Slashdot Mirror


User: dgatwood

dgatwood's activity in the archive.

Stories
0
Comments
14,277
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 14,277

  1. Re:What's Bell's stake in this? on Canada's Telco Bell Tried To Have VPNs Banned During NAFTA Negotiations (techdirt.com) · · Score: 1

    Either way, terminology aside, the point still remains that the purpose of NAFTA was to remove artificial trade barriers between the countries, and geo-blocking is an artificial trade barrier.

  2. As complex as these applications are and with as many hands involved in development of them, I find it encouraging that they have so few serious bugs.

    I don't. I find it suspicious. When something this serious and easily discoverable (not by hackers, but by end users) makes it out into a released product, I assume that it is just the tip of the iceberg. How many more serious security problems just haven't been discovered yet? And how many of them have been found and are being secretly exploited by groups who don't have any motivation to disclose them?

    The first rule of secure programming is to assume that the client is hostile and is trying to access resources that they are not authorized to access. I can't even begin to imagine how something like this could possibly get into production, because it should have been stopped at least three times, and arguably four:

    • The calling client should not have activated the button that lets you turn a call into a group until the call is connected. Instead, the client activated that button long before it made any sense to do so. This is a sign of sloppy UI design that didn't get adequate vetting, both by programmers and by UI designers. Dozens of people had to miss this one, and it was literally staring them right in the face. Good UI uses button state to tell the user what can be done at a given point in time, and this app obviously didn't do that properly (if at all).
    • The server should have rejected the request to add a connection to a group when the connection was not yet established. Instead, the server deferred all responsibility for security to the client (very, very bad). This complete lack of state tracking on the server side implies server programmers who lack adequate training in writing secure software. This one is unconscionable.
    • The receiving client should not have allowed data to pass from the camera or microphone to the encoder until the user accepted the call. This strongly suggests that the client is also being absurdly non-stateful. A "waiting for user confirmation" state is not the same as the "waiting for server confirmation" state, and the only way you could combine those two would be to keep no state at all, and blindly trust the server. This one is also unconscionable.
    • It should really not even be possible for the server to turn on the encoder. That is a fundamental design flaw. The client should start sending data to the server when an outgoing connection opens, and the server should discard it until it has someone to send the data to. With that much simpler design, turning the camera and microphone on remotely would be impossible.

    Those are three very different bugs at three very different levels of the system — a client UI design bug, a client state machine design bug, and a server failing to check state properly before passing on a request from a hostile client to another client. This wasn't just a failure to think about the edge cases. Rather, this should only be possible if you almost completely fail to design the app or the server at all. And that's the best case scenario. There might be even deeper design flaws, like using the same message to trigger two different client behaviors. We can't know for sure, because the protocol is unpublished.

    IMO, there are really only two ways to explain such a comedy of errors: either the programmers who designed this were too inexperienced to be trusted to design a protocol by themselves or the product was rushed to market, resulting in inadequate time for proper design and testing. And the fact that group FaceTime support was almost two months late further supports that assertion. Either way, the root cause is bad management, and the problem needs to be fixed from the top down (read "by replacing people from the top down").

    Well, no, actually there is a third possible explanation. Given the history of various spy agencies attempting to inject remote monitor

  3. Re:What's Bell's stake in this? on Canada's Telco Bell Tried To Have VPNs Banned During NAFTA Negotiations (techdirt.com) · · Score: 2

    The intent of NAFTA was to create a common market for the U.S., Canada, and Mexico by eliminating trade barriers between those countries. If it makes sense to eliminate geo-blocking among EU states, then it also makes sense to eliminate it among the U.S., Canada, and Mexico for precisely the same reason.

  4. Re:How to safeguard on UltraViolet Digital Movie Locker is Shutting Down (theverge.com) · · Score: 1

    Amazon often had two versions of a movie, one with a code, one without, and there was always a price difference between the two, despite being the same movie. Now whether those were precisely the same edition or the non-UV copies were new old stock, I couldn't say, but the effect is the same, either way. And unused codes affected the resale price of discs as well.

  5. Re:What's Bell's stake in this? on Canada's Telco Bell Tried To Have VPNs Banned During NAFTA Negotiations (techdirt.com) · · Score: 2

    This right here is why geographic restrictions on content should be illegal. Europe got it right when they banned geo-blocking. It only hurts consumers by diminishing the free market and propping up monopolies/oligopolies. It can never have any real benefit.

  6. So this isn't the fault of the phone or the server. Nor is it the fault of Apple's security model. It's the fault of the face time app. The face time app should never enable the microphone or camera until the user answers the call, regardless of what the server does.

    Chances are that this is something silly, like incorrectly assuming that a group connection request is a new person being added by someone in the group already, who therefore should be connected immediately, while failing to check if the group is actually connected yet.

    Still, this makes me seriously question whether Apple’s aggressive push to hire so many junior employees straight out of college is having a major negative impact on their code quality. After all, this required two different teams to write code that fails to check state properly. The client should have refused to connect the stream before the call was established, and the server should have refused to ask for one. Two *different* teams at Apple failed to care enough about customer privacy to make sure that FaceTime couldn’t become a tool for spying on users.

    This doesn’t point to a minor problem, but rather, suggests a fairly fundamental problem in the protocol (the server not knowing the state of the connection). Of course, there’s no way to know for sure, because Apple never published the FaceTime communication protocol like they said they were going to. Odds are, this flaw would have been prevented had they put security above their proprietary nature and published it as an open specification during the product development cycle. And this, boys and girls, is why proprietary protocols are bad.

    Either way, this is one seriously bad mistake that could only happen if a *lot* of employees were *all* grossly negligent about security and failed to understand basic threat modeling. So this sounds to me like a major systemic problem that needs to be fixed from the top down with real leadership. Mr. Cook, it’s time to step up.

  7. Re:Further clarification - not limited on Apple Blocks Google From Running Its Internal iOS Apps (theverge.com) · · Score: 1

    Nope. Employees have to be paid minimum wage. Contractors do not. In fact, most contracts are fixed-price contracts, where the company pays a specific amount of money in exchange for a specific job getting completed by a particular deadline. The contractor asks for an amount of money based on how long he or she thinks the job will take. If it takes longer and the contractor ends up getting less than minimum wage, it's the contractor's fault for bidding too low.

  8. Re:How to safeguard on UltraViolet Digital Movie Locker is Shutting Down (theverge.com) · · Score: 3, Informative

    I have the discs, my Ultraviolet codes came with the physical disc and just gave me a nice way to access the content while traveling on a business trip if I found myself bored and with some time to kill.

    The problem is, IIRC, they charged a premium for the versions with the codes, so a lot of people got suckered out of real money for something that is now useless. I'm betting the class-action lawyers are already salivating.

  9. Re:Further clarification - not limited on Apple Blocks Google From Running Its Internal iOS Apps (theverge.com) · · Score: 1

    Oh yes, it's a very clear violation of terms as you are told when you sign up for the program that it's only for use by employees of the company (or contractors).

    Emphasis mine. It's unclear whether paying someone to run an app is sufficient to legally consider that person to be a contractor, but IMO, that's a big enough grey area to build a large office building inside it. :-)

  10. Re:Why would telcos care? on Criminals Are Tapping Into the Phone Network Backbone to Empty Bank Accounts (vice.com) · · Score: 1

    A cell phone is not a good second factor, period. All it takes is one security bug in the operating system, and boom, your authenticator app just got its private keys stolen, and now someone can impersonate you. Worse, with a little luck, the attackers get the passwords for all of your accounts at the same time.

    What we need is for all the banks to standardize on an NFC-based wallet card that lets you add new keys for additional bank accounts, but that is otherwise isolated from the public Internet except while you are adding accounts. It would have two buttons, one of which cycles between functions (NFC programming, Show code for Bank A, Show code for Bank B, etc.), and the other of which is a "Go" button. The codes would be used just like an authenticator app, but more secure because of the impracticality of stealing the keys and the complete physical isolation between the keys and their associated usernames and passwords.

  11. Re: Put Jenny McCarthy in jail on State of Emergency Declared in Washington State Over Measles Outbreak (cbsnews.com) · · Score: 1

    ROFL. Keep telling yourself that. Although the term autism did not exist until the early 20th century, there are records of autistic children in Russia back to the 16th century.

  12. Re: Put Jenny McCarthy in jail on State of Emergency Declared in Washington State Over Measles Outbreak (cbsnews.com) · · Score: 1

    Rate of autism in vaccinated kids: 1 per 59, which is 17 per 1000. Compare for yourself.

    Rate of autism in unvaccinated kids: 1 in 59.

    Done.

  13. Only a modern idiot believes that it requires more skill to sit in an office doing what is effectively busywork than to raise crops.

    You can teach people how to pick fruit or cotton or do other basic repetitive tasks in minutes. This is not true for office work. You need, at a bare minimum, basic literacy to do even the simplest tasks like filing, and you need computer competence to do anything significant. For people who have those skills, they aren't a big deal. For people who don't, you're talking about a significant learning curve.

    A mechanic or anyone who works on engines, process systems or construction typically has many more skills that most of the office drones that spend their lives pushing around electrons for a living, despite the fact they are not compensated for it to the same level.

    Probably true. However, it should be noted that skill level has very little to do with whether a job will be automated, and even intellectual requirements are not necessarily predictive. It takes a fair amount of intellect, skill, and learning to read bad doctor handwriting and type it into a medical records system properly. However, computers are getting better at handling these tasks automatically, and more medical professionals are doing the data entry directly as they work. Eventually, these tasks will become entirely unnecessary.

    The primary dividing line between things that are readily automated and things that aren't is creativity. If your job doesn't involve creativity, you can assume that it is just a matter of time before it goes away.

    For example, architects will exist for a long time. People building houses will continue exist for a while, because lots of stuff has to be figured out on the job site based on interpreting the architectural diagrams. But as prefab house construction becomes more automated, at some point, you'll see more and more prefab houses being built by machine and delivered, because the cost savings will eventually make these more common than traditionally built houses. It is unclear how quickly this will occur, of course. And there will still be a need for carpenters to do renovations and repairs until robots get good enough to do work on-site, which could be a very long time because of the need to creatively tweak the plans based on real-world conditions.

    Heinlein had it right. Specialization is for insects. People are generalists. And a generalist can always move on to another field. A lot of the up and coming generation see it. A person is not their job and the purpose of a job or jobs is to generate the income needed to do what you want to do. Once you make more than you need you're just keeping score and more and more people are losing interest in just keeping score.

    Well, yes, but only to a point. People are generalists, but each individual can function usefully only within a narrow ability band. Give that person a job that is beneath him or her, and the person will get bored and do a bad job or leave. Give that person a job that exceeds his or her capabilities (mentally or physically) and the person will fail. Two keys to maintaining stability are ensuring that there are always enough jobs in each of those ability bands to accommodate the workers and finding ways to improve people's abilities so that they can work in ever-higher bands over time.

  14. Whoops. Screwed up the formatting there. That third paragraph was supposed to be part of the outer quote. Mea culpa.

  15. Oops. I should have commented on the second part.

    The media, in this field as in many other areas of technical expertise, is attracted to extreme statements rather than focusing on a balanced discussion of what is known in the academic area. In the context of the future of work, this takes the form of statements claiming that new technologies will bring the end of work for humans. Nothing in the serious research in this area suggests that something like this is in the cards.

    If you want to use that study to argue the Luddite case, you should go argue it with the author. I'm going to assume he knows the results of the study better than you or the sensationalist media does.

    Obviously it will not bring about the end of work for humans, and obviously the article does not say that it will. What it will do is bring about a rapid (and rapidly increasing) reduction in work for humans who do not have adequate levels of education or skill to do more complex jobs. The problem is, we have an alarming number of people who are not well educated. These people are likely to be absolutely screwed within the next couple of decades, because there won't be any work for someone who isn't either artistic or college-educated (and not enough work for many of the people who are). And even though a percentage of those people will retire before the transition is complete, they will be replaced by another generation who are also unlikely to be well educated — not just because of the genetic component of intelligence, but also because kids who grow up in an educated family that puts a high value on education are more likely to care about becoming educated themselves and tend to do better in school.

    So what will we do with all of those extra workers? Do we have the government create artificial work projects that could be done for far less money through automation just so that they will have something to do, or do we pay them money to do nothing and hope that they use their free time for something productive or creative? Because the only real alternative I can see to doing one of those things would be to let them starve, and historically speaking, that usually leads to guillotines and heads on pikes.

  16. Carriage companies didn't turn into automobile companies. Woodworkers didn't make the best car makers. Instead, bicycle companies turned into automobile companies and their suppliers. The Carriage companies literally went away, with only one (Studebaker) lasting for very long, before it also went out of business and the brand name (not the workers) was absorbed by a car company.

    Actually, you missed a bunch of companies.

    • Holden, a saddlery company, transitioned to making sidecars for motorcycles and eventually became part of GM.
    • Brighton Buggy Company, founded in 1894, was subsequently moved and renamed to Hercules Buggy Company in 1902, and merged with the other Hercules companies in 1920; Hercules still builds truck and custom van bodies to this day in Henderson, KY (just across the river from stoplight city).
    • George V. Arth & Son began as a buggy builder and transitioned to being a car body shop.

    It seems likely that many more of those companies continued to exist in one form or another, though it's hard to say how many. Either way, carriages were still in use in some parts of the U.S. well into the 1920s, which means the transition from carriages to cars took about forty years to complete (and of course a few groups, such as the Amish, still use them today). During those four decades, young people who would have gone into woodworking instead went into car manufacture, so job loss was a lot more limited than you seem to assume.

    By contrast, with automation getting better and better, manufacturing is likely to approach full automation in the next decade, and other job classes are getting pretty close as well. Ostensibly, any physical job creation has always been only temporary until it could be automated, but when the time period for automation was measured in decades, centuries, or millennia, things were okay. But the growth rate of automation is accelerating rapidly, and so the time period for replacement by robots is getting shorter and shorter. At some point, there will not be enough of those temporary jobs for anything approaching full employment, which also means the pay will also collapse to the minimum allowable by law.

    And this is what study after study have shown is happening. Things are *not* like they were in the 1800s, because new jobs are no longer arriving quickly enough to replace the job losses from automation. We aren't even seeing an increase in high-skill/high-education jobs to make up for the losses in low-skill jobs, much less an increase in jobs that the original workers can be quickly retrained for. We're just seeing a net loss in jobs. So although ostensibly there is always more work to be done, the rate of automation replacing jobs exceeds the rate at which people think of new things to be done, and most new manufacturing and similar is highly automated from day one, which reduces the rate of job creation even for new projects.

  17. True, but it is orders of magnitude less complex if the only things you care about are how the object is moving (i.e. does it have significant mass), whether it is big, and whether it is a person.

  18. Vast areas of work will be almost eliminated such as school teachers. An eighth history class could be broadcast to every eighth grade student in the US.

    This could happen already. It turns out that having an actual knowledgeable person in the class matters a great deal, because passive learning doesn't work nearly as well as active learning.

    The other things, yes, but education probably won't be automated for a long time to come.

  19. Virtually 100% of the carriage making industry has been lost. There were 13,000 of those businesses in 1890, now they're pretty much all defunct.

    Nonsense. There are now just a few dozen companies, but there are at least 4x as many people, so presumably at least 4x as many (horseless) carriages, and probably more given that most families only had one carriage, and the average family probably has 2.5 cars or something.

    There's almost nobody who hand spins thread for a living anymore, either. That used to employ vast numbers of people, mostly across the South.

    Even that was replaced by similarly semi-skilled jobs, though. The difference between those changes and the current changes is that right now, it is looking like in 20-30 years, there will be no more semi-skilled jobs.

    It's one thing to retrain someone to do something else that requires only average mental ability. It's quite another to say, "If you cannot get a job as a delivery driver, you should retrain to become a brain surgeon." Believing such a thing is broadly possible would require borderline Marie Antoinette levels of naïveté.

    Fortunately, there is literally no limit to the amount of work available for people to do, just a lack of people to be available to do it. Specific jobs have been being destroyed by automation for hundreds of years. Yes, the process has accelerated recently. Guess what, it hasn't had a noticeable effect on unemployment rates, rather it leads to increased wages over time as increased productivity as a result of more capital (automation) being able to be used by people to accomplish more.

    That is only true because as humans are still needed for some parts of the process. We're rapidly approaching a tipping point where that will no longer be true. And we're already seeing increased unemployment from automation.

    A 2017 study out of MIT and Boston University found that from 1993 to 2007, for every one additional robot added per 1000 workers, unemployment increased by .18–.34% and average wages decreased by .25–.5%. They found that somewhere between 360,000 and 670,000 jobs were lost due to automation, and further found that "Interestingly, and perhaps surprisingly, we do not find positive and offsetting employment gains in any occupation or education groups."

    Let that sink in for a moment. Jobs were lost and nothing took their place. Unemployment increased because of automation. And nothing replaced those jobs. And the jobs that remained paid less money because people were competing against automation and trying to underbid it. And the more automation replaces people, the faster it will do so.

  20. Is Google even close to recognizing a *still picture* of a duck from a dog from a cat from a beaver using their entire datacenter within the time the car will need?

    If it is flying in the general direction of your windshield, I don't care if it is a duck or a dog or a cat. The car had better stop. Being able to identify objects is not necessary. What is necessary is the ability to classify objects as something that will cause damage when hit or not, along with the ability to determine whether those objects have the right of way or not.

  21. Maybe we could add a bit of scorched earth to the equation — make them battle it out with swords or flamethrowers or land mines or something. Last person standing determines whether the bill passes or not.

  22. but A. convincing someone by email/phone/snail mail is far less efficient than in-person conversations

    Which is EXACTLY why you want to have congresspeople near others of similar, good, ideas so those ideas can germinate and take hold, not wither in a sea of privacy.

    What good ideas? I haven't seen any good ideas out of either party since... well... wow, I'm actually having a hard time thinking of any. In my lifetime. I remember all the way back through Reagan, and can't think of a single law that hasn't been, at best, badly screwed up by lobbyists to the point that it had serious problems (including Obamacare, which is one of the least horrible). And most of them have been downright disasters.

    No, what you want is to have congresspeople near the people, so that good ideas that come from the general public can actually get brought to the attention of the rest of Congress. Good ideas do not form in isolation, and Washington D.C. is basically one giant echo chamber. Expecting people to have good ideas when all they are exposed to are a bunch of blowhard politicians and partisan think-tanks is like expecting a random person who has never left the country to understand world culture. The more isolated congresspeople are from their constituents, the less in touch they are with the needs of their districts, and the worse they are as legislators, inherently. There's simply no way around that reality.

  23. Of course. But that costs a couple hundred dollars per politician. Multiply that times 535, and a single circuit around Congress likely costs more than your lobbyist's annual salary. Flying lobbyists to visit every politician is quite infeasible, and even flying to all the key politicians in a single committee is expen$ive. As I said, the goal is not to make lobbying impossible, just to make it expensive enough that the effects of corporate lobbying can easily be counteracted by public opinion.

    Right now, Washington groups and big companies have all the power, because they're the only ones who can realistically get face time with our representatives. Anything that can change that will substantially shift the balance of power, for better or worse.

  24. Until lobbying is illegal, it will always be there. You can not move a lawmaker far enough away from a lobbyist. Lawmakers and lobbyists co-exist in the current system.

    The point is not to move the lawmakers too far away for lobbyists, but rather to change the slope of the playing field in the opposite direction.

    If a congressperson is in Washington D.C., then a company can hire a single lobbyist to talk to that congressperson in person, along with about 534 others, barring vacancies. And the congressperson is too far away for the people in the district to realistically do any in-person lobbying of their own.

    If a congressperson is in his or her district, then a company either has to hire 535 lobbyists, fly one lobbyist all around the country, or somewhere in between. Either way, it is dramatically more expensive, which will significantly reduce the amount of lobbying to issues that those organizations have very strong feelings about and/or organizations that are really wealthy. And it will be a nice, easy drive for the people in the district to go up and visit their congresspeople.

    Yes, there will be non-in-person lobbying going on by lobbyists, but A. convincing someone by email/phone/snail mail is far less efficient than in-person conversations, and B. with a little luck, the number of people doing in-person lobbying will dwarf the number of corporations doing remote lobbying, which tilts the scale even further in the direction of the people.

  25. We already don't need the Senate, and there are already proposals on the table to push a constitutional amendment dissolving the senate.

    Oh, yes, we most certainly do. Although the senate's one-state-two-votes rule is something of an anachronism, the primary purpose for the senate is very much still valid — putting the brakes on a fickle electorate by ensuring that no more than one third of that house can change in a single election cycle.

    BTW, the person asking the original question got it very wrong. The question should not be whether lawmakers should be allowed to hold hearings, debate, and vote on legislation from their districts, but rather whether they should be required to do so.

    The main problem with Washington, as far as I can tell, is that lobbyists and partisan think-tanks have amazing access to legislators, while the people in their districts have almost none. As far as I'm concerned, Congress should meet for one week at the start of each legislative year, for the opening gavel and choosing people for committees to replace folks who are stepping down or who have left Congress entirely. They should meet again for the closing gavel, followed by a holiday party at the end of the year. The rest of the time, they should be required to spend at least 90% of their days in their districts, among the people they represent.

    The current situation is absolute madness, and has been for some time.