And you both totally forgot about Mr or Ms I-write-my-password-on-a-sticky-note, plus all of the other identity management disciplines, like preventing a socially engineered password reset call to the help line, etc.
It doesn't matter if they know for certain where the traffic originated from. The point is, you wouldn't wander up to a completely unknown stranger and whisper your personal secrets so they could tell them to another stranger and so on, so why have your computer do that same thing? Even if they don't know the origin, the metadata in your traffic will betray your privacy at some point. How can you trust someone you don't know?
That's how that guy in Europe got into hot legal water when he demonstrated the emperor hath no TOR clothes with his accumulation of sensitive information belonging to political officials, ripe for the picking at a TOR exit node.
Anyone else wondering if "Bolivia is the Saudia Arabia of lithium" that it means they're the #1 most important import country when it comes to politics and wars, but the #3 biggest import country by actual imports, behind Canada and Mexico?
>>>started up a national health service, and began a process of ensuring personal freedoms
Forcing your neighbors to pay YOUR health bills is not freedom. It's graft. It's no different than if I bought a Lexus, and then demanded everybody contribute $1 to pay my bill & extracted the money from their wallets.
If he said "house" instead of "lexus" would it have NOT been a troll? I get that some people may not like comparing health care to luxury cars, but replace "health care" with any "need" (food, water, clothing, shelter, and... love...) and the parent's point is pretty valid.
I still want to understand, since the Federal Reserve will be printing money for these bailouts and stimuli, why can't they just print money to pay off these debts in the first place?
-- libertarian: socially liberal (you can do whatever you want), financially conservative (as long as I don't have to pay for it); people can help people directly (private charities work better than government regulated bureaucracies); and people can mostly govern themselves, thanks! (Politicians, stay out of our lives!)
Just wait until something that is important to you evolves (through a slippery slope) into something that those in control politically disagree with. Then, you'll either fall in step and give up your "thoughtcrime" or you'll become a Winston Smith and have to continue your thoughts underground.
I've got a great idea-- how about all of those in favor of strong central (federal) government move to states that grant that authority to the fed as a part of the 10th amendment. Those of us who want to remain "weak" and keep our income tax dollars in our own wallets can move to states that recognize the importance of check and balance as granted in the 10th amendment.
Those who want Creation taught as Science move to like-minded states (or just private schools). Those who want real science, move to the other states.
Those who want abortion, move to state ___. Those who don't, move to state ___.
Those who want ___, move to X; those who don't, move to Y.
...
Are you starting to see the beauty of a collection of independent states yet? Notice how if we allowed the Constitution to work like the framers intended, most of these stupid squabbles could be resolved by selling one's home and moving. If it's not important enough to you to change your address, then shut your mouth or petition your state.
Just once, I've love to hear a die-hard libertarian explain how privatized roads would work. Just once.
"libertarians" believe in private property, yes. But to argue that all libertarians want all roads private is just as stupid as making all citizens pay for all roads with federal tax dollars. The primary notion is decentralization. If a community wants to collect local tax revenues (via property, sales, or income tax) to pay for local roads, that's OK by a libertarian. A libertarian wants the LIBERTY to choose whether or not to live in such a location. In some places, it makes economic sense to do so, because free roads (and parking) may provide a boom to local economy.
But a libertarian also wants the freedom (liberty) to choose to live on the end of a long private road with no trespassers or passersby. It's the freedom of choice.
I'm also curious how many libertarians would want to live in large megalopolis cities like LA or NY.
OK. Now that I have your attention, instead of "children" think of other small, computationally weak things... like handhelds. ECC excels in lower computational cost over RSA. That is yet another reason, as everyone's day planner has a web browser which requires DNS. Want your iPhone's battery to drain less fast? Use ECC instead of RSA for your public key crypto of choice.
For that matter, DNSSEC should consider allowing ECC public keys. Then we would at least be debating the merits of the application of crypto in the protocols, not the crypto algorithms themselves (slashdot really isn't the place to debate that anyway).
OK, so I'll either by insightful or a troll here (at least I'm aware of that).
It's more obvious than that (why blackberries fail more often than iPhones)...
Blackberries are the Windows PCs of the handheld market. Sure, they're more "enterprise" than Macs (iPhones), but all of the same criticisms apply. It's typically the same customer base, too, who have come to expect high percentages of failures in products.
Mark me as a flaming troll if you want, but it's true.
Exactly. So to do the right thing, they'd have to cut off their profits. And they've already convinced so many people that hourly untested (at least not tested in your environment) updates to something so close to the core of how your computer behaves is "normal".
So, in not too far of a parody, we've already given the Nigerian royalty (AV vendors) our account numbers. The social engineering is complete--time for the exploit.
Anti-Virus is outsourcing the problem of deciding what is good to execute on your computer to a vendor who works backwards and blind.
It's "backwards", in that you don't tell them what is "good". They try to guess what would be on your "bad" list. As everyone here knows, it turns out that the "bad" list is much, much longer than the "good" list. In 2007 alone, F-Secure added more virus sigs to their products than the totality of sigs accumulated from the previous 20 years! And last I heard from them, 2008 was projected to double 2007. That sounds almost like quadratic growth to me... and keeping up with that growth rate is not a game I'd want to play! My list of "good" software doesn't increase on a quadratic growth rate, does yours? If this were any other field of computation, the signature approach would have been laughed off the planet by now.
It's "blind" in that they aren't seeing what is actually running on your computer. For privacy (and performance) reasons, nobody provides metrics back to AV vendors about all of the executables that weren't labeled "bad", and rarely do the metrics about what is labeled "OK" actually go back to them. The AV vendors have to take a shot in the dark. They can simulate what they think your computing environment looks like, but it's just a guess. They cannot know if you have custom or proprietary software that matches one of their AV sigs unless they actually test that particular program against their sigs (and you don't let them do that, hence the "blind" remark).
Backwards and Blind is very problematic. Every once in awhile, we hear about fiascos like Symantec deciding an asian language DLL is a virus, killing all of their asian customers' windows installs for a day or two.
The question the benchmark is really trying to answer is: Which vendor's product is best tuned for the least amount of false positives and false negatives? When we should really be asking the question: Do I know what is good to run on my computers? And if the answer to that is "yes", then we should be asking the question: Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?
I agree. If the quantum crypto community wants to use that quantum computing power to factor the large primes in RSA, then the quantum computing community could justify selling us their quantum crypto. Make a need, sell a solution.
In reality, it's always going to be the "endpoints" that are the problem. We still cannot even know with 99.999% certainty that a transaction to a remote application came from a specific user. We use bloated software with tens of millions of lines of code. Even the best error rates per thousand lines of code suggests a nearly uncountable number of bugs in any common OS (FOSS included), any of which could open up a channel for an adversary to do anything with data that you could do... but without your knowledge.
Researchers should leave the crypto alone and catch up the end points first. Once we have formally (mathematically) provably secure code running on our machines (on the same level that we can prove that the proverbial "Eve" can't brute force Alice's and Bob's eternal public key crypto), then we can revert to crypto research.
I'd tell you my OpenVMS uptime but it would be awkward and uncomfortable to see you cry.
You run OpenVMS on a laptop?! I'm not sure if "pity" is the word. When's the last time lynx needed a security update? Guess you missed out on that whole clickjacking thing.
It's all about the formal verification, or the "correctness" of the implementation (binary executable) of the problem. If you follow the works of the late Edsger Dijkstra, he argued that all code should really be an abstraction of a formal mathematical proof of a solution to a problem. Now, most "agile" software developers through that out the window as shite, but we need to find a compromise somewhere in between.
If we were able to do formal verification of a binary, then the world wouldn't need to see source code to know you can trust third-party written code. Ada or whatever language, the research significance here is that the characteristics of the language and compilation that yields positive steps towards formal verification. So, maybe for you "secure" is "I patched it and today's signature database from [insert vuln scanner] doesn't find any holes", but for three letter institutions (and anyone who has worked diligently enough in security to become jaded like me) that's just not good enough. A better definition of "secure" software would be "I know what it is intended to do and I can formally prove it does that and only that."
Never attribute to malice that which can be adequately explained by stupidity.
Don't assume these people don't care or don't want to fix it. CSRF is in the class of "WebAppSec" (what the kids call it these days) that is not "syntactic" in nature; meaning that you cannot just say "here, use this API and you're safe". It's a "semantic" problem; the developer has to both understand "how" sensitive transactions can be abused AND "how" these transactions can be fixed (like with a nonce).
It's probably just that they don't know how to do it, at least not manageably on an average budget.
Many people are members of multple castes. There are also other castes that present from time to time.
So you're saying Slashdot supports social mobility? I'm tired of slumming with the trolls.
I'm read to start moving up to the middle-class spelling/grammar nazis. One day, I hope to move all the way up to meme propagators (not "propogators" -- hey I'm moving up already!).
Slashdot Mirror
And you both totally forgot about Mr or Ms I-write-my-password-on-a-sticky-note, plus all of the other identity management disciplines, like preventing a socially engineered password reset call to the help line, etc.
It doesn't matter if they know for certain where the traffic originated from. The point is, you wouldn't wander up to a completely unknown stranger and whisper your personal secrets so they could tell them to another stranger and so on, so why have your computer do that same thing? Even if they don't know the origin, the metadata in your traffic will betray your privacy at some point. How can you trust someone you don't know?
That's how that guy in Europe got into hot legal water when he demonstrated the emperor hath no TOR clothes with his accumulation of sensitive information belonging to political officials, ripe for the picking at a TOR exit node.
Anyone else wondering if "Bolivia is the Saudia Arabia of lithium" that it means they're the #1 most important import country when it comes to politics and wars, but the #3 biggest import country by actual imports, behind Canada and Mexico?
Whoever rated the parent "informative" must think Monty Python and the Holy Grail is a historical documentary, or they're new here.
Where do I upload suspected thoughtcrime?
>>>started up a national health service, and began a process of ensuring personal freedoms
Forcing your neighbors to pay YOUR health bills is not freedom. It's graft. It's no different than if I bought a Lexus, and then demanded everybody contribute $1 to pay my bill & extracted the money from their wallets.
If he said "house" instead of "lexus" would it have NOT been a troll? I get that some people may not like comparing health care to luxury cars, but replace "health care" with any "need" (food, water, clothing, shelter, and ... love ...) and the parent's point is pretty valid.
I still want to understand, since the Federal Reserve will be printing money for these bailouts and stimuli, why can't they just print money to pay off these debts in the first place?
--
libertarian: socially liberal (you can do whatever you want), financially conservative (as long as I don't have to pay for it); people can help people directly (private charities work better than government regulated bureaucracies); and people can mostly govern themselves, thanks! (Politicians, stay out of our lives!)
Do you agree with every "gift" the Fed makes on your behalf? I bet I can find at least one way you are not altruistic.
That's because you have nothing to hide now .
Just wait until something that is important to you evolves (through a slippery slope) into something that those in control politically disagree with. Then, you'll either fall in step and give up your "thoughtcrime" or you'll become a Winston Smith and have to continue your thoughts underground.
Where's the tag!?
Don't be ridiculous, everybody knows "guns don't kill people, mosquitoes do".
I've got a great idea-- how about all of those in favor of strong central (federal) government move to states that grant that authority to the fed as a part of the 10th amendment. Those of us who want to remain "weak" and keep our income tax dollars in our own wallets can move to states that recognize the importance of check and balance as granted in the 10th amendment.
...
Those who want Creation taught as Science move to like-minded states (or just private schools). Those who want real science, move to the other states.
Those who want abortion, move to state ___. Those who don't, move to state ___.
Those who want ___, move to X; those who don't, move to Y.
Are you starting to see the beauty of a collection of independent states yet? Notice how if we allowed the Constitution to work like the framers intended, most of these stupid squabbles could be resolved by selling one's home and moving. If it's not important enough to you to change your address, then shut your mouth or petition your state.
Just once, I've love to hear a die-hard libertarian explain how privatized roads would work. Just once.
"libertarians" believe in private property, yes. But to argue that all libertarians want all roads private is just as stupid as making all citizens pay for all roads with federal tax dollars. The primary notion is decentralization. If a community wants to collect local tax revenues (via property, sales, or income tax) to pay for local roads, that's OK by a libertarian. A libertarian wants the LIBERTY to choose whether or not to live in such a location. In some places, it makes economic sense to do so, because free roads (and parking) may provide a boom to local economy.
But a libertarian also wants the freedom (liberty) to choose to live on the end of a long private road with no trespassers or passersby. It's the freedom of choice.
I'm also curious how many libertarians would want to live in large megalopolis cities like LA or NY.
OK. Now that I have your attention, instead of "children" think of other small, computationally weak things ... like handhelds. ECC excels in lower computational cost over RSA. That is yet another reason, as everyone's day planner has a web browser which requires DNS. Want your iPhone's battery to drain less fast? Use ECC instead of RSA for your public key crypto of choice.
For that matter, DNSSEC should consider allowing ECC public keys. Then we would at least be debating the merits of the application of crypto in the protocols, not the crypto algorithms themselves (slashdot really isn't the place to debate that anyway).
OK, so I'll either by insightful or a troll here (at least I'm aware of that).
...
It's more obvious than that (why blackberries fail more often than iPhones)
Blackberries are the Windows PCs of the handheld market. Sure, they're more "enterprise" than Macs (iPhones), but all of the same criticisms apply. It's typically the same customer base, too, who have come to expect high percentages of failures in products.
Mark me as a flaming troll if you want, but it's true.
Exactly. So to do the right thing, they'd have to cut off their profits. And they've already convinced so many people that hourly untested (at least not tested in your environment) updates to something so close to the core of how your computer behaves is "normal".
So, in not too far of a parody, we've already given the Nigerian royalty (AV vendors) our account numbers. The social engineering is complete--time for the exploit.
Anti-Virus is outsourcing the problem of deciding what is good to execute on your computer to a vendor who works backwards and blind.
... and keeping up with that growth rate is not a game I'd want to play! My list of "good" software doesn't increase on a quadratic growth rate, does yours? If this were any other field of computation, the signature approach would have been laughed off the planet by now.
It's "backwards", in that you don't tell them what is "good". They try to guess what would be on your "bad" list. As everyone here knows, it turns out that the "bad" list is much, much longer than the "good" list. In 2007 alone, F-Secure added more virus sigs to their products than the totality of sigs accumulated from the previous 20 years! And last I heard from them, 2008 was projected to double 2007. That sounds almost like quadratic growth to me
It's "blind" in that they aren't seeing what is actually running on your computer. For privacy (and performance) reasons, nobody provides metrics back to AV vendors about all of the executables that weren't labeled "bad", and rarely do the metrics about what is labeled "OK" actually go back to them. The AV vendors have to take a shot in the dark. They can simulate what they think your computing environment looks like, but it's just a guess. They cannot know if you have custom or proprietary software that matches one of their AV sigs unless they actually test that particular program against their sigs (and you don't let them do that, hence the "blind" remark).
Backwards and Blind is very problematic. Every once in awhile, we hear about fiascos like Symantec deciding an asian language DLL is a virus, killing all of their asian customers' windows installs for a day or two.
The question the benchmark is really trying to answer is: Which vendor's product is best tuned for the least amount of false positives and false negatives? When we should really be asking the question: Do I know what is good to run on my computers? And if the answer to that is "yes", then we should be asking the question: Why can't these vendors make a product that only allows my "good" programs to execute and nothing else?
possessing encryption tools was considered as munitions
That's because the NSA figured out that good crypto is no big deal when we have such shoddy endpoints.
I agree. If the quantum crypto community wants to use that quantum computing power to factor the large primes in RSA, then the quantum computing community could justify selling us their quantum crypto. Make a need, sell a solution.
... but without your knowledge.
In reality, it's always going to be the "endpoints" that are the problem. We still cannot even know with 99.999% certainty that a transaction to a remote application came from a specific user. We use bloated software with tens of millions of lines of code. Even the best error rates per thousand lines of code suggests a nearly uncountable number of bugs in any common OS (FOSS included), any of which could open up a channel for an adversary to do anything with data that you could do
Researchers should leave the crypto alone and catch up the end points first. Once we have formally (mathematically) provably secure code running on our machines (on the same level that we can prove that the proverbial "Eve" can't brute force Alice's and Bob's eternal public key crypto), then we can revert to crypto research.
I'd tell you my OpenVMS uptime but it would be awkward and uncomfortable to see you cry.
You run OpenVMS on a laptop?! I'm not sure if "pity" is the word. When's the last time lynx needed a security update? Guess you missed out on that whole clickjacking thing.
You are statically safer flying an airplane then driving
That's true, I always get shocked while riding in cars. Can't remember a time in a plane, though. Must be that the plane is off the "ground".
It's all about the formal verification, or the "correctness" of the implementation (binary executable) of the problem. If you follow the works of the late Edsger Dijkstra, he argued that all code should really be an abstraction of a formal mathematical proof of a solution to a problem. Now, most "agile" software developers through that out the window as shite, but we need to find a compromise somewhere in between.
If we were able to do formal verification of a binary, then the world wouldn't need to see source code to know you can trust third-party written code. Ada or whatever language, the research significance here is that the characteristics of the language and compilation that yields positive steps towards formal verification. So, maybe for you "secure" is "I patched it and today's signature database from [insert vuln scanner] doesn't find any holes", but for three letter institutions (and anyone who has worked diligently enough in security to become jaded like me) that's just not good enough. A better definition of "secure" software would be "I know what it is intended to do and I can formally prove it does that and only that."
Word of the day is verification.
Never attribute to malice that which can be adequately explained by stupidity.
Don't assume these people don't care or don't want to fix it. CSRF is in the class of "WebAppSec" (what the kids call it these days) that is not "syntactic" in nature; meaning that you cannot just say "here, use this API and you're safe". It's a "semantic" problem; the developer has to both understand "how" sensitive transactions can be abused AND "how" these transactions can be fixed (like with a nonce).
It's probably just that they don't know how to do it, at least not manageably on an average budget.
Many people are members of multple castes. There are also other castes that present from time to time.
So you're saying Slashdot supports social mobility? I'm tired of slumming with the trolls. I'm read to start moving up to the middle-class spelling/grammar nazis. One day, I hope to move all the way up to meme propagators (not "propogators" -- hey I'm moving up already!).
Is how many libraries of congress it can read in a fortnight.
Nope.
PROGRAM HelloWorld
PRINT *, "Hello World"
END PROGRAM HelloWorld
Clearly popups don't work in an effective way, yet programmers continue to use them for the wrong purposes.
It isn't just Windows either. Apps in Gnome, KDE and OpenOffice also open up stupid dialogs.
Lotus Notes comes to mind.