Because the entire concept of "used goods" works because physical goods degrade and are difficult to replicate. When something doesnt degrade, and you can easily (and untraceably) make a duplicate, and a purchaser of the used article cannot verify that you have no copies left, the whole concept falls apart.
Interestingly, when the discussion comes around to MPAA using IP to identify, many on slashdot would claim that IP is in no way evidence of anything for a wide number of reasons-- insecure Wifi, multiple household users, DHCP, etc.
Obviously the two arent exactly the same, and obviously I cant accuse YOU of a double standard, but slashdot as a community certainly seems to have a double standard.
Given Windows usually hasn't got tools like, cut, paste, diff, comm, join, (useful version of ) sort, uniq, grep, awk, and sed installed Access makes a marginally suitable replacement.
It does now. Give Powershell a whirl, you might be impressed (once you get over its insane, ridiculous, and excessive wordiness)
There are millions of Americans in jail with a large percentage in jail to prop up failed business methods.
Your government isn't much different then China's, alternating between progressive and conservative every 8 years though the people do have slightly more input and the capability of throwing out a (perceived) weak ruler after only 4 years.
You sound like you have never been to the US, and also like (luckily for you) youve not been to China or seen its problems. Heres a shortlist of differences between the two.
* In China, you can be summarily and indefinately detained and your family placed on house arrest for political speech (Liu Xiaobo)
* In China, student protests may and have been broken up by the military (Tianamen Square)
* In China, it is illegal to search for such incidents (GFW)
* In China, every cellphone call you make is tracked. Every website you visit is monitored. The state owns and controls every single method of communication. Distributing anti-government newspapers is illegal.
* In China, you are required to take an oath of atheism in order to work for the communist party. Proselytzing / speaking of religion to anyone under 18 is illegal. It is illegal to form private churches.
In the US, the only one of those you could POSSIBLY claim is bits of the "monitoring"; the US certainly does have echelon, tho its capabilities are unknown, and at the very least ISPs can refuse to turn over customer records without a warrant. In China, they dont need cooperation from the ISP; they already have the info you need as everything passes thru their filters.
Its unfortunate that a number of people ignorantly think as you do, having little experience with either country. The US has some issues, but China is currently a minefield of problems with things that are taken for granted in most western societies.
The guy broke the law, that has consequences. Whether or not you like it, "injustice" would be if he got away with breaking laws passed by our society.
Yes, it is super scary when you break the law and the law catches up with you.
Fair enough, but if the posts be believed the "major problem here" is that Schwartz was somehow goaded into suicide because he was threatened with legal consequences for having broken the law. To me, that seems kind of backwards.
he same people who threatened with 35 years something that alternately could be convicted with only 6 months,
Prosecutors can threaten all sorts of stuff, that doesnt make it A) reality or B) illegal.
he'd have to go to jail WITHOUT a trial, if he didn't want that threat against him.
Then go to trial. Wait, whats that, he doesnt want to do that because hes actually guilty? Boo hoo.
It almost sounds like youre trying to spin it so that it would be an injustice if a person who had broken the law was actually found guilty, or actually recieved prison time for breaking that law.
You dont understand what port-security does. Please research port-security and sticky mac. Duplicate MACs have no bearing on port-security (the switch honestly doesnt care, as long as your MAC doesnt mysteriously change).
Before proposing new solutions to problems that have already been solved, I recommend you do more research.
Every port being on a different segment is utterly unnecessary, and would introduce unneeded latency, break discoverability (broadcasts no longer work), waste huge numbers of IPs (for every IP you get, youre wasting one on the network number, one on the broadcast, and one on the gateway), and all for no benefit.
As I said, you cal ALREADY turn on port-security with dynamically learned MAC addresses on a mid-range Cisco Switch, which immediately thwarts MAC spoofing / ARP poisoning. The thing is, these attacks are pretty rare (since you have to be on the LAN in order to perform them, and theyre incredibly easy to detect and incredibly disruptive), so theres generally no need. The solution you are proposing-- segmenting everything onto a separate subnet-- adds a HUGE amount of complexity to address management and huge expenses in the hardware side. Routers perform a vastly different job than switches, and do so orders of magnitude slower. switching is performed essentially "wire-speed", with fractions of a millisecond incurred by switching delay, while routers can add multiple milliseconds to that. And when you're dealing with latency sensitive applications-- for instance, SAN access or remote computng-- and you add up the milliseconds from EACH router along the way, that becomes substantial.
And Im at an utter loss as to why using routers would even SOLVE this problem; you STILL would have to do filtering, just at layer 3 instead of layer 2.
If it performs routing, then it is a router.
And if it performs switching, it is a switch. Layer 3 switches perform switching, fast as you would normally expect, but have the rudimentary ability to route between VLANs on the same switch. It is still technically within the "switching" realm (as you are doing a lookup of physical port to IP address-- something that routers simply do not do), but also touches the routing realm (as you are crossing subnet boundaries). To call it "a router" is to misunderstand what it does.
Im beginning to wonder if Im on candid camera here; you appear to be advocating with a "straight face" the replacement of OSI layer 2 with OSI layer 3, with no conception of why that is an awful idea.
Then it should use the proper IP address on the interface that it is using. You cannot do what you're suggesting, because if your main line goes down and you continue to use that IP on the redundant connection, your return traffic will still be routed to the downed line.
Alternatively, if you try to send a packet sourced on one NIC IP out through a different NIC, your computer will discard the response as it is coming into the wrong interface.
There is NO circumstance where your ISP can properly route a packet back to you and yet not know that they are doing so. Every ISP knows the valid range of IP addresses that they can route; they must, in order to route them-- they have to announce them via BGP, they have to route them internally. And unless an ISP has a single massive layer-2 broadcast domain, they also know with great specificity which routers are serving which customers, and which IPs those routers are routing.
There is a major difference. TCP is designed to actually work, even if nodes are spoofing source IP
TCP will not work when the source ip is spoofed; the 3-way handshake will fail, and every stateful firewall on the market will block the traffic as bogus ACK or SYN-ACK traffic. For the TCP handshake to complete there must be 3 packets sent back and forth, and only two endpoint IPs involved (excepting NAT or other packet re-writing techniques).
Ethernet is designed for a LAN where people trust each other. On a LAN it only takes a few packets with spoofed source address to break connectivity,
Thats only true with commodity hardware. It is trivial with enterprise hardware to do the exact same sort of filtering; switches can be configured to watch what MACs come across a port and then accept ONLY those MACs in the future.
Switches will probably not be replaced by routers; they serve different purposes, and in fact you see the reverse trend-- layer 3 switches which are able to perform rudimentary routing. The problem with routers is that they are much much slower, and they perform a fundamentally different task. All routers I have ever worked on explicitly forbid having more than one physical interface with the same subnet (home wifi routers are combo router / switches). And you absolutely do not want your router being hammered with every bit of traffic on your network-- mid-range switches can easily handle 96gbps of traffic, while a router than can handle that would be substantially more expensive.
MAC spoofing is not an issue in any environment with the budget for a $500 switch, and the serious desire to defeat MAC spoofing.
Nonsense. I think that OSS enthusiasts grossly overstate the benefits of OSS sometimes, but the "many eyes" DID find the problem, and now they are working on a fix.
Would you rather A) they tell everyone "hey, the problem is that you can easily exploit PostGreSQL by doing X, but we will have a fix in a week or two", or B) tell everyone "there is a security flaw, but we will not disclose details until the fix is out"
Guess which one ALL major vendors do when they have a choice, btw? Google does this, MS does this, etc.
Incidentally, no, vista does not low-level format the drive. Low-level formatting requires tools supplied by the drive vendor and cannot generally be done "in the field" without rendering your drive useless.
At this point im suspecting that you are a troll, and I dont really have a desire to argue with someone who wants to ignore documentation by the company who makes the very tools we are discussing.
Slashdot Mirror
Because VNC is slow and sucks.
point release = bugfix, security fix
major release = new features
Seriously, its not as if this hasnt been answered about a zillion times already.
Because noone has solved the problem of "how do you ensure that the user has transferred all of his copies to the recipient", among other things.
Because the entire concept of "used goods" works because physical goods degrade and are difficult to replicate. When something doesnt degrade, and you can easily (and untraceably) make a duplicate, and a purchaser of the used article cannot verify that you have no copies left, the whole concept falls apart.
Google is a company that makes money by offering services in return for advertising.
If you dont like their terms, there are options for that.
If you use a VPN to a diskless box that keeps no logs, certainly you can untraceably (at least to local enforcement) use another's IP.
Interestingly, when the discussion comes around to MPAA using IP to identify, many on slashdot would claim that IP is in no way evidence of anything for a wide number of reasons-- insecure Wifi, multiple household users, DHCP, etc.
Obviously the two arent exactly the same, and obviously I cant accuse YOU of a double standard, but slashdot as a community certainly seems to have a double standard.
Given Windows usually hasn't got tools like, cut, paste, diff, comm, join, (useful version of ) sort, uniq, grep, awk, and sed installed Access makes a marginally suitable replacement.
It does now. Give Powershell a whirl, you might be impressed (once you get over its insane, ridiculous, and excessive wordiness)
Nitpick, you cant PROVE anything historical, because history isnt something you can test in a lab.
There are millions of Americans in jail with a large percentage in jail to prop up failed business methods.
Your government isn't much different then China's, alternating between progressive and conservative every 8 years though the people do have slightly more input and the capability of throwing out a (perceived) weak ruler after only 4 years.
You sound like you have never been to the US, and also like (luckily for you) youve not been to China or seen its problems.
Heres a shortlist of differences between the two.
* In China, you can be summarily and indefinately detained and your family placed on house arrest for political speech (Liu Xiaobo)
* In China, student protests may and have been broken up by the military (Tianamen Square)
* In China, it is illegal to search for such incidents (GFW)
* In China, every cellphone call you make is tracked. Every website you visit is monitored. The state owns and controls every single method of communication. Distributing anti-government newspapers is illegal.
* In China, you are required to take an oath of atheism in order to work for the communist party. Proselytzing / speaking of religion to anyone under 18 is illegal. It is illegal to form private churches.
In the US, the only one of those you could POSSIBLY claim is bits of the "monitoring"; the US certainly does have echelon, tho its capabilities are unknown, and at the very least ISPs can refuse to turn over customer records without a warrant. In China, they dont need cooperation from the ISP; they already have the info you need as everything passes thru their filters.
Its unfortunate that a number of people ignorantly think as you do, having little experience with either country. The US has some issues, but China is currently a minefield of problems with things that are taken for granted in most western societies.
The guy broke the law, that has consequences. Whether or not you like it, "injustice" would be if he got away with breaking laws passed by our society.
Yes, it is super scary when you break the law and the law catches up with you.
This is slashdot, the solution to EVERY problem must involve a mob.
Is it really suicide if he committed it to prevent the prosecutor from ruining his girlfriend's life and putting her child into the foster system?
Yes, its really suicide.
Im pretty certain the man responsible for Schwartz' death is already dead.
However, Im glad that in your zeal for justice you are prepared to justify death threats.
Fair enough, but if the posts be believed the "major problem here" is that Schwartz was somehow goaded into suicide because he was threatened with legal consequences for having broken the law. To me, that seems kind of backwards.
he same people who threatened with 35 years something that alternately could be convicted with only 6 months,
Prosecutors can threaten all sorts of stuff, that doesnt make it A) reality or B) illegal.
he'd have to go to jail WITHOUT a trial, if he didn't want that threat against him.
Then go to trial. Wait, whats that, he doesnt want to do that because hes actually guilty? Boo hoo.
It almost sounds like youre trying to spin it so that it would be an injustice if a person who had broken the law was actually found guilty, or actually recieved prison time for breaking that law.
If slashdot comments be believed, the majorty of posters seem to believe that we (those in the US) live in an orwellian police state.
Thats kind of what GP was talkinga bout.
You dont understand what port-security does. Please research port-security and sticky mac. Duplicate MACs have no bearing on port-security (the switch honestly doesnt care, as long as your MAC doesnt mysteriously change).
Before proposing new solutions to problems that have already been solved, I recommend you do more research.
Are you justifying threats?
Every port being on a different segment is utterly unnecessary, and would introduce unneeded latency, break discoverability (broadcasts no longer work), waste huge numbers of IPs (for every IP you get, youre wasting one on the network number, one on the broadcast, and one on the gateway), and all for no benefit.
As I said, you cal ALREADY turn on port-security with dynamically learned MAC addresses on a mid-range Cisco Switch, which immediately thwarts MAC spoofing / ARP poisoning. The thing is, these attacks are pretty rare (since you have to be on the LAN in order to perform them, and theyre incredibly easy to detect and incredibly disruptive), so theres generally no need. The solution you are proposing-- segmenting everything onto a separate subnet-- adds a HUGE amount of complexity to address management and huge expenses in the hardware side. Routers perform a vastly different job than switches, and do so orders of magnitude slower. switching is performed essentially "wire-speed", with fractions of a millisecond incurred by switching delay, while routers can add multiple milliseconds to that. And when you're dealing with latency sensitive applications-- for instance, SAN access or remote computng-- and you add up the milliseconds from EACH router along the way, that becomes substantial.
And Im at an utter loss as to why using routers would even SOLVE this problem; you STILL would have to do filtering, just at layer 3 instead of layer 2.
If it performs routing, then it is a router.
And if it performs switching, it is a switch. Layer 3 switches perform switching, fast as you would normally expect, but have the rudimentary ability to route between VLANs on the same switch. It is still technically within the "switching" realm (as you are doing a lookup of physical port to IP address-- something that routers simply do not do), but also touches the routing realm (as you are crossing subnet boundaries). To call it "a router" is to misunderstand what it does.
Im beginning to wonder if Im on candid camera here; you appear to be advocating with a "straight face" the replacement of OSI layer 2 with OSI layer 3, with no conception of why that is an awful idea.
Pretty sure armed robbery gets you more than a month in jail.
I also dont believe they generally let you keep the proceeds of your crime when they let you go.
You're welcome to also attempt to stop spam by reconfiguring your BIND server. Just dont be too disappointed when the spam doesnt stop.
It could be delivered through a different path.
Then it should use the proper IP address on the interface that it is using. You cannot do what you're suggesting, because if your main line goes down and you continue to use that IP on the redundant connection, your return traffic will still be routed to the downed line.
Alternatively, if you try to send a packet sourced on one NIC IP out through a different NIC, your computer will discard the response as it is coming into the wrong interface.
There is NO circumstance where your ISP can properly route a packet back to you and yet not know that they are doing so. Every ISP knows the valid range of IP addresses that they can route; they must, in order to route them-- they have to announce them via BGP, they have to route them internally. And unless an ISP has a single massive layer-2 broadcast domain, they also know with great specificity which routers are serving which customers, and which IPs those routers are routing.
There is a major difference. TCP is designed to actually work, even if nodes are spoofing source IP
TCP will not work when the source ip is spoofed; the 3-way handshake will fail, and every stateful firewall on the market will block the traffic as bogus ACK or SYN-ACK traffic. For the TCP handshake to complete there must be 3 packets sent back and forth, and only two endpoint IPs involved (excepting NAT or other packet re-writing techniques).
Ethernet is designed for a LAN where people trust each other. On a LAN it only takes a few packets with spoofed source address to break connectivity,
Thats only true with commodity hardware. It is trivial with enterprise hardware to do the exact same sort of filtering; switches can be configured to watch what MACs come across a port and then accept ONLY those MACs in the future.
Switches will probably not be replaced by routers; they serve different purposes, and in fact you see the reverse trend-- layer 3 switches which are able to perform rudimentary routing. The problem with routers is that they are much much slower, and they perform a fundamentally different task. All routers I have ever worked on explicitly forbid having more than one physical interface with the same subnet (home wifi routers are combo router / switches). And you absolutely do not want your router being hammered with every bit of traffic on your network-- mid-range switches can easily handle 96gbps of traffic, while a router than can handle that would be substantially more expensive.
MAC spoofing is not an issue in any environment with the budget for a $500 switch, and the serious desire to defeat MAC spoofing.
Nonsense. I think that OSS enthusiasts grossly overstate the benefits of OSS sometimes, but the "many eyes" DID find the problem, and now they are working on a fix.
Would you rather
A) they tell everyone "hey, the problem is that you can easily exploit PostGreSQL by doing X, but we will have a fix in a week or two", or
B) tell everyone "there is a security flaw, but we will not disclose details until the fix is out"
Guess which one ALL major vendors do when they have a choice, btw? Google does this, MS does this, etc.
Incidentally, no, vista does not low-level format the drive. Low-level formatting requires tools supplied by the drive vendor and cannot generally be done "in the field" without rendering your drive useless.
At this point im suspecting that you are a troll, and I dont really have a desire to argue with someone who wants to ignore documentation by the company who makes the very tools we are discussing.