only cloned any particular keyboard once it probably still wouldn't help unless you only authenticated any keyboard once. If you did that then if you took a legitimate keyboard and tried to use it on two laptops it would fail.

Keep in mind that if you're a government then your adversaries are likely to be foreign intelligence agencies. Do you think it would really be that hard to get your hands on one keyboard/printer/etc and clone it without it being reported missing so that you could target one computer for hacking?

Also, none of this is consumer-grade capability. That means that instead of buying $20 logitech keyboards the government is now buying $1000 secure keyboards, and no doubt the next Ronald Regan will come along and point that out. I was chatting with somebody who worked for a defense contractor and a bunch of brass was wondering why they couldn't have an "app store" for military phones, instead of huge bricks that had fixed firmware and multi-year upgrade projects.

I'm not trying to say that security is impossible to achieve. I'm just saying that a significant increase in security isn't just an incidental bolt-on to existing consumer hardware. If you're going to re-design interfaces, register individual pieces of hardware with special authentication modules, and all that stuff, then sure, you can improve on things. Just don't expect to be buying that stuff at Staples.

Re: Seriously?

[AK Marc]

Sure, but that is fairly different to what you initially proposed.

I don't see it as any different that what I initially proposed. You took what I said as the worst possible implementation, rather than trying to figure out how to do it best.

The general idea is - authenticate USB devices. Somthing that isn't done today. The rest is first guess as to a possible manner. You are complaining about the color of the USB device, rather than addressing the general idea.

Also, none of this is consumer-grade capability

Also, none of this is consumer-grade capability

You are wrong. Not even close. When you think of something, you think of the worst possible way only. That makes you and only you wrong, and not me. I mentioned drivers, because I was expecting your inane and irrelevant response. All USB deviced identify themselves to the OS today. So a "key" of some kind to unlock the device is well within the capabilities of consumer-grade devices today.

That you are still listing reasons why it's impossible just shows you have no imagination, not that there's anything wrong with the idea. As you are uninterested in discussing the idea, but instead just "proving" me wrong in every post, I give up. You win. USB is impossible. Nobody will ever make USB work (hey, that's no more off topic/non sequitur than any of your responses so far).

Re: Seriously?

[Rich0]

Yikes, don't take it so personally!

Are you uniquely whitelisting devices or not? Right now every logitech keyboard model 123 on the planet identifies itself in the same way. If you can impersonate one of them, you can impersonate all of them. Your solution to that was to uniquely identify and authenticate each keyboard. I just pointed out that for this to work you now need to keep track of which logitech keyboard model 123s you're using, and ensure that only one of them works at a time. That means a central server keeping track of who is using which keyboard. That simply can't work at a consumer level. If you don't track who is using which keyboard then sure I might only be able to impersonate one keyboard, but it doesn't matter because every device on your network still trusts that one keyboard and you have no way of knowing that there are now two of them on your network.

You might think there is a trivial solution to these problems, but which seems more likely to you? Either you're right and I'm wrong and there is an easy way to secure USB peripherals and collectively every IT organization on the planet is just too lazy to implement it, or I'm right and the reason that it doesn't happen is because the potential solutions to these problems have so much complexity and so many trade-offs that they're just not great candidates for widespread adoption. Only governments have the kinds of money to throw at this problem that you'd need, and the problem there is that their adversaries have just as much money to throw at circumventing their solutions.

Re: Seriously?

[AK Marc]

Are you uniquely whitelisting devices or not?

Yes.

You might think there is a trivial solution to these problems, but which seems more likely to you?

Yes. Trivial. The reason I said "encryption" in the first place is that most of these would be going on Windows computers. Windows servers come with CA included. So it's trivial to authorize every device. Now, identifying all of them individually and ensuring no duplication would require an authentication step that doesn't exist today. But it's still trivial.

Either you're right and I'm wrong and there is an easy way to secure USB peripherals and collectively every IT organization on the planet is just too lazy to implement it,

You are asking the wrong question. It's impossible to secure USB today. It's trivial to do it if you wanted to (and had the hardware makers on board). And if the US governemnt said "if you don't do it, we'll never buy another of your devices, and make sure any grants to organizations will never be used to buy your stuff" you'd have 10 or so makers fight to get in on the program (at zero hardware cost to the government). After that it'd be free and trivial for IT departments to secure USB (while still generally allowing it).

The system must uniquely identify all USB devices. Just passing a UID would be sufficient to identify every USB device separately, but would run into the problem of trivial cloning.

Certificates are a white list. My computer knows *every* valid certificate. It may not store the necessary answer to all locally, but will go up the cert chain, which is an explicit white list. There is no "allowed" certificate that isn't recorded right not, explicitly. And for millions of unique sites. So the scale isn't an issue. We do more complex today.

Only governments have the kinds of money to throw at this problem that you'd need,

It's not the amount of money, but the willingless to spend it. Securing USB for all is a noble goal. Once the government is on board, then private IT can decide if it's worthy, and if so, adopt it for trivial cost. They are already running a CA server (in their Windows server), even if they just have that functionality turned off. The cost is to the hardware makers. And if they willingly accept the cost as a cost of doing business with the government, then everyone can benefit from it.

Trivial and cheap/free (to the users).

Re: Seriously?

[Rich0]

The problem with what you propose is that the only way to prevent cloning of devices is to have a central registry that tracks them. Even that doesn't completely prevent cloning - you could swap out a device with a clone without any issues in such a design - the only thing you couldn't do is add a clone without getting rid of the original.

This is how online copy-protection schemes work - the game phones home with its serial number and the server keeps track of usage.

However, this system requires that any device to be tracked is basically always online, which is a constraint that doesn't always work. It requires establishing a server to keep track of everything. You have to be able to trust the server to do its job, and you also need to trust the server owner with knowledge of all the devices you're using (which might or might not be sensitive - do you really want some VIP's bluetooth keyboard phoning home to some server introducing the possibility of tracking? how about a spy's?).

A corporation might set up its own tracking system for items it procures via controlled sources (still a lot of admin overhead to check in every device, or get your vendors to do it for you). The average consumer or small organization wouldn't benefit from this at all unless the manufacturer ran a central server. Do you really want every peripheral you own phoning home all the time? Oh, and just wait until Apple determines that your audio cable isn't genuine. :)

But, yes, if you're willing to work at it you can certainly authenticate individual devices such that introducing a strange device into your environment requires replacing a legitimate one with a tailored replica. That would be pretty tricky to pull off unless the device is one that won't be noticed if it goes missing for a while (and if you're super-paranoid just having it go missing might be noticed by your central server).

Re: Seriously?

[AK Marc]

I don't disagree it would be hard to do right. I do disagree it's impossible. Logitech supplies a list of serials in the shipment, and they are entered on the list. You can even lock it down as much as to have windows for the "first install" of the device, and the serials allowed. You could lock it down more or less, as you see fit.

Re: Seriously?

[Rich0]

I do disagree it's impossible.

I never claimed that it was. I just think that it is completely impractical for consumer use. I'm not even sure what the point of it would be for consumer use - when was the last time you bought a device for personal use via a controlled supply chain (ie you had a high level of assurance that from manufacture to your hands that it couldn't have been tampered with)?

Re: Seriously?

[AK Marc]

I just think that it is completely impractical for consumer use.

I said that it would be easy for the government to require it, and then have the manufacturers support it. It takes almost nothing (if not nothing) in the hardware to support it, just changes to the way the (already existent) identification to the OS is applied to the hardware. The *only* one I said would use it initially would be the government. And that everyone who sells to the government would sell the same stuff to the people, who could use or not use the "extra" feature, with no down sides.

I never said that consumer use would take advantage of any or all of the feature uplift, just that they "could".

She is an advisor

[Mostly a lurker]

The impact she can have depends on the attitude of the President and those around him.

Re:She is an advisor

[Hognoxious]

Pretty much the same as any CTO. You're expected to keep things secure and allow the CFO to install dancingPigs.exe at the same time.

Re:She is an advisor

[fizzer06]

Tell me more of these dancing pigs.

I am intrigued.

Re:She is an advisor

[Anonymous Coward]

That is the expectation, but in reality it is to keep costs low since we all know IT has no real value :)

Every CTO I worked for came from somewhere in marketing/sales except for one who came from 'real IT'. He called BS on a lot of things and was removed after 6 months. This is in a large company and I doubt any other large companies are much different.

Re:She is an advisor

[ColdWetDog]

Ha! We've outed you, mister C-level.

Would you like to subscribe to our newsletter?

From the summary

[Anonymous Coward]

So this position is much more show than substance. No wonder she's the third with the title in five years.

Re:From the summary

[AchilleTalon]

Exactly that and the article is full of bullshit. It mentions floppy disks, nowhere it is explained where they are still using them and for what purpose. It may be a marginal usage and for good reasons as well or it may be wide spread and completely idiotic. Nobody can judge from the article, the floppy disk is mentioned in the beginning and the end of the article. For the BlackBerries, there is currently new models and I don't see why they should switch to something else given the security required. Perhaps being a former exec from Google she is a little bit in conflit with the interests of her former employer.

What's the point about a 2013 laptop? I am very sorry, but as a CTO she doesn't need the latest technology for herself to enjoy, left this to the staff that really need it.

Last thing, a CTO with background in mechanical engineering and no real experience in IT, since she was heading a research division at Google, not the IT department. I am not sure this nomination was a good one. There is many other women better qualified for the job out there. With her background, if I was a CIO or CTO of another government division, I am not sure I would embrace everything in her vision.

Re:From the summary

[CrimsonAvenger]

There is many other women better qualified for the job out there.

Are you trying to suggest she was picked for the job because she was a woman?

Isn't it a violation of all sorts of anti-discrimination laws to pick someone for a job based on irrelevancies like what's between their legs? Aren't qualifications for the job the only thing that matters?

On the other hand, she's a woman, so obviously discrimination can only be done TO her, never by her or in her favour....

Re: From the summary

[Anonymous Coward]

I worked at the executive office the president and I never saw a floppy used on any of the computers that were connected to any of the networks (unclassified and several classified).

Blackberries are still common, but you had the option of using your personal device with an app that kept the EOP data segregated. The IT folks were testing newer devices to replace the BBs and the switchover is supposed to be soon.

Overall, I did not find the IT outdated. They were not completely cutting edge, but I think if you account for security, managing common configurations, and procurement cycles I think EOP struck a good balance.

As for the age of the machines, consider the trade off between buying a new computer to replace a 2013 laptop or being able to send someone for training or travel for a meeting.

Re:From the summary

[avandesande]

Worked 10 years contracting for a government agency. I don't think I ever saw a floppy disk- not even once.

Re:From the summary

[Technician]

Until they put a Write Protect on thumb drives my diagnostics boot from Write Disabled media, either optical or a floppy in a USB drive. Practice safe computing. I have a punch to remove the write tab from floppies.

Re:From the summary

[KermodeBear]

BlackBerry phones are still the de facto gold standard for international travel. You can go just about anywhere and it will work. Those who travel between North America and Europe know what I'm talking about. If you're somewhat high level in the government I'd imagine there is a fair amount of international travel, so it's nice to have something that will "just work" when you head overseas.

I know, BlackBerry isn't considered trendy or sexy or cool or hipster, but their products work.

Re:From the summary

[KermodeBear]

I remember sending mail to America Online requesting their installation disks. They had that hole removed so that you couldn't write to them, meaning you weren't able to use their disks for whatever you wanted.

Worked great - until I fetched a roll of tape. ~(o:

Re: From the summary

[Jane Q. Public]

This means little.

If you worked at EOP you were getting the best the government had to offer. If YOUR stuff "wasn't cutting edge", just imagine what some low-level bureaucrat or secretary might be stuck with.

Re:From the summary

[Technician]

Electrical tape made a great temporary Write enable to create service disks. A few other vendors provided them for free.
Harder to find were 5-1/4 floppies without a write notch. I had a drive modified just to write them.

Oh the memories.
Still looking for thumb drives with a write protect that works.

Re: From the summary

[Anonymous Coward]

The article (or at least the summary) asserts that floppy disks are common within EOP. My point is that I did not see floppy disks in use while I was at EOP. The only time I have used floppy disks was to bridge air gaps (most notably to send AUTODIN messages) and that was over 10 years ago.

As for EOP having the best the government has to offer, not true. EOP has to put a budget submission to Congress like the rest of the government and they have to prioritize IT recap with other budget demands within EOP (e.g. training, travel, office furniture, hiring). I had much nicer office equipment outside of the EOP (I think my desk dated back to the Nixon administration and no it was not a nice mahogany desk). In fact, the tight budget environment within EOP has had one beneficial side effect--many office areas have not been renovated to the new open environment so there are many private offices. Don't confuse things like Air Force One and nifty Secret Service gear with EOP. Those don't belong to EOP.

I have worked in multiple departments (e.g. DOD) and I would assert that the level of IT sophistication is relatively consistent. Just like any distribution, some agencies are more sophisticated than others. For example, DOD has deployed two-factor authentication on NIPR while other agencies have not done that yet.

Re:From the summary

[stoborrobots]

How about a USB sd card reader? Most of my SD cards have working write protect switches...

Re:From the summary

[toddestan]

Fun fact: The write protection on SD cards is implemented in software. In other words, the switch doesn't physically prevent data from being written to the card. A rogue card reader can ignore the switch and write data anyway.

Jedi

[johnsnails]

Jed will be able to pick up where George left off.

Re:Jedi

[Anonymous Coward]

You say that like the Republicans even have a shot in 2016. All the Dems have to do is put a black guy on the ticket, and just like they did for Obama, all the blacks will come out again to vote for him, despite knowing nothing about him other than his skin color. The only hope is that the Dems, being as dumb as a sack of shit, might not realize this and choose two crackers and give the Republicans a chance to get this country back in order.

Captcha: Invasion - Damn right there's an invasion. Too many Mexicans coming across the border, yet Obama wants to grant them amnesty? That will just encourage even more to come here and steal our jobs by working illegally for pennies and probably commit crimes as well. God, I can't wait until this fucker is gone in 2016.

Re:Jedi

[houghi]

(I know he is trolling. Nobody can be THAT stoopid.)
Mexicans working for a lower pay and take your job? That is how capitalism works. Are you a communist?

Re:Jedi

[Anonymous Coward]

He's trolling and actually a Democrat, so he probably is communist. How do I know? Because he's racist. Democrats are racist.

Re: Jedi

[Anonymous Coward]

Without 'needy' immigrants the Republicans would win hands down. Its the Republicans with the higher birth rates who breed on average more Republicans. The average American democrats is a dying breed without imports.

Re: Jedi

[johnsnails]

I agreed with you up until your last sentence.

Floppies I understand, but...

[Anonymous Coward]

What's wrong with BlackBerries? I know they aren't in style anymore, but what do they have in mind as a replacement that is powerful and secure enough for government? iPhone? WP8? Don't make me laugh!

Re:Floppies I understand, but...

[pigiron]

Blackberries are easy to type on because of their real keyboards.

Re:Floppies I understand, but...

[AK Marc]

They are expensive for what they do. An Android fork that used government servers, rather than Google, for everything would be similar in functionality and security, with no licensing cost, and run on much more hardware.

Re:Floppies I understand, but...

[Anonymous Coward]

Sure, as long as you define "easier to type on" as, "easier to mash multiple/incorrect keys because of their tiny physical aspect"

It is unsurprising that virtual keyboards have won out in the market against physical ones. They are cheaper to produce, less likely to fail, easier to use, and free up space for other purposes when not needed. The physical keyboards were only superior back in the early days of smart phones when the virtual keyboards hadn't really been figured out and touch screens were not that good.

Re: Floppies I understand, but...

[Anonymous Coward]

Hardware made by China? Fuck off.

Re: Floppies I understand, but...

[AK Marc]

Are you asserting there exists no Android phone with less Chinese content than any Blackberry?

floppy disks don't contain silicon ICs

[lkcl]

wait... floppy disks are a particularly coarse-grained media, meaning that they are quite likely to survive (in storage) for a very long time. also, they don't contain silicon ICs. does anyone remember the great idea of SD Cards with built-in OSes and a WIFI antenna, and how those have been used as spyware tools? likewise USB sticks could have absolutely anything in them. so i don't think it's such a good idea for the whitehouse to move away from floppy disks.

blackberries on the other hand, i heard a story back in 2007 that the entire email infrastructure at the time ran off of *two* machines (two physical machines). one for the US, one for the rest of the world. i trust that the whitehouse email doesn't go through a single server. that would be... bad.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

While the worry about the security of USB drives and memory cards makes sense, floppies aren't exactly reliable media, nor can they hold much data. Writable optical disks also lack ICs, but at least can hold much more data (and have much better transfer speeds to go with their greater capacity), although they also fail pretty often. Of course, the limited limited storage space might be a feature, not a bug, if the reasoning is paranoia about data leaking.

Re:floppy disks don't contain silicon ICs

[serviscope_minor]

Not really survivable.

Or more to the point, not any more.

Back in the day, floppies were amazing. Quite pricy but nuless you slid your finger across the surface (later slid the cover open and did the same), or hacked it apart with scissors, they basically worked and retained data very reliably.

They were quite expensive.

Somewhere towards the end of their reign of dominance, more when they started to be pushed out by being too small to be of any use and cheap CD-Rs (not USB back then---it worked like crap) they got super cheap and started to massively suck. Some would work only a few times before conking out.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

That, and the fact a floppydisk does not receive electrical current (only rotation), means you can scan floppys for electric charge and electronics (as easy as passing them through a airport-scanner), and if not found, certify them as floppies. But certifying an USB medium (as already described by parent) is much harder.
For larger amounts of data, one can use an encrypted harddrive, 4 eyes principle, where keys are split up into 2 sides, and both the drive carrier, as the data handler need to be present to activate it. HDD can get reset before AND after each use. Some systems are just not networked, it makes them more secure.

However, make no mistake, you can fit a large amount of text in a floppy using compression, and extra sectors, and what not.

Re:floppy disks don't contain silicon ICs

[AchilleTalon]

blackberries on the other hand, i heard a story back in 2007 that the entire email infrastructure at the time ran off of *two* machines (two physical machines). one for the US, one for the rest of the world. i trust that the whitehouse email doesn't go through a single server. that would be... bad.

This has nothing to do with the BlackBerry as a solution and everything to do with the infrastructure they put in place to support them. It can be fixed without changing any BlackBerry.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

floppy disks don't have HOSTS FILES.

this is a major security RISK.

time to UPGRADE.

Re:floppy disks don't contain silicon ICs

[buckfeta2014]

Last time I remember using a floppy, I formatted the disk, put some files on it, and walked across the room. The PC I put the floppy into didn't even see that it was formatted. Put the floppy back into the first machine, and sure enough, it was blank. Fuck Floppies.

Re:floppy disks don't contain silicon ICs

[elgatozorbas]

Back in the day, floppies were amazing [...] they basically worked and retained data very reliably.

Not by today's standards they didn't. Anything remotely important, I would put on at least two floppies. I still need to experience the first USB stick failure.

(Okay, okay, USB sticks may fail too, I know, but not nearly as often as floppies).

Re:floppy disks don't contain silicon ICs

[serviscope_minor]

Compared to when?

IFrom what I remember, the downturn happened sometime in the early mid 90s. Before, floppies were -reliable-. I used floppies a *LOT* more than USB disks since I didn't have a hard disk so I used them for literally everything.

And failures were rare.

I've had dead flash disks too, but not nearly as many as floppy failures later on when the price plummeted and the build quality went to crap with it.

Re:floppy disks don't contain silicon ICs

[__aaclcg7560]

Keeping a magnet inside your pants pocket helps neither floppy disks nor sperm count.

Re:floppy disks don't contain silicon ICs

[SuricouRaven]

Static magnetic fields have no affect on humans at all, or most other forms of life. Changing ones have to be running at a silly intensity to do anything, though if you crank them up enough you can jam areas of the brain. It's useful in research for safely probing things without having to open the skull.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

If you had gone to a real school instead of city college, you might know how real biology works instead of superstitions.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

I think you're looking at the past through rose-coloured glasses. I've been using floppies from when I first got my 286 in the late eighties until the late naughties when technology advances meant that I didn't really have to transmit data between different computers that often. (And when I had to, the amount of data was generally to big for floppies to be a practical exchange, let alone storage, medium.)

Throughout that period, I had to throw away about one in ten floppies and haven't experienced big quality differences. I also often had problems where a floppy would be readable in computer A but not in computer B. When you formatted it on computer B, even though both computers used the same OS, format parameters and file system, it would be unreadable on computer A. And the floppies that I didn't have to throw away tended to develop bad sectors over time, or they just tended to lose data because they slowly lost their magnetisation. Failures rates were also pretty inconsistent even between different batches of the same brand. I've seen boxes from the eighties that still work, and boxes from the same brand and time period where every single one was unreadable. I think about half of the really old floppies still work.

For comparison, I've had only one USB stick fail on me. The controller overheated and burnt. And I haven't had a single SD or micro SD card fail on me. In theory they fail after a certain number of writes, but apparently it isn't easy to hit that limit in practice.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

Did you even read his comment before you responded? The last part spesifically mentions the downfall in quality, maybe you just don't remember the good ones, or never spent more then 2$ on a 5pack?

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

This was also my experience. 3.5" floppy's manufactured before 1992 worked fine. In the UK a chain of computer shops called Escom opened around 1992/1993.
They sold the cheapest floppy disks in town. They came ready formatted and norton disk doctor found a bad sector or two on half of them new out of the box.
I bought a few box's then threw them all away a few months later. I only bought TDK floppy disks after that.

Re:floppy disks don't contain silicon ICs

[serviscope_minor]

I think you're looking at the past through rose-coloured glasses. I've been using floppies from when I first got my 286

A 286 would have a hard disk, so you'd do a lot of stuff off that. I was thinking of my old beeb which had a 5.25" single floppy drive and an audio cassette adaptor. Every time I wanted to do anything at all, I'd have to load something from the disk, and any time I saved anything, that went to the disk as well.

For this they were used more for local storage than transmitting data between computers.

But yeah, modern flash storage is mor relaible than the old disks. But I still think floppy disks got much worse by the mid 90s than they were earlier.

Re:floppy disks don't contain silicon ICs

[mjwalshe]

I suspect there is an entire private infrastructure used just for government BB's

Re:floppy disks don't contain silicon ICs

[AK Marc]

Quite pricy but nuless you slid your finger across the surface (later slid the cover open and did the same), or hacked it apart with scissors, they basically worked and retained data very reliably.

The disk drives for a C64 would wipe floppies. Take a disk out, put it on top of the drive. Put #2 in, #1 is now unusable. It wasn't every drive, but it was a common problem at the time. I had a friend with one. Also, I've seen a USB left in a pocket survive a wash cycle. It wasn't water or weatherproof. I've never seen a floppy work after being dunked in water, though I hadn't tried that much. Floppies are more fragile than USB drives. At least from my experience.

Re:floppy disks don't contain silicon ICs

[AK Marc]

And is fixed by the government and any enterprise that runs their own servers. Funny how blackberry is the only company that sells government-proof phones, and is the only one being kept alive by government contracts.

Re:floppy disks don't contain silicon ICs

[Lehk228]

. I still need to experience the first USB stick failure.

I have two old ones I can lend you to help you out on that. one is 128megs the other is a 1 gig.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

You're right about the timing of the downturn. What happened was they started to make the cases out of thinner plastic, which made them flexible and lighter. Among other changes. Your $2.50 disk from 1990 would weigh about four times as much as one from 1996, and last infinitely longer.

It was especially bad in shared operations, such as a university with shared computer labs, because all the cheapos would get terrible disks they'd drop in their bag, which would get bent and damaged, and those scratches on the surface (and other foreign objects) would cause damage to the floppy heads, which would in turn cause damage to even the sturdiest of 3.5" floppy disks. To keep your floppies running well, you had to have a reader that you kept running well too.

Very similar to the ZIP drive "click of death".

Re:floppy disks don't contain silicon ICs

[__aaclcg7560]

I wouldn't brag about having a university degree while wallowing in student loans that you can't ever pay off.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

I experienced that one. Not too fun. It was mostly do to hasty unpluging.

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

I'll come out of the wood work for this one. 286's could have a hard disk, and most did; however, the original IBM-PC typically came with only two floppies (one for the os / program, one for the data, if present), and that meant that 286's had to have a floppy to be of any practical use. Without a floppy, you couldn't really do the sneaker net dance to get the data into the machine (or off the machine).

Re:floppy disks don't contain silicon ICs

[Jane Q. Public]

Before, floppies were -reliable-. I used floppies a *LOT* more than USB disks

You want reliable? At the time paper tape was more reliable than either floppies OR hard disks OR magnetic tape.

Granted, the data density was low. But as long as you took care of your tape spools, they never wore out, never dropped a single bit.

But while that is 100% true, I don't think anybody wants to go back to those days.

Re:floppy disks don't contain silicon ICs

[_xeno_]

I can tell you about my most common mode of USB stick failure, and it's something I never had to worry about with floppies:

Kneeing the damned things such that I break the USB connector while it's plugged into the side of a laptop. OK, so yes, that's my own damned fault. But still, I never did that with a floppy...

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

Put them in the fridge for a bit or bend them to one side (have to hold for the entire time using them) to make a connection and they might work again :)

Source - working at a large school these tricks worked most of the time to recover student data (others required recovery tools like photorec)

Re:floppy disks don't contain silicon ICs

[tlhIngan]

Somewhere towards the end of their reign of dominance, more when they started to be pushed out by being too small to be of any use and cheap CD-Rs (not USB back then---it worked like crap) they got super cheap and started to massively suck. Some would work only a few times before conking out.

I've found the 3.5" ones to be fairly reliable, even near the end. The ones that were HORRENDOUSLY unreliable were the 5.25" ones, because the 360K and 1.2MB ones were physically incompatible with each other (the 360K had tracks twice as wide as the 1.2MB version). While a 1.2MB drive could reliably read a 360k floppy, it could not write to them reliably because they only wrote half the track. The end result was something that maybe-kinda-sorta could work in a 360k drive.

The 3.5" disks generally tended to be reliable for a year or so - even the bottom of the basket AOL ones. After that, if you weren't using name-brand disks, it isn't reliable - the coatings start to flake.

At least Sony when moving from 720k to 1440k (or "1.44MB" - using *both* binary and decimal prefixes in the same measurement!) made them completely compatible.

Re:floppy disks don't contain silicon ICs

[serialband]

Old Floppies were made to be very reliable. They became unreliable when AOHell started dumping their software all over. They needed the cheapest media possible for one time use distribution and the suppliers accommodated them. Once the cheap floppies were being produced, the suppliers decided they could sell them to regular consumers and undercut the other manufacturers in pricing. When they failed, consumers would just buy another batch I still have old floppies from before the dumping that were quiet heavily used and still read just fine on a few antique systems I've kept. Floppies that came on the market after the AOHell dumping would die after a few read/write cycles, just enough for a dumb consumer to load AOHell onto their system. AOHell basically destroyed floppies.

Re:floppy disks don't contain silicon ICs

[Lehk228]

both failed with data integrity issues, the 128 meg one will randomly wipe itself the 1 gig one corrupts files

Re:floppy disks don't contain silicon ICs

[Anonymous Coward]

i don't think the floppies got bad, they were extremely simple in construction. if anything it was drive construction that got worse, some pc's like dells had a slot for the floppy drive built into the case, not a rectangular hole and they werent good at keeping dust out and the head aligned. i remember losing a months classwork that i had on a floppy and when i pulled open the cover there was a circular mark around the disk where something metal dragged on it, killed several floppies with that drive until i realised what caused it.

I think sneakernet floppies are a good idea

[Anonymous Coward]

For a security sensitive place, like the US govt, I think lack of networking, and using floppy disks to transfer files is a good thing. It is harder to sneak out large amounts of data undetected. Doesn't the Kremlin use typewriters now?

Re:I think sneakernet floppies are a good idea

[SternisheFan]

For a security sensitive place, like the US govt, I think lack of networking, and using floppy disks to transfer files is a good thing. It is harder to sneak out large amounts of data undetected. Doesn't the Kremlin use typewriters now?

Yes! http://www.telegraph.co.uk/new...

A source at Russia's Federal Guard Service (FSO), which is in charge of safeguarding Kremlin communications and protecting President Vladimir Putin, claimed that the return to typewriters has been prompted by the publication of secret documents by WikiLeaks, the whistle-blowing website, as well as Edward Snowden, the fugitive US intelligence contractor. The FSO is looking to spend 486,000 roubles – around £10,000 – on a number of electric typewriters, according to the site of state procurement agency, zakupki.gov.ru. The notice included ribbons for German-made Triumph Adlew TWEN 180 typewriters, although it was not clear if the typewriters themselves were this kind.

The service declined to comment on the notice, which was posted last week. However an FSO source told Izvestiya newspaper: “After scandals with the distribution of secret documents by WikiLeaks, the exposes by Edward Snowden, reports about Dmitry Medvedev being listened in on during his visit to the G20 summit in London, it has been decided to expand the practice of creating paper documents.”

Unlike printers, every typewriter has its own individual pattern of type so it is possible to link every document to a machine used to type it.

Re:I think sneakernet floppies are a good idea

[__aaclcg7560]

Today's typewriters are pure crap compared to the typewriters from 20 to 30 years ago. Back then you could to go to Gemco to look at a dozen different typewriters from the clunky manual typewriters to electronic typewriters with the little spinning ball type head. Those were built to last. I gave up my typewriters in the mid-90's after the college library got a bunch of Macintosh SE and a laser printer. Writing on the computer became the hip thing to do. Took a few years before the anti-computer zealots in the English department got the memo that laser-printed pages were acceptable for class assignments.

Re:I think sneakernet floppies are a good idea

[CanEHdian]

How Delisle spied

Information presented at Delisle's bail hearing detailed how Delisle would browse for material on the secure computer at Trinity, save it in the notepad feature, then transfer it to a floppy disk drive. He would take the floppy out of the secure computer, transfer it to an unsecure system and make a USB copy.

Re:I think sneakernet floppies are a good idea

[Anonymous Coward]

Today's typewriters are pure crap

Just like a city college.

Re:I think sneakernet floppies are a good idea

[phantomfive]

Unlike printers, every typewriter has its own individual pattern of type so it is possible to link every document to a machine used to type it.

That's a good point.

Re:I think sneakernet floppies are a good idea

[__aaclcg7560]

Just like a city college.

Spoken by someone who is stuck with student loans for eternity by getting a university degree. I worked and paid for my first associate degree. Uncle Sam paid for my second associate degree with a $3,000 tax credit. Except for one year at the university that got me stuck with a $2,500 student loan for ten years, I'm not wallowing in student debt.

Re:I think sneakernet floppies are a good idea

[Anonymous Coward]

I'll second this. People went to college expecting their financial woes to be nearly over; but, since they didn't learn how to handle money before they got there, the leveraged their future for a very nice "now".

I worked part time jobs, killed my savings, and joined the military as a reservist to make ends meet. When I got out, I had nearly nothing in my pocket but owed $0. It allowed me to take jobs that were good for my career, and to live on those jobs. I realized I made a career choice mistake, and went back to school to do it again (and apparently with the right career this time). Again, I borrowed nothing.

Bad money management coupled with borrowing seems like a slam dunk for financial instability; however, the students keep blaming the colleges. I went to a city college, and came out a winner; but, it wasn't because of the city college; it was because I took responsibility for my future. Stop diverting blame, and then one can learn from their mistakes. After all, you are the only variable you can change in the entire game of life, so why build a rule system (blame others) which prevents you from changing anything?

Re:I think sneakernet floppies are a good idea

[wvmarle]

So those sanctions against Russia target the wrong products!

The purpose of sanctions is to hurt the government rather than the common people. I don't think there are many people that depend on typewriters nowadays, so banning the export of typewriters and their supplies to Russia would paralyse the government while leaving the common people alone. As an added bonus, it'd have a much smaller effect on European farmers than the current boycotts have.

Re:I think sneakernet floppies are a good idea

[ausekilis]

For a security sensitive place, like the US govt, I think lack of networking, and using floppy disks to transfer files is a good thing. It is harder to sneak out large amounts of data undetected. Doesn't the Kremlin use typewriters now?

...

Unlike printers, every typewriter has its own individual pattern of type so it is possible to link every document to a machine used to type it.

That's not entirely true. Printers will output small dots intended to be invisible to the naked eye (they're tiny and yellow). This is called printer steganography. While not all of them have been decoded (as of whenever that was updated), the assumption is that the marking can uniquely identify an individual printer and printout by serial and date/time.

Well understood technologies ...

[MacTO]

There is a chance that the Whitehouse is using obsolete technologies because that's the way that things were always done. Yet there can be other reasons behind it.

Consider that floppy diskette. Assuming the OS is properly configured, a disk is a disk. Contrast that to a USB flash drive: is it behaving as a flash drive, or is the firmware causing it to behave as something else? Contrast that to a network connection: properly handled physical media has a clear chain of responsibility, while network connections (even internal ones) may be managed by many more people and have more access points. Yes, there are ways to deal with security in such situations. No, they are not foolproof. That's particularly true with high-stakes institutions like the Whitehouse.

Another consideration is the providence of the technology. It is bad enough when you have to go through a single vendor (e.g. Blackberry or Microsoft) or are dealing with contractors. Many modern technologies make things worse by being a service. Products become property of the government when purchased. Contractors can be replaced when contracts come up for renewal, or in the intervening period if terms are violated or appropriate clauses are added. Services are a different issue though, and that's exactly what a lot of modern "technologies" are. Does the Whitehouse want to create a situation where another party has control over their data. Even if they could guarantee the security and portability of the data, it could be difficult to find or create a replacement. Businesses take advantage of this difficulty all of the time, and literally milk the government because of it. In most cases it is because of the cost of complying with government regulations. In the case of services, it could simply be because there is no alternative.

Re:Well understood technologies ...

[Anonymous Coward]

literally milk the government

I don't think that means what you think it means.

Re:Well understood technologies ...

[DerekLyons]

She complains of having to use a laptop from 2013? WTF? The same goes for the Blackberry, if it's doing it's job - what's the problem that it's not "cutting edge"?

The problem here isn't the technology the White House is using, the problem is a manager without a clue. (Which shouldn't come as a real surprise, as she doesn't appear to have any actual qualifications for the job other than having worked at Google.)

Re:Well understood technologies ...

[Simulant]

She complains of having to use a laptop from 2013? WTF? The same goes for the Blackberry, if it's doing it's job - what's the problem that it's not "cutting edge"?

The problem here isn't the technology the White House is using, the problem is a manager without a clue. (Which shouldn't come as a real surprise, as she doesn't appear to have any actual qualifications for the job other than having worked at Google.)

Is she complaining or the NYT? I couldn't tell.

Re:Well understood technologies ...

[AchilleTalon]

She is, read again. She even complains her young son asked what it was, about the laptop. I don't know how old is her young son, but I don't see much difference between a 2013 laptop and a 2014 laptop, in particular it is not like 10 years ago when after 18 months your laptop was obsoleted by the new faster CPU on the market. Today, we have reached a plateau, I have an even older laptop than hers and I don't see why I should change for another one, I will not get a better performance or the gain will be so tiny it doesn't worth to bother.

Re:Well understood technologies ...

[Anonymous Coward]

One of those two inch thick Dell laptops is substantially different than a MacBook Air. I think it is probably a question of make and model, and not vintage.

Re:Well understood technologies ...

[AK Marc]

I have a 10 year old laptop that would still be in use (as a kid's play machine) if the hinge didn't break. It looks like any other laptop. Aside from the beige/brown color, a Toshiba from the '90s looks like a modern laptop, even if thick. Not like the Compaq "portables" I had back in school. They really are a WTF compared to today's laptops.

Re:Well understood technologies ...

[iamacat]

Uh.. no! There are no sane reasons for using 1.44MB storage medium. I would fully understand CD-RW, zip drives or sd cards for reasons you described. And if you don't want to depend on single vendor, Blackberry is not the best choice.

White House floppies

[AndyCater]

Competent CTO - check.
White House CTO - check

MIT and Google - check.

Woman - check. Cue misogyny on all sides.

Parent - check. Cue incredulity that she can combine work and family life.

Lesbian - check. Oh, that's OK - her marital status gets a mention as does the fact that she's separated (so presumably her estranged wife is looking after the kids for her.)

Any chance of a sensible in depth, hard hitting article detailing how well she's doing in the teeth of opposition, lack of mandate and innate technical conservatism?

Re:White House floppies

[Anonymous Coward]

Go ask Anita Sarkessian or Leigh Alexander, I'm sure they'll write it for you.

Re:White House floppies

[Anonymous Coward]

their tech staff being competent or not is immaterial.

my guess is that these are are used for sneakernet short term transfer of data between offices and departments where network storage is impractical or not desired. with sealed envelopes, documented chain-of-custody and the whole nine yards.. with that in mind...

floppy disks are more easily destroyed when needed, super cheap, contain no electronics inside, and textual documents fit nicely on them, save for things like the full budget

flash drives hold insanely more data so when one goes missing it's a much larger issue, have electronics, plug into an external port that itself is a security risk to have active and available on computers, is more reliant on overseas manufacturers to produce, and is less environmentally 'friendly' when destroying them.

sounds like they know what they're doing. the white house is not your typical 'enterprise'.

"Can... no... authority... make a difference?"

[Anonymous Coward]

No, she can't. And it doesn't matter if you replace "President" with "CEO", the job of CTO is incredibly frustrating.

The reason is the "business side" in north america and the UK have great distain for technical people, and the CTO is often seen as that annoying guy who (stupid) customers seem to connect with. In Germany, China and Japan, the technical side actually does have authority for technology (imagine that!).

Re:"Can... no... authority... make a difference?"

[geoskd]

The reason is the "business side" in north america and the UK have great distain for technical people, and the CTO is often seen as that annoying guy who (stupid) customers seem to connect with. In Germany, China and Japan, the technical side actually does have authority for technology (imagine that!).

That "Business Side" you seem to disrespect so much, pays the bills. CTOs have a bad habit of forgetting their place. IT is a cost center, not a revenue center. As such, their role is to provide the required services as cheaply as possible. If they are having trouble doing their job its because they have failed to understand the business role they are primarily supposed to fill. If they feel something needs to be done, they should do the cost/benefit analysis and present it. If it is compelling then they will have no problem getting what they want. If its not, then there really is no justification for it anyways. This is the fundamental truth that many IT people simply don't get. Companies are about making money, not making peoples jobs easier.

Seen another way, if a change is proposed, the math to figure out what to do is stupid simple: If the cost of making a particular change is less than the amount of money that change will save, then do it. If its more, or if its roughly equal, then no dice. End of Story

Re:"Can... no... authority... make a difference?"

[Anonymous Coward]

Bzzzt, Wrong. That's the CIO's responsibility.

CTO is the technology that the company makes and sells. In other words, the real business. The rest of the world knows this, you American 'FIRE' people think you know, and it just makes it easier for us capture all the value of your Tech (or, should I say, marketing) companies :-)

CEO and former CTO here, Jackass :-)

Re:"Can... no... authority... make a difference?"

[geoskd]

CTO is the technology that the company makes and sells. In other words, the real business.

Only if a company makes/sells a technology product. In other cases (such as government), CTO and CIO are used interchangeably to mean CIO. We are discussing a government entity here, and there is only a single CIO/CTO officer (as evidenced by the fact that, PTFA, the various departments CIOs report to this CTO.

Re:"Can... no... authority... make a difference?"

[Anonymous Coward]

The business side of things isn't disrespected because it's the business side, it's disrespected because it so often acts disrespectable.

There have been examples of IT driving businesses into the ground, but it's usually stupid business people making stupid business decisions that do it.

If instead of trying to put IT people in "their place" people like you tried to treat their coworkers with respect you might just find your results and performance improve a bit.

I don't see the problem.

[Justpin]

Back in 6th form college (16-18 UK education) the only place with fast internet was the college. As such we would turn up with huge sports bags filled with floppies to download big files and the files were often split into how many ever floppies was needed. There were some funny ones where 1gb files were split into hundreds of floppies. Invariably when you joined the file back together one of the floppies would be corrupt. Anyway I'd say that it is MUCH harder to smuggle large amounts of data out using floppies than SD cards and therefore it is probably strange but semi effective security system.

Re:I don't see the problem.

[Anonymous Coward]

You can buy a Sony Floppy Disk Adaptor for $50 that has a built-in memory card adapter.

Re:I don't see the problem.

[Anonymous Coward]

LUL WUT?

You DL'ed 1 GB of shit onto a "sports bag" of floppies?

BS!

Bad Sectors!

[Anonymous Coward]

Floppy disks did not survive in storage or in everyday use. They were an unreliable temporary way to store data. They often developed bad sectors. Those of us around back then will remember people bringing disks to us that they could not longer read files off of, and having to use things like Norton Utilities to try to recover data, which was often as not unsuccessful.

I had a huge number of floppy disks in storage in the 1990s, and copied them to more reliable media - what I could of them - a lot of them had errors.

Re:Bad Sectors!

[Pinkfud]

Yep. I had a huge box of them from the 90s and one day I decided to copy anything useful from them while I still had a computer with a floppy drive. Total waste of time - not a single one was readable. Oddly enough, more than half showed as not even being present at all. No disc in drive. That's a pretty bad failure!

Re:Bad Sectors!

[cbhacking]

Did you check that the drive itself worked? I've seen the drives go bad from long-term disuse, though admittedly that was in an area where the humidity rarely drops below 90% and the ocean is a few feet away, so it was rather hostile to electronics. We used to need to open up the laptops' keyboards and clean all the contacts about every other month. Good luck trying to fix a modern laptop in a similar situation...

Re:Bad Sectors!

[Teun]

Weird, a few months back a client asked for data from the early 90's and I checked around 30 floppies that were 'in storage' like 'not yet thrown out'.

I was able to read all of them, no failures.

At the time I was already backing them up to Zip drives and they are also very reliable.

Re:Bad Sectors!

[ColdWetDog]

I was able to read all of them, no failures.

I think he was referring to the data, not the label on the outside of the disk.

Where do they get floppy DRIVES?!

[Anonymous Coward]

Where do they get drives for their floppies? Laptops no longer have them. I haven't had a tower with a floppy drive this century. Mobos no longer have the floppy connectors, it's all SATA now. Does every government employee get a USB floppy drive?

Re:Where do they get floppy DRIVES?!

[damnbunni]

You can still get motherboards with floppy connectors, though you have to shop around a bit.

Usually not 'gamer class' boards, but some workstation and server boards have 'em.

Alternately, you can use an IDE or SCSI floppy drive, though those are getting hard to find too. (And they're all old.)

Re:Where do they get floppy DRIVES?!

[buckfeta2014]

Iomega. They make USB-based floppy drives still.

Re:Where do they get floppy DRIVES?!

[cbhacking]

My motherboard (a bit over two years old, gamer-targeted) has the option to boot from USB floppy drive, but I don't believe it has actual headers for a floppy interface. I'm not sure it even has IDE, though. It apparently thinks that 12 SATA3 and 6 SATA2 connectors is enough... well, and a bunch of USB ports and headers, including USB3.

Re:Where do they get floppy DRIVES?!

[__aaclcg7560]

Where else?

Re:Where do they get floppy DRIVES?!

[__aaclcg7560]

MicroATX boards are likely to have legacy connectors (i.e., floppy, IDE, parallel and serial).

Re:Where do they get floppy DRIVES?!

[Anonymous Coward]

As far as I can tell, Iomega hasn't made USB floppy drives for at least a couple years. The only USB floppy drive vendors I can find that aren't from sketchy NOS discounters are Syba, BYTECC, Nippon Labs, and Sabrent.

Re:Where do they get floppy DRIVES?!

[Joe_Dragon]

just about all boards now days have USB boot that also works with USB floppy drives as well.

Nothing wrong with Blackberries

[MikeRT]

I have a Z10 running 10.2.X. It's a very nice phone and a good replacement for the piece of garbage my iPhone 4S turned into when I made the mistake of switching to iOS 7. Cost me $200 for a well-designed handset that has user-replaceable batteries, a mini-SD card slot that cheerfully takes a $25 64GB card and runs plenty of Android apps. Personally, I even find the OS to behave much like how I WISE iOS would behave (hint: UI is very similar, but has some nice Androidish features like a file manager that is very well designed).

What's the argument? Not a lot of apps? That's an argument in its favor with the federal government. Enterprise management is very easy and straight forward for the federal government too. BYOP has absolutely no place in the federal government.

Re:Nothing wrong with Blackberries

[urbanriot]

What's the argument? Not a lot of apps? That's an argument in its favor with the federal government.

Have you ever put a Blackberry owner in a room with a Google or iPhone zealot? Certainly the majority of people use their phone and plenty think it's great without trying to convince everyone they need to switch immediately, but this woman comes from Google's Google Glass division, so of course she'll claim that moving anyone towards Google is an 'upgrade'. I'm certainly interested to hear her explain how moving from, arguably, the most secure phone, to the phone with the most malware is an 'upgrade'.

Re:Nothing wrong with Blackberries

[Anonymous Coward]

As a former RIM employee and now working for a competing cell phone manufacturer, I can tell you that I miss my BlackBerry daily. Sure, there are thousands of apps that BB doesn't have, but I don't care about that. I want a communication device. Something that does email. And has an excellent phone. And a unified inbox. And a calendar that actually works. The competition is 15 years behind BlackBerry when talking about email & voice integration.

I casually toss my BB onto my desk when I get home. I carefully place my mobile now. It's already broken multiple times. Oh, and the lack of a physical keyboard means that real typing is nearly impossible. I once dealt with 200+ important emails a day and composed many. Now, I don't even bother trying because it's way too frustrating.

If you want a mobile computer with plenty of games and apps and also kinda shows you email and has an okay phone, you probably already have one. If you want an adult's communication device, get a BB.

Perhaps Ms Smith is having trouble convincing people to switch because she's simply wrong.

Re:Nothing wrong with Blackberries

[Octorian]

Remember that many places are still running older devices (e.g. Bold 9900) with their old operating system (OS 7.x or below). This old OS is what everyone continues to point to and make an example of when complaining about the company and their products. Often this is done in an atmosphere of complete denial at the very existence of their newer OS and products.

I wouldn't be the least bit surprised if the Whitehouse has not yet upgraded their devices and infrastructure from BB7 to BB10.

Some comparable jumps in the computer world would be Mac OS 9 to 10, or Windows 3.x to NT/2000. Yes, its that big a change. No, it doesn't happen quickly. In the interim, there's a lot of overlap and strong opinions that are dismissive of the newer product.

Re:Nothing wrong with Blackberries

[avandesande]

There is an Android emulator for Z10 if you need other apps.

Re:Nothing wrong with Blackberries

[Anonymous Coward]

My Z10 weights so much that it couldn't possibly be moved without a truck of some sort. The water cooling system alone weights a ton. The number of apps is not the primary concern when using it as a portable phone, but it looks nice.

She is a Mechanical Engineer??

[Anonymous Coward]

If you read the article, she took her brother's bike apart to see how it worked when she was 14, then left the parts in a bucket. A REAL MECHANICAL ENGINEER (her degree from MIT??) would have been able to reassemble it. IMHO, like most managers, she lacks any technical know how. But that's not a problem if you have minions to wok out the details.

Re:She is a Mechanical Engineer??

[Hognoxious]

Reassemble it better than it originally was, and still have parts left over.

In the snow.

Re:She is a Mechanical Engineer??

[Anonymous Coward]

To her credit, she got the "parts left over" right.

Re:She is a Mechanical Engineer??

[__aaclcg7560]

My father's one-ton flatbed truck blew a hole in the engine block. After it came out of the shop, he discovered that the mechanics had switched out the standard bolts for metric bolts. That pissed him off to no ends. He borrowed a metric tool set from a neighbor and we spent a summer day replacing all the bolts. Somehow we ended up with extra bolts -- both standard and metric -- than we started off. The truck ran. After ten years and a million miles, he sold the truck to a guy who lost his flatbed truck in a wreck but kept the engine block.

Re:She is a Mechanical Engineer??

[Anonymous Coward]

I guess your father also had a city college education.

Re:She is a Mechanical Engineer??

[ColdWetDog]

It the motorcycle racing world, we called that 'adding lightness'.

Re:She is a Mechanical Engineer??

[__aaclcg7560]

My father graduated from the eighth grade in the 1950's, which was the equivalent of a four-year college education today. He worked for the same construction company for 50 years and three generations of owners. Most university-trained architects believe they are gods and their drawings are perfect. Yet he routinely dissected their drawings, finding mistakes and implementing fixes.

Floppy bad reputation undeserved

[Anonymous Coward]

Floppies get a bad rap as unreliable due to the junk China-made disks and drives manufactured @ the mediums end of life from 1998+.

I have to use these things everyday in computer-controlled machine tools, and media/drive quality matter 100%.

IME, 20 year-old 3M-branded floppies from Ebay paired with drives made from cast aluminum frames are reliable (old school Teac/Sony/Panasonic drives).

Remeber, this was the mainstream distribution media for software for ~30 years (how often did you have to return original SW due to a bad floppy?). It only started to go down hill after the push to obsolete the floppy by Apple. By this point, it was just a race to the bottom and a checkmark option offered by the x86 PC manufacturers.

Re:Floppy bad reputation undeserved

[DerekLyons]

Remeber, this was the mainstream distribution media for software for ~30 years (how often did you have to return original SW due to a bad floppy?).

Never - but that's completely irrelevant to the actual question at hand: how often did disks in use (either read only for software or read/write for data) fail? Plenty. By about 1985 or so I was already in the habit of working from copies of my 'install' disks and routinely backing up my working (data) disks because of these failures.
 

I have to use these things everyday in computer-controlled machine tools, and media/drive quality matter 100%.

IME, 20 year-old 3M-branded floppies from Ebay paired with drives made from cast aluminum frames are reliable (old school Teac/Sony/Panasonic drives).

Curiously (or perhaps not) you insist that quality matters 100% - but you don't tell us anything beyond them being "reliable", which can mean almost anything.

Re:Floppy bad reputation undeserved

[damnbunni]

Did you know that for $30 you can get a floppy-to-USB device?

It's the size of a floppy drive, installs in a floppy bay, plugs up to the floppy and power connectors, and provides a USB port, a couple of buttons, and a numeric display.

You plug in a USB stick, use the buttons to select which diskette image you want to use, and it presents it to the host machine like a floppy disk.

You often see them advertised for Roland keyboards, but they should work with most floppy applications.

Re:Floppy bad reputation undeserved

[xystren]

Remeber, this was the mainstream distribution media for software for ~30 years (how often did you have to return original SW due to a bad floppy?). It only started to go down hill after the push to obsolete the floppy by Apple. By this point, it was just a race to the bottom and a checkmark option offered by the x86 PC manufacturers.

I remember having to send a bunch of floppies with WordPerfect for Dos back to WordPerfect.... But that wasn't due to a bad floppy, well it was, but not due to unreliability... It was due to WordPerfect being shipped from the factory with the Jerusalem-B virus on it.

Managing up

[Anonymous Coward]

I am going to go ahead and assume she is pretty competent at her job.

She is likely to wield power as a subject matter expert. My boss and others ask and act on my opinion on a number of topics. I have no "authority" but still exert influence by controlling the flow of information. Here, controlling means ensuring that the information is accurate and relevant.

Security is most important

[Anonymous Coward]

Her main concern should be security. Protect computers and communication service providers owned or used by the government, military, banks, power stations, emergency responders, water companies, and grocery stores. I hope she's trying to convince Pres. Obama of the need protect them from break-ins, and from disasters like getting hit by a massive EMP.

Protecting grocery stores might sound unimportant, until you imagine what would happen if people couldn't buy groceries.

If you like your floppy you can keep it?

[lennier1]

j/k

To be fair, it depends on the context. A few years ago I was working for a company whose bank still required the large amount of end-of-month transactions for automated processing to be submitted via a 3.5" disk instead of an encrypted connection. Part of the reason why the company eventually switched to a major bank with a decent infrastructure.

Re:If you like your floppy you can keep it?

[__aaclcg7560]

Ten years ago I did a one-night job for IBM where the bank switched from token ring to Ethernet. Never mind that the brand new building was set up for Ethernet. When the branch office moved in, IBM installed 10BASE2 cables along side the Ethernet cables because the bank wasn't ready to transition after using token ring for 20+ years. That was the first and last time I saw token ring in the wilds.

Re:If you like your floppy you can keep it?

[Anonymous Coward]

Not surprising since they only hire city college graduates and not anyone with a real degree who has a clue.

Re:If you like your floppy you can keep it?

[silas_moeckel]

A major health insurance company still runs token ring in their headquarters. Instead of putting in conduit they put token ring into the concrete. Their upgrade so far has been wifi but they are still buying token ring cards that costs more than the laptop they connect to.

Re:If you like your floppy you can keep it?

[__aaclcg7560]

Think god I had a city college education! The contracting company for IBM hired to fresh out of high school students who thought they were hot stuff because they can unbox a Dell computer without looking at the unboxing diagram on the box. The job was simple: unplugged the token ring cable, plugged in the Ethernet cable, and test the high-bandwidth network video application for 300 workstations. They couldn't bother to read the instruction sheet, plugged the Ethernet cable into the token ring card, which supported both 10BASE2 and twisted pair cables, and didn't test the video application to catch their mistake. I made an extra four hours in OT pay and left the job at 3:30AM in the morning.

Life-long lesson learned: You make more money being the guy who cleans up other people's mistakes.

no exactly a "she"

[Anonymous Coward]

Sorry, but she is more of a he. She built things in her childhood, went to a technical U, then married a woman.

Re:no exactly a "she"

[Anonymous Coward]

Sorry, but she is more of a he. She built things in her childhood, went to a technical U, then married a woman.

And you still live in your mom's basement.

FBI uses 8" floppies

[Anonymous Coward]

All of the FBI's case files are stored on 8" floppy and used with some type of CP/M workstations connected to a PDP/11.

There was a push a few years back to modernize the FBI's system, but the controactor ran over budget by something like 100+ million dollars, and they eventually scrapped the whole thing. FBI is back to 8" floppies again.

Not a troll, and I don't know if they ever modernized their systems yet. Probably get their 8" floppies from the same place the Air Force command get them (government warehouse filled floor to ceiling with 8" floppies guarded by snipers and attack dogs).

Re:FBI uses 8" floppies

[Anonymous Coward]

lol i can totally see some obama program propping up 8" floppy manufacturers to keep someone in a job for the sake of a job.

lol

Floppy DISK = SOCIALISM.

Re:FBI uses 8" floppies

[Trax3001BBS]

All of the FBI's case files are stored on 8" floppy and used with some type of CP/M workstations connected to a PDP/11.

There was a push a few years back to modernize the FBI's system, but the controactor ran over budget by something like 100+ million dollars, and they eventually scrapped the whole thing. FBI is back to 8" floppies again.

Not a troll, and I don't know if they ever modernized their systems yet. Probably get their 8" floppies from the same place the Air Force command get them (government warehouse filled floor to ceiling with 8" floppies guarded by snipers and attack dogs).

I can see this happening to the FBI, them using 8" floppies to start; having such a stock pile or library of them they continued to use them from whoever still sales them.

To transfer a vast amount of data from 8" floppies that at the most have just over 1 Mbyte storage http://en.wikipedia.org/wiki/L... would be a nightmare come true.

I can see the concerns of USB drives if autoplay isn't disabled, and other safe guards.

The really odd thing is the treasure department was reference for: ToolsTechniquesProceduresOfTheRSA_HackersRevealed-C5_APT_C2InTheFifthDomain.pdf
plus, I also still have a PDF on how to set up NT to be secure, as the default install was very insure, this released by the FBI.
>>

Can a position with a direct access to the President but no real decision-making authority make a difference?
Megan J. Smith is a very accomplished person, she just might be able to, but it would be a long road to change out every department and not an easy task.

OTOH - Floppies are safe!

[garry_g]

After all, hardly any computers comes with floppy drives anymore ... so unauthorized access is almost completely prevented, better than any software encryption ... :)

Re:OTOH - Floppies are safe!

[Trax3001BBS]

After all, hardly any computers comes with floppy drives anymore ... so unauthorized access is almost completely prevented, better than any software encryption ... :)

I consider myself fairly computer competent but the new mother boards have no floppy access, and the one I have a floppy connection on I can't get a floppy to work, not sure if it's me or the floppy drives being treated so badly in the past they just quit working.

I have lots of 3.5 Amiga floppies (thousands of em) but they take a special floppy as the format is an odd one: 790K not the normal 1.4Meg.

So safe they are.

Re:OTOH - Floppies are safe!

[PPH]

Security through obscurity? I doubt there are many motivated espionage groups who can't get hold of a Kryoflux controller.

Re:OTOH - Floppies are safe!

[ColdWetDog]

Just booted up my Otrona Attache (circa 1982) with 64K of RAM, CPM 2.2 and a pair of DSDD floppy drives.

Still loads up WordStar....

PIP B: = A:*.*

Looks like it's time to mow the lawn.

Re:OTOH - Floppies are safe!

[sa666_666]

Actually, 880K and 1.76MB.

Re:OTOH - Floppies are safe!

[Trax3001BBS]

Actually, 880K and 1.76MB.

I stopped at the Amiga 3, still have my 500, and 2000; at that time they were still 790K*, but talk of increasing them, and they aren't special disk but normal 3.5's

All I ever bought were 1.4K 3.5" I know there was a program to increase this size but it was for the PC which I didn't have at the time. Nor did I use the program as I thought it would cause problems when I did acquire a PC (just to play DOOM, my start in the PC world).

If the densities have been increased I've been unaware of it.

* http://en.wikipedia.org/wiki/F... - claims 720 kB for the Amiga maybe they were they were, I've always thought 790K

"The Amiga was so far ahead of its time that almost nobody—including Commodore's marketing department—could fully articulate what it was all about. Today, it's obvious the Amiga was the first multimedia computer, but in those days it was derided as a game machine because few people grasped the importance of advanced graphics, sound, and video. Nine years later, vendors are still struggling to make systems that work like 1985 Amigas.
— Byte Magazine, August 1994

YUO FAIL IT?

[Anonymous Coward]

FUCKING USELESS gig in front of to yet another to deliver what,

Hmmmm

[DaMattster]

There isn't enough money that Uncle Sam could pay me to be the US CTO. Imagine dealing with that squeaky wheel. It's so old and poorly oiled that it's practically seized. Only the most career-masochistic people would want something like that!.

Floppy Security Concern

[Guppy06]

Now is probably not a good time to continue to use a medium developed by Sony for storing critical information.

Re:Floppy Security Concern

[mjwalshe]

IBM I believe where the developers of th8 inch floppy the gradaddy of the 3.5 I can still remember the distinctive *Granch* sound of the old hard sectored display writers

No

[rainer_d]

Next question?

The most technically-advanced Presidency...

[mi]

Remember all the fans adoring Candidate, President-elect, and even President Obama for his use of Blackberry? While mocking McCain for his inability to even use keyboard (because his hands were repeatedly broken by the People's Torturers in North Vietnam)?

In all likelihood, Megan J. Smith was one of the fans... Possibly, even with a special female twist to it...

Well, maybe, the job of running the Executive government's bureaucracy is just too difficult? TFA certainly suggests that... But that's exactly the job, Obama was hired for, darn it. There were people pointing out his shortage of executive experience — he never ran things (other than a failed charity — once), but this was countered, incredibly, by how he ran his election campaign...

Well, here we go — either he was never as advanced technologically as he and supporters portrayed him, or he has no ability to execute — to run things... Certainly not enough of it to affect the oft-promised change. Management is hard, let's go golfing.

Re:The most technically-advanced Presidency...

[Anonymous Coward]

Isn't that the truth! He can't run a hotdog stand yet somehow, he's qualified to the the CEO of the largest executive position in the world..... Those that were duped need to have their voting rights revoked.

Re:The most technically-advanced Presidency...

[CanHasDIY]

The guy elected previously tanked a baseball team and multiple oil companies. He was voted for by all the people who didn't vote for Obama.

By your logic (or rather, lack thereof), no one should be "allowed" their right to vote.

Re:The most technically-advanced Presidency...

[mi]

The guy elected previously tanked a baseball team and multiple oil companies.

Citations, please.

Re:The most technically-advanced Presidency...

[thrich81]

Well, I realize this is going way off topic, but previous executive and management experience/training has not been an indicator of being an effective US President (or good one, whatever the definition of that is). Example number one: G W Bush -- Harvard MBA, campaigned to "put a CEO in the White House", governor of Texas for two terms -- none of that seemed to help much when he hit the presidency. I know, bringing up Bush when discussing Obama's failings is a new kind of Godwin's law, but in this case the facts of the argument are germane.

Re:The most technically-advanced Presidency...

[CanHasDIY]

http://lmgtfy.com/?q=george+w+...

Was that so hard?

Re:The most technically-advanced Presidency...

[AK Marc]

Bush didn't tank a baseball team. He made millions off it. He bought in, used his "influence" (asking daddy for favors) to get the old stadium re-built at taxpayer expense, and sold off, for a massive profit. He didn't have any real duties, despite an inflated title, and was just there to grease political wheels for a new stadium.

Traditional Republican style, welfare for the rich. A millionaire made milions more off the taxpayers because he got a "free house" but God forbid we let a poor person stay in a state home for a while to get back on their feet after personal problems.

Re:The most technically-advanced Presidency...

[mi]

Example number one: G W Bush -- Harvard MBA, campaigned to "put a CEO in the White House", governor of Texas for two terms -- none of that seemed to help much when he hit the presidency.

Why do you say that? Whether or not he has been a very successful President, any failures were not due to his inability to organize and manage staff — as seems to be the case with Obama in general, and certainly in the case of "floppy disks" in particular.

Re:The most technically-advanced Presidency...

[mi]

Was that so hard?

No, darling, it does not work like that:

-- Your honor, the accused is guilty! Just search Google for evidence of his crimes and misdemeanors.

You make accusations, you supply evidence...

Re:The most technically-advanced Presidency...

[mi]

He bought in, used his "influence" (asking daddy for favors) to get the old stadium re-built at taxpayer expense

Are you going to agree with the Libertarians, that no stadiums should be (re)built at taxpayer expense? Or are you going to claim, some stadiums are more equal than others?

Traditional Republican style

Citations needed — please, supply links, proving, that such "style" is especially prevalent among Republicans. Thank you.

Re:The most technically-advanced Presidency...

[AK Marc]

Are you going to agree with the Libertarians, that no stadiums should be (re)built at taxpayer expense? Or are you going to claim, some stadiums are more equal than others?

Can I just point out that your strawman is a false dichotomy?

One

[Anonymous Coward]

One IT director to rule them all, one floppy disk to bind them.

What is the goal of getting off floppies?

[damn_registrars]

Hopefully the CTO is aspiring to get the white house off of floppy disks for a solid reason beyond just the age of the technology. There is likely a good reason why floppies are still being used and that needs to be taken into mind when trying to replace them with newer technology. After all, we saw an article not that long ago that the nuclear missile sites in the US still use 8 inch floppies, but there is no solid reason to get them away from that.

US Department of Information Technology

[modmans2ndcoming]

Or maybe just an agency under the supervision of a department....but both would require an act of congress. It is the only way to get authority under a CIO position that can affect the entire government through policy...Frankly it should be done from a security aspect alone.

Get with the times

[WorldWarPi]

and use Magneto-Optical, like I do.

what is wrong with BlackBerries?

[Anonymous Coward]

I like them. I like phones with a touch-type keypad like the old Palm Treo PDAs. I must be missing something.

CTO?

[CanHasDIY]

Isn't "CTO" a corporate term? Since when does our republic have corporate leadership?

Screw the floppies, I'm more concerned about the basically open announcement that our government is now fascist, in the most literal sense of the word.

Most geeks seem to think

[Sqreater]

That tech should be bought every six months. The truth in the real world is that once a system is put in place and works, it is kept for as long as it works. The USPS is using many sorting machines that are twenty years old and use ICs from the 70s-80s. Why? Because they work and they have been paid for many years ago. They do the job. At they same time, in the recent decade, the USPS bought and installed a billion dollars worth of flats sorting machinery. Keep what gets the job done. Buy new when the need changes.

Re:Most geeks seem to think

[CrankyFool]

I finally got to the (current, temporary) end of the the comment page on this article, and I find this particular comment somewhat ironic, given that it seems like about 80% of the comments about floppies have been pro-floppy, anti-change-for-change-sake, "maybe there's a very good reason to use floppies in this case."

It may be that most geeks seem to think that tech should be bought every six months, but certainly most Slashdot commenters seem to think otherwise (and, in general, are prone to being luddites, in my experience -- manifested as profound distrust in new technology and a dismissal of any new tech that's not ready to be useful today, right now, in its current state).

Re:Most geeks seem to think

[Sqreater]

I suggest slashdotters are actually not pure geeks, but are really a hybrid geek/responsible-tech-manager entity and that the true geeks don't really show up here. Occasionally one will show up and geek away, but usually, not. Go to Adafruit and watch the geek videos to see a true geek tech environment.

Re:Most geeks seem to think

[Anonymous Coward]

Maybe it has to do with being tired of chasing fads before you even understand what you are implementing. Can you securely wipe an ssd? is it really better to be unable to change your batteries? How many unknown variables do you want to change at a time?

What's Wrong with Government IT

[avandesande]

Lack of trusts and/or connections between networks
duplication of services between agencies

USB is less secure

[mjwalshe]

remember government computing has a lot more security issues than say Sony does especially the president ad his advisors security - at least they haven't employed a female version of Steve Bong http://www.theregister.co.uk/A...

I think sneakernet floppies are a good idea

[Anonymous Coward]

I do not know where you are. But my government secure hole in the ground does not allow you to use floppies, cd, usbs, ect. If it needs to go off the network are be move to another system you need to have a security officer do it for you.

to many Contractors / sub Contractors in gov IT

[Joe_Dragon]

There are to many Contractors / sub Contractors in gov IT. Some of are picked based on how much of a kick back they give out.

And they add a lot of over head as well adding walls of PHB's that get in the way of one team talking to an other team.

Know why they call her "Chief Technical Officer" ?

[Anonymous Coward]

Because you live in a corrupt fascist nazi's wet dream and the USA is nothing more than a corporation.

Security

[Anonymous Coward]

Floppy disks have a un-hackable audible sound/alarm when a program accesses them.

I still use them too.

[antdude]

Well, 3.5" disk(ette)s on very old IBM test PCs to boot off to use Ghost.

Incorrect reference

[techno_dan]

The article never mention weaning off of blackberries, yet your link features it prominently. I for one prefer the blackberry for work purposes, after trying various other devices. To each their own. Just don't state what an article is about, when it has nothing to do with it. State facts. Stop opinionated posts.

deliberately nebulous...lacking in real authority

[Don Faulkner]

her position is deliberately nebulous and lacking in real authority

So, just like every other CTO, right?

Some stadiums are more equal than others?

[mi]

Can I just point out that your strawman is a false dichotomy?

You certainly can, but you'll be wrong — twice.

There is nothing automatically wrong in what Bush did, as you describe it. Maybe, as Libertarians believe, taxpayers should not be (re)building any stadiums at all — this would prevent politically-connected businessmen from profiting from any such projects. This approach would not help you indict Bush, however — as long as public policy provides financing for stadium-repairs, there is nothing wrong in taking part — even if the policy is in error...

Or you can remain in your Statist comfort zone and claim that, although some stadiums should be repaired by the taxpayer, that particular one should not have been. That's what I referred to as "some stadiums being more equal than others". This would make it possible for you to accuse Bush of wrong-doing, but you'll need to explain, why "his" stadium in particular should not have received public money. "Being owned by a Republican" is not a good enough reason.

You can also do both — claim, there should be no tax-funded stadiums at all and that the funding Bush received back then was especially improper. You still need to explain why, of course.

And then you'll still need to substantiate your earlier claim, that this — profiting from taxpayer-funded projects — is an especially Republican "style". Put up or shut up...

Please, don't hate. Thank you.

Re:Some stadiums are more equal than others?

[AK Marc]

There is nothing automatically wrong in what Bush did, as you describe it.

Quote where I said there was.

If you can't do that, you are a lying troll.

Please, don't hate. Thank you.

Then stop lying. I never said anything about any of the tangents you are going off on. You are guessing my personal opinon based on public statments, then attacking me as a person, and ignoring what I said. That makes you wrong, even if you guessed right.

And then you'll still need to substantiate your earlier claim, that this — profiting from taxpayer-funded projects — is an especially Republican "style". Put up or shut up...

George W Bush (R)

Q.E.D.

Re:Some stadiums are more equal than others?

[mi]

Quote where I said there was.

Right here, dear. The post is full of hatred "on" G.W. Bush — explained by his profiting from taxpayer-funded renovations of a stadium.

I never said anything about any of the tangents you are going off on

What "tangents"? You were expressing a clear disapproval of Bush's handling of a sports-team. That's neither a "tangent" nor a "guess".

That makes you wrong, even if you guessed right.

I did guess right, didn't I? Heh-heh...Take your weaseling to Bill Clinton, we are done here.

And then you'll still need to substantiate your earlier claim, that this — profiting from taxpayer-funded projects — is an especially Republican "style". Put up or shut up...

George W Bush (R)

That Bush profited from a publicly-funded project (whether or not there was anything wrong in that) does not mean, such profiting is a particularly-Republican tendency — for all we know, he may have been the sole Republican to so profit in the last 100 years. To claim — as you did above — that it is an especially Republican "style", you need to put up evidence. You had several opportunities to provide a substantiation, but did not — did I say, we are done here?..

Re:Some stadiums are more equal than others?

[Anonymous Coward]

Your strawman argument WAS a false dichotomy, so don't try to change the subject, you fucking asshole.

Floppies

[brunnegd]

So the WH is still using floppy disks. That is what happens,when Harvard professors, long on philosophy and short on the real world, are in charge.

Why diss floppies?

[MoarSauce123]

Floppies will be a new trick in securing data since the majority of folks has no longer access to floppy drives. Heck, many governments even go back to purely mechanical typewriters because they cannot be spied on by US intelligence.