So what you're saying is that because the thing to measure is way more complex than the simple model beneath it, the whole tool is useless because it can't tell you when it's right and when it's wrong. I'm saying that doesn't make the model useless, because it's representing only the probability that a given subject will have comprehension of a particular text.
I'd like to see it tested and proven or disproven. Draw a fuzzy circle representing actual measured comprehension of a set of texts by a set of students, and another circle representing the readability of those texts as measured by the FKRI. I expect the circles will both be fuzzy and large, but there will be a lot of overlap - enough to make statistically significant predictions. And the FKRI is simple and fast and cheap. It has it's place even if it isn't always right.
In what sense is it a "guideline"? Perfectly clear text can get a poor readability index, incomprehensible text can get good readability.
A reading index is just like a measuring tape. It can't tell you that you built a crappy house with crooked walls and a leaky roof; it can only tell you that something is 40 feet long by 30 feet wide.
A reading index is a tool that simplifies understanding, reducing a very complex thing to a simple number that's useful for comparisons. Just like you can use the measurements of the house to figure out that it's 1,200 square feet, you can compare that to a house that is 2,400 square feet. Neither measurement tells you the quality of the construction, the color, the flooring, the lot size, or the neighborhood. But if you're looking for a home for a family of six, knowing the floor space is one thing that can help weed out the useless candidates quickly. If you're looking for a book for first graders, you don't trot out a book with a reading index of 18.
And claiming it doesn't work on incomprehensible text is like complaining that a measuring tape can't tell you the color of a house. A reading index is not an interpreter of syntax, grammar, spelling, or any other attribute of text. It just measures one simple set of dimensions of text.
A reading scoring system can only give you an indication, not a guarantee, of what kind of audience should be able to comprehend a given piece of text; and it can give you an indication of relative difficulty. For example, the widely used Flesch-Kincaid Readability Index bases its score on the average number of words per sentence and the average number of syllables per word, and outputs a "grade level". The grade levels were probably modeled on the textbooks and lesson books of the era in which it was developed. Is it still relevant? Perhaps the actual grade levels are different these days, but it's still a widely accepted model because it's useful for what it does provide.
It's simple economics. If the cost of problems with annoyed customers remains below the cost of upgrading the system, then they won't upgrade.
Comcast makes no money on the traffic that traverses their network, and has nothing to gain by upgrading except their customers' good will. Since every third post here begins with "Comcrap" or ends with "sucks", I don't think they're too worried about their quality of service image.
Here's the deal breaker for Santa's conspiracy theory: what kind of idiot would locate their service inside this boundary, effectively guaranteeing crappy service to everyone who isn't a Comcast customer? There would have to be a compelling reason that this would improve Comcast's networking business for this theory to be true, and I see nothing compelling about this.
There's a perfectly simple explanation, backed by a mountain of evidence: Comcast is cheap.
What makes Backdoor Santa think this is done to drive service providers to Comcast? Occam's razor has a much simpler explanation: Comcast doesn't want to spend more money upgrading their capacity.
Hell, if I was a service provider I wouldn't consider Comcast after seeing those charts, not with that bad service.
No kidding. Stargate Universe is essentially House + BSG. It's just sad how much the Universe writers shamelessly rip off those two shows.
Actually, I always thought "Stargate Universe == Gilligan's Island + Star Trek: Voyager."
Seriously, all the main tropes originated from Gilligan's Island. Our castaways set sail that day for a three-stargate tour. A three-stargate tour. They get to have weekly guest stars thanks to magic rocks that have them exchanging bodies like the mad scientist episode of Gilligan's Island. They re-invent stuff that the Professor usually made out of split coconuts and bicycle pedals. Col. Young has his naive little buddy Eli and mopes about feeling responsible for stranding them all there.
Unfortunately, it still uses a lot of Star Trek plotions (reverse the cross-coupling power adapters to move all power to the shields!) and Chloe is no Mary Ann.
Of course I still watch the damn show. I have to admit that I really like the utterly amoral character of the Professor... I mean Dr. Rush.
--
The Ballad of Stargate: Universe
Just sit right back and you'll hear a tale, A tale of a fateful trip That started from this secret planet Through the eponymous plot device.
The mate was a failed Stanford kid, The Colonel brave and sure. The VIPs set sail that day For a three hour tour, a three hour tour.
The bombing started getting rough, The tiny base was tossed, If not for the courage of the fearless crew The civilians would be lost, civilians would be lost.
The ring sent them to a ship out there beyond the Milky way With the Eli kid The Colonel too, The turncoat who screwed his wife. The porno doc! The professor and Sgt Greer, Here on an alien's ship.
So this is the tale of the castaways, They're here for a long, long time, They'll have to make the best of things, It's an uphill climb.
The college kid and the Colonel too, Will do their very best, To make the others comfortable, In the busted ship.
No phone, no lights, no shuttle craft, Just a thousand Dell PCs, Like ST:TNG, As primitive as can be.
So join us here each week my friends, You're sure to watch them slip, From all the stranded castaways, Here on "Alien's Ship."
What I'm saying is that "properly implemented Kerberos" (your words) is a strong assurance, but it is NOT a guarantee of "rock solid". The first four versions of Kerberos all had various weaknesses that weren't discovered until after they were in use.
If Kerberos 5 has an as-yet-undiscovered weakness, it no longer meets the definition of rock solid, and whatever secrets it was protecting may now be exposed at every site relying on it. Do I think V5 has such a weakness? Doubtful, but let me put it this way: I had absolute faith in the security of PGP, which was shattered by the discovery that someone could tack an almost invisible escrow decryption agent into unsigned data attached to someone's public key. Now, I maintain what I consider to be a healthy skepticism in the supposed perfection of any system.
And regardless of the strength of the underlying authenticating technology, I believe proper implementation is a myth. Some sites are very, very good at it today, but reality issues always seem to creep in. Someone outsources someone else's task; and the outgoing employees stop caring, or the incoming contractors never care. Spies break into a factory or two and steal their private CA signing root keys. The offline server is accidentally left online. Joe gets drunk and forgets his keycard in the bar. Or a surrogate Mary McDonnell hooks up with the lead security architect via an XSS hack at match.com and pulls some shenanigans.
Central authentication isn't a panacea, it's just better than anything else we are willing to put up with at the moment.
Having people reinvent it constantly is counterproductive to your goal. What we need are a few people who actually know what they're doing to design it, and for everybody else to use that.
How about Kerberos, versions 1-4? Oh, wait. Bad example.
My point is that MIT has the people who not only know what they're doing, but are the ones who often define the very security practices the rest of us rely on. And even they needed to get to version 5 before they got it right (for current definitions of "right").
I'm certainly not saying that ShmooCMS is going to do a better job than MIT did with kerberos at defining an unhackable protocol. They're not. I am saying to "be mindful of what you rely on", because even the best systems are not likely to remain secure forever.
You don't even need to register a throwaway address for Hulu or sites like it. Enter bugmenot, savior of the net.
Bugmenot unfortunately lost their courage a few years ago when they changed the way they function. I suspect they were threatened by a lawsuit. Now, any domain or site owner can request that bugmenot exclude their site from participating, and I've found that so many of the popular ones do that it's lost all practical value for me.
I now use mailinator for all my throwaway registrations, then if I care in the least I change the password just in case someone else reads from the same random email name that I did. I usually don't. For more "durable" sites where I'm likely to participate over a longer time, I'll create a unique sneakemail address and keep them around forever. When something like the Gizmodo breach happens I simply flag them as spam, and they plonk all the email from them for me. I've had to do that a couple of times now. I find their service is well worth the $24/year.
That doesn't change anything if the algorithm is fast, since the salt is stored _with_ the hash. If you have the hash, you have the salt. Dictionary based means that the _original_ string is looked up in a dictionary.
Salting doesn't change the security of a single hash against brute force attack, but it does change the security of a collection of hashes.
Salt provides a measure of hiding otherwise innocuous collisions. The classic example is a password database. If I enter a password of "asdf" and you enter a password of "asdf", our unsalted hashed values would be identical in the database, where any random admin could spot that they were identical. It's like a poor-man's dictionary attack.
Remember, short strings are inherently more susceptible to collisions than long strings, particularly if they're strings people can choose, and not just random data.
I block ads and trackers everywhere: the mailbox, the do-not-call list, opt-out mailings, heavy use of the DVR 30-second-skip button while watching pre-recorded TV, and of course on the web. But since I read slashdot so regularly I pay them the subscription fee as recompense. I would rather pay them for the valuable service than waste my time and everyone's bandwidth downloading ads that will only serve to annoy me.
To all the sites that think that they're not capturing my valuable opinions on what I find interesting to click on, or what gadgets I hover my mouse pointer over, I'm willing to accept your judgments based on what you've learned from other users via trackers. To sites that want ad revenue from me? Put up a tip jar, or sell site-specific merchandise. That way I can sponsor you directly.
Look, I'm internet savvy and resourceful. I can think for myself. If and when I want some product I will seek it out. None of your "throw your shit in my face" will make me want to buy your product. In fact it alienates me - IOW it has the opposite effect. Get this through your thick skull - people like me who actively use things like AdBlock are not your customers and never will be. We will seek out and buy things using the wonderful internet as a research tool if and when we - not you - determine we need your product. You'd be best to spend your ad dollars on making a stellar product!
Actually, their ad dollars are spent wisely. Merchandisers know that a significant fraction of the public won't listen to them, and that some of us have run eight flavors of ad-block for the past decade. They also know that leaves a significant fraction that will listen to them, so that's who they're targeting. But opt-in just rubs it in the face of those who are susceptible that there are non-gullible people out there, and nobody wants to think of themselves as gullible; so a large number of the susceptible people won't choose to opt-in. Thus, with opt-in ad eyeballs drop, and so do sales.
The thing with advertising is it's damn effective, statistically speaking. Certain kinds of ads resonate with certain kinds of people. I never understood why there was a single person in America who bought anything Billy Mays was pitching, that anyone would watch late-night infomercials, or would read spam, or why the home shopping cable channels even exist. Yet Mays died a very wealthy man, infomercials are on every night, spam is as profitable as ever, and home shopping has been a cable mainstay for at least 30 years. You and I may never understand what drives the kinds of people that watch this nonsense, but advertisers do, and they will continue to try anything and everything to keep hawking their wares.
Cloning the power cells would be interesting, and was the first thing I thought of when I saw it, too. I'm sure they could find the genes to splice to produce the xanthopterin in another organism, such as a conveniently non-flying and non-stinging pine tree. But without the insect's sophisticated chitin structure to collect the energy I suspect much of it would be wasted; and that's only if there's enough light energy to start the reaction at all.
But the thought of hooking electrodes up to a Frankentree and hanging LEDs from the branches just kind of amuses me.
Since xanthopterin converts light directly into electricity, according to the research, what exactly does the wasp do with the electricity produced? Does it directly excite muscles? Is there a tiny capacitor in the abdomen that dumps the energy into pulling the wings down?
Although I'd appreciate a phone that, for once, did the basic things right first. Like with car stereos, I have yet to find a device that does not have one or more major annoyances.
Most phones have those annoyances, but our problem is that we constantly shift expectations of what "the basic things" are. Not long ago, basic meant "voice". So if you go back to basic old Motorola phones, the voice was fine but they had clunky speed dial memory schemes. Fast forward a few years, and we had good voice and contact lists, but SMS was awful. Then came Bluetooth and MP3 players, most of which were slow and/or crashed often, but SMS was improved with T9. Now we have phones that do voice, music, Bluetooth, MMS, etc., but web surfing is awful. Or the walled gardens chafe. Or something else is annoying.
Truly basic phones (large-face screens, number-only buttons, no features to do anything else) sell well with a certain group of people who no longer wish to learn the latest in technology on an annual basis, and they are fine at what they do. But of course that may be "too basic" for average tastes these days.
Only musically ignorant pieces of shit would find a video game of a crazy dead pop star pointless? Therefore you're going to save the world from Monsanto from those of us who aren't murderers??
Wait, what?
Back away from the keyboard, and take a deep breath. Calm. Exhale. Calm.
If you need someone, your friends from the internet are here for you, buddy. Take all the time you want.
I wouldn't write my pirating code based on this just yet. Those are just some "possible" ways, I'm certainly not saying they're the only ways nor even the way this game was protected. They could base protection on any number of other attributes. They could even have a serial read-only chip hidden in their cartridge on a different line that returns a decryption key not ordinarily accessible by flash media addressing schemes.
Seriously, it would work. Issue volunteers over 18 one-shot hand-held tasers. The tasers should scream shrilly when triggered, and spray ink on the hand of the person holding it. But you manufacture only one out of four tasers with an actual firing mechanism and high voltage circuit - the rest are screaming non-functional dummies that weigh the same. Cast the cases out of aluminum and weld them shut at manufacture time. Tumble them all to a common sheen, then add a tamper-evident finish. That way neither employees nor potential terrorists know and can't figure out if they have an effective weapon or not. Batch numbers only - no individual serial numbers on the weapons, but they would have disposable barcode stickers that are required to be collected upon landing from every assigned passenger. The TSA would have a protocol for assigning and collecting the weapons before and after each flight, separate from the airline agents, and would have a testing regime. The passengers would place the holsters in specially designed compartments in the seatback in front of them, and removing them in-flight would sound a local alarm, flash a light over the seat, and alert the crew. Breaking the hermetic inner seal of the protective holster would be a federal offense, and get you detained upon landing.
Anyone who fires their taser in-flight triggers their screamer, and will likely get tased by several nearby passengers, some of whom will likely have working weapons. Upon the first firing, the crew follows lockdown instructions, landing at one of eight nearby airports (selected by ATC) randomly chosen by a simple rock-paper-scissors kind of protocol that prevents any one crew member (or the ATC controller) from influencing the actual destination. Subverting this scheme would require the corruption of the entire flight crew. People whose tasers were discharged would remain in the local airport while the plane resumes its course to its intended destination.
Special requirements: all passenger cabin circuitry would have to be isolated from flight circuitry, so if a bad guy tried to zap his headphone jack, the seat-back TVs, lighting circuits, galley equipment, smoke detectors, or other accessible electronics, it'd just damage the passenger cabin systems. All avionics and control wiring would be enclosed in conduit whenever it passes from nose to tail.
So if a bad guy pulls out some kind of weapon that slipped through the metal detectors, his neighbors zap him. Repeatedly.
The same way they always have for the last 30 years. Bury some code that's supposed to toggle some hardware effect in the cartridge or media, check for the side effect, then crap out if it fails.
Another way is just using attributes of the cartridges against pirates. Copies are often made on read-write media, but legitimate cartridges are read-only. So you have legitimate executable code that says "DO_MUSIC: call PLAY_MUSIC", and you add a statement that says "write to address DO_MUSIC 'call PLAY_VUVUZELA'". A legitimate cartridge can't overwrite the ROM, so it fails, and the call to PLAY_MUSIC remains in place. But on a rewritable cartridge it does overwrite it and zzzzzzzzzzzzzz happens.
That's the problem with Web 2.0. Everything's a script, from pull down menus to "Reply" buttons on blogs. Which of those is random? Which is malicious? Which shouldn't I run?
It's easy to sort out the third-party scripts, and block all but domain originated scripts from the sites you visit. I don't care if CrazyEgg can't tell where I clicked, or if google-adsense fails to rack up another hit, or alexa doesn't count me in the Top 100. But I kind of need the internal site navigation stuff, and a lot of sites use scripts for sorting, comparison shopping, etc. The scripts in TFA are originating at the domain, and are not being served up as external scripts that are ordinarily blocked by noscript, ghostery, etc.
I suspect these can be blocked with a greasemonkey script that redefines document.defaultView.getComputedStyle() and causes it to throw an exception or something (I can't think of a legitimate use of getComputedStyle that I'd care about.) But what about the invisible attacks I still don't know about yet? I guess I'll block them as they come.
If your company is large enough, it can provide a participatory body that's of positive value to the company. Set up an internal corporate wiki, a corporate stackoverflow, a corporate forum, and a corporate blog site. Encourage your employees to spend some time participating in online activities that mutually benefit each other.
Will it be as useful as stack overflow? Probably not, but it may be more specific, and you can discuss company ideas and applications without breaking confidentiality.
happy workers are generally more productive and of greater value to the company
I spotted the problem in your logic above. We're discussing government agencies, not a for-profit company. Governments, as a rule, have always treated their civil servants with the least amount of civility possible. And production apparently never enters into the equation, which is why when on the rare occasion they have enough people to do the job in a timely fashion, they cut the budgets, shed a truckload of them and delays once again become the norm. Standard operating procedures for government agencies of any size, from cities all the way up to nations.
My prediction? Draconian rules will be applied, overall workplace misery will increase, and nothing else will change.
Slashdot Mirror
So what you're saying is that because the thing to measure is way more complex than the simple model beneath it, the whole tool is useless because it can't tell you when it's right and when it's wrong. I'm saying that doesn't make the model useless, because it's representing only the probability that a given subject will have comprehension of a particular text.
I'd like to see it tested and proven or disproven. Draw a fuzzy circle representing actual measured comprehension of a set of texts by a set of students, and another circle representing the readability of those texts as measured by the FKRI. I expect the circles will both be fuzzy and large, but there will be a lot of overlap - enough to make statistically significant predictions. And the FKRI is simple and fast and cheap. It has it's place even if it isn't always right.
What happens if you come across a slug? a fathom? a league? your automatic translation is gonna screw alotta stuff up that wasn't intended.
The "League of Unfathomable Slugs" is complaining that Google has turned them into the "5556 meters of division by zero 14.5939029 kilograms"
In what sense is it a "guideline"? Perfectly clear text can get a poor readability index, incomprehensible text can get good readability.
A reading index is just like a measuring tape. It can't tell you that you built a crappy house with crooked walls and a leaky roof; it can only tell you that something is 40 feet long by 30 feet wide.
A reading index is a tool that simplifies understanding, reducing a very complex thing to a simple number that's useful for comparisons. Just like you can use the measurements of the house to figure out that it's 1,200 square feet, you can compare that to a house that is 2,400 square feet. Neither measurement tells you the quality of the construction, the color, the flooring, the lot size, or the neighborhood. But if you're looking for a home for a family of six, knowing the floor space is one thing that can help weed out the useless candidates quickly. If you're looking for a book for first graders, you don't trot out a book with a reading index of 18.
And claiming it doesn't work on incomprehensible text is like complaining that a measuring tape can't tell you the color of a house. A reading index is not an interpreter of syntax, grammar, spelling, or any other attribute of text. It just measures one simple set of dimensions of text.
A reading scoring system can only give you an indication, not a guarantee, of what kind of audience should be able to comprehend a given piece of text; and it can give you an indication of relative difficulty. For example, the widely used Flesch-Kincaid Readability Index bases its score on the average number of words per sentence and the average number of syllables per word, and outputs a "grade level". The grade levels were probably modeled on the textbooks and lesson books of the era in which it was developed. Is it still relevant? Perhaps the actual grade levels are different these days, but it's still a widely accepted model because it's useful for what it does provide.
It's simple economics. If the cost of problems with annoyed customers remains below the cost of upgrading the system, then they won't upgrade.
Comcast makes no money on the traffic that traverses their network, and has nothing to gain by upgrading except their customers' good will. Since every third post here begins with "Comcrap" or ends with "sucks", I don't think they're too worried about their quality of service image.
Here's the deal breaker for Santa's conspiracy theory: what kind of idiot would locate their service inside this boundary, effectively guaranteeing crappy service to everyone who isn't a Comcast customer? There would have to be a compelling reason that this would improve Comcast's networking business for this theory to be true, and I see nothing compelling about this.
There's a perfectly simple explanation, backed by a mountain of evidence: Comcast is cheap.
What makes Backdoor Santa think this is done to drive service providers to Comcast? Occam's razor has a much simpler explanation: Comcast doesn't want to spend more money upgrading their capacity.
Hell, if I was a service provider I wouldn't consider Comcast after seeing those charts, not with that bad service.
Stargate Universe is boooooring. I blame BSG.
No kidding. Stargate Universe is essentially House + BSG. It's just sad how much the Universe writers shamelessly rip off those two shows.
Actually, I always thought "Stargate Universe == Gilligan's Island + Star Trek: Voyager."
Seriously, all the main tropes originated from Gilligan's Island. Our castaways set sail that day for a three-stargate tour. A three-stargate tour. They get to have weekly guest stars thanks to magic rocks that have them exchanging bodies like the mad scientist episode of Gilligan's Island. They re-invent stuff that the Professor usually made out of split coconuts and bicycle pedals. Col. Young has his naive little buddy Eli and mopes about feeling responsible for stranding them all there.
Unfortunately, it still uses a lot of Star Trek plotions (reverse the cross-coupling power adapters to move all power to the shields!) and Chloe is no Mary Ann.
Of course I still watch the damn show. I have to admit that I really like the utterly amoral character of the Professor ... I mean Dr. Rush.
--
The Ballad of Stargate: Universe
Just sit right back and you'll hear a tale,
A tale of a fateful trip
That started from this secret planet
Through the eponymous plot device.
The mate was a failed Stanford kid,
The Colonel brave and sure.
The VIPs set sail that day
For a three hour tour, a three hour tour.
The bombing started getting rough,
The tiny base was tossed,
If not for the courage of the fearless crew
The civilians would be lost, civilians would be lost.
The ring sent them to a ship out there beyond the Milky way
With the Eli kid
The Colonel too,
The turncoat who screwed his wife.
The porno doc!
The professor and Sgt Greer,
Here on an alien's ship.
So this is the tale of the castaways,
They're here for a long, long time,
They'll have to make the best of things,
It's an uphill climb.
The college kid and the Colonel too,
Will do their very best,
To make the others comfortable,
In the busted ship.
No phone, no lights, no shuttle craft,
Just a thousand Dell PCs,
Like ST:TNG,
As primitive as can be.
So join us here each week my friends,
You're sure to watch them slip,
From all the stranded castaways,
Here on "Alien's Ship."
What I'm saying is that "properly implemented Kerberos" (your words) is a strong assurance, but it is NOT a guarantee of "rock solid". The first four versions of Kerberos all had various weaknesses that weren't discovered until after they were in use.
If Kerberos 5 has an as-yet-undiscovered weakness, it no longer meets the definition of rock solid, and whatever secrets it was protecting may now be exposed at every site relying on it. Do I think V5 has such a weakness? Doubtful, but let me put it this way: I had absolute faith in the security of PGP, which was shattered by the discovery that someone could tack an almost invisible escrow decryption agent into unsigned data attached to someone's public key. Now, I maintain what I consider to be a healthy skepticism in the supposed perfection of any system.
And regardless of the strength of the underlying authenticating technology, I believe proper implementation is a myth. Some sites are very, very good at it today, but reality issues always seem to creep in. Someone outsources someone else's task; and the outgoing employees stop caring, or the incoming contractors never care. Spies break into a factory or two and steal their private CA signing root keys. The offline server is accidentally left online. Joe gets drunk and forgets his keycard in the bar. Or a surrogate Mary McDonnell hooks up with the lead security architect via an XSS hack at match.com and pulls some shenanigans.
Central authentication isn't a panacea, it's just better than anything else we are willing to put up with at the moment.
Having people reinvent it constantly is counterproductive to your goal. What we need are a few people who actually know what they're doing to design it, and for everybody else to use that.
How about Kerberos, versions 1-4? Oh, wait. Bad example.
My point is that MIT has the people who not only know what they're doing, but are the ones who often define the very security practices the rest of us rely on. And even they needed to get to version 5 before they got it right (for current definitions of "right").
I'm certainly not saying that ShmooCMS is going to do a better job than MIT did with kerberos at defining an unhackable protocol. They're not. I am saying to "be mindful of what you rely on", because even the best systems are not likely to remain secure forever.
..the future is the "cloud"?
On what planet?
It's a methane cloud.
You don't even need to register a throwaway address for Hulu or sites like it. Enter bugmenot, savior of the net.
Bugmenot unfortunately lost their courage a few years ago when they changed the way they function. I suspect they were threatened by a lawsuit. Now, any domain or site owner can request that bugmenot exclude their site from participating, and I've found that so many of the popular ones do that it's lost all practical value for me.
I now use mailinator for all my throwaway registrations, then if I care in the least I change the password just in case someone else reads from the same random email name that I did. I usually don't. For more "durable" sites where I'm likely to participate over a longer time, I'll create a unique sneakemail address and keep them around forever. When something like the Gizmodo breach happens I simply flag them as spam, and they plonk all the email from them for me. I've had to do that a couple of times now. I find their service is well worth the $24/year.
Short strings are supposed to be salted anyway.
That doesn't change anything if the algorithm is fast, since the salt is stored _with_ the hash. If you have the hash, you have the salt. Dictionary based means that the _original_ string is looked up in a dictionary.
Salting doesn't change the security of a single hash against brute force attack, but it does change the security of a collection of hashes.
Salt provides a measure of hiding otherwise innocuous collisions. The classic example is a password database. If I enter a password of "asdf" and you enter a password of "asdf", our unsalted hashed values would be identical in the database, where any random admin could spot that they were identical. It's like a poor-man's dictionary attack.
Remember, short strings are inherently more susceptible to collisions than long strings, particularly if they're strings people can choose, and not just random data.
I block ads and trackers everywhere: the mailbox, the do-not-call list, opt-out mailings, heavy use of the DVR 30-second-skip button while watching pre-recorded TV, and of course on the web. But since I read slashdot so regularly I pay them the subscription fee as recompense. I would rather pay them for the valuable service than waste my time and everyone's bandwidth downloading ads that will only serve to annoy me.
To all the sites that think that they're not capturing my valuable opinions on what I find interesting to click on, or what gadgets I hover my mouse pointer over, I'm willing to accept your judgments based on what you've learned from other users via trackers. To sites that want ad revenue from me? Put up a tip jar, or sell site-specific merchandise. That way I can sponsor you directly.
Look, I'm internet savvy and resourceful. I can think for myself. If and when I want some product I will seek it out. None of your "throw your shit in my face" will make me want to buy your product. In fact it alienates me - IOW it has the opposite effect. Get this through your thick skull - people like me who actively use things like AdBlock are not your customers and never will be. We will seek out and buy things using the wonderful internet as a research tool if and when we - not you - determine we need your product. You'd be best to spend your ad dollars on making a stellar product!
Actually, their ad dollars are spent wisely. Merchandisers know that a significant fraction of the public won't listen to them, and that some of us have run eight flavors of ad-block for the past decade. They also know that leaves a significant fraction that will listen to them, so that's who they're targeting. But opt-in just rubs it in the face of those who are susceptible that there are non-gullible people out there, and nobody wants to think of themselves as gullible; so a large number of the susceptible people won't choose to opt-in. Thus, with opt-in ad eyeballs drop, and so do sales.
The thing with advertising is it's damn effective, statistically speaking. Certain kinds of ads resonate with certain kinds of people. I never understood why there was a single person in America who bought anything Billy Mays was pitching, that anyone would watch late-night infomercials, or would read spam, or why the home shopping cable channels even exist. Yet Mays died a very wealthy man, infomercials are on every night, spam is as profitable as ever, and home shopping has been a cable mainstay for at least 30 years. You and I may never understand what drives the kinds of people that watch this nonsense, but advertisers do, and they will continue to try anything and everything to keep hawking their wares.
Cloning the power cells would be interesting, and was the first thing I thought of when I saw it, too. I'm sure they could find the genes to splice to produce the xanthopterin in another organism, such as a conveniently non-flying and non-stinging pine tree. But without the insect's sophisticated chitin structure to collect the energy I suspect much of it would be wasted; and that's only if there's enough light energy to start the reaction at all.
But the thought of hooking electrodes up to a Frankentree and hanging LEDs from the branches just kind of amuses me.
Since xanthopterin converts light directly into electricity, according to the research, what exactly does the wasp do with the electricity produced? Does it directly excite muscles? Is there a tiny capacitor in the abdomen that dumps the energy into pulling the wings down?
Although I'd appreciate a phone that, for once, did the basic things right first. Like with car stereos, I have yet to find a device that does not have one or more major annoyances.
Most phones have those annoyances, but our problem is that we constantly shift expectations of what "the basic things" are. Not long ago, basic meant "voice". So if you go back to basic old Motorola phones, the voice was fine but they had clunky speed dial memory schemes. Fast forward a few years, and we had good voice and contact lists, but SMS was awful. Then came Bluetooth and MP3 players, most of which were slow and/or crashed often, but SMS was improved with T9. Now we have phones that do voice, music, Bluetooth, MMS, etc., but web surfing is awful. Or the walled gardens chafe. Or something else is annoying.
Truly basic phones (large-face screens, number-only buttons, no features to do anything else) sell well with a certain group of people who no longer wish to learn the latest in technology on an annual basis, and they are fine at what they do. But of course that may be "too basic" for average tastes these days.
Only musically ignorant pieces of shit would find a video game of a crazy dead pop star pointless? Therefore you're going to save the world from Monsanto from those of us who aren't murderers??
Wait, what?
Back away from the keyboard, and take a deep breath. Calm. Exhale. Calm.
If you need someone, your friends from the internet are here for you, buddy. Take all the time you want.
I wouldn't write my pirating code based on this just yet. Those are just some "possible" ways, I'm certainly not saying they're the only ways nor even the way this game was protected. They could base protection on any number of other attributes. They could even have a serial read-only chip hidden in their cartridge on a different line that returns a decryption key not ordinarily accessible by flash media addressing schemes.
Seriously, it would work. Issue volunteers over 18 one-shot hand-held tasers. The tasers should scream shrilly when triggered, and spray ink on the hand of the person holding it. But you manufacture only one out of four tasers with an actual firing mechanism and high voltage circuit - the rest are screaming non-functional dummies that weigh the same. Cast the cases out of aluminum and weld them shut at manufacture time. Tumble them all to a common sheen, then add a tamper-evident finish. That way neither employees nor potential terrorists know and can't figure out if they have an effective weapon or not. Batch numbers only - no individual serial numbers on the weapons, but they would have disposable barcode stickers that are required to be collected upon landing from every assigned passenger. The TSA would have a protocol for assigning and collecting the weapons before and after each flight, separate from the airline agents, and would have a testing regime. The passengers would place the holsters in specially designed compartments in the seatback in front of them, and removing them in-flight would sound a local alarm, flash a light over the seat, and alert the crew. Breaking the hermetic inner seal of the protective holster would be a federal offense, and get you detained upon landing.
Anyone who fires their taser in-flight triggers their screamer, and will likely get tased by several nearby passengers, some of whom will likely have working weapons. Upon the first firing, the crew follows lockdown instructions, landing at one of eight nearby airports (selected by ATC) randomly chosen by a simple rock-paper-scissors kind of protocol that prevents any one crew member (or the ATC controller) from influencing the actual destination. Subverting this scheme would require the corruption of the entire flight crew. People whose tasers were discharged would remain in the local airport while the plane resumes its course to its intended destination.
Special requirements: all passenger cabin circuitry would have to be isolated from flight circuitry, so if a bad guy tried to zap his headphone jack, the seat-back TVs, lighting circuits, galley equipment, smoke detectors, or other accessible electronics, it'd just damage the passenger cabin systems. All avionics and control wiring would be enclosed in conduit whenever it passes from nose to tail.
So if a bad guy pulls out some kind of weapon that slipped through the metal detectors, his neighbors zap him. Repeatedly.
The same way they always have for the last 30 years. Bury some code that's supposed to toggle some hardware effect in the cartridge or media, check for the side effect, then crap out if it fails.
Another way is just using attributes of the cartridges against pirates. Copies are often made on read-write media, but legitimate cartridges are read-only. So you have legitimate executable code that says "DO_MUSIC: call PLAY_MUSIC", and you add a statement that says "write to address DO_MUSIC 'call PLAY_VUVUZELA'". A legitimate cartridge can't overwrite the ROM, so it fails, and the call to PLAY_MUSIC remains in place. But on a rewritable cartridge it does overwrite it and zzzzzzzzzzzzzz happens.
Seriously, people would copy a game playing Michael Jackson? Seems like the vuvuzelas are redundant.
That's the problem with Web 2.0. Everything's a script, from pull down menus to "Reply" buttons on blogs. Which of those is random? Which is malicious? Which shouldn't I run?
It's easy to sort out the third-party scripts, and block all but domain originated scripts from the sites you visit. I don't care if CrazyEgg can't tell where I clicked, or if google-adsense fails to rack up another hit, or alexa doesn't count me in the Top 100. But I kind of need the internal site navigation stuff, and a lot of sites use scripts for sorting, comparison shopping, etc. The scripts in TFA are originating at the domain, and are not being served up as external scripts that are ordinarily blocked by noscript, ghostery, etc.
I suspect these can be blocked with a greasemonkey script that redefines document.defaultView.getComputedStyle() and causes it to throw an exception or something (I can't think of a legitimate use of getComputedStyle that I'd care about.) But what about the invisible attacks I still don't know about yet? I guess I'll block them as they come.
The headline didn't even use that word; it used "hi-jacking" (note the hyphen). I was asking what that meant. I've never seen that term before.
It's just editorial hi-jinks, no doubt.
If your company is large enough, it can provide a participatory body that's of positive value to the company. Set up an internal corporate wiki, a corporate stackoverflow, a corporate forum, and a corporate blog site. Encourage your employees to spend some time participating in online activities that mutually benefit each other.
Will it be as useful as stack overflow? Probably not, but it may be more specific, and you can discuss company ideas and applications without breaking confidentiality.
happy workers are generally more productive and of greater value to the company
I spotted the problem in your logic above. We're discussing government agencies, not a for-profit company. Governments, as a rule, have always treated their civil servants with the least amount of civility possible. And production apparently never enters into the equation, which is why when on the rare occasion they have enough people to do the job in a timely fashion, they cut the budgets, shed a truckload of them and delays once again become the norm. Standard operating procedures for government agencies of any size, from cities all the way up to nations.
My prediction? Draconian rules will be applied, overall workplace misery will increase, and nothing else will change.