Never say never. I recall reading some malware can detect the presence of vmware and/or sandboxie and get around it. Sandboxie helps, but it of limited protection on 64 bit systems.
We nearly had that happen, in '06 with the INDUCE act that nearly become law. A computer made without a hardware DRM stack was considered under that bill only made for copyright infringement.
I can think of a lot of uses for it, mainly in the research/testing fields:
1: Observing wild animals without worry about noise spilling over.
2: Outer walls of a building to keep sound in (so the neighbor doesn't call 911 because of that awesome drum solo at 11:00 PM), while being able to hear what is going on outside.
3: As stated above, keep the obnoxious music inside the car, while still being able to hear the motorcycle in the blind spot.
Exact thing happened with a small company I worked for. The devs were testing some code to make packets for a distributed application go between machines effectively, and created a pretty snazzy broadcast storm, taking down the entire internal network.
Thus began having multiple subnets, with development and QA having their own "padded cell" VLANs.
There is choosing one's battles, to keep a company going versus going down like mp3.com.
On one side, there is paying off a troll.
The other side is if a troll managed to get a judge (likely in East Texas) to issue an injunction that no products can be sold, that will cause major revenue loss, even if the case has no merit. Same if the troll got the export regulators to prohibit export/import of the product.
It is a game of poker. How good is the troll's law firm, and how valid their patents would be in the eyes of nontechnical judges are all points of decision of when a company should fold and pay the troll off, versus digging in and doing battle.
It is really a lose/lose thing for RedHat. If they lose the battle, they might go bankrupt. If they win against a patent troll, they gain nada.
I'd recommend splitting the workstations up by division and putting them on separate VLANs. Why?
1: The guy in HR runs a Trojan which phones home. Instead of nailing the complete company, it only nails his department.
2: Be able to comply better with Sarbanes-Oxley. For example, I'd probably put machines in Finance on an isolated network that isn't connected to the outside world, but have some Citrix or Terminal servers for Web browsing. This way, internal stuff can't make it out even if boxes do get compromised.
3: You want your IT guys to have access anywhere, but other departments not to be able to touch servers that are internal, such as the TSM/NetBackup/Networker box.
Oh, and the OP better think of other things other than just basic connectivity:
IDS: You want to see where the nasty 0-day malware infection is coming from.
IPS: You want non-zero day malware infections stopped, or the guy who thinks he is awesomesauce and is running nmap dealt with.
Site blocking: Depends on the corporate culture. Pr0n blockers may be needed, or just something to block the rogue sites used for phishing, or known botnet C&C machines.
SSL interception: BlueCoat may be needed depending on what rules/regs/contracts are put in place.
Transparent proxy to ask for a username/password before Web access is granted. This will help with keeping malware from phoning home, as well as provide audit trails (which are needed in some businesses). Other places don't need this. It is all up to the corporate culture.
Just having connectivity is just a tiny part of the entire picture. You have to have security and the ability to have software automatically isolate machines.
Don't blame the admins. In so many private companies, the PHBs decide that security has no ROI, so at best they give lip service to it.
Guess what smaller businesses say about a security breach? "Geek Squad can clean the mess up and we can call them 24/7".
Bigger businesses really are not affected because there is no financial incentive to. Customer list a.torrent on an ID theft side? Doesn't result in quarterly losses, and will be quickly forgotten.
It will take governments stepping in before anything is done. Even then, things like Sarbanes-Oxley have not helped one whit in security. SOX and other laws have made SAN providers rich, with all the stuff that has to be stored/archived.
This isn't really a dig against Windows proper, but having one OS everywhere is a bad thing. This allows malware makers to focus on just one platform for a maximum payoff.
Having ATMs and other devices run another OS forces blackhats to divert their efforts, and it might end up that the payoff for trying to crack into OS/2 or an embedded OS with multiple security features may be far less than trying to get Windows 7 Embedded to pop up a command shell on an ATM.
Google has too much at stake for Android to get known for malware.
Malware on Android is rare. Otherwise, if malware were common, you would hear screaming from friends and friends of friends almost everywhere.
Take Windows, if it isn't a friend, it is a friend of a friend, or an acquaintance of a friend who has an infected machine. Android is nowhere near this point yet. If one person gets their phone infected, they will be telling everyone they know, so word would get out. As of now, there are rumors about bad apps, but as of now, a true compromise of an Android device is exceptionally rare, other than offshore knock-offs of established games which are sold overseas.
It is possible, but once someone brings pictures and recorded conversations out in a trial obtained that way, there would be a mass uproar:
People would start powering off their cellphones. Others would take apart the device and cut the solder traces to the cameras, snip the microphones, and use BlueTooth for all conversations. Enterprising companies will make cases out of metal and foam to guarantee the mic and camera won't pick up anything. Other cellphone case makers will make cases where only the wireless systems worked, so people could make calls via BT, but the onboard camera/mic would not be usable.
Yes, being able to use the camera and mic will help for investigators, but only on the scale of gaining enemy intel. If they started using it to put people into prison, suddently it would be cool in the thug life to go back to citizen's band radios, and you will start seeing blinged out Cobra hand-helds as the latest style.
Also, if an app that doesn't do anything nasty has access to items, who knows if a future update pushed out with more malicious code may affect people. A lot of people automatically update their devices, and the SMS archiver that works perfectly with the v1.0 copy is spamming contacts at random with the 1.0.1 rev.
I'd say DroidWall has been out at least a year. It has done so far an effective job at keeping apps from phoning home.
It would be nice to have a utility that offers the ability to keep apps away from the ability to get GPS info, either coarse or fine. This way, an app can do what it needs to, but when phoning home with whatever info it can find, it will either get the coordinates of some random place, or none at all.
Actually, in Android there are multiple layers of rooting:
1: Getting a root prompt. 2: Keeping a root prompt and changes done, as opposed to having the phone soft-brick (until it gets reflashed), or automatically reinstall itself. 3: Being able to keep the root prompt across a reboot. 4: Being able to modify filesystems, mount them read/write and have changes persist across reboots. 5: Flash a ROM, kexec()ing around the signed kernel, because the bootloader is encrypted. Other than the Droid and the Xoom, this is the best modders can do with Motorola devices. 6: Flashing a completely customized ROM with a custom kernel. 7: Disabling anti-consumer crap completely on the device and allowing the user to do what he/she wants. This is how the Nexus and other Google items ship (fastboot oem unlock.) Complete unlock means that the device is not carrier locked, nor locked to a certain ROM. This is why I highly recommend GSM based HTC devices -- IIRC, almost all of them can have "S/OFF" flipped, so they don't care what ROM or carrier they work with.
Perhaps it would be good to have a small device about the form factor of a credit card:
It would have a PINpad and a fingerprint scanner (the scanner is for the equivilent of a day-lock on a safe -- protection while the device is unlocked.)
Then, using NFC or even BT, a sales transaction would post a prompt on the card stating that this mechant that had its name and key signed by this CA wants to charge this card in the list $amount (or an amount in CDS, but translated to USD). If the user wants to affirm, they run their finger on the fingerprint scanner, or type in a PIN. Saying no, click the "decline" button.
The vendor then is sent a PGP signed transaction, with the customer's key validated by the bank's CA.
There are obvious holes -- fingerprint scanners are not 100% accurate, PINs can be shoulder surfed, etc. However this raises the bar of consumer credit card fraud past just having possession of the CC information.
I'd give an alternative... nonces. These are used as IDs which are mapped to a credit card processor for subscriptions that are easily cancellable by the user.
This way, the user sets up a subscription. They get passed to the clearinghouse to enter in info (perhaps authorizing with two factor authentication.) The place offering subscriptions gets an ID back that they can use for cancelling a subscription (if someone got banned), or refunding all/part of a sub.
Worst that can happen if the blackhats get the sub IDs? They would have to forge the subscription maker's access, and then they might be able to issue bogus refunds, or just cancel everyone's subscriptions en masse.
Paypal does a mechanism similar to this.
As an added bonus, the user can cancel their subscription at their will, without having to go through calling a number staffed from 11:00 am to 11:01 each day, or other shit like that that a lot of places have started doing. I know people who have gotten to the point where they just mark their credit cards as lost/stolen, let the chips fall where they may.
Those are important items, especially #1. There are a lot more which make life hell for someone trying to get NTFS to work fully as a supported filesystem for a UNIX based OS. A few more:
4: Alternate data streams. It is common for malware to add an ADS onto a file, a directory, a junction point, or even the C: drive object itself. Without a dedicated utility that snorts out these, they are essentially invisible.
5: Like #1 above, NTFS changes in undocumented [1] ways. For example, EFS changed to add different encryption algorithms between Windows XP and Windows XP Service Pack 3. So, not knowing that may bring someone a world of hurt.
6: Similar to #3, NTFS's ACLs are hard to reimplement in the UNIX world. U/G/O permissions can be mapped (Cygwin does this).
7: For a filesystem to be usable as a production one, it needs a filesystem checking utility that can go through the whole filesystem and check/repair integrity on every part of it, be it mostly unimplemented/unused items (transactional-NTFS), features off the filesystem (NTFS compressed files, EFS), and many other items.. Yes, there are ways to run Windows's chkdsk.exe utility, but that is a hack at best.
One of the biggest problems with operating systems today is that there are no compatible filesystems beyond FAT and FAT32. Perhaps UFS. Either one filesystem has too much patent encumbrance to be used, or its license.
I wonder how easy life would be if we had a standard filesystem that could replace the LVM (similar to ZFS), offer modern features (deduplication, encryption, 64-bit checksumming [2], encryption, compression (various levels), snapshotting [3]. On an LVM level, it would be nice to have mountable disk images similar to OS X's sparse bundles. If something changes on the encrypted drive, only a few bands change, as opposed to having to back up the whole file.
Life would be easier if every OS out there had a common filesystem with modern features. A good example about how useful this would be would be antivirus scanning. Unpresent a LUN from a Windows server, scan it on a Solaris box for malware, then re-present it, for example.
[1]: Undocumented unless you are elite enough to have the MS source code handed to you, all work on the filesystem is all reverse engineering.
[2]: Backup programs would have it easy and not rely on dates or archive bits... just look for files where the checksum has changed and back those up just like the -c option in rsync.
1: Placate older viewers who have not hopped onto the Internet as a mainstream source of information.
2: Act as background noise so people waiting in some sort of waiting room have something to focus on.
3: A distraction in a hospital room.
4: People who want to be spoon fed the news. For example, in 5-10 minutes of reading Google News, I get all the stories that it would take a TV watcher 1-2 hours of sitting there getting spoon fed whatever biased info the station chooses to put on there. Of course, Websites can be biased, but it is easy to flip between several and at least figure out a nugget of truth out of the haystack of propaganda.
With this in mind, it is understandable that the top tier economic base of people have moved from TV to other forms of entertainment.
It shows in how much money is being spent on TV shows too. TV studios don't care to spend the top dollar on sci-fi shows and special effects. Why do that, when doing a "reality show" is far cheaper? Why pay for a sonic screwdriver wielder when a Snooki will score the advertising bucks?
This race to the bottom is not just killing TV, but radio too. Radio once was the place to find new bands. Now, that has been replaced by word of mouth, YouTube, and services like last.fm and Pandora, and what you hear on the radio is likely what people's fathers or grandfathers heard when they were drag-racing their Trans-Ams.
What needs to happen? A return to the roots. TV has a niche for education, especially kids too small to really put in front of a computer. This is what the inventor of the medium conceptualized TV as being for. TV also needs to start showing stuff that other mediums have trouble with, such as films from up and coming producers. Radio needs an enema too. They need to go back to having not just a 1-2 hour special on Friday nights with new stuff, but start showcasing new bands... just like they used to before the late 90s. Then they might be relevant in daily life again.
Even if it had to be turned on by some obscure switch, I would love to have a "real" filesystem on the SD card.
Even better: Put a LUKS layer down, and ask for the encryption key when the device boots (perhaps with the option of having a keyfile that can be backed up). This way, if someone steals the phone, a remote kill of just the OS would render the SD card inaccessible.
Heck, for more firepower, have a service that can back up the SD card to Dropbox, encrypting all data with a typed in passphrase or keyfile. This way, assuming the user remembers his/her passphrase and has a safe backup of the keyfile, the device can completely restore itself from remote, with zero data stored on the remote site that isn't encrypted.
It was an example -- someone spending 30 minutes near a car will be detected and hauled off, while nobody would notice someone spending 30 minutes within physical range of a wireless AP, especially with a high gain antenna.
It would be nice if the car thieves in my area would take a half hour to break into vehicles.
There is a whole world of difference between a pickable lock on a car door and security on a router:
Someone sits there spending 30 minutes by a car door. People eventually will notice and either drop a note to the local gendarmes, or approach the person with pointed questioning. Especially people know the owner of that car.
Someone parked in a car spending 30 minutes on a laptop or cellphone to crack open a WEP protected router, few would notice, much less care about the issue.
MAC address filtering also is a switch flippable by anyone on a router. Yes, it gives a speed bump, but use it for what it is designed for -- keep honest people honest (say after a LAN party, you turn it on to kick everyone off but your stuff before you change your key.)
I highly recommend using MAC address filtering as the icing on the cake, but if you don't use WPA2 (or if forced to, WPA), you are asking to be hacked.
I disagree about it being US propaganda, because the US can royally lose and lose big in a pissing contest these days. China can do three things in less than 24 hours to royally fsck the US and her economy:
1: Allow the yuan to trade freely.
2: Push for a "currency basket", or have oil be traded by the yuan.
3: Start arming countries or factions that don't like the US. For example, if the Taliban started getting access to UCAVs from a mysterious source. Or Ahmadinejad showing off his new technology of ICBMs that isn't enhanced by Photoshop skills.
Any of these three would cripple the US economy quickly. #3 is farfetched in today's dynamics, but if push came to shove, can be done. #1 and #2 would easily push the US dollar into hyperinflation.
Slashdot Mirror
Never say never. I recall reading some malware can detect the presence of vmware and/or sandboxie and get around it. Sandboxie helps, but it of limited protection on 64 bit systems.
We nearly had that happen, in '06 with the INDUCE act that nearly become law. A computer made without a hardware DRM stack was considered under that bill only made for copyright infringement.
I can think of a lot of uses for it, mainly in the research/testing fields:
1: Observing wild animals without worry about noise spilling over.
2: Outer walls of a building to keep sound in (so the neighbor doesn't call 911 because of that awesome drum solo at 11:00 PM), while being able to hear what is going on outside.
3: As stated above, keep the obnoxious music inside the car, while still being able to hear the motorcycle in the blind spot.
Exact thing happened with a small company I worked for. The devs were testing some code to make packets for a distributed application go between machines effectively, and created a pretty snazzy broadcast storm, taking down the entire internal network.
Thus began having multiple subnets, with development and QA having their own "padded cell" VLANs.
There is choosing one's battles, to keep a company going versus going down like mp3.com.
On one side, there is paying off a troll.
The other side is if a troll managed to get a judge (likely in East Texas) to issue an injunction that no products can be sold, that will cause major revenue loss, even if the case has no merit. Same if the troll got the export regulators to prohibit export/import of the product.
It is a game of poker. How good is the troll's law firm, and how valid their patents would be in the eyes of nontechnical judges are all points of decision of when a company should fold and pay the troll off, versus digging in and doing battle.
It is really a lose/lose thing for RedHat. If they lose the battle, they might go bankrupt. If they win against a patent troll, they gain nada.
I'd recommend splitting the workstations up by division and putting them on separate VLANs. Why?
1: The guy in HR runs a Trojan which phones home. Instead of nailing the complete company, it only nails his department.
2: Be able to comply better with Sarbanes-Oxley. For example, I'd probably put machines in Finance on an isolated network that isn't connected to the outside world, but have some Citrix or Terminal servers for Web browsing. This way, internal stuff can't make it out even if boxes do get compromised.
3: You want your IT guys to have access anywhere, but other departments not to be able to touch servers that are internal, such as the TSM/NetBackup/Networker box.
Oh, and the OP better think of other things other than just basic connectivity:
IDS: You want to see where the nasty 0-day malware infection is coming from.
IPS: You want non-zero day malware infections stopped, or the guy who thinks he is awesomesauce and is running nmap dealt with.
Site blocking: Depends on the corporate culture. Pr0n blockers may be needed, or just something to block the rogue sites used for phishing, or known botnet C&C machines.
SSL interception: BlueCoat may be needed depending on what rules/regs/contracts are put in place.
Transparent proxy to ask for a username/password before Web access is granted. This will help with keeping malware from phoning home, as well as provide audit trails (which are needed in some businesses). Other places don't need this. It is all up to the corporate culture.
Just having connectivity is just a tiny part of the entire picture. You have to have security and the ability to have software automatically isolate machines.
Don't blame the admins. In so many private companies, the PHBs decide that security has no ROI, so at best they give lip service to it.
Guess what smaller businesses say about a security breach? "Geek Squad can clean the mess up and we can call them 24/7".
Bigger businesses really are not affected because there is no financial incentive to. Customer list a .torrent on an ID theft side? Doesn't result in quarterly losses, and will be quickly forgotten.
It will take governments stepping in before anything is done. Even then, things like Sarbanes-Oxley have not helped one whit in security. SOX and other laws have made SAN providers rich, with all the stuff that has to be stored/archived.
You could do a `dd if=/dev/random bs=1 count=256` in there somewhere for some cryptographically secure entropy as well.
This isn't really a dig against Windows proper, but having one OS everywhere is a bad thing. This allows malware makers to focus on just one platform for a maximum payoff.
Having ATMs and other devices run another OS forces blackhats to divert their efforts, and it might end up that the payoff for trying to crack into OS/2 or an embedded OS with multiple security features may be far less than trying to get Windows 7 Embedded to pop up a command shell on an ATM.
Maybe they should go back to running OS/2... eComStation still has the OS maintained and on life support.
Google has too much at stake for Android to get known for malware.
Malware on Android is rare. Otherwise, if malware were common, you would hear screaming from friends and friends of friends almost everywhere.
Take Windows, if it isn't a friend, it is a friend of a friend, or an acquaintance of a friend who has an infected machine. Android is nowhere near this point yet. If one person gets their phone infected, they will be telling everyone they know, so word would get out. As of now, there are rumors about bad apps, but as of now, a true compromise of an Android device is exceptionally rare, other than offshore knock-offs of established games which are sold overseas.
It is possible, but once someone brings pictures and recorded conversations out in a trial obtained that way, there would be a mass uproar:
People would start powering off their cellphones. Others would take apart the device and cut the solder traces to the cameras, snip the microphones, and use BlueTooth for all conversations. Enterprising companies will make cases out of metal and foam to guarantee the mic and camera won't pick up anything. Other cellphone case makers will make cases where only the wireless systems worked, so people could make calls via BT, but the onboard camera/mic would not be usable.
Yes, being able to use the camera and mic will help for investigators, but only on the scale of gaining enemy intel. If they started using it to put people into prison, suddently it would be cool in the thug life to go back to citizen's band radios, and you will start seeing blinged out Cobra hand-helds as the latest style.
Also, if an app that doesn't do anything nasty has access to items, who knows if a future update pushed out with more malicious code may affect people. A lot of people automatically update their devices, and the SMS archiver that works perfectly with the v1.0 copy is spamming contacts at random with the 1.0.1 rev.
I'd say DroidWall has been out at least a year. It has done so far an effective job at keeping apps from phoning home.
It would be nice to have a utility that offers the ability to keep apps away from the ability to get GPS info, either coarse or fine. This way, an app can do what it needs to, but when phoning home with whatever info it can find, it will either get the coordinates of some random place, or none at all.
True. I expect a negative option as well, but thankfully not yet:
-1: Allow for ADB access.
Actually, in Android there are multiple layers of rooting:
1: Getting a root prompt.
2: Keeping a root prompt and changes done, as opposed to having the phone soft-brick (until it gets reflashed), or automatically reinstall itself.
3: Being able to keep the root prompt across a reboot.
4: Being able to modify filesystems, mount them read/write and have changes persist across reboots.
5: Flash a ROM, kexec()ing around the signed kernel, because the bootloader is encrypted. Other than the Droid and the Xoom, this is the best modders can do with Motorola devices.
6: Flashing a completely customized ROM with a custom kernel.
7: Disabling anti-consumer crap completely on the device and allowing the user to do what he/she wants. This is how the Nexus and other Google items ship (fastboot oem unlock.) Complete unlock means that the device is not carrier locked, nor locked to a certain ROM. This is why I highly recommend GSM based HTC devices -- IIRC, almost all of them can have "S/OFF" flipped, so they don't care what ROM or carrier they work with.
Don't forget the AIX admins -- the zombie hordes just ignore them, or moan, "one of us, one of us".
That would be nice.
Perhaps it would be good to have a small device about the form factor of a credit card:
It would have a PINpad and a fingerprint scanner (the scanner is for the equivilent of a day-lock on a safe -- protection while the device is unlocked.)
Then, using NFC or even BT, a sales transaction would post a prompt on the card stating that this mechant that had its name and key signed by this CA wants to charge this card in the list $amount (or an amount in CDS, but translated to USD). If the user wants to affirm, they run their finger on the fingerprint scanner, or type in a PIN. Saying no, click the "decline" button.
The vendor then is sent a PGP signed transaction, with the customer's key validated by the bank's CA.
There are obvious holes -- fingerprint scanners are not 100% accurate, PINs can be shoulder surfed, etc. However this raises the bar of consumer credit card fraud past just having possession of the CC information.
I'd give an alternative... nonces. These are used as IDs which are mapped to a credit card processor for subscriptions that are easily cancellable by the user.
This way, the user sets up a subscription. They get passed to the clearinghouse to enter in info (perhaps authorizing with two factor authentication.) The place offering subscriptions gets an ID back that they can use for cancelling a subscription (if someone got banned), or refunding all/part of a sub.
Worst that can happen if the blackhats get the sub IDs? They would have to forge the subscription maker's access, and then they might be able to issue bogus refunds, or just cancel everyone's subscriptions en masse.
Paypal does a mechanism similar to this.
As an added bonus, the user can cancel their subscription at their will, without having to go through calling a number staffed from 11:00 am to 11:01 each day, or other shit like that that a lot of places have started doing. I know people who have gotten to the point where they just mark their credit cards as lost/stolen, let the chips fall where they may.
Those are important items, especially #1. There are a lot more which make life hell for someone trying to get NTFS to work fully as a supported filesystem for a UNIX based OS. A few more:
4: Alternate data streams. It is common for malware to add an ADS onto a file, a directory, a junction point, or even the C: drive object itself. Without a dedicated utility that snorts out these, they are essentially invisible.
5: Like #1 above, NTFS changes in undocumented [1] ways. For example, EFS changed to add different encryption algorithms between Windows XP and Windows XP Service Pack 3. So, not knowing that may bring someone a world of hurt.
6: Similar to #3, NTFS's ACLs are hard to reimplement in the UNIX world. U/G/O permissions can be mapped (Cygwin does this).
7: For a filesystem to be usable as a production one, it needs a filesystem checking utility that can go through the whole filesystem and check/repair integrity on every part of it, be it mostly unimplemented/unused items (transactional-NTFS), features off the filesystem (NTFS compressed files, EFS), and many other items.. Yes, there are ways to run Windows's chkdsk.exe utility, but that is a hack at best.
One of the biggest problems with operating systems today is that there are no compatible filesystems beyond FAT and FAT32. Perhaps UFS. Either one filesystem has too much patent encumbrance to be used, or its license.
I wonder how easy life would be if we had a standard filesystem that could replace the LVM (similar to ZFS), offer modern features (deduplication, encryption, 64-bit checksumming [2], encryption, compression (various levels), snapshotting [3]. On an LVM level, it would be nice to have mountable disk images similar to OS X's sparse bundles. If something changes on the encrypted drive, only a few bands change, as opposed to having to back up the whole file.
Life would be easier if every OS out there had a common filesystem with modern features. A good example about how useful this would be would be antivirus scanning. Unpresent a LUN from a Windows server, scan it on a Solaris box for malware, then re-present it, for example.
[1]: Undocumented unless you are elite enough to have the MS source code handed to you, all work on the filesystem is all reverse engineering.
[2]: Backup programs would have it easy and not rely on dates or archive bits... just look for files where the checksum has changed and back those up just like the -c option in rsync.
I see TVs used for these purposes:
1: Placate older viewers who have not hopped onto the Internet as a mainstream source of information.
2: Act as background noise so people waiting in some sort of waiting room have something to focus on.
3: A distraction in a hospital room.
4: People who want to be spoon fed the news. For example, in 5-10 minutes of reading Google News, I get all the stories that it would take a TV watcher 1-2 hours of sitting there getting spoon fed whatever biased info the station chooses to put on there. Of course, Websites can be biased, but it is easy to flip between several and at least figure out a nugget of truth out of the haystack of propaganda.
With this in mind, it is understandable that the top tier economic base of people have moved from TV to other forms of entertainment.
It shows in how much money is being spent on TV shows too. TV studios don't care to spend the top dollar on sci-fi shows and special effects. Why do that, when doing a "reality show" is far cheaper? Why pay for a sonic screwdriver wielder when a Snooki will score the advertising bucks?
This race to the bottom is not just killing TV, but radio too. Radio once was the place to find new bands. Now, that has been replaced by word of mouth, YouTube, and services like last.fm and Pandora, and what you hear on the radio is likely what people's fathers or grandfathers heard when they were drag-racing their Trans-Ams.
What needs to happen? A return to the roots. TV has a niche for education, especially kids too small to really put in front of a computer. This is what the inventor of the medium conceptualized TV as being for. TV also needs to start showing stuff that other mediums have trouble with, such as films from up and coming producers. Radio needs an enema too. They need to go back to having not just a 1-2 hour special on Friday nights with new stuff, but start showcasing new bands... just like they used to before the late 90s. Then they might be relevant in daily life again.
Even if it had to be turned on by some obscure switch, I would love to have a "real" filesystem on the SD card.
Even better: Put a LUKS layer down, and ask for the encryption key when the device boots (perhaps with the option of having a keyfile that can be backed up). This way, if someone steals the phone, a remote kill of just the OS would render the SD card inaccessible.
Heck, for more firepower, have a service that can back up the SD card to Dropbox, encrypting all data with a typed in passphrase or keyfile. This way, assuming the user remembers his/her passphrase and has a safe backup of the keyfile, the device can completely restore itself from remote, with zero data stored on the remote site that isn't encrypted.
It was an example -- someone spending 30 minutes near a car will be detected and hauled off, while nobody would notice someone spending 30 minutes within physical range of a wireless AP, especially with a high gain antenna.
It would be nice if the car thieves in my area would take a half hour to break into vehicles.
There is a whole world of difference between a pickable lock on a car door and security on a router:
Someone sits there spending 30 minutes by a car door. People eventually will notice and either drop a note to the local gendarmes, or approach the person with pointed questioning. Especially people know the owner of that car.
Someone parked in a car spending 30 minutes on a laptop or cellphone to crack open a WEP protected router, few would notice, much less care about the issue.
MAC address filtering also is a switch flippable by anyone on a router. Yes, it gives a speed bump, but use it for what it is designed for -- keep honest people honest (say after a LAN party, you turn it on to kick everyone off but your stuff before you change your key.)
I highly recommend using MAC address filtering as the icing on the cake, but if you don't use WPA2 (or if forced to, WPA), you are asking to be hacked.
I disagree about it being US propaganda, because the US can royally lose and lose big in a pissing contest these days. China can do three things in less than 24 hours to royally fsck the US and her economy:
1: Allow the yuan to trade freely.
2: Push for a "currency basket", or have oil be traded by the yuan.
3: Start arming countries or factions that don't like the US. For example, if the Taliban started getting access to UCAVs from a mysterious source. Or Ahmadinejad showing off his new technology of ICBMs that isn't enhanced by Photoshop skills.
Any of these three would cripple the US economy quickly. #3 is farfetched in today's dynamics, but if push came to shove, can be done. #1 and #2 would easily push the US dollar into hyperinflation.