They're interfering with my usage of a product I paid money for and that they no longer own. How does that possibly not fit into your definition of wrong?
Apple has no obligation to behave in any way aside from being legal. That's all.
Never said otherwise. That's why I qualified my posts with "moral right" and "ideal world." Just because something is legal does not make it right. In this case the law is wrong and any type of DRM that locks the user out of doing anything he damn well pleases with a device he bought, and not just rented, should be illegal.
Doesn't mean they have to expend effort to enable that.
No it doesn't, I completely agree. However, it does mean they don't have the moral right to expend any effort on preventing it.
No they don't, but good luck getting it onto the iPhone
Especially when they start attacking the only other way of getting apps on the iPhone. They also encrypt firmware on newer iPod devices so you can't install rockbox. They started encrypting their database so you couldn't sync it with linux apps. They go way beyond "not expending effort to enable" competition.
I'm not here to say that Microsoft has a great track record on that. Windows mobile devices are pretty open as far as applications go...anyone can develop one and sell them independently. At the same time, syncing with them on anything other than Active Sync is ridiculously difficult, and that pisses me off too. Also, I'm seeing a lot of posts that indicate the Zune is a very closed device (I wouldn't really know). It seems Ballmer is being incredibly hypocritical, but that doesn't make what Apple is doing right.
It's apple's product and marketplace, okay? Apple set the thing up, they get to set the rules.
It is their marketplace, but it most certainly isn't their product once I buy it. It's my product, manufactured by apple. They lose (or by all right should lose) all rights as to what I can and cannot install on the thing, and where I can and cannot buy applications from. At that point, they can feel free to choose what they want to sell and what they don't want to sell in their store, but they don't get to prevent other people from having their own competing stores.
At least that's how it should be in an ideal world.
I meant to say I'd applaud a decision against the banning of pornography sales to kids. Again, if the parents care, they should be the ones to monitor their kids.
While many here will certainly applaud this decision, I find the double-standard amazing. If we can ban sales of pictures of people having sex to minors and impose other draconian punishment, then why is obscene violence any different?
I completely agree, and I hate the double standard myself. Personally, I do applaud this decision, and I'd similarly applaud a decision banning sales of pictures of people having sex to minors.
I somehow doubt the founding fathers would have equated free speech to depictions of extreme violence
That might be true, but it's quite irrelevant. If you think it's right that they would be able to decide what equates to free speech and what does not, what you're actually doing is advocating a state-vetted list of things you can and cannot say. That's exactly the opposite of free speech. What makes them right?
I certainly am not happy about my freedom to criticize politicians being considered on the same level as some spotty fifteen year old kid's "right" to buy GTA.
Don't think of it in those terms. It's not that they have a right to buy GTA. It's that the government doesn't have a right to stop them. That's the job of the parents of this spotty fifteen year old kid. Parents these days think that educating their kid means sending them to school and plopping them in front of the tv. Monitoring your kids, especially during the teenage years is tough, but that doesn't mean the government should do your job for you.
Sure, from what we know of how life on this planet developed, it seems reasonable that we're not special. However, we don't even see it in other "reasonable" places in our own solar system.
It has nothing to do with what we know of how life on this planet developed. It just means that unless you assume development of life requires conscious divine intervention, it happened as a result of certain conditions. We could be very special in the sense of life being an extremely low probability, even given the right conditions. However, given the size and age of the universe, it doesn't matter how low the probability is: if it happened once, it's happened multiple times.
Don't misunderstand me. I'm not saying we'll ever meet E.T. If the universe is mostly uninhabited, there might be nobody close by. Even if there's any life "close by" they're not necessarily intelligent. Even if there's intelligent life "close by" they're civilization does not necessarily need to be alive simultaneously with ours. Even if they are, "close" in the scale we're speaking of is still impractically far for travel or even conversation.
A zit on your nose doesn't imply a zit on your ass. Two or three or four zits on your face may well lead a person to believe you're just a zitty bastard, though.
Your argument is actually sound, but it's not arguing what you think it is. A zit on my nose doesn't imply zits are common in the rest of my body. Similarly, life on Earth doesn't imply the universe is full of life everywhere. And that's not what I'm arguing.
What I am arguing is that a zit on my nose implies the existence of zits elsewhere in the human population. If you see a zit (or even something extremely rare that you've never seen before) on my face, it's illogical to assume I'm the only person in the world to ever have gotten that particularly thing, and that nobody else out of billions of people that have ever lived and will live will ever get it. And billions is a very small number when you're talking about stars in the universe.
Our Sun isn't that special of a star. There are many others that have been identified that are just like it. Countless others that we have never seen. It's completely unreasonable to assume that none of those have a planet in the sweet spot. Out of those that none of them have developed life. I'm not saying it's common, I'm not saying life is everywhere, I'm not saying we'll ever find it, but regardless of how common it is: you have no reason to assume it doesn't exist.
I wasn't intending to prove that it is technologically realistic to travel this fast, more that it wouldn't break the major laws of physics...Finding a way to maintain this acceleration would indeed be a huge feat of engineering on a scale likely orders of magnitude from what we can currently obtain. But that doesn't necessarily mean that it is impossible.
Ah. In that case you are absolutely correct. Thanks for clarifying your point for me.
...shows that accelerating at 9.8 meters per second per second will get you halfway to a destination 10 light years away in 2.2 years. 4.4 year one way trip, 8.8 year round trip
Uh-huh. You want to continuously accelerate at 1G for 2.2 years (and then presumably decelerate at 1G for the remaining 2.2 years). Care the calculate the amount of fuel you'd need for that? The amount of food you need to carry to sustain a crew for 4.4 years (we'll assume we can refuel and restock at the planet we're going to)?
If you can carry enough reaction mass or somehow collect it on the way
Yeah, see...you've concentrated on the relativistic issues and brushed off the real problem. Time to get there isn't a problem. Even if it took 500 years, if we assume we can carry / farm enough food on the ship, we can get humans there by having a crew that spans a few generations. Or, if you assume we're capable of putting people in stasis like you said, we get around the food problem. However, the things you are just assuming and brushing off are the actual challenges, and they're pretty tough to get around.
we have no reason to suspect that there is life beyond this planet.
No reason to suspect? It goes like this. There is life on this planet. Therefore probability of life > 0. There are many, many, many stars in our galaxy, countless in the universe. No matter how small the chances are, given the size of the universe and since we have proven that the probability is greater than 0, it's inconceivable to imagine that we're the only ones.
In fact, the only reason to be arrogant enough to say that we're the only ones would be religious nonsense.
Write up a "rosetta stone" with a bunch of pictorial/mathematical representations of words, and so on. Probably doable.
I know a lot of science fiction books and music like to tout math as a "universal language" but it's really not a language at all. In fact, we need language in order to convey the mathematical concepts.
Case in point, most human scientists had difficulty deciphering the Pioneer plaque and it's attempt to encode information about humans and the location of the earth in a mathematical way. A lot of the things we don't think of as "language" such as arrows to point directions, really are.
Not at all. Everything was correct on the Wikipedia side. The erroneous entry was removed, someone found a reputable source that backed up the erroneous entry, and they put it back. Then it was found that the reputable source had it wrong, so it was changed again.
The problem lies entirely with the newspapers who went for wikipedia as their source. You never use an encyclopedia as your source, EVER. The last time I was allowed to use an encyclopedia as a source was in third grade, and even that shouldn't be allowed because it teaches bad research habits to kids who will grow up to be journalists. You use the encyclopedia to satisfy idle curiosity and to start your research (not to gather facts, but to figure out what questions you should be asking and what directions your research will take).
Also as aside, thanks for the civilized and intelligent debate! That is getting much harder to find online these days.:)
You're giving me far too much credit. I mostly just misinterpreted your original point. I thought you were arguing that it was always a bad idea to encrypt everything when you were simply advocating careful consideration of all the options and what they entailed. We're in complete agreement there.
Thanks for taking the time to help me understand what you meant.
I wouldn't go so far as to say there's absolutely no downside to encrypting everything. All encryption has overhead - some products, significant overhead. Then there's either the extra expense of a key management strategy and team plus sysadmin overhead and labor OR the cost of losing data once something bad occurs and the data cannot be recovered.
Fair enough. If you think things through, there shouldn't be a case where the data cannot be recovered (I mean, if something bad happens even unencrypted data can go poof. First of all, backups are important, and second, if you're encrypting things, the ability to restore the password to a default one you originally set is absolutely necessary. Most packages will have some way to do this).
That said, I was thinking about the technical side of things. From a purely technical perspective, it's definitely feasible and can get you some security benefits. However, you have a good point on labor and other costs. As you've said a risk/benefit analysis is important in any decision.
i am automatically excluding all the idiotic correlations and causations, that are well outside an honest probability rating
Who decides? You can get a lot of people arguing that violent videogames increase violent behavior in teens, and there are correlations to back that up. It's not an idiotic correlation because there's a working hypothesis as to why that might be the case. At the same time, using the correlation alone isn't viable because it ignores a whole lot of other variables. Obviously there's an increase in usage of violent video games, because they are relatively new. What else has changed in our society that could cause an increase in violent behavior? And then there's the question of direction: wouldn't violent people naturally choose to play violent video games?
See? Sometimes it's not black and white.
i will underline my assertion with a dull overused weapon: occam's razor. i won't insult your intelligence and explain occam's razor for you, but i will assert that if correlation!=causation,for most intellectually honest sets of correlation, occam's razor would not be a useful dictum
That's a pet peeve of mine, so I would really appreciate it if you did explain it to me. Let me give you a hint: if you think Occam's Razor says, "the simplest explanation is usually the correct one" you've been watching Contact, and you don't know what it actually says. Occam's Razor says nothing about the correctness of a statement, which invalidates your entire claim.
What Occam's Razor actually says is that entities should not be multiplied beyond necessity. If you have two hypothesis that give you the exact same predictions, but one of them is more complicated than the other, then you should use the simplest one because you lose nothing by doing so since the predictions are the same. The other one might be the correct one in terms of describing more accurately what is happening, but if you can't develop an experiment that would differentiate the predictions of the two theories, then there is no reason to assume the complex one is the correct one and you simplify things by choosing the simpler version.
I see this directive a lot. It boils down to "We don't know where our sensitive data is, or don't trust our employees to keep it where it should be, so we're encrypting everything!".
Which is a pretty good idea. Page files, application-level caches, all this stuff muddles the water of where our sensitive data might be. And trusting employees to keep everything where it should be is just stupid. Even if they're smart guys, people make mistakes.
Most of the time when I see this, it's because the person making the directive is responsible for security in some manner but has no experience with risk management and mitigation, so they go for the "all out, definitely safe!" shotgun solution. The problem is there's no such thing!
You're absolutely right. However it doesn't make sense to go from there to, "encrypting everything doesn't make sense because it doesn't make you definitely safe." That argument leads to the inevitable conclusion that any security feature is unnecessary because, as you've said, nothing fits the bill.
What risks are you actually attempting to mitigate through encrypting everything, and are you aware of the risks you are creating? These are questions the person who made the directive should be able to answer!
Again, most definitely correct.
If you're trying to stop a malicious insider, no amount of encryption will save you if they've been given the key.
Not really. Being able to access the data, and being able to carry the data out are two entirely different things. If your data is really important, and the computer holding the data isn't connected to the 'net, the insider doesn't have admin rights, and the usb ports are disabled to people without admin access...he could still break in and steal the hard drive. There's a reason to keep it encrypted.
There are also things you might not necessarily anticipate. You don't lose anything by encrypting everything. You are creating some additional risks (users forgetting passwords is a common one), but as long as you are aware that it's not a silver bullet and as long as you have a strategy to handle the additional risks, then it is an option.
Finally as others suggested, what's your key management and password management strategy?
Yes, that's the type of question that he most definitely needs to deal with. But again, as long as they are looking into issues of that sort, and not just buying into what they think is instant security, there's absolutely no downside to encrypting everything.
Sensitive customer data should NOT be treated the same as OS files.
Do you know where your OS caches files that you've opened? Even if you do (I'm pretty sure I do), are you convinced that you're going to catch any and all changes to this behavior that come in the next update designed to improve performance. Even if you do keep informed of every single change update patches make to your system, do you really want to change the encryption strategy of every computer you support or hold off the update just because the OS is now caching in a place you didn't have the foresight to encrypt?
Whole disk encryption is the only way to go if you're serious about keeping your data secure. That's without even mentioning the fact that even though you might know the difference between sensitive consumer data and stuff that doesn't need to be encrypted there are bound to be stupid employees who will copy data off the encrypted partition / usb key / whatever to the unencrypted drive just so they can avoid typing a password.
it's a mindless kneejerk reply, and it insults the intelligence of anyone reading your words
1. it announces with smarmy glee a concept that your audience already knows
I agree completely
2. a lot if not most times correlation does actually reveal causation
Whoa, you just disproved your first point. "If not most"? Are you honestly telling me that you can come up with more examples of correlation that implies causation than examples where it does not? You're saying that this is even remotely a possibility? I'm guessing you don't really understand this concept that you're supposed to already know.
A great example is the whole decline of pirates and global warming correlation. Do you think it was particularly difficult to come up with that, and it just happened to be an amazing coincidence that there was a correlation where there was obviously no causation? You can get any two completely unrelated things and if you analyze enough trends, you'll be able to find some correlation.
I think what you're looking for here is, "correlation is a necessary, but insufficient condition for causation." No more, no less. In the case of IE, bundling helped, because a browser was there. The fact that it was free when navigator was not (at least not in the beginning if you weren't an academic or non-profit institution) helped a lot more. The fact that by the time netscape became available for free IE was unambiguously a much superior browser sealed the deal.
No, by law you are required to continue supporting a product for 5 years after you pull it from sales.
Citation needed.
This is why Microsoft continues to provide security patches for operating systems (like WinXP) that can no longer be bought through retail (shrinkwrap software box, not the OEM installs that come on EeePCs) for 5 or 7 years or whatever it is.
It's not by law, it's because no business would touch microsoft if they didn't provide security patches. By contrast, their support period for Windows is 90 days from date of activation. If you call them up after that date to report a problem with their software, you need to pay them for their time. If it turns out to be a bug on their side, they claim to refund your money, but that's just their own personal policy again: they are not required to.
Uh - I may be missing the point but if you charge for a product then it seems to me you might have some sort responsibility to your clients
Not unless there's a support contract in the purchase. You've paid for the copy of the software, you have the copy of the software, transaction is completed. No further work required on the part of the developer.
Of course, if you build a reputation for ignoring complaints and not supporting the software you make, you might find it more and more difficult to sell your software. That's a risk the developer is free to take, though.
Also depending on the OSS license you use you might have the responsibility of providing source code to those people whom you distribute it to.
I guess these things wouldn't prevent you from walking away but they might make it somewhat more annoying/painful.
If you plan it right, thinking that you might want to walk away in the future, you just include the source code with the binary distribution. This way everybody who is entitled to the code already has it and your responsibility is complete. You're not required to forever distribute the source code, you're just required to give it to anyone to whom you (not somebody else) gave the binary to, if they want it.
Of course, if you really do it right, you just put your source code on sourceforge or somewhere like it. Anytime you walk away, the code is still there, and others can fork/restart the project anytime they want in.
OK/Cancel buttons are a disaster-area anyway, since every OS and every application has a different idea on what order they should go in, and people get used to clicking the left/right one for OK without looking at the labels.
If you color the ok button green and the cancel button red is there any culture for which that would seem backward? I honestly don't know the answer to that, but the convention of "green=ok, red=pay attention, something's wrong" might be universal.
This is actually rather obvious. If Jimbo tells you that there's a 1% chance that your tire will go flat if you don't fix it, that's not 1% if Jimbo is wrong 50% of the time. At best, it's 50.5%. Or something like that.
Hmm...no? That's not even close to right. If Jimbo is right, then there's a 1% chance your tire will go flat. If Jimbo is wrong, you have no information about the tire. It could be even better odds. It could be that there's only 0.05% chance of of the tire going flat. You can't use the 50% probability to determine the chances of your tire going flat unless Jimbo is making true/false statements. In which case, if he's wrong you know what the right answer should be, and the statistic applies.
So according to you there won't be a global lack of food until everyone in the world earns about the same and then people are starving?
No, in my opinion there isn't a global lack of food until the lack food drives prices up to the point where the middle class can't afford it.
Do you realize how impossible that 'utopia' is to achieve? In reality, climbing out of poverty is quite difficult and a very slow process
I'm not saying we'll ever achieve a point where no people are starving. It would be nice, but I'm not saying we're going to do it. What I'm saying is that the reason people are starving has nothing to do with the lack of food. We have plenty of farm land that is not being used. It's not currently being used because it's not profitable to oversaturate the market with food driving the prices down to the level these people can afford it. It's cold, but that's how the market works.
As the population of people with money to pay for food increases, the amount of available food will increase to accommodate them.
Basically, there is a problem, it's a tough problem to solve, but it has nothing to do with "the earth cannot sustain the current population food needs." It has to do with a very large class gap between them and us.
Slashdot Mirror
Id doesn't make it wrong either
They're interfering with my usage of a product I paid money for and that they no longer own. How does that possibly not fit into your definition of wrong?
Apple has no obligation to behave in any way aside from being legal. That's all.
Never said otherwise. That's why I qualified my posts with "moral right" and "ideal world." Just because something is legal does not make it right. In this case the law is wrong and any type of DRM that locks the user out of doing anything he damn well pleases with a device he bought, and not just rented, should be illegal.
Doesn't mean they have to expend effort to enable that.
No it doesn't, I completely agree. However, it does mean they don't have the moral right to expend any effort on preventing it.
No they don't, but good luck getting it onto the iPhone
Especially when they start attacking the only other way of getting apps on the iPhone. They also encrypt firmware on newer iPod devices so you can't install rockbox. They started encrypting their database so you couldn't sync it with linux apps. They go way beyond "not expending effort to enable" competition.
I'm not here to say that Microsoft has a great track record on that. Windows mobile devices are pretty open as far as applications go...anyone can develop one and sell them independently. At the same time, syncing with them on anything other than Active Sync is ridiculously difficult, and that pisses me off too. Also, I'm seeing a lot of posts that indicate the Zune is a very closed device (I wouldn't really know). It seems Ballmer is being incredibly hypocritical, but that doesn't make what Apple is doing right.
It's apple's product and marketplace, okay? Apple set the thing up, they get to set the rules.
It is their marketplace, but it most certainly isn't their product once I buy it. It's my product, manufactured by apple. They lose (or by all right should lose) all rights as to what I can and cannot install on the thing, and where I can and cannot buy applications from. At that point, they can feel free to choose what they want to sell and what they don't want to sell in their store, but they don't get to prevent other people from having their own competing stores.
At least that's how it should be in an ideal world.
Ugh...I should read my previews.
I meant to say I'd applaud a decision against the banning of pornography sales to kids. Again, if the parents care, they should be the ones to monitor their kids.
Sorry for the confusion
While many here will certainly applaud this decision, I find the double-standard amazing. If we can ban sales of pictures of people having sex to minors and impose other draconian punishment, then why is obscene violence any different?
I completely agree, and I hate the double standard myself. Personally, I do applaud this decision, and I'd similarly applaud a decision banning sales of pictures of people having sex to minors.
I somehow doubt the founding fathers would have equated free speech to depictions of extreme violence
That might be true, but it's quite irrelevant. If you think it's right that they would be able to decide what equates to free speech and what does not, what you're actually doing is advocating a state-vetted list of things you can and cannot say. That's exactly the opposite of free speech. What makes them right?
I certainly am not happy about my freedom to criticize politicians being considered on the same level as some spotty fifteen year old kid's "right" to buy GTA.
Don't think of it in those terms. It's not that they have a right to buy GTA. It's that the government doesn't have a right to stop them. That's the job of the parents of this spotty fifteen year old kid. Parents these days think that educating their kid means sending them to school and plopping them in front of the tv. Monitoring your kids, especially during the teenage years is tough, but that doesn't mean the government should do your job for you.
nah, she wasn't all that expensive.
Well, you weren't the one who divorced her :)
Sure, from what we know of how life on this planet developed, it seems reasonable that we're not special. However, we don't even see it in other "reasonable" places in our own solar system.
It has nothing to do with what we know of how life on this planet developed. It just means that unless you assume development of life requires conscious divine intervention, it happened as a result of certain conditions. We could be very special in the sense of life being an extremely low probability, even given the right conditions. However, given the size and age of the universe, it doesn't matter how low the probability is: if it happened once, it's happened multiple times.
Don't misunderstand me. I'm not saying we'll ever meet E.T. If the universe is mostly uninhabited, there might be nobody close by. Even if there's any life "close by" they're not necessarily intelligent. Even if there's intelligent life "close by" they're civilization does not necessarily need to be alive simultaneously with ours. Even if they are, "close" in the scale we're speaking of is still impractically far for travel or even conversation.
A zit on your nose doesn't imply a zit on your ass. Two or three or four zits on your face may well lead a person to believe you're just a zitty bastard, though.
Your argument is actually sound, but it's not arguing what you think it is. A zit on my nose doesn't imply zits are common in the rest of my body. Similarly, life on Earth doesn't imply the universe is full of life everywhere. And that's not what I'm arguing.
What I am arguing is that a zit on my nose implies the existence of zits elsewhere in the human population. If you see a zit (or even something extremely rare that you've never seen before) on my face, it's illogical to assume I'm the only person in the world to ever have gotten that particularly thing, and that nobody else out of billions of people that have ever lived and will live will ever get it. And billions is a very small number when you're talking about stars in the universe.
Our Sun isn't that special of a star. There are many others that have been identified that are just like it. Countless others that we have never seen. It's completely unreasonable to assume that none of those have a planet in the sweet spot. Out of those that none of them have developed life. I'm not saying it's common, I'm not saying life is everywhere, I'm not saying we'll ever find it, but regardless of how common it is: you have no reason to assume it doesn't exist.
I wasn't intending to prove that it is technologically realistic to travel this fast, more that it wouldn't break the major laws of physics...Finding a way to maintain this acceleration would indeed be a huge feat of engineering on a scale likely orders of magnitude from what we can currently obtain. But that doesn't necessarily mean that it is impossible.
Ah. In that case you are absolutely correct. Thanks for clarifying your point for me.
...shows that accelerating at 9.8 meters per second per second will get you halfway to a destination 10 light years away in 2.2 years. 4.4 year one way trip, 8.8 year round trip
Uh-huh. You want to continuously accelerate at 1G for 2.2 years (and then presumably decelerate at 1G for the remaining 2.2 years). Care the calculate the amount of fuel you'd need for that? The amount of food you need to carry to sustain a crew for 4.4 years (we'll assume we can refuel and restock at the planet we're going to)?
If you can carry enough reaction mass or somehow collect it on the way
Yeah, see...you've concentrated on the relativistic issues and brushed off the real problem. Time to get there isn't a problem. Even if it took 500 years, if we assume we can carry / farm enough food on the ship, we can get humans there by having a crew that spans a few generations. Or, if you assume we're capable of putting people in stasis like you said, we get around the food problem. However, the things you are just assuming and brushing off are the actual challenges, and they're pretty tough to get around.
we have no reason to suspect that there is life beyond this planet.
No reason to suspect? It goes like this. There is life on this planet. Therefore probability of life > 0. There are many, many, many stars in our galaxy, countless in the universe. No matter how small the chances are, given the size of the universe and since we have proven that the probability is greater than 0, it's inconceivable to imagine that we're the only ones.
In fact, the only reason to be arrogant enough to say that we're the only ones would be religious nonsense.
Write up a "rosetta stone" with a bunch of pictorial/mathematical representations of words, and so on. Probably doable.
I know a lot of science fiction books and music like to tout math as a "universal language" but it's really not a language at all. In fact, we need language in order to convey the mathematical concepts.
Case in point, most human scientists had difficulty deciphering the Pioneer plaque and it's attempt to encode information about humans and the location of the earth in a mathematical way. A lot of the things we don't think of as "language" such as arrows to point directions, really are.
And therein lies Wikipedia's problem.
Not at all. Everything was correct on the Wikipedia side. The erroneous entry was removed, someone found a reputable source that backed up the erroneous entry, and they put it back. Then it was found that the reputable source had it wrong, so it was changed again.
The problem lies entirely with the newspapers who went for wikipedia as their source. You never use an encyclopedia as your source, EVER. The last time I was allowed to use an encyclopedia as a source was in third grade, and even that shouldn't be allowed because it teaches bad research habits to kids who will grow up to be journalists. You use the encyclopedia to satisfy idle curiosity and to start your research (not to gather facts, but to figure out what questions you should be asking and what directions your research will take).
I wish I had no fame and no money
Don't do that. Quite a few of us have been inspired by you and we think you deserve both.
Have fun at DWTS, I look forward to any pranks you manage to pull off.
Also as aside, thanks for the civilized and intelligent debate! That is getting much harder to find online these days. :)
You're giving me far too much credit. I mostly just misinterpreted your original point. I thought you were arguing that it was always a bad idea to encrypt everything when you were simply advocating careful consideration of all the options and what they entailed. We're in complete agreement there.
Thanks for taking the time to help me understand what you meant.
I wouldn't go so far as to say there's absolutely no downside to encrypting everything. All encryption has overhead - some products, significant overhead. Then there's either the extra expense of a key management strategy and team plus sysadmin overhead and labor OR the cost of losing data once something bad occurs and the data cannot be recovered.
Fair enough. If you think things through, there shouldn't be a case where the data cannot be recovered (I mean, if something bad happens even unencrypted data can go poof. First of all, backups are important, and second, if you're encrypting things, the ability to restore the password to a default one you originally set is absolutely necessary. Most packages will have some way to do this).
That said, I was thinking about the technical side of things. From a purely technical perspective, it's definitely feasible and can get you some security benefits. However, you have a good point on labor and other costs. As you've said a risk/benefit analysis is important in any decision.
i am automatically excluding all the idiotic correlations and causations, that are well outside an honest probability rating
Who decides? You can get a lot of people arguing that violent videogames increase violent behavior in teens, and there are correlations to back that up. It's not an idiotic correlation because there's a working hypothesis as to why that might be the case. At the same time, using the correlation alone isn't viable because it ignores a whole lot of other variables. Obviously there's an increase in usage of violent video games, because they are relatively new. What else has changed in our society that could cause an increase in violent behavior? And then there's the question of direction: wouldn't violent people naturally choose to play violent video games?
See? Sometimes it's not black and white.
i will underline my assertion with a dull overused weapon: occam's razor. i won't insult your intelligence and explain occam's razor for you, but i will assert that if correlation!=causation,for most intellectually honest sets of correlation, occam's razor would not be a useful dictum
That's a pet peeve of mine, so I would really appreciate it if you did explain it to me. Let me give you a hint: if you think Occam's Razor says, "the simplest explanation is usually the correct one" you've been watching Contact, and you don't know what it actually says. Occam's Razor says nothing about the correctness of a statement, which invalidates your entire claim.
What Occam's Razor actually says is that entities should not be multiplied beyond necessity. If you have two hypothesis that give you the exact same predictions, but one of them is more complicated than the other, then you should use the simplest one because you lose nothing by doing so since the predictions are the same. The other one might be the correct one in terms of describing more accurately what is happening, but if you can't develop an experiment that would differentiate the predictions of the two theories, then there is no reason to assume the complex one is the correct one and you simplify things by choosing the simpler version.
I see this directive a lot. It boils down to "We don't know where our sensitive data is, or don't trust our employees to keep it where it should be, so we're encrypting everything!".
Which is a pretty good idea. Page files, application-level caches, all this stuff muddles the water of where our sensitive data might be. And trusting employees to keep everything where it should be is just stupid. Even if they're smart guys, people make mistakes.
Most of the time when I see this, it's because the person making the directive is responsible for security in some manner but has no experience with risk management and mitigation, so they go for the "all out, definitely safe!" shotgun solution. The problem is there's no such thing!
You're absolutely right. However it doesn't make sense to go from there to, "encrypting everything doesn't make sense because it doesn't make you definitely safe." That argument leads to the inevitable conclusion that any security feature is unnecessary because, as you've said, nothing fits the bill.
What risks are you actually attempting to mitigate through encrypting everything, and are you aware of the risks you are creating? These are questions the person who made the directive should be able to answer!
Again, most definitely correct.
If you're trying to stop a malicious insider, no amount of encryption will save you if they've been given the key.
Not really. Being able to access the data, and being able to carry the data out are two entirely different things. If your data is really important, and the computer holding the data isn't connected to the 'net, the insider doesn't have admin rights, and the usb ports are disabled to people without admin access...he could still break in and steal the hard drive. There's a reason to keep it encrypted.
There are also things you might not necessarily anticipate. You don't lose anything by encrypting everything. You are creating some additional risks (users forgetting passwords is a common one), but as long as you are aware that it's not a silver bullet and as long as you have a strategy to handle the additional risks, then it is an option.
Finally as others suggested, what's your key management and password management strategy?
Yes, that's the type of question that he most definitely needs to deal with. But again, as long as they are looking into issues of that sort, and not just buying into what they think is instant security, there's absolutely no downside to encrypting everything.
Sensitive customer data should NOT be treated the same as OS files.
Do you know where your OS caches files that you've opened? Even if you do (I'm pretty sure I do), are you convinced that you're going to catch any and all changes to this behavior that come in the next update designed to improve performance. Even if you do keep informed of every single change update patches make to your system, do you really want to change the encryption strategy of every computer you support or hold off the update just because the OS is now caching in a place you didn't have the foresight to encrypt?
Whole disk encryption is the only way to go if you're serious about keeping your data secure. That's without even mentioning the fact that even though you might know the difference between sensitive consumer data and stuff that doesn't need to be encrypted there are bound to be stupid employees who will copy data off the encrypted partition / usb key / whatever to the unencrypted drive just so they can avoid typing a password.
it's a mindless kneejerk reply, and it insults the intelligence of anyone reading your words
1. it announces with smarmy glee a concept that your audience already knows
I agree completely
2. a lot if not most times correlation does actually reveal causation
Whoa, you just disproved your first point. "If not most"? Are you honestly telling me that you can come up with more examples of correlation that implies causation than examples where it does not? You're saying that this is even remotely a possibility? I'm guessing you don't really understand this concept that you're supposed to already know.
A great example is the whole decline of pirates and global warming correlation. Do you think it was particularly difficult to come up with that, and it just happened to be an amazing coincidence that there was a correlation where there was obviously no causation? You can get any two completely unrelated things and if you analyze enough trends, you'll be able to find some correlation.
I think what you're looking for here is, "correlation is a necessary, but insufficient condition for causation." No more, no less. In the case of IE, bundling helped, because a browser was there. The fact that it was free when navigator was not (at least not in the beginning if you weren't an academic or non-profit institution) helped a lot more. The fact that by the time netscape became available for free IE was unambiguously a much superior browser sealed the deal.
No, by law you are required to continue supporting a product for 5 years after you pull it from sales.
Citation needed.
This is why Microsoft continues to provide security patches for operating systems (like WinXP) that can no longer be bought through retail (shrinkwrap software box, not the OEM installs that come on EeePCs) for 5 or 7 years or whatever it is.
It's not by law, it's because no business would touch microsoft if they didn't provide security patches. By contrast, their support period for Windows is 90 days from date of activation. If you call them up after that date to report a problem with their software, you need to pay them for their time. If it turns out to be a bug on their side, they claim to refund your money, but that's just their own personal policy again: they are not required to.
Uh - I may be missing the point but if you charge for a product then it seems to me you might have some sort responsibility to your clients
Not unless there's a support contract in the purchase. You've paid for the copy of the software, you have the copy of the software, transaction is completed. No further work required on the part of the developer.
Of course, if you build a reputation for ignoring complaints and not supporting the software you make, you might find it more and more difficult to sell your software. That's a risk the developer is free to take, though.
Also depending on the OSS license you use you might have the responsibility of providing source code to those people whom you distribute it to.
I guess these things wouldn't prevent you from walking away but they might make it somewhat more annoying/painful.
If you plan it right, thinking that you might want to walk away in the future, you just include the source code with the binary distribution. This way everybody who is entitled to the code already has it and your responsibility is complete. You're not required to forever distribute the source code, you're just required to give it to anyone to whom you (not somebody else) gave the binary to, if they want it.
Of course, if you really do it right, you just put your source code on sourceforge or somewhere like it. Anytime you walk away, the code is still there, and others can fork/restart the project anytime they want in.
WTF?
I'm guessing his wife is of noble descent.
OK/Cancel buttons are a disaster-area anyway, since every OS and every application has a different idea on what order they should go in, and people get used to clicking the left/right one for OK without looking at the labels.
If you color the ok button green and the cancel button red is there any culture for which that would seem backward? I honestly don't know the answer to that, but the convention of "green=ok, red=pay attention, something's wrong" might be universal.
This is actually rather obvious. If Jimbo tells you that there's a 1% chance that your tire will go flat if you don't fix it, that's not 1% if Jimbo is wrong 50% of the time. At best, it's 50.5%. Or something like that.
Hmm...no? That's not even close to right. If Jimbo is right, then there's a 1% chance your tire will go flat. If Jimbo is wrong, you have no information about the tire. It could be even better odds. It could be that there's only 0.05% chance of of the tire going flat. You can't use the 50% probability to determine the chances of your tire going flat unless Jimbo is making true/false statements. In which case, if he's wrong you know what the right answer should be, and the statistic applies.
So according to you there won't be a global lack of food until everyone in the world earns about the same and then people are starving?
No, in my opinion there isn't a global lack of food until the lack food drives prices up to the point where the middle class can't afford it.
Do you realize how impossible that 'utopia' is to achieve? In reality, climbing out of poverty is quite difficult and a very slow process
I'm not saying we'll ever achieve a point where no people are starving. It would be nice, but I'm not saying we're going to do it. What I'm saying is that the reason people are starving has nothing to do with the lack of food. We have plenty of farm land that is not being used. It's not currently being used because it's not profitable to oversaturate the market with food driving the prices down to the level these people can afford it. It's cold, but that's how the market works.
As the population of people with money to pay for food increases, the amount of available food will increase to accommodate them.
Basically, there is a problem, it's a tough problem to solve, but it has nothing to do with "the earth cannot sustain the current population food needs." It has to do with a very large class gap between them and us.