WEP == Wired Equivalency Privacy, meaning that (if it were to work as designed) it is only designed to offer security similar to a wired network. In a wired network, you (conceptually) have control over who access it based on physical access control to the wire, but you can still see packets from other users (this used to be easier with hubs, it is still possible with switches, but takes a little more work). I'm not up to date on the various modes of WPA, but as far as I know, it was mostly designed to fix problems with WEP, not to provide VPN service. This is why many places that maintain private WiFi networks require users to use VPN with it. The problem with SSL (or a similar certificate-based system) is that it's connected to DNS. You can't validate an SSL certificate without having a domain name or some other such structured system of establishing identity. Indeed, many VPN solutions use a mechanism equivalent to a certificate, but when this happens it requires that the user obtain the VPN server's certificate through some other means, which doesn't seem very practical for a public WiFi provider like Starbucks.
SSL is a stream-based protocol, and wireless networks need to provide packet-based access. "VPN" can mean a wide variety of things, some of which are stream-based and some of which are packet-based, but in any case, offering packet-based encryption gets more complicated and produces much more overhead due to packet size limits and the fact that there is no guarantee that the packets will be delivered in order, if they are delivered at all.
And what, exactly, is stopping someone from forging an MS cert on their own worm
...the fact that nobody is capable of factoring 1,000-digit numbers in a reasonable amount of time? The digital certificate problem was solved a long time ago, and the updates would most likely use the same technology used with SSL certificates, SSH host keys, digitally signed e-mail, etc..., which outside of the NSA (or some other evil genius living in a basement somewhere without interaction with the general public), can be shown to be mathematically secure.
There isn't a hard cut-off in what frequencies you hear. Higher (and lower) frequencies just get softer, sort of like moving the tuner on an analog radio (actually, it is very much like that). Sounds that you can't consciously perceive can still produce physiological effects, and can affect the tone quality of sounds with lower base frequencies. Most quality head phones are built with a frequency response up to 30 kHz, even though the generally accepted upper limit on what humans can perceive is about 20 kHz, though I guess a lot of people can't hear that well. I remember when I was in middle school the ~15 kHz whine from a TV's horizontal synch signal would drive me crazy, but everyone else thought I was hearing things.
The stack and the heap usually occupy different ends of the same block of memory (virtual or otherwise), so when one overflows, it runs into the other. I've seen it happen, and it can cause quite a spectacular crash. Unless the stack is limited to a single segment like in the olden days..... mmmmmm....... segmented memory........
Encryption only protects the ISP from monitoring the content. The MAFIAA are going after people by finding out what they are sharing from the p2p networks themselves, and ISPs could just as easily be required to enforce the three-strikes rule against customers that the MAFIAA identify this way. The article doesn't specifically state that the law is limited to ISPs directly spying on their customers. The solution to this would be to have a p2p network that proxies traffic, like Tor. Unfortunately, I fear that this line of thought will eventually lead governments to pass legislation against technologies that allow people to share information anonymously. The reality of the matter is that the only way anything is going to really get fixed is for the entertainment industry to realize that regardless of what is legal and what is not, they are continuing to base their revenue on a business model that can no longer be enforced effectively.
Won't this also make it harder to set up a mail server? I run a mail server at home, and I currently don't control the domain I am in, only my host. Most of the dynamic IP services out there provide support for this. When all the major players start using it, is this going to screw over people who run their own personal mail servers?
Disposable addresses are a system that works completely within the existing standard for e-mail. I use them on my server, with no other filtering mechanism whatsoever, and I almost never get spam or phishing e-mails.
"The public good" is the motivating factor behind both socialism and capitalism. The difference is that socialism tries to address the public good through conditioning people to act with less regard to their own interests, where capitalism believes that providing personal rewards for people who are productive will increase the value of the society as a whole. Most IP laws (copyright, patent, etc...) were originally written to stimulate innovative and creative works that eventually will benefit everyone, by rewarding those who discover or create them. The two are, however, extremes, and like most extremes, the best solution is probably somewhere in between. The USSR illustrated the shortcomings of pure communism, and the U.S. has been gradually learning that there need to be checks in place to prevent pure capitalism from acting against the public good (anti-trust laws, for example). The USSR falling apart has caused major changes in that part of the world, and this "blackmail" activity looks like the proverbial pendulum swinging back a little too far. Of course, no matter which philosophy you follow, the people in power can still skew it in whichever direction is most convenient to their own agendas.
There is a difference between normal pseudo-random numbers and secure pseudo-random numbers. Generating data that is sufficiently random for security purposes takes a lot of work. In Java, the Random class generates non-secure pseudo-random numbers, and the SecureRandom class generates numbers suitable for security applications (at increased computational cost). I would expect.NET does something similar.
Compression only works on certain types of data. It does not work on data that is already encrypted, or on data that is already compressed (like most audio, video, and similar formats that account for most large files) without degrading quality. There are several free software products already available for hiding one set of data in something else, usually in the free space on a file system or as background noise in audio, video, or images.
I thought this was called Carnivore... or Magic Lantern... *sigh* so many FBI spy systems to keep track of. But my question is when did they start caring about getting permission?
Hasn't this problem been solved already with two-factor authentication? You have a token that has a short numeric code that changes every minute or so, and your password is a combination of a secret PIN and the number on the device. Or, for the poor-man's-version, you have a series of one-time PINs written down (or printed out) so that the credentials you use to authenticate yourself can only be used once. I have been using a system like this on one of my servers for a couple years now. One major limitation to the proposed system is that you have to have a specialized hardware device attached to whatever system you're authenticating with (and the software needs direct access to it). Biometrics (like the fingerprinting mentioned in another response) are another form of two-factor authentication that would work in situations where specialized hardware is not a problem.
With regard to Gmail, for some reason I just don't trust a company whose publicly state mission is "...to organize the world's information and make it universally accessible..." (http://www.google.com/corporate/) to handle my e-mail.
Easier still... all they need to do is find one entity (person or corporation) that is being financially impacted (or let that entity find them), and just have their lawyers go about business as usually, officially representing the person or corporation instead of the EFF
Slashdot Mirror
WEP == Wired Equivalency Privacy, meaning that (if it were to work as designed) it is only designed to offer security similar to a wired network. In a wired network, you (conceptually) have control over who access it based on physical access control to the wire, but you can still see packets from other users (this used to be easier with hubs, it is still possible with switches, but takes a little more work). I'm not up to date on the various modes of WPA, but as far as I know, it was mostly designed to fix problems with WEP, not to provide VPN service. This is why many places that maintain private WiFi networks require users to use VPN with it. The problem with SSL (or a similar certificate-based system) is that it's connected to DNS. You can't validate an SSL certificate without having a domain name or some other such structured system of establishing identity. Indeed, many VPN solutions use a mechanism equivalent to a certificate, but when this happens it requires that the user obtain the VPN server's certificate through some other means, which doesn't seem very practical for a public WiFi provider like Starbucks.
SSL is a stream-based protocol, and wireless networks need to provide packet-based access. "VPN" can mean a wide variety of things, some of which are stream-based and some of which are packet-based, but in any case, offering packet-based encryption gets more complicated and produces much more overhead due to packet size limits and the fact that there is no guarantee that the packets will be delivered in order, if they are delivered at all.
Does it bother anyone else that Microsoft sells their own anti-virus software, and now they are actually trying to write their own worms?
There isn't a hard cut-off in what frequencies you hear. Higher (and lower) frequencies just get softer, sort of like moving the tuner on an analog radio (actually, it is very much like that). Sounds that you can't consciously perceive can still produce physiological effects, and can affect the tone quality of sounds with lower base frequencies. Most quality head phones are built with a frequency response up to 30 kHz, even though the generally accepted upper limit on what humans can perceive is about 20 kHz, though I guess a lot of people can't hear that well. I remember when I was in middle school the ~15 kHz whine from a TV's horizontal synch signal would drive me crazy, but everyone else thought I was hearing things.
....if you buy devices to store your own original media, you first have to pay copying levies to every other artist in the E.U.??? WTF?
NASA falsifies telemetry to obtain funding from Haliburton...story at 11...
Why only half drunk? I don't half-ass it when it comes to my liquor :)
The stack and the heap usually occupy different ends of the same block of memory (virtual or otherwise), so when one overflows, it runs into the other. I've seen it happen, and it can cause quite a spectacular crash. Unless the stack is limited to a single segment like in the olden days..... mmmmmm....... segmented memory........
Encryption only protects the ISP from monitoring the content. The MAFIAA are going after people by finding out what they are sharing from the p2p networks themselves, and ISPs could just as easily be required to enforce the three-strikes rule against customers that the MAFIAA identify this way. The article doesn't specifically state that the law is limited to ISPs directly spying on their customers. The solution to this would be to have a p2p network that proxies traffic, like Tor. Unfortunately, I fear that this line of thought will eventually lead governments to pass legislation against technologies that allow people to share information anonymously. The reality of the matter is that the only way anything is going to really get fixed is for the entertainment industry to realize that regardless of what is legal and what is not, they are continuing to base their revenue on a business model that can no longer be enforced effectively.
This is your planet. This is your planet on global warming. Any questions?
My favorite benchmark for finding the size of the memory heap:
void doit(int i) { printf("%i\n", i); doit(i + 1); }
worked really well until I tried it in an environment where the call stack could get paged...then it turned into a hard drive benchmark
Won't this also make it harder to set up a mail server? I run a mail server at home, and I currently don't control the domain I am in, only my host. Most of the dynamic IP services out there provide support for this. When all the major players start using it, is this going to screw over people who run their own personal mail servers? Disposable addresses are a system that works completely within the existing standard for e-mail. I use them on my server, with no other filtering mechanism whatsoever, and I almost never get spam or phishing e-mails.
"The public good" is the motivating factor behind both socialism and capitalism. The difference is that socialism tries to address the public good through conditioning people to act with less regard to their own interests, where capitalism believes that providing personal rewards for people who are productive will increase the value of the society as a whole. Most IP laws (copyright, patent, etc...) were originally written to stimulate innovative and creative works that eventually will benefit everyone, by rewarding those who discover or create them. The two are, however, extremes, and like most extremes, the best solution is probably somewhere in between. The USSR illustrated the shortcomings of pure communism, and the U.S. has been gradually learning that there need to be checks in place to prevent pure capitalism from acting against the public good (anti-trust laws, for example). The USSR falling apart has caused major changes in that part of the world, and this "blackmail" activity looks like the proverbial pendulum swinging back a little too far. Of course, no matter which philosophy you follow, the people in power can still skew it in whichever direction is most convenient to their own agendas.
There is a difference between normal pseudo-random numbers and secure pseudo-random numbers. Generating data that is sufficiently random for security purposes takes a lot of work. In Java, the Random class generates non-secure pseudo-random numbers, and the SecureRandom class generates numbers suitable for security applications (at increased computational cost). I would expect .NET does something similar.
My laptop has a biometric login...are they going to seize my finger?
Compression only works on certain types of data. It does not work on data that is already encrypted, or on data that is already compressed (like most audio, video, and similar formats that account for most large files) without degrading quality. There are several free software products already available for hiding one set of data in something else, usually in the free space on a file system or as background noise in audio, video, or images.
I thought this was called Carnivore... or Magic Lantern... *sigh* so many FBI spy systems to keep track of. But my question is when did they start caring about getting permission?
Hasn't this problem been solved already with two-factor authentication? You have a token that has a short numeric code that changes every minute or so, and your password is a combination of a secret PIN and the number on the device. Or, for the poor-man's-version, you have a series of one-time PINs written down (or printed out) so that the credentials you use to authenticate yourself can only be used once. I have been using a system like this on one of my servers for a couple years now. One major limitation to the proposed system is that you have to have a specialized hardware device attached to whatever system you're authenticating with (and the software needs direct access to it). Biometrics (like the fingerprinting mentioned in another response) are another form of two-factor authentication that would work in situations where specialized hardware is not a problem.
Can we all say, "Embrace, Extend, Exterminate"? This is one of the reasons I run my own mail server.
With regard to Gmail, for some reason I just don't trust a company whose publicly state mission is "...to organize the world's information and make it universally accessible..." (http://www.google.com/corporate/) to handle my e-mail.
Easier still... all they need to do is find one entity (person or corporation) that is being financially impacted (or let that entity find them), and just have their lawyers go about business as usually, officially representing the person or corporation instead of the EFF
Quick! To the patent office! While the fools are busy with Pi, I shall file patents for e. All your logarithm shall belong to us!
You mean God is illegally watching my TV too? Why can't he get his own TV! He's going to get me sued...