There have been various ad-hoc solutions to the problem, nothing standardized has yet hit the field, though the PCI-SIG has an initial standard. These guys are representative enough of the sort of products actually available, usually break-out boxes to allow laptops or undersized desktops to run a few more cards. A few more specialized instances, for the laptop market, have consisted of basically your usual docking station; but with a cable that plugs into an expresscard port, rather than a proprietary connector.
Everybody knows that everybody is trying to buff their JS scores; both because the Web2.0 gods demand it, and because not having the best sunspider scores causes your e-penis to shrivel. It isn't exactly a skunkworks secret weapon kind of feature.
The only way that they could really hide from a remotely sophisticated adversary(ie. a group that includes anybody remotely capable of making a competing browser), would be to sacrifice openness in a pretty huge way and make it so that only internal devs could see commits and things being made. If they aren't doing that, they aren't actually hiding much of anything.
Plus, since JS performance is such a point of competition, pre-announcing your coming-real-soon-now feature is a way of encouraging people not to defect to competing products before the feature is actually released.
Given the way costs incurred by corporations are allocated, do you suspect that there are any ways of "getting the message across" whose cost to the company wouldn't end up coming out of their payroll, at least indirectly, if not directly?
The only one I can think of would be to skip the whole "corporation" thing entirely, and just start dropping criminal cases on the heads of management, something for which the political stomach seems to be lacking, at best.
Because "customer" does not necessarily imply "end user of product" just "buyer of product".
Say, for instance, we have a Product X that is Open Source, in the sense of being redistributable; but only distributes source to customers who buy the binary version(as is compatible with OSI or Free Software licences).
Say, for instance, you run a Linux distro, and your customers are whining about "Why isn't Product X in the repositories?". Assuming you think that it will make you more in additional support contracts/boxed copies/OEM integrated sales/whatever you just feel like doing it, it is completely economically rational for you to buy a binary copy of Product X, obtain your copy of the redistributable source, and then package it for your distro.
It would be similarly logical, though requiring more organization, for a coalition of small customers to club together and buy a single binary copy, then share source copies between all members of the club.
This is just more evidence that Piracy is Killing Music(tm)! Pirates, apparently less busy stealing food from the mouths of starving artists' starving children than they seemed, managed to pull over 15 and a half million dollars from the RIAA's coffers...
Clearly, we must set up a cabinet-level Department of Intellectual Property so that the War on Pirates can be fought at public expense, with the same efficiency and success as the scourges of drugs and poverty....
Umm... Because some politician decided that going up against the lobbying might of the American Chemistry Council(including their Chlorine group, which can churn out every-so-touching PSAs about how chlorine is what keeps your childrens' drinking water safe with extreme efficiency), the pulp and paper industries(and their customers, the newspapers, who definitely have no effect on public opinion), and American farmers, who have both a fondness for herbicides and a nearly unbeatable stock of political capital? Seriously? In order to court the all-powerful "hardcore environmentalist wonks" vote?
Obviously, political expediency is an excellent predictor of politician behavior. That much is true and granted. As political strategies go, though, artificially cracking down on dioxins makes incrementally more sense than staging a press conference where you high-five Osama Bin Laden under a banner announcing your endorsement by NAMBLA; but that is about it....
We need to start a pro-dioxin public relations campaign in the Third World, so we can continue to have a place to manufacture those cheap consumer goods. They don't need long life-spans over there because who wants to live long in those nasty places anyway? We could say that dioxin makes you more virile or something. It worked for cigarettes.
To quote one Lawrence Summers:
"'Dirty' Industries: Just between you and me, shouldn't the World Bank be encouraging MORE migration of the dirty industries to the LDCs [Less Developed Countries]? I can think of three reasons:
1) The measurements of the costs of health impairing pollution depends on the foregone earnings from increased morbidity and mortality. From this point of view a given amount of health impairing pollution should be done in the country with the lowest cost, which will be the country with the lowest wages. I think the economic logic behind dumping a load of toxic waste in the lowest wage country is impeccable and we should face up to that.
2) The costs of pollution are likely to be non-linear as the initial increments of pollution probably have very low cost. I've always though that under-populated countries in Africa are vastly UNDER-polluted, their air quality is probably vastly inefficiently low compared to Los Angeles or Mexico City. Only the lamentable facts that so much pollution is generated by non-tradable industries (transport, electrical generation) and that the unit transport costs of solid waste are so high prevent world welfare enhancing trade in air pollution and waste.
3) The demand for a clean environment for aesthetic and health reasons is likely to have very high income elasticity. The concern over an agent that causes a one in a million change in the odds of prostrate cancer is obviously going to be much higher in a country where people survive to get prostrate cancer than in a country where under 5 mortality is is 200 per thousand. Also, much of the concern over industrial atmosphere discharge is about visibility impairing particulates. These discharges may have very little direct health impact. Clearly trade in goods that embody aesthetic pollution concerns could be welfare enhancing. While production is mobile the consumption of pretty air is a non-tradable.
The problem with the arguments against all of these proposals for more pollution in LDCs (intrinsic rights to certain goods, moral reasons, social concerns, lack of adequate markets, etc.) could be turned around and used more or less effectively against every Bank proposal for liberalization. "
One, it directly informs industrial hygiene standards for workers exposed to it on the job. OSHA recommendations/requirements will(possibly some decades after the fact, The Business of America is Business(tm) after all) reflect the levels of exposure that are permissible, given the expected health effects.
Two, it informs environmental regulations related to the discharge of the chemicals in question. Dioxins are only "unavoidable" today because their release has historically been alarmingly close to unregulated, and they are fairly persistent little critters. If the safe exposure limit is revised downward, acceptable release limits will(again, possibly with substantial lag, nobody wants to make the American Chemistry Council cry) will be revised downward, so that, as the compounds eventually are degraded or encapsulated, exposures will fall.
"Bleach" is usually Sodium Hypochlorite, in water solution. Historically, both Sodium Hypochlorite and elemental Chlorine, among others, would have been used at various stages of the pulp bleaching process. Unfortunately, a number of organochlorine compounds are pretty nasty customers(dioxins hog the stage time; but furans, PCBs, and others are also not exactly tasty treats), and using Chlorine to attack wood pulp, full of various organic compounds, produces nice white wood pulp, and a bunch of organochlorine compounds(even if the cardboard isn't going into food packaging, these tend to end up going more or less straight into the river).
The almost-as-cheap-and-somewhat-less-dangerous method substitutes chlorine dioxide for straight chlorine. Apparently, this reduces the amount of exciting organochlorines in the result.
The more costly; but chlorine free, technique involves Ozone(the same applies in water treatment plants). The nice thing about Ozone is that it is pretty close to Chlorine in terms of being a vociferous oxidizing and bleaching agent that is soluble in water; but that it consists entirely of oxygen atoms, and is fairly unstable. This means that you can have a ghastly disinfecting or bleaching agent that, after 24-48 hours of sitting around, is pretty much just plain water with dissolved oxygen.
The chlorine-free methods are particularly popular in Europe, and they've reduced the output of Chlorinated nasties pretty much everywhere; but the odds are still pretty good that, unless specifically stated otherwise and in the EU, your white paper is white because of a chlorine process.
Good that the situation was legally rectified(for the moment); but an illustration of the problem.
They, successfully, used the technological change to pass the buck for a number of years, until outrage and the law eventually caught up with them. Clearly, since the law had to force their hand, their intention was to keep the buck passed forever.
Given the, er, robust state of American democracy, and its laudable freedom from corruption and corporate influence at all levels, I for one am certain that things would end happily here. It would, in fact, probably turn out even better than the Mortgage Electronic Record System, a paragon of accuracy, efficiency, and usually not sending the sheriff to kick people out of their homes without any documentation that a mortgage actually existed, much less is delinquent....
Obviously, this research is just part of the satanic one-world-government's evil population control agenda... Developed weaponized testicle gangrene, to be spread via chemtrail by the UN's black helicopters and Area 51 UFOs reverse engineered from Grey alien technology purchased through a blood-pact involving Christian fetuses illicitly harvested by planned parenthood.
What could be more logical?
(Unfortunately, the loonier grade of anti-vaxer will probably be claiming something approximately that sensible over in the pits of squalor that are NaturalNews and Whale.to. If we are super lucky, it will mutate into a rumor loony enough to, say, interfere with the eradication of polio...)
"Hey boss, marketing and/or legal say we have to have 'two factor authentication' in our product. We could adapt the smartcard chips they use in sims and...."
"Jesus fuck, man, that sounds expensive! We mail out those cards, sometimes unsolicited and pre-activated to poorly validated addresses, like goddamn candy. If your next scheme involves a per-card hardware cost, you might as well go pack your desk, to save security the trouble..."
"Well, we could just change the software and add a scary-looking screen that asks for the ZIP code, that's, like, totally a government-granted numeric ID, right?"
While a CC system that doesn't utterly suck, and trust pretty much every link in the chain like it would its own mother, after she had been notarized and presented two forms of photo ID, I suspect that we could be waiting a while for that...
In the meantime, I'm curious why the "card path" of any exposed payment system would be designed such that it has internal voids where 3rd party hardware can be stashed. A mag-stripe reader is just a surface, with a few mm of electronics behind it. Generally, because people aren't too good at keeping their card at just the right distance, you mount the reader parallel to a passive plate a few mm away, through which the card is run. With a surface channel design, the attacker has to stick their skimmer onto the surface, where it can be detected by visual inspection(made easier if the card slot has blinkenlights, a highly specific shape, certain color/pattern, etc.)
If, for some reason, an internal card path must be used, so that the card can be held on to during the transaction or whatever, one could still make sure that the internal chamber is small enough to admit only a card, and that the eject mechanism doesn't just pop the card halfway out; but actually completely scrapes out the internal chamber each cycle(in order to remove, say, a thin-film reader fabricated on a sticky backed piece of flexible circuit board)...
Good mechanical design won't stop all skimmers; because people may not notice even a fairly blatant one just taped on top of the actual reader; but it should be fairly easy, with good design of the card path, to make it impossible to mount an internal reader without doing some in-situ metalworking.
Even in situations where there isn't an inside man(and I'm sure that there sometimes is), a scheme that habituates the employees, anybody monitoring the CCTV cameras, and the public at large, to people frequently opening and poking at the pumps is likely to decrease security, rather than increase it.
The uniforms of gas station employees aren't exactly secret, nor are clothes that look very much like them hard to get ahold of(given that they are generally just plaincloths, or mechanic-style coveralls, possibly with silkscreened logos), so it would be pretty trivial to concoct a plausible disguise in which to tamper with the device.
I doubt the skimmer-makers would bother, unless the cops have quietly been hunting bluetooth emissions for a while now; but it wouldn't exactly be rocket surgery to have a bluetooth device that just sits there, receiving but maintaining absolute radio silence unless it hears a particular transmission(from a particular bluetooth MAC, if you really want to get paranoid). The wireless analog of port knocking, more or less...
Particularly with all the cellphones floating around, a BT radio, even one yelling its little amplifier out, is hardly automatically suspicious in a reasonably crowded area. Somebody who knew what they were doing, had the right set of antennas, and had some knowledge of what they were looking for(if, for instance, the skimmer-manufacturers produced a large batch, all with BT modules from the same manufacturer, or even with MACs in series, and some were captured by conventional physical inspection), could definitely hunt them down much more quickly, unless they are very short range units, or were using some stealth strategy like the above...
There is one unpleasant downside to "chip & PIN"...
While it is certainly more secure than mag stripe, the various issuing institutions, at least in Britain, have tried to use this to argue that theft/skimming losses should now be the fault of the "negligent" customer, rather than their problem.
I have nothing against better security, I do have a problem with better security being tarted up as evidence that no intrusion could possibly have occurred without the connivance of the customer.
In any but the smallest and most naive deployments, or situations where pages do, in fact, have to be generated dynamically because they are substantially unique per-user, the use of CMS caching is already commonplace.
In the most extreme cases, the user will actually treat the CMS system, running on an internal dev box, as essentially a glorified HTML editor; an easy way to get consistent style and working navigation links on all the pages you write, and then push the static output of the CMS to the actual webserver. Doesn't work if you want comments; but gives you the advantages of easy layout/navigation/styling and sharply reduces your vulnerability to common CMS hacks.
More commonly, the actual CMS will be online; but there will be some caching of output. Particularly with memory so cheap, hammering the DB every time a new user shows up or refreshes doesn't make any sense at all unless the page has actually changed recently.
Obviously, this is more likely to happen in well managed pro environments than in joe nobody's thrown-together drupal instance; but that's the handy thing: the more users you have(and thus the greater the energy cost of Doing It Wrong), the greater the financial costs of doing it wrong.
That's the nice thing about much(though not all) of IT energy use. The energy market itself is riddled with all kinds of fucked up externalities; but IT energy use is (comparatively) easy to measure, and actually gets allocated pretty accurately; by the standards of a lot of externality-riddled markets. Particularly with the move to laptops, even horribly ignorant consumers have an energy efficiency metric to care about: energy-hungry laptops are hot, heavy, and have short battery lives. Energy efficient ones are lighter, quieter, and have better battery lives. Among serious hosting operations, energy costs are a pretty decent slice of overall hosting costs, so they are watched fairly carefully(and any modern PC whose ACPI implementation isn't seriously fucked can actually report fairly accurately on its own energy use, making fairly comprehensive management and visualization a fairly simple software problem.)
Probably the last area where energy management really still sucks is your basic giant-cube-farm-o'-enterprise-desktops use case(Hardcore gamer kiddies draw more power per capita; but they aren't as common, and much of their energy draw is waste only in the sense that humanity doesn't really need to play Crysis, not the sense that simple settings changes that could have been made weren't). That represents enough computers that it really matters; but WoL is AWOL enough that a lot of IT departments are loath to turn of machines, for fear that they won't be able to wake them for patches, AV updates, and other things best done when expensive workers aren't trying to get work done on them(Plus, centralized power management of XP boxes is surprisingly shit, I had no idea it would be such a pain in the ass before I was involved in a project attempting it).
The jury is still somewhat undecided on the born vs. made issue(and that counts; because "made" implies that you might be able to control the supply relatively easily and without doing anything ethically troubling, while "born" is harder); but that doesn't change the fact that some people are Just Bad News, and failure to recognize that is a dangerous mistake. If it is a mistake you are making about a business partner or spouse or something, the consequences can be unfortunate for you.
If it is a mistake you make when you are supposed to be working on somebody else's behalf, as in the case of school staff, parole boards, and the like; it can have major consequences for others, which makes you either negligent or incompetent.
Since you can't really put a shrimp on a shrink-couch and ask it about its feelings, it is very hard to say whether the shrimp are "suicidal" or whether their fear responses are being blunted.
More than a few antidepressants also have some anti-anxiety properties, which are often quite useful in a theraputic context; but for an organism that is tiny and made of meat, "anti-anxiety" and "pro-suicide" might be uncomfortably close...
I find the tendency of spree killers toward taking out a bunch of random bystanders along with their intended targets deplorable in the extreme; but I can say completely seriously that if more instances of bullying ended in murder, and fewer in suicide, the world would be a better place.
Seeing how far you can push somebody wouldn't be such an attractive hobby if the risk of being the guy who pushed them just a little too far were there in the back of your mind...
parents and teacher don't want to address the issue. That's how they get away with it.
More strictly(at least in my experience), parents and teachers, and admins are actually very interested, with occasional exceptions, in addressing the issue(When I was in school, they were constantly emitting pious anti-bullying PSAs, having observed administrators in an occupational context, their bookshelves and seminar schedules are packed with mentions of the issue, written by assorted well-meaning education Ph.Ds).
The problem, though, is that they generally aren't willing to face the reality of the issue. They cling to the illusion that, with the right magic words and social niceties and apologies and shit, everyone will just be able to get along and be nice to each other. The fact that "X is a bully" implies "X is a sadistic bastard who derives pleasure from inflicting pain on those weaker than him" was just too unpleasant to enter their analysis of the situation. Oh, no, if we just call in one of X's victims and have them talk over their differences(nice way to let X know who squealed on him, assholes, that isn't going to go badly), we can all come together and sing "kumbaya" in joyous harmony. This basic failure made all their well meaning efforts utterly futile, and not infrequently counterproductive.
The trouble is, the sort of well-meaning softies who care the most about bullying are the ones who have the greatest difficulty wrapping their minds around the fact that they are dealing with genuinely crafty, vicious people. A bully/victim dynamic is not a "misunderstanding". There is no "talking over" to be done. It is an application of power and violence, just because they can, and because they enjoy it. The sort of person who is all empathic and becomes a guidance counselor or whatever just isn't very well equipped to understand that. They have such a long(and vicerally immediate) history of caring, and feeling other people's pain, that they have difficulty imagining the inner lives of people who don't care, and who enjoy others' pain. Even if told, the abstract model is so alien to their emotional experience that they just can't take it seriously and grapple with its implications to a useful degree....
Slashdot Mirror
There have been various ad-hoc solutions to the problem, nothing standardized has yet hit the field, though the PCI-SIG has an initial standard. These guys are representative enough of the sort of products actually available, usually break-out boxes to allow laptops or undersized desktops to run a few more cards. A few more specialized instances, for the laptop market, have consisted of basically your usual docking station; but with a cable that plugs into an expresscard port, rather than a proprietary connector.
Everybody knows that everybody is trying to buff their JS scores; both because the Web2.0 gods demand it, and because not having the best sunspider scores causes your e-penis to shrivel. It isn't exactly a skunkworks secret weapon kind of feature.
The only way that they could really hide from a remotely sophisticated adversary(ie. a group that includes anybody remotely capable of making a competing browser), would be to sacrifice openness in a pretty huge way and make it so that only internal devs could see commits and things being made. If they aren't doing that, they aren't actually hiding much of anything.
Plus, since JS performance is such a point of competition, pre-announcing your coming-real-soon-now feature is a way of encouraging people not to defect to competing products before the feature is actually released.
Given the way costs incurred by corporations are allocated, do you suspect that there are any ways of "getting the message across" whose cost to the company wouldn't end up coming out of their payroll, at least indirectly, if not directly?
The only one I can think of would be to skip the whole "corporation" thing entirely, and just start dropping criminal cases on the heads of management, something for which the political stomach seems to be lacking, at best.
Because "customer" does not necessarily imply "end user of product" just "buyer of product".
Say, for instance, we have a Product X that is Open Source, in the sense of being redistributable; but only distributes source to customers who buy the binary version(as is compatible with OSI or Free Software licences).
Say, for instance, you run a Linux distro, and your customers are whining about "Why isn't Product X in the repositories?". Assuming you think that it will make you more in additional support contracts/boxed copies/OEM integrated sales/whatever you just feel like doing it, it is completely economically rational for you to buy a binary copy of Product X, obtain your copy of the redistributable source, and then package it for your distro.
It would be similarly logical, though requiring more organization, for a coalition of small customers to club together and buy a single binary copy, then share source copies between all members of the club.
Luckily, you don't have to go very far back in Italian history to change that...
This is just more evidence that Piracy is Killing Music(tm)! Pirates, apparently less busy stealing food from the mouths of starving artists' starving children than they seemed, managed to pull over 15 and a half million dollars from the RIAA's coffers...
Clearly, we must set up a cabinet-level Department of Intellectual Property so that the War on Pirates can be fought at public expense, with the same efficiency and success as the scourges of drugs and poverty....
Umm... Because some politician decided that going up against the lobbying might of the American Chemistry Council(including their Chlorine group, which can churn out every-so-touching PSAs about how chlorine is what keeps your childrens' drinking water safe with extreme efficiency), the pulp and paper industries(and their customers, the newspapers, who definitely have no effect on public opinion), and American farmers, who have both a fondness for herbicides and a nearly unbeatable stock of political capital? Seriously? In order to court the all-powerful "hardcore environmentalist wonks" vote?
Obviously, political expediency is an excellent predictor of politician behavior. That much is true and granted. As political strategies go, though, artificially cracking down on dioxins makes incrementally more sense than staging a press conference where you high-five Osama Bin Laden under a banner announcing your endorsement by NAMBLA; but that is about it....
We need to start a pro-dioxin public relations campaign in the Third World, so we can continue to have a place to manufacture those cheap consumer goods. They don't need long life-spans over there because who wants to live long in those nasty places anyway? We could say that dioxin makes you more virile or something. It worked for cigarettes.
To quote one Lawrence Summers:
"'Dirty' Industries: Just between you and me, shouldn't the World Bank be encouraging MORE migration of the dirty industries to the LDCs [Less Developed Countries]? I can think of three reasons: 1) The measurements of the costs of health impairing pollution depends on the foregone earnings from increased morbidity and mortality. From this point of view a given amount of health impairing pollution should be done in the country with the lowest cost, which will be the country with the lowest wages. I think the economic logic behind dumping a load of toxic waste in the lowest wage country is impeccable and we should face up to that.
2) The costs of pollution are likely to be non-linear as the initial increments of pollution probably have very low cost. I've always though that under-populated countries in Africa are vastly UNDER-polluted, their air quality is probably vastly inefficiently low compared to Los Angeles or Mexico City. Only the lamentable facts that so much pollution is generated by non-tradable industries (transport, electrical generation) and that the unit transport costs of solid waste are so high prevent world welfare enhancing trade in air pollution and waste.
3) The demand for a clean environment for aesthetic and health reasons is likely to have very high income elasticity. The concern over an agent that causes a one in a million change in the odds of prostrate cancer is obviously going to be much higher in a country where people survive to get prostrate cancer than in a country where under 5 mortality is is 200 per thousand. Also, much of the concern over industrial atmosphere discharge is about visibility impairing particulates. These discharges may have very little direct health impact. Clearly trade in goods that embody aesthetic pollution concerns could be welfare enhancing. While production is mobile the consumption of pretty air is a non-tradable.
The problem with the arguments against all of these proposals for more pollution in LDCs (intrinsic rights to certain goods, moral reasons, social concerns, lack of adequate markets, etc.) could be turned around and used more or less effectively against every Bank proposal for liberalization. "
The safe exposure limit has two major uses:
One, it directly informs industrial hygiene standards for workers exposed to it on the job. OSHA recommendations/requirements will(possibly some decades after the fact, The Business of America is Business(tm) after all) reflect the levels of exposure that are permissible, given the expected health effects.
Two, it informs environmental regulations related to the discharge of the chemicals in question. Dioxins are only "unavoidable" today because their release has historically been alarmingly close to unregulated, and they are fairly persistent little critters. If the safe exposure limit is revised downward, acceptable release limits will(again, possibly with substantial lag, nobody wants to make the American Chemistry Council cry) will be revised downward, so that, as the compounds eventually are degraded or encapsulated, exposures will fall.
"Bleach" is usually Sodium Hypochlorite, in water solution. Historically, both Sodium Hypochlorite and elemental Chlorine, among others, would have been used at various stages of the pulp bleaching process. Unfortunately, a number of organochlorine compounds are pretty nasty customers(dioxins hog the stage time; but furans, PCBs, and others are also not exactly tasty treats), and using Chlorine to attack wood pulp, full of various organic compounds, produces nice white wood pulp, and a bunch of organochlorine compounds(even if the cardboard isn't going into food packaging, these tend to end up going more or less straight into the river).
The almost-as-cheap-and-somewhat-less-dangerous method substitutes chlorine dioxide for straight chlorine. Apparently, this reduces the amount of exciting organochlorines in the result.
The more costly; but chlorine free, technique involves Ozone(the same applies in water treatment plants). The nice thing about Ozone is that it is pretty close to Chlorine in terms of being a vociferous oxidizing and bleaching agent that is soluble in water; but that it consists entirely of oxygen atoms, and is fairly unstable. This means that you can have a ghastly disinfecting or bleaching agent that, after 24-48 hours of sitting around, is pretty much just plain water with dissolved oxygen.
The chlorine-free methods are particularly popular in Europe, and they've reduced the output of Chlorinated nasties pretty much everywhere; but the odds are still pretty good that, unless specifically stated otherwise and in the EU, your white paper is white because of a chlorine process.
Good that the situation was legally rectified(for the moment); but an illustration of the problem.
They, successfully, used the technological change to pass the buck for a number of years, until outrage and the law eventually caught up with them. Clearly, since the law had to force their hand, their intention was to keep the buck passed forever.
Given the, er, robust state of American democracy, and its laudable freedom from corruption and corporate influence at all levels, I for one am certain that things would end happily here. It would, in fact, probably turn out even better than the Mortgage Electronic Record System, a paragon of accuracy, efficiency, and usually not sending the sheriff to kick people out of their homes without any documentation that a mortgage actually existed, much less is delinquent....
Obviously, this research is just part of the satanic one-world-government's evil population control agenda... Developed weaponized testicle gangrene, to be spread via chemtrail by the UN's black helicopters and Area 51 UFOs reverse engineered from Grey alien technology purchased through a blood-pact involving Christian fetuses illicitly harvested by planned parenthood.
What could be more logical?
(Unfortunately, the loonier grade of anti-vaxer will probably be claiming something approximately that sensible over in the pits of squalor that are NaturalNews and Whale.to. If we are super lucky, it will mutate into a rumor loony enough to, say, interfere with the eradication of polio...)
Sinclair said: "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!"
When dealing with PR flacks, their salary depends on you not understanding it, which is likely even worse...
"Hey boss, marketing and/or legal say we have to have 'two factor authentication' in our product. We could adapt the smartcard chips they use in sims and...."
"Jesus fuck, man, that sounds expensive! We mail out those cards, sometimes unsolicited and pre-activated to poorly validated addresses, like goddamn candy. If your next scheme involves a per-card hardware cost, you might as well go pack your desk, to save security the trouble..."
"Well, we could just change the software and add a scary-looking screen that asks for the ZIP code, that's, like, totally a government-granted numeric ID, right?"
"Good work. Make it so."
While a CC system that doesn't utterly suck, and trust pretty much every link in the chain like it would its own mother, after she had been notarized and presented two forms of photo ID, I suspect that we could be waiting a while for that...
In the meantime, I'm curious why the "card path" of any exposed payment system would be designed such that it has internal voids where 3rd party hardware can be stashed. A mag-stripe reader is just a surface, with a few mm of electronics behind it. Generally, because people aren't too good at keeping their card at just the right distance, you mount the reader parallel to a passive plate a few mm away, through which the card is run. With a surface channel design, the attacker has to stick their skimmer onto the surface, where it can be detected by visual inspection(made easier if the card slot has blinkenlights, a highly specific shape, certain color/pattern, etc.)
If, for some reason, an internal card path must be used, so that the card can be held on to during the transaction or whatever, one could still make sure that the internal chamber is small enough to admit only a card, and that the eject mechanism doesn't just pop the card halfway out; but actually completely scrapes out the internal chamber each cycle(in order to remove, say, a thin-film reader fabricated on a sticky backed piece of flexible circuit board)...
Good mechanical design won't stop all skimmers; because people may not notice even a fairly blatant one just taped on top of the actual reader; but it should be fairly easy, with good design of the card path, to make it impossible to mount an internal reader without doing some in-situ metalworking.
Even in situations where there isn't an inside man(and I'm sure that there sometimes is), a scheme that habituates the employees, anybody monitoring the CCTV cameras, and the public at large, to people frequently opening and poking at the pumps is likely to decrease security, rather than increase it.
The uniforms of gas station employees aren't exactly secret, nor are clothes that look very much like them hard to get ahold of(given that they are generally just plaincloths, or mechanic-style coveralls, possibly with silkscreened logos), so it would be pretty trivial to concoct a plausible disguise in which to tamper with the device.
I doubt the skimmer-makers would bother, unless the cops have quietly been hunting bluetooth emissions for a while now; but it wouldn't exactly be rocket surgery to have a bluetooth device that just sits there, receiving but maintaining absolute radio silence unless it hears a particular transmission(from a particular bluetooth MAC, if you really want to get paranoid). The wireless analog of port knocking, more or less...
Particularly with all the cellphones floating around, a BT radio, even one yelling its little amplifier out, is hardly automatically suspicious in a reasonably crowded area. Somebody who knew what they were doing, had the right set of antennas, and had some knowledge of what they were looking for(if, for instance, the skimmer-manufacturers produced a large batch, all with BT modules from the same manufacturer, or even with MACs in series, and some were captured by conventional physical inspection), could definitely hunt them down much more quickly, unless they are very short range units, or were using some stealth strategy like the above...
There is one unpleasant downside to "chip & PIN"...
While it is certainly more secure than mag stripe, the various issuing institutions, at least in Britain, have tried to use this to argue that theft/skimming losses should now be the fault of the "negligent" customer, rather than their problem.
I have nothing against better security, I do have a problem with better security being tarted up as evidence that no intrusion could possibly have occurred without the connivance of the customer.
In any but the smallest and most naive deployments, or situations where pages do, in fact, have to be generated dynamically because they are substantially unique per-user, the use of CMS caching is already commonplace.
In the most extreme cases, the user will actually treat the CMS system, running on an internal dev box, as essentially a glorified HTML editor; an easy way to get consistent style and working navigation links on all the pages you write, and then push the static output of the CMS to the actual webserver. Doesn't work if you want comments; but gives you the advantages of easy layout/navigation/styling and sharply reduces your vulnerability to common CMS hacks.
More commonly, the actual CMS will be online; but there will be some caching of output. Particularly with memory so cheap, hammering the DB every time a new user shows up or refreshes doesn't make any sense at all unless the page has actually changed recently.
Obviously, this is more likely to happen in well managed pro environments than in joe nobody's thrown-together drupal instance; but that's the handy thing: the more users you have(and thus the greater the energy cost of Doing It Wrong), the greater the financial costs of doing it wrong.
That's the nice thing about much(though not all) of IT energy use. The energy market itself is riddled with all kinds of fucked up externalities; but IT energy use is (comparatively) easy to measure, and actually gets allocated pretty accurately; by the standards of a lot of externality-riddled markets. Particularly with the move to laptops, even horribly ignorant consumers have an energy efficiency metric to care about: energy-hungry laptops are hot, heavy, and have short battery lives. Energy efficient ones are lighter, quieter, and have better battery lives. Among serious hosting operations, energy costs are a pretty decent slice of overall hosting costs, so they are watched fairly carefully(and any modern PC whose ACPI implementation isn't seriously fucked can actually report fairly accurately on its own energy use, making fairly comprehensive management and visualization a fairly simple software problem.)
Probably the last area where energy management really still sucks is your basic giant-cube-farm-o'-enterprise-desktops use case(Hardcore gamer kiddies draw more power per capita; but they aren't as common, and much of their energy draw is waste only in the sense that humanity doesn't really need to play Crysis, not the sense that simple settings changes that could have been made weren't). That represents enough computers that it really matters; but WoL is AWOL enough that a lot of IT departments are loath to turn of machines, for fear that they won't be able to wake them for patches, AV updates, and other things best done when expensive workers aren't trying to get work done on them(Plus, centralized power management of XP boxes is surprisingly shit, I had no idea it would be such a pain in the ass before I was involved in a project attempting it).
The jury is still somewhat undecided on the born vs. made issue(and that counts; because "made" implies that you might be able to control the supply relatively easily and without doing anything ethically troubling, while "born" is harder); but that doesn't change the fact that some people are Just Bad News, and failure to recognize that is a dangerous mistake. If it is a mistake you are making about a business partner or spouse or something, the consequences can be unfortunate for you.
If it is a mistake you make when you are supposed to be working on somebody else's behalf, as in the case of school staff, parole boards, and the like; it can have major consequences for others, which makes you either negligent or incompetent.
Since you can't really put a shrimp on a shrink-couch and ask it about its feelings, it is very hard to say whether the shrimp are "suicidal" or whether their fear responses are being blunted.
More than a few antidepressants also have some anti-anxiety properties, which are often quite useful in a theraputic context; but for an organism that is tiny and made of meat, "anti-anxiety" and "pro-suicide" might be uncomfortably close...
I find the tendency of spree killers toward taking out a bunch of random bystanders along with their intended targets deplorable in the extreme; but I can say completely seriously that if more instances of bullying ended in murder, and fewer in suicide, the world would be a better place.
Seeing how far you can push somebody wouldn't be such an attractive hobby if the risk of being the guy who pushed them just a little too far were there in the back of your mind...
parents and teacher don't want to address the issue. That's how they get away with it.
More strictly(at least in my experience), parents and teachers, and admins are actually very interested, with occasional exceptions, in addressing the issue(When I was in school, they were constantly emitting pious anti-bullying PSAs, having observed administrators in an occupational context, their bookshelves and seminar schedules are packed with mentions of the issue, written by assorted well-meaning education Ph.Ds).
The problem, though, is that they generally aren't willing to face the reality of the issue. They cling to the illusion that, with the right magic words and social niceties and apologies and shit, everyone will just be able to get along and be nice to each other. The fact that "X is a bully" implies "X is a sadistic bastard who derives pleasure from inflicting pain on those weaker than him" was just too unpleasant to enter their analysis of the situation. Oh, no, if we just call in one of X's victims and have them talk over their differences(nice way to let X know who squealed on him, assholes, that isn't going to go badly), we can all come together and sing "kumbaya" in joyous harmony. This basic failure made all their well meaning efforts utterly futile, and not infrequently counterproductive.
The trouble is, the sort of well-meaning softies who care the most about bullying are the ones who have the greatest difficulty wrapping their minds around the fact that they are dealing with genuinely crafty, vicious people. A bully/victim dynamic is not a "misunderstanding". There is no "talking over" to be done. It is an application of power and violence, just because they can, and because they enjoy it. The sort of person who is all empathic and becomes a guidance counselor or whatever just isn't very well equipped to understand that. They have such a long(and vicerally immediate) history of caring, and feeling other people's pain, that they have difficulty imagining the inner lives of people who don't care, and who enjoy others' pain. Even if told, the abstract model is so alien to their emotional experience that they just can't take it seriously and grapple with its implications to a useful degree....
Only members of the chess club get to do that...
We should just issue handguns to everyone over a certain GPA... That seems like a good, solid, American solution to this bullying problem.