The iPhone has similar issues. JB the iPhone, grab pirated apps from unknown/untrusted repos, shovel them via Installous, and there have been some really nasty things reported.
The average user is not going to be sideloading apps, and if told to by a website, he or she should be VERY wary, and be checking search engines about the app mentioned.
Bingo. I have seen many companies with hacked computers used as launching points for attacks.
If someone coming from a.pk host launched an attack that blew out a bunch of transformers in India, how can one prove that it was someone from the ISI who did it, or a compromised host, and the real culprit is some kid in a basement who wants to see India and Pakistan exchange nukes? There is no certain way to tell.
The fear outshines the facts. A picture of Godzilla will outweigh a hundred statistics saying how dangerous other methods of energy generation are.
The only downside to nuclear power is the fact that contractors can get away with failing to do their part. If there are laws placed to hold people culpable (perhaps something that the company would be immediately nationalized if serious misconduct was found), this would be minimized.
The reward is more than worth the risk. No CO2 emissions. No pollution to the environment. Excellent energy density, so it can be built nearby a city, minimizing loss via power lines. Until fusion becomes a viable energy source, what else can one ask for?
Then stuff gets nasty. We still have plenty of coal. Dirty, polluting, highly toxic lignite coal. Stuff that loves to turn water tables into cesspits that only exotic variations of bacteria can live in.
Lignite coal is cheap, and if push comes to shove, laws (like basic labor, environmental, or safety ordinances) will be set aside to get it.
Want a real solution to the energy problem? Campaign for R&D on the latest generation of nuclear reactors (Gen IV) with an emphasis on traveling wave reactor designs, and designs that are made to not just withstand hazards, but PEBCAK/ID10T errors in construction and installation.
Believe it or not, it was not DoD related in any shape or form. In the private sector, from what I experienced on my job hunt, HR people want to see a TS/SCI clearance because it means that someone, somewhere decided that the person having that cert was worth enough cash to the company to pay to have them cleared.
That is the problem. Most shops have a hiring process that cares more about the pieces of paper, forcing candidates to slap the CCIE, CNE, CCIE, BOFH, BDSM, TL;DR stuff after their names. For a HR rep, they wouldn't even stop to cross check the cert IDs they have. It just means the resume stays on the desk and actually makes it to the tech people.
Here is the Scylla and Charybdis of job hunting: The clued people will see the certs and toss the resume as someone who doesn't have experience other than taking tests. However, to get to the clued people, in most companies, one has to pass the HR droids. They ogle at the alphabet soup of letters, and go "ooo, here is our candidate", passing the resume on, while experienced candidates they look at the resume, go "well, he did run this, this, and this... but he doesn't have any paperwork, so he really hasn't maintained his career. Better off with someone with pieces of paper."
Of course, the best way to bypass that BS is to have contacts, so the hiring process consists of "Well, you got me home after I was passed out in the bushes after that party, so you are hired."
What I do is ask for their cert number. Most places (RedHat, IBM, etc.) will have a cert checker on their website to verify the number they hand out.
If the person can't produce the number, or the number is registered in someone else's name, then it is time to get suspicious and nudging that person's resume towards the round file.
Certs are meaningless to you, and your boss who has a clue.
They mean something to HR and upper management who don't see people's skills. All they see is that candidate "A" vying for a promotion has an alphabet soup of certifications, and candidate "B" doesn't. Guess who gets the promotion, even though candidate "A" may be a "paper MC-ITP?" You got it.
When I was looking for work after I graduated, even with a degree in hand and a large amount of experience in IT before going back to college, for a lot of places, this is how the interview went:
Interview: "Do you have a TS/SCI clearance, or a CISSP? No? Next in line please."
The pretty pieces of paper are PHB food. They are not for the people or their direct managers who actually are in the trenches. However, to get interviewed by the people who actually know their stuff, you have to get past the HR roadblocks, and that means having the pieces of paper (e. g. for a MS admin, a MS-ITP, a bachelor's degree, A+ cert, etc.)
Realistically, when the PS4 comes out, people who buy it will have completely forgotten about GeoHot and the PSN breaches. They will see some cool game (perhaps another Madden release, or another FPS), buy the console, and because they spent the cash for the console, will buy the console's games.
The public has a short memory, unless the press digs it up for them.
You are not the only one. The Android devices I bought were ones which were the easiest to root/customize at the time. For example, the HTC Inspire 4G was remarkably easy to S/OFF, slap ClockworkMod Recovery, and drop a ROM onto.
I also tell people and try to explain to them why a locked bootloader is bad. It does influence purchasing decisions, especially if someone does want to dip their toe with a custom firmware, or just be able to back up the phone's image completely using nandroid.
Now, if HTC can make a decent landscape slider (like the Moto CLIQ) on AT&T's network that is up to par with the latest specs (dual core, decent RAM, etc), I'd pay full retail for it, no questions asked.
Maybe I should have stated this in a better manner:
Lusers are not people who brick phones. Bricking stuff is part of the way of being a good modder.
Lusers are people who brick them, then try to RMA the phone as bad, or flash a ROM that might not be up to snuff in some feature, and then return the phone as opposed to going back to stock, or clicking on ROM Manager and finding another one that may be more stable.
Your first point, definitely. It does make returns and support calls come in. However, it does keep Joe Sixpack from flashing a new ROM, then returning the device because the ROM had faulty BT support.
The second point is different. I have encountered phones that even if you get full root on them and attempt to pull the crapware off, as soon as they are rebooted, they either reload their filesystems, or go into a bootloop until you reflash the stock ROM.
Rooting and unlocked bootloaders go hand in hand. A "#" prompt doesn't help much if any changes result in a bootloop, or that there is a process that checks for anything not on an authorized list and kills anything running not on it.
What is sad is that Motorola has some cool hardware. Take the Atrix for example. If the bootloader wasn't locked, I could imagine using it as a reasonable netbook replacement. It could dump backups to an encrypted filesystem if using Amazon or Dropbox, or via ssh to a private machine at home. Obviously, it would have the functionality of a low end netbook at best, but on the road, that is what is needed, and if the laptop "adapter" is made standard so future products work with it, the $500 or so for that may be worth it, since keyboards and monitors really don't change.
With the Atrix and the Lapdock, that would pretty much deal with what I'd need on the road, for something good enough to check mail, RDP into Windows boxes, ssh into others, and browse the web. As an added bonus, since the phone is on me at all times, i can leave the dock in the car, and if someone steals that, I'm out the cost of that, rather than that + a lot of sensitive data.
However, because the Atrix is so locked down, all that functionality is being wasted. Had Motorola not locked the bootloader and allowed customization, this device likely would have sold a lot better, especially for people who dash out on weekends, and just need as little as possible for checking work stuff.
1: Lusers who mod their phones, "brick" [1] them, then return it. Locking bootloaders means that they don't get returns or support calls on these types.
2: It cozies hardware makers with the DRM culprits who want digital restrictions in every device out there.
3: It makes cellular carriers happy in four ways:
A: If a security hole in Android comes out, and a phone can't be patches, people are likely to upgrade or buy a new phone.
B: Phones won't run the latest apps, due to the inability to be upgraded to the latest Android rev, so consumers will trash the devices for a new one.
C: Carriers can lock out features, add non-removable "branding", etc.
D: Carriers can create their own locked-down app/music stores.
[1]: A lot of people don't understand that for some phones, it takes some effort to truly brick them (as in make them impossible to reflash and get working.) For example, people with iPhones who claim their phone is bricked, but never have bothered to do a DFU restore, people with Motorola devices who have never bothered downloading RSD Lite and flashing a factory.SHX back, or people with HTC phones who can't be bothered with copying a ROM to the SD card and holding down a button when turning the phone on.
Motorola mentioned something today about considering unlocking their bootloaders as well. I hope they do, because it would be a nice change from the previous statement they made last year telling modders to go elsewhere.
Bingo, the more there are bans against sites, the more companies will be stepping up to offer VPN services.
The sad thing is that once people are forced to VPN services, there is nothing countries can do to see traffic, unless try to ban the services. Then a cat and mouse game will ensue.
One feature I miss is a true low level format of a HDD. Now just for overwriting sectors, but for allowing the drive to rebuild its sector relocation table.
Older SCSI drives would mark blocks as bad and relocate the data. When they got low level formatted, the bad blocks would remain bad, but the area reserved for bad blocks would be clear (since the remapped blocks would be flagged as bad and not used.) This would allow the drive to continue to be used, as when the remapped block area fills up, the drive can't do anything except report soft/hard errors.
A true low level format also brought peace of mind -- any data on the disk before that was blanked out, and every usable sector has been tested to make sure it was readable/writable.
Why can't people who design authentication systems understand this:
Don't store the password.
At the minimum, store a hash where trying to get the password is like trying to run a meat grinder in reverse to get the cow back out.
A better way would be to store a salt, XOR the salt with the password, hash that result and store the hash.
Even better would be to store a salt, then encrypt the salt with the key being a hash of the password (the hash is used to act as a 'bit blender' so the entire keyspace is used, not just the space of letters/numbers). Store the encrypted salt, and the plaintext salt. Add rounds of encryption to help against brute forcing at the expensive of slowing down legit authentication. This way, the password is never stored, even "encrypted".
Actually, after caps, comes "premium" sites that don't cost if people visit... however for sites to have this status, they will have to open their wallet up to $ISP.
Next step is "soft" redirection, "Oh, you really wanted Bing, because they actually paid us and Google didn't. Click here to actually go there and pay the bandwidth charges."
Next step is "hard" redirection. Try to get to a non "blessed" site, you get redirected somewhere else. There are no laws against this whatsoever and at all.
Of course, throw in there Phorm-like ad injecting just for kicks and extra ISP revenue.
Funny thing is that Sony could easily have a revenue stream for dedicated computers if they sell unlocked PS3s.
Even if the device didn't have the ability to run PS3 games, I'm sure that they would be quite useful in a lot of applications, from server appliances to firewalls, to compute clusters (a la the USAF's baby.) Because it is a non x86 architecture, malware would have to be specifically coded to attack it.
Win/Win for Sony, if they cared to dip their toe in these waters.
I fear a Sino-American war, and hope it doesn't happen. However, there are a lot of things that worry me:
1: Two countries, one set of resources. Almost always, this is what wars end up being fought over.
2: China's nationalism. Race is second, because there are a lot of races in China.
3: Revenge, especially of what Japan did to them last century.
I just hope old hatreds can be set aside, people here in the US start using nuclear power as opposed to fighting over dino juice, and that both countries get some wisdom of their own that trading is a lot better than chucking ICBMs.
China is also going through a cultural renaissance. Now that people can do art and music without being lined against a wall and shot (like in Mao's time), people there are more interested in education and developing their economy as opposed to military gains.
I cross my fingers -- in a lot of ways, China is a command economy, but it isn't an extreme country (now that the nuts like Mao are cozily dead), nor is it one that would sacrifice its children for religious dogma meaninglessly. I just hope it stays that way.
Doubt it. China actually could shitcan the US economy in 24 hours, either using currency manipulation, calling in the debt, or even military means (getting their puppet Kim to shell Seoul, overrun Taiwan, etc.)
Because companies know that, there is a reason why you don't see PLA posts as the target for FPS games.
Slashdot Mirror
The iPhone has similar issues. JB the iPhone, grab pirated apps from unknown/untrusted repos, shovel them via Installous, and there have been some really nasty things reported.
The average user is not going to be sideloading apps, and if told to by a website, he or she should be VERY wary, and be checking search engines about the app mentioned.
Bingo. I have seen many companies with hacked computers used as launching points for attacks.
If someone coming from a .pk host launched an attack that blew out a bunch of transformers in India, how can one prove that it was someone from the ISI who did it, or a compromised host, and the real culprit is some kid in a basement who wants to see India and Pakistan exchange nukes? There is no certain way to tell.
The fear outshines the facts. A picture of Godzilla will outweigh a hundred statistics saying how dangerous other methods of energy generation are.
The only downside to nuclear power is the fact that contractors can get away with failing to do their part. If there are laws placed to hold people culpable (perhaps something that the company would be immediately nationalized if serious misconduct was found), this would be minimized.
The reward is more than worth the risk. No CO2 emissions. No pollution to the environment. Excellent energy density, so it can be built nearby a city, minimizing loss via power lines. Until fusion becomes a viable energy source, what else can one ask for?
Then stuff gets nasty. We still have plenty of coal. Dirty, polluting, highly toxic lignite coal. Stuff that loves to turn water tables into cesspits that only exotic variations of bacteria can live in.
Lignite coal is cheap, and if push comes to shove, laws (like basic labor, environmental, or safety ordinances) will be set aside to get it.
Want a real solution to the energy problem? Campaign for R&D on the latest generation of nuclear reactors (Gen IV) with an emphasis on traveling wave reactor designs, and designs that are made to not just withstand hazards, but PEBCAK/ID10T errors in construction and installation.
Believe it or not, it was not DoD related in any shape or form. In the private sector, from what I experienced on my job hunt, HR people want to see a TS/SCI clearance because it means that someone, somewhere decided that the person having that cert was worth enough cash to the company to pay to have them cleared.
That is the problem. Most shops have a hiring process that cares more about the pieces of paper, forcing candidates to slap the CCIE, CNE, CCIE, BOFH, BDSM, TL;DR stuff after their names. For a HR rep, they wouldn't even stop to cross check the cert IDs they have. It just means the resume stays on the desk and actually makes it to the tech people.
Here is the Scylla and Charybdis of job hunting: The clued people will see the certs and toss the resume as someone who doesn't have experience other than taking tests. However, to get to the clued people, in most companies, one has to pass the HR droids. They ogle at the alphabet soup of letters, and go "ooo, here is our candidate", passing the resume on, while experienced candidates they look at the resume, go "well, he did run this, this, and this... but he doesn't have any paperwork, so he really hasn't maintained his career. Better off with someone with pieces of paper."
Of course, the best way to bypass that BS is to have contacts, so the hiring process consists of "Well, you got me home after I was passed out in the bushes after that party, so you are hired."
What I do is ask for their cert number. Most places (RedHat, IBM, etc.) will have a cert checker on their website to verify the number they hand out.
If the person can't produce the number, or the number is registered in someone else's name, then it is time to get suspicious and nudging that person's resume towards the round file.
Certs are meaningless to you, and your boss who has a clue.
They mean something to HR and upper management who don't see people's skills. All they see is that candidate "A" vying for a promotion has an alphabet soup of certifications, and candidate "B" doesn't. Guess who gets the promotion, even though candidate "A" may be a "paper MC-ITP?" You got it.
When I was looking for work after I graduated, even with a degree in hand and a large amount of experience in IT before going back to college, for a lot of places, this is how the interview went:
Interview: "Do you have a TS/SCI clearance, or a CISSP? No? Next in line please."
The pretty pieces of paper are PHB food. They are not for the people or their direct managers who actually are in the trenches. However, to get interviewed by the people who actually know their stuff, you have to get past the HR roadblocks, and that means having the pieces of paper (e. g. for a MS admin, a MS-ITP, a bachelor's degree, A+ cert, etc.)
Realistically, when the PS4 comes out, people who buy it will have completely forgotten about GeoHot and the PSN breaches. They will see some cool game (perhaps another Madden release, or another FPS), buy the console, and because they spent the cash for the console, will buy the console's games.
The public has a short memory, unless the press digs it up for them.
You are not the only one. The Android devices I bought were ones which were the easiest to root/customize at the time. For example, the HTC Inspire 4G was remarkably easy to S/OFF, slap ClockworkMod Recovery, and drop a ROM onto.
I also tell people and try to explain to them why a locked bootloader is bad. It does influence purchasing decisions, especially if someone does want to dip their toe with a custom firmware, or just be able to back up the phone's image completely using nandroid.
Now, if HTC can make a decent landscape slider (like the Moto CLIQ) on AT&T's network that is up to par with the latest specs (dual core, decent RAM, etc), I'd pay full retail for it, no questions asked.
Maybe I should have stated this in a better manner:
Lusers are not people who brick phones. Bricking stuff is part of the way of being a good modder.
Lusers are people who brick them, then try to RMA the phone as bad, or flash a ROM that might not be up to snuff in some feature, and then return the phone as opposed to going back to stock, or clicking on ROM Manager and finding another one that may be more stable.
Your first point, definitely. It does make returns and support calls come in. However, it does keep Joe Sixpack from flashing a new ROM, then returning the device because the ROM had faulty BT support.
The second point is different. I have encountered phones that even if you get full root on them and attempt to pull the crapware off, as soon as they are rebooted, they either reload their filesystems, or go into a bootloop until you reflash the stock ROM.
Rooting and unlocked bootloaders go hand in hand. A "#" prompt doesn't help much if any changes result in a bootloop, or that there is a process that checks for anything not on an authorized list and kills anything running not on it.
What is sad is that Motorola has some cool hardware. Take the Atrix for example. If the bootloader wasn't locked, I could imagine using it as a reasonable netbook replacement. It could dump backups to an encrypted filesystem if using Amazon or Dropbox, or via ssh to a private machine at home. Obviously, it would have the functionality of a low end netbook at best, but on the road, that is what is needed, and if the laptop "adapter" is made standard so future products work with it, the $500 or so for that may be worth it, since keyboards and monitors really don't change.
With the Atrix and the Lapdock, that would pretty much deal with what I'd need on the road, for something good enough to check mail, RDP into Windows boxes, ssh into others, and browse the web. As an added bonus, since the phone is on me at all times, i can leave the dock in the car, and if someone steals that, I'm out the cost of that, rather than that + a lot of sensitive data.
However, because the Atrix is so locked down, all that functionality is being wasted. Had Motorola not locked the bootloader and allowed customization, this device likely would have sold a lot better, especially for people who dash out on weekends, and just need as little as possible for checking work stuff.
I couldn't find that tweet, but did see one saying that an unlocked bootloader device from HTC would be allowed to work.
There are three benefits hardware vendors get:
1: Lusers who mod their phones, "brick" [1] them, then return it. Locking bootloaders means that they don't get returns or support calls on these types.
2: It cozies hardware makers with the DRM culprits who want digital restrictions in every device out there.
3: It makes cellular carriers happy in four ways:
A: If a security hole in Android comes out, and a phone can't be patches, people are likely to upgrade or buy a new phone.
B: Phones won't run the latest apps, due to the inability to be upgraded to the latest Android rev, so consumers will trash the devices for a new one.
C: Carriers can lock out features, add non-removable "branding", etc.
D: Carriers can create their own locked-down app/music stores.
[1]: A lot of people don't understand that for some phones, it takes some effort to truly brick them (as in make them impossible to reflash and get working.) For example, people with iPhones who claim their phone is bricked, but never have bothered to do a DFU restore, people with Motorola devices who have never bothered downloading RSD Lite and flashing a factory .SHX back, or people with HTC phones who can't be bothered with copying a ROM to the SD card and holding down a button when turning the phone on.
Motorola mentioned something today about considering unlocking their bootloaders as well. I hope they do, because it would be a nice change from the previous statement they made last year telling modders to go elsewhere.
Bingo, the more there are bans against sites, the more companies will be stepping up to offer VPN services.
The sad thing is that once people are forced to VPN services, there is nothing countries can do to see traffic, unless try to ban the services. Then a cat and mouse game will ensue.
One feature I miss is a true low level format of a HDD. Now just for overwriting sectors, but for allowing the drive to rebuild its sector relocation table.
Older SCSI drives would mark blocks as bad and relocate the data. When they got low level formatted, the bad blocks would remain bad, but the area reserved for bad blocks would be clear (since the remapped blocks would be flagged as bad and not used.) This would allow the drive to continue to be used, as when the remapped block area fills up, the drive can't do anything except report soft/hard errors.
A true low level format also brought peace of mind -- any data on the disk before that was blanked out, and every usable sector has been tested to make sure it was readable/writable.
Why can't people who design authentication systems understand this:
Don't store the password.
At the minimum, store a hash where trying to get the password is like trying to run a meat grinder in reverse to get the cow back out.
A better way would be to store a salt, XOR the salt with the password, hash that result and store the hash.
Even better would be to store a salt, then encrypt the salt with the key being a hash of the password (the hash is used to act as a 'bit blender' so the entire keyspace is used, not just the space of letters/numbers). Store the encrypted salt, and the plaintext salt. Add rounds of encryption to help against brute forcing at the expensive of slowing down legit authentication. This way, the password is never stored, even "encrypted".
Actually, after caps, comes "premium" sites that don't cost if people visit... however for sites to have this status, they will have to open their wallet up to $ISP.
Next step is "soft" redirection, "Oh, you really wanted Bing, because they actually paid us and Google didn't. Click here to actually go there and pay the bandwidth charges."
Next step is "hard" redirection. Try to get to a non "blessed" site, you get redirected somewhere else. There are no laws against this whatsoever and at all.
Of course, throw in there Phorm-like ad injecting just for kicks and extra ISP revenue.
My question, as I have never done a grow room... what keeps a pot farm from actually getting their electricity from after the meter?
If they just cut a connection before the meter and manage to hide it, there are no power worries whatsoever. Cheaper utility bills to boot as well.
That is one blessing about Austin: The Alamo Drafthouse.
No kids (except clearly marked "baby day" shows.)
Real beers on tap.
People yapping on cellphones get escorted out.
People texting get escorted out.
And who cares about focus after 2-3 brews anyway.
Funny thing is that Sony could easily have a revenue stream for dedicated computers if they sell unlocked PS3s.
Even if the device didn't have the ability to run PS3 games, I'm sure that they would be quite useful in a lot of applications, from server appliances to firewalls, to compute clusters (a la the USAF's baby.) Because it is a non x86 architecture, malware would have to be specifically coded to attack it.
Win/Win for Sony, if they cared to dip their toe in these waters.
I fear a Sino-American war, and hope it doesn't happen. However, there are a lot of things that worry me:
1: Two countries, one set of resources. Almost always, this is what wars end up being fought over.
2: China's nationalism. Race is second, because there are a lot of races in China.
3: Revenge, especially of what Japan did to them last century.
I just hope old hatreds can be set aside, people here in the US start using nuclear power as opposed to fighting over dino juice, and that both countries get some wisdom of their own that trading is a lot better than chucking ICBMs.
China is also going through a cultural renaissance. Now that people can do art and music without being lined against a wall and shot (like in Mao's time), people there are more interested in education and developing their economy as opposed to military gains.
I cross my fingers -- in a lot of ways, China is a command economy, but it isn't an extreme country (now that the nuts like Mao are cozily dead), nor is it one that would sacrifice its children for religious dogma meaninglessly. I just hope it stays that way.
Doubt it. China actually could shitcan the US economy in 24 hours, either using currency manipulation, calling in the debt, or even military means (getting their puppet Kim to shell Seoul, overrun Taiwan, etc.)
Because companies know that, there is a reason why you don't see PLA posts as the target for FPS games.