It's a matter of degree. And tech tends to skew further in the direction of 'being thrown to the shark-like feeding frenzy' than do most other subjects.
While I entirely agree with you on that one (I've been in more 'some sort of technical group/club/class' contexts than I can remember where having the temerity to join while female was treated as an implicit invitation for every optimist in the place to hit on you(well beyond the bounds of taste, being asked to fuck off, etc. so spare me the 'feminism is killing fun!!!') until you gave up in disgust and left.
What concerns me is that the assorted 'multicultural' bullshit described in TFA sounds more like some kind of racist farce than like an actual inclusion strategy: "Hey, black kid, you 'urban' types like skatesboards and graffiti, right? How about some programming with skateboards and graffiti?" and will do absolutely nothing to address the 'entire class looks you up and down, because you are not one of us and/or we are interested only in fucking you' school of dissuading people from taking up technical subjects.
It's not as though pasty white guys take up comp sci because it "expresses their anglo-saxon heritage".
In some of the world's lousier neighborhoods, it'd probably buy you the AKs and a supply of conscripted children to operate them, the serious metal printers are Not Cheap.
(Also, company PR emphasizes that 'no machining' had to be done to the printed parts; which is impressive; but also allows room for assorted heat treatment, surface coating, and other things you do to metal without machine tools)
Faking gold is tough: It's about twice as dense as lead; but is almost comically unlike tungsten or uranium (more or less your only options on density) in every other respect.
you cannot proxy https and about anything that uses authentication
You can't (easily) MiTM clients that you don't manage; but many, perhaps most, update mechanisms don't use SSL or authentication. It's assumed that ineligible users either have absolutely no interest, or (as in the case of pirates) are probably sophisticated enough that trying to keep them from scoring a copy somehow isn't worth the effort.
As for SSL, that's extra overhead, and the server is shovelling out the same set of patches to everyone and (on all remotely recent and non-insane update systems) the update client is verifying the package signature before installation, so protecting the package on-the-fly isn't a high priority.
There are likely to be exceptions, which you'll have to block or suck up; but SSL is not a priority in basic patching scenarios (though the fact that some of the big guys, like Windows update, use BITS rather than HTTP will be modestly inconvenient, since HTTP proxies are incredibly common compared to other flavors).
Why did the NYT let a report called 'Walt Mossberg' write newb-level electronics reviews, rather than pushing him in the direction of being a hard hitting, hard drinking, crime-beat reporter with a tolerance for risk and a taste for vigilante justice?
If you want to spin 'pressure' flavored conspiracy theories, whose CEO was in the position of being a really shitty organ donor candidate; but needed a new liver, fast, if he felt like not dying?
The Cypress parts are actually pretty neat for suitable applications. USB2 interface hardware all done for you, fast-enough-for-bit-shovelling 8051, and you only need a tiny slice of nonvolatile storage to store your VID/PID of choice, to tell the host system what firmware to load on launch.
Quite a few neat little devices, like the Saleae Logic are based on them: relatively cheap, pretty much impossible to 'brick' (since they just reload their firmware when unplugged and plugged back in, makes updates easy); but they seem like a hell of a thing to bake permanently into a non-user-accessible location with permanent access to the USB bus.
Cameras with physical lens covers are thicker than cameras without. That's all it took to convince Apple.
Now, why they have an 8051 hardwired to the USB bus that accepts arbitrary firmware uploads without even having to elevate beyond user permissions, I can only blame stupidity.
I wouldn't bet on it, short of some sort of psych plea alarming enough that he'll end up in a secure ward.
This is Boston (well, Cambridge, 'Greater Boston'.) The local security forces have a... less than glorious... history with bomb-related issues. The 9/11 planes took off from Logan, the Mooninite panic made fools of the PD, a couple of losers with essentially zero resources just hand-carried bombs right into the Boston Marathon crowds and walked away, with the cops bringing the entire area to a screeching halt as they bumbled their way toward capturing the less interesting suspect, after substantial delay, and are still embroiled in an unimpressive looking case (complete with an allegedly valuable person of interest who mysteriously had to be shot to death during interrogation...)
I would be shocked if the PD, FBI, and local DAs aren't licking their lips and smelling blood. They have their man, and bagged him quickly and efficiently, and his 'I made a bomb threat because exams!' position is sympathetic to absolutely no one. I Would. Not. Want. to be him right now.
... to use TOR, but then gave a full confession during an "interview", throwing his right to remain silent (and to have a lawyer present during questioning) out the window?
Outside of pessimists, paranoiacs, and people whose job description involves the word 'uptime', it's normal for someone engaged in 'problem solving' to stop thinking as soon as they find a solution.
In his case, he started thinking, came up with a multi-layer anonymity plan, and then apparently stopped. When it failed, he suddenly had FBI agents and no additional plan. (Also, basic script-kiddie attempts at hiding online and lying to experienced interrogators in person are two very, very, different skills.)
All the campus networks I've seen remotely recently do some sort of access control, if only to avoid being a free wifi provider for every porn-torrent enthusiast in the neighborhood. Sometimes 802.11x, sometimes that bloody awful Cisco VPN monstrosity.
What's more notable is that they apparently keep traffic logs for some amount of time, at least long enough to catch this guy, who knows how much longer?
If you have a network of any nontrivial size, and want to keep it from falling in a screaming heap (especially with the lousiness of wireless links in the mix), taking steps to ensure that most of the users are the ones you are supposed to be providing service to, and doing some QoS to keep them from stepping on each others' toes is basically necessary. Keeping traffic logs, though, is an additional chunk of effort and expense, and all so that people will be motivated to come bug you for access to them. I wonder when they started keeping logs, and why.
The best Harvard students learn that you have no need to conceal your crimes if you can commit them from a position of enough influence to simply make them legal. That's where kiddo slipped up.
It doesn't much help his case that circumstantial evidence pointed everyone more or less immediately at the Harvard campus, and thus at the first layer of the 'onion'. Tor is only minimally better (if at all) then straight SSL/TLS if the operator of hop #1 has strong reasons to be suspicious of Tor traffic within a set time period.
Do not do anything on a cellular phone that you would not do on a public computer in the library. Treat them as you would a public phone.
That should tell you everything you need to know about the "security".
You must be one of those 'optimists' I've read about. A public phone isn't strongly correlated with you, personally, nor does it provide much in the way of real time location data (aside from the 'well, he must have been in the phone booth when he made that call' data point). Plus, you can still get computers without cameras and microphones...
SMSes seem to be fairly commonly abused as the cheapskate's "Two-factor authentication" (a convenient excuse to rake in customer phone numbers, and a device that probably isn't infected with the same malware as the users' PCs, plus it's cheaper than dedicate hardware security tokens!)
Blame is irrational. Identifying patient zero can be very useful indeed. That doesn't give the process a moral dimension; but the mechanics are pretty similar.
I suspect that they are talking about 'genes being released' because they are using some sort of "metagenomic" technique.
Traditionally, if you wanted to study bacteria, you'd take samples, haul them back to the lab, plate them out, try to grow them in culture, then do your tests. Trouble is, not all organisms grow under those conditions. With gene sequencing now cheap and fast, you can go the alternate route of just grabbing a sample, grinding it up, and sequencing everything. You lose the ability to trivially correlate a given gene with a given organism (unless you have prior knowledge that allows you to make an inference); but you get a very powerful 'snapshot' of what genes are present, and in what proportions, in the sample without the need to know how to separate and cultivate them.
It's an extremely powerful approach for hunting novel species, since basically anything with DNA will show up regardless of whether you know anything about its care and feeding or not, and you can then identify novel DNA sequences and start looking for their hosts. It's also suitable in this case, because they aren't really interested in the bacteria (it isn't news that drinking sewage is a bad plan); but in shifts in the gene distribution of the entire population, which is exactly what grinding it up and sequencing it will get you a look at.
It is considered...painfully poor practice... but it isn't unheard of for IPMI interfaces to be left accessible to all and sundry, with nothing but some (generally dreadful) vendor firmware between the hostile world and essentially physical-or-better access to the server.
And for any BIOS not presently connected to the internet, the Distributed Management Task Force is probably working on 'fixing' that.
Perhaps more importantly, even if their claims are 100% true, they are basically irrelevant to the 'read absolutely everybody's email on the entire planet' side of the NSA, and instead support the 'do tedious work on making sure computer security sucks less' side of the NSA.
Building a dystopian panopticon surveillance apparatus is of limited use for preventing such an attack (best case, maybe the attackers will be dumb enough to chat about it over insecure channels months or years before it's finished); but provides a dangerous incentive to tolerate, or even encourage, vulnerabilities in systems and infrastructure.
Fixing vulnerabilities is something you can do with nothing more than access to samples of potentially vulnerable things, along with a supply of suitably skilled people paid to poke at them; along with a basic research type group that explores techniques for building future systems more securely.
If the NSA were known for doing that sort of stuff, nobody would have anything unpleasant to say about them, aside from a few possible grumblings about whether software companies were slacking off because they expected the NSA to clean up after them.
Slashdot Mirror
It's a matter of degree. And tech tends to skew further in the direction of 'being thrown to the shark-like feeding frenzy' than do most other subjects.
While I entirely agree with you on that one (I've been in more 'some sort of technical group/club/class' contexts than I can remember where having the temerity to join while female was treated as an implicit invitation for every optimist in the place to hit on you(well beyond the bounds of taste, being asked to fuck off, etc. so spare me the 'feminism is killing fun!!!') until you gave up in disgust and left.
What concerns me is that the assorted 'multicultural' bullshit described in TFA sounds more like some kind of racist farce than like an actual inclusion strategy: "Hey, black kid, you 'urban' types like skatesboards and graffiti, right? How about some programming with skateboards and graffiti?" and will do absolutely nothing to address the 'entire class looks you up and down, because you are not one of us and/or we are interested only in fucking you' school of dissuading people from taking up technical subjects.
It's not as though pasty white guys take up comp sci because it "expresses their anglo-saxon heritage".
In some of the world's lousier neighborhoods, it'd probably buy you the AKs and a supply of conscripted children to operate them, the serious metal printers are Not Cheap.
(Also, company PR emphasizes that 'no machining' had to be done to the printed parts; which is impressive; but also allows room for assorted heat treatment, surface coating, and other things you do to metal without machine tools)
Faking gold is tough: It's about twice as dense as lead; but is almost comically unlike tungsten or uranium (more or less your only options on density) in every other respect.
Let me let you in on a little secret about "Fuzzyfuzzyfungus" and "FuzzyFungus" and the fact that Boingboing has a 16-character username limit...
you cannot proxy https and about anything that uses authentication
You can't (easily) MiTM clients that you don't manage; but many, perhaps most, update mechanisms don't use SSL or authentication. It's assumed that ineligible users either have absolutely no interest, or (as in the case of pirates) are probably sophisticated enough that trying to keep them from scoring a copy somehow isn't worth the effort.
As for SSL, that's extra overhead, and the server is shovelling out the same set of patches to everyone and (on all remotely recent and non-insane update systems) the update client is verifying the package signature before installation, so protecting the package on-the-fly isn't a high priority.
There are likely to be exceptions, which you'll have to block or suck up; but SSL is not a priority in basic patching scenarios (though the fact that some of the big guys, like Windows update, use BITS rather than HTTP will be modestly inconvenient, since HTTP proxies are incredibly common compared to other flavors).
Why did the NYT let a report called 'Walt Mossberg' write newb-level electronics reviews, rather than pushing him in the direction of being a hard hitting, hard drinking, crime-beat reporter with a tolerance for risk and a taste for vigilante justice?
It seems like such a waste...
If you want to spin 'pressure' flavored conspiracy theories, whose CEO was in the position of being a really shitty organ donor candidate; but needed a new liver, fast, if he felt like not dying?
The Cypress parts are actually pretty neat for suitable applications. USB2 interface hardware all done for you, fast-enough-for-bit-shovelling 8051, and you only need a tiny slice of nonvolatile storage to store your VID/PID of choice, to tell the host system what firmware to load on launch.
Quite a few neat little devices, like the Saleae Logic are based on them: relatively cheap, pretty much impossible to 'brick' (since they just reload their firmware when unplugged and plugged back in, makes updates easy); but they seem like a hell of a thing to bake permanently into a non-user-accessible location with permanent access to the USB bus.
Hence the interest in robots.
Cameras with physical lens covers are thicker than cameras without. That's all it took to convince Apple.
Now, why they have an 8051 hardwired to the USB bus that accepts arbitrary firmware uploads without even having to elevate beyond user permissions, I can only blame stupidity.
Compliance is Exciting and Mandatory! Thank you in advance for your cooperation.
True enough. Never let it be said that amphetamines are a perfect substitute for sleep.
I wouldn't bet on it, short of some sort of psych plea alarming enough that he'll end up in a secure ward.
This is Boston (well, Cambridge, 'Greater Boston'.) The local security forces have a... less than glorious... history with bomb-related issues. The 9/11 planes took off from Logan, the Mooninite panic made fools of the PD, a couple of losers with essentially zero resources just hand-carried bombs right into the Boston Marathon crowds and walked away, with the cops bringing the entire area to a screeching halt as they bumbled their way toward capturing the less interesting suspect, after substantial delay, and are still embroiled in an unimpressive looking case (complete with an allegedly valuable person of interest who mysteriously had to be shot to death during interrogation...)
I would be shocked if the PD, FBI, and local DAs aren't licking their lips and smelling blood. They have their man, and bagged him quickly and efficiently, and his 'I made a bomb threat because exams!' position is sympathetic to absolutely no one. I Would. Not. Want. to be him right now.
... to use TOR, but then gave a full confession during an "interview", throwing his right to remain silent (and to have a lawyer present during questioning) out the window?
Outside of pessimists, paranoiacs, and people whose job description involves the word 'uptime', it's normal for someone engaged in 'problem solving' to stop thinking as soon as they find a solution.
In his case, he started thinking, came up with a multi-layer anonymity plan, and then apparently stopped. When it failed, he suddenly had FBI agents and no additional plan. (Also, basic script-kiddie attempts at hiding online and lying to experienced interrogators in person are two very, very, different skills.)
All the campus networks I've seen remotely recently do some sort of access control, if only to avoid being a free wifi provider for every porn-torrent enthusiast in the neighborhood. Sometimes 802.11x, sometimes that bloody awful Cisco VPN monstrosity.
What's more notable is that they apparently keep traffic logs for some amount of time, at least long enough to catch this guy, who knows how much longer?
If you have a network of any nontrivial size, and want to keep it from falling in a screaming heap (especially with the lousiness of wireless links in the mix), taking steps to ensure that most of the users are the ones you are supposed to be providing service to, and doing some QoS to keep them from stepping on each others' toes is basically necessary. Keeping traffic logs, though, is an additional chunk of effort and expense, and all so that people will be motivated to come bug you for access to them. I wonder when they started keeping logs, and why.
The best Harvard students learn that you have no need to conceal your crimes if you can commit them from a position of enough influence to simply make them legal. That's where kiddo slipped up.
It doesn't much help his case that circumstantial evidence pointed everyone more or less immediately at the Harvard campus, and thus at the first layer of the 'onion'. Tor is only minimally better (if at all) then straight SSL/TLS if the operator of hop #1 has strong reasons to be suspicious of Tor traffic within a set time period.
Do not do anything on a cellular phone that you would not do on a public computer in the library. Treat them as you would a public phone.
That should tell you everything you need to know about the "security".
You must be one of those 'optimists' I've read about. A public phone isn't strongly correlated with you, personally, nor does it provide much in the way of real time location data (aside from the 'well, he must have been in the phone booth when he made that call' data point). Plus, you can still get computers without cameras and microphones...
SMSes seem to be fairly commonly abused as the cheapskate's "Two-factor authentication" (a convenient excuse to rake in customer phone numbers, and a device that probably isn't infected with the same malware as the users' PCs, plus it's cheaper than dedicate hardware security tokens!)
When there are ~4-6x10^30 of you, you reproduce unbelievably quickly, and know neither fear nor pain, very few things are futile...
Blame is irrational. Identifying patient zero can be very useful indeed. That doesn't give the process a moral dimension; but the mechanics are pretty similar.
I suspect that they are talking about 'genes being released' because they are using some sort of "metagenomic" technique.
Traditionally, if you wanted to study bacteria, you'd take samples, haul them back to the lab, plate them out, try to grow them in culture, then do your tests. Trouble is, not all organisms grow under those conditions. With gene sequencing now cheap and fast, you can go the alternate route of just grabbing a sample, grinding it up, and sequencing everything. You lose the ability to trivially correlate a given gene with a given organism (unless you have prior knowledge that allows you to make an inference); but you get a very powerful 'snapshot' of what genes are present, and in what proportions, in the sample without the need to know how to separate and cultivate them.
It's an extremely powerful approach for hunting novel species, since basically anything with DNA will show up regardless of whether you know anything about its care and feeding or not, and you can then identify novel DNA sequences and start looking for their hosts. It's also suitable in this case, because they aren't really interested in the bacteria (it isn't news that drinking sewage is a bad plan); but in shifts in the gene distribution of the entire population, which is exactly what grinding it up and sequencing it will get you a look at.
It is considered...painfully poor practice... but it isn't unheard of for IPMI interfaces to be left accessible to all and sundry, with nothing but some (generally dreadful) vendor firmware between the hostile world and essentially physical-or-better access to the server.
And for any BIOS not presently connected to the internet, the Distributed Management Task Force is probably working on 'fixing' that.
Perhaps more importantly, even if their claims are 100% true, they are basically irrelevant to the 'read absolutely everybody's email on the entire planet' side of the NSA, and instead support the 'do tedious work on making sure computer security sucks less' side of the NSA.
Building a dystopian panopticon surveillance apparatus is of limited use for preventing such an attack (best case, maybe the attackers will be dumb enough to chat about it over insecure channels months or years before it's finished); but provides a dangerous incentive to tolerate, or even encourage, vulnerabilities in systems and infrastructure.
Fixing vulnerabilities is something you can do with nothing more than access to samples of potentially vulnerable things, along with a supply of suitably skilled people paid to poke at them; along with a basic research type group that explores techniques for building future systems more securely.
If the NSA were known for doing that sort of stuff, nobody would have anything unpleasant to say about them, aside from a few possible grumblings about whether software companies were slacking off because they expected the NSA to clean up after them.