Not quite. Until the cat-operated remotely-operated opposable thumb device is complete, humans will also be needed to open doors, change TV channels and write lolcat captions. Cats have progressed on the last of those, with the new plug-in for speech recognition devices, but it is limited to the Breaking News section at present.
I'd worry about anyone living in a place with such a weird name, but I think we're basically on the same page and I think we're in agreement that there is no practical reason (cost included) as to why any community, including rural ones, should have poor connectivity.
I'm looking at that picture, particularly North May Road. I'm seeing houses that can be served by communal taps there. Fiber optic =modules= (never mind the rest of the router) can run upwards of $8000 a throw. Buy one for two or three houses and run cheap lines from the communal point, you end up saving a lot of money. Remember, the object is to prove this can be done cheaply. It may not be the best technologically, but if I can halve the costs without impacting bandwidth then my solution is (by definition) twice as cheap.
My claim is that the critics are inflating costs and looking at cases that simply don't exist in nature. Your own photo confirms that, with well-defined groupings and non-random distributions. In that example, I'd probably use the village to the right as one of the points for the outermost ring. The junction of Oak and Center seems a sensible point. For the village, you'd probably want to radiate out with the spokes passing through the middle of each block. A single block is small enough that a single router can run CAT6 to each house within the block and remain well within range. You don't need many villages, or indeed many houses per block, for the savings to significantly offset the cost of such a project.
For the more isolated dwellings, as I said, two or three are usually within 200' of a central point where you could have a communal tap.
Again, it's not the technologically ideal solution, but it's cheap enough that the claim that it's financially impossible is falsified.
To defuse the tensions, I'll agree to a communications breakdown and we can ignore the blame game. Unless you want to blame Microsoft, I'll go with that.
Fibre to each house, although technologically the best solution, is problematic. Fibre-capable routers cost money. The best compromise is to have fibre to as few houses as you can absolutely get away with (which will be all farmhouses, some McMansions and isolates) and then have communal taps wherever two or more end-points are going to be within range of a cheaper option.
Even when you have fibre running to a house, not many computers will have fibre-capable network cards and you really don't want multiple fibre-capable routers inside. So the inside will have to be CAT6 and therefore the ports from the router to the inside will all have to be CAT6. As far as the house is concerned, it's getting one or more CAT6 lines and it doesn't see anything beyond that point.
Then I will paraphrase what I've said across the posts.
First, plot the rural end-points.
Second, group them such that each group can be fitted to a line, curve or elipse, such that the distance required to build a spanning tree* between the groups plus the sum of the length of the groups is minimal AND the shortest distance from the line, curve or elipse to any given point within the group is minimized.
Third, fill out your spanning tree and groups with fibre at a depth at which ground temperatures will remain relatively uniform OR providing the fibre with a jacket such that the temperature variation is kept to a minimum.
Fourth, run fibre from the nearest dark fibre to the closest point in the spanning tree*.
Finally, where distances lie within the range of CAT6 (and if you've fitted those shapes correctly they damn well all aught to be), run CAT6 from the nearest point in the appropriate group to the location. You may well be able to get multiple locations off a single fibre tap in most village settings. Individual farmhouses will probably end up being one tap per house.
You now have CAT6 to each house and not have to run it rural distances. Whoopee. And all with your standard A-level plotting functions, some SIMPLEX and the knowledge that rural buildings aren't randomly distributed but are almost invariably on an extremely basic pattern.
The myth of the expensive rural network comes from the idea that you have to allow for randomly-placed buildings, maximizing the overall distances and maximizing the joins in the topology. That simply never happens. The pattern may be based on the geography (the norm for farming communities, since it's cheaper to build on flat land than on the side of a steep slope), it may be based on grids, and in the case of intelligent villages, it may be based around some central point. You can ALWAYS exploit these patterns.
*In some cases, such as running lines up river or glacial valleys, you may want to break with the strict tree topology and opt for a graph. It adds redundancy, reduces latency and does so at not a whole lot of overhead.
Look, it's quite simple. I said nothing in my original post about running CAT6 across rural distances and made it explicit in my follow-up that you'd use fibre for the long-distance (including "last mile") and CAT6 only at the last moment (since routers that support fibre are generally expensive, so you don't want more of them than necessary). In rural towns and villages you find buildings next to each other. Why have fibre to both when you can have fibre to the midpoint between them and 50' at absolute worst of CAT6 to each?
Why are you insisting on picking interpretations that clearly don't make sense when I've already stated that a solution exists? If a solution exists, then stop and think about what that solution might be rather than yammering on about a flawed understanding you have for which NO solution exists? This isn't rocket science. If you are asked to solve for X, then don't go telling me what's wrong with solving for Y. You're not asked to solve for Y.
I'll leave you to re-read the bit about dark fibre. And then look for the bit in my original post about running CAT6 across rural distances (amazingly, you won't find it). And then I expect you to say something sensible.
Quite possibly on the lone programmer, almost certainly on the code review. The NSA has some nice whitepapers on how to prevent SQL injection attacks, though they could really be summarized as "follow parent post's advice".
I've probably lived in more rural communities in more countries than you could shake a stick at, so cut the wise-ass remarks. If I say I know damn well that you can get CAT6 to people's houses, then I suggest you start by asking how, not telling me that it can't be done. I won't say the problem's not solvable unless I've actually done the work to know it is solvable and have the engineering skills to know what the limits of theory are in practice. The people who get things done are not the ones who say it can't be done. The ones who get things done are the ones who establish IF, WHEN and HOW -- questions you utterly fail to ask.
If you haven't asked those questions for each and every damn article you read and each and every post you reply to, you have failed.
There is, as other posters have noted, plenty of dark fibre. Communities, ESPECIALLY rural ones (and my mother's side comes from North Dakota, so I know how rural things get), have a central point. They're not randomly dotted around.
Option 1: For a close community, you find a central point and run a tap from the nearest dark fibre to that point. That gives you a rural hub to run from. Option 2: You run a ring of fibre round the community, again running a tap from the nearest pre-existing dark, with branches as necessary. Use a curve-fitting algorithm for different groups of locations. You'll end up with everything inside CAT6 range. Option 3: For simple street-based communities, run fibre along the street and have a switch convert to CAT6 every N houses the way cable does.
Where new fibre is being run in areas (such as North Dakota) where temperatures can vary wildly, either run the lines about 5-6 inches below the ground (where temperatures will remain essentially constant) or jacket the damn thing.
You are absolutely correct and I'd extend that to say that since we don't know if the attackers were able to obtain the master signing key or not (that key was not amongst the revoked), the risks caused by the embargo could be far worse than is currently known.
Well, if home sites used a web proxy cache (eg: Squid) and sites didn't rely on massive amounts of bandwidth, we'd not have that problem.
Also, if wireless routers used directional aerials once a connection had been established, you'd have less risk of interference between devices and therefore more bandwidth available (since there'd be less sharing). In fact, you could probably get away with just having a bunch of fixed-position loop aerials (12 should be sufficient) and scrap the omnidirectional reception altogether. A docecahedron would look cooler, too.
Wireless is also overused, which is why the lack of security on it matters so much. Despite what the naysayers may claim, even in rural areas in the US it would not cost that much to have CAT6 to each house, and at that point no more expensive to run it through the house than it is to run cable.
The extent of the problem is surely a matter of whether the signing key was obtained or not. If the attackers obtained that, then revoking the certs issued on the CA's computer are almost immaterial as the attacker can continue issuing certs on their own computer. Gah, this is such a mess.
This has been debated endless times, as to when it is best to reveal that a vulnerability exists, with one camp arguing that it's best to delay announcements until there is no risk that the announcement will increase the degree of exploitation, and the other arguing that unannounced exploits are ALWAYS a danger, that you should not assume that those who are potential threats are ignorant simply because the users are.
As you can probably gather, I tend to be in the latter group. It doesn't take a child long to figure out that whether they can see you has no bearing on whether you can see them. Why it takes security experts well into their adulthood to figure that out (and some never do) is beyond me.
Few things that are supposed to be "human condition" really are. That's usually just an excuse to not dig deeper. In this case, Mozilla happened to "err" on the side of non-disclosure just about the time it was releasing a new browser and really didn't need people mistaking the messenger for the message. Far better to let people worry about the security of other browsers.
Even the official comments will have disclaimers. I'm surprised the disclaimers don't have disclaimers. Not because I'm "for" one side or the other, but because I know that companies are risk-averse and lawyers like to add stuff they can charge for later.
If they're going to have the data, then it damn well had best be secure by law for precisely that reason. I don't give a rat's ass if the database gets pwnd by someone if it's encrypted and the carrier only has half the decryption key (the other half being sealed so that the carrier can't access the data except under court order or by DPA request), provided the key is long enough. What good is an encrypted database to a thief?
(The great thing about PKI is that you can encrypt data without being able to then decrypt it. The carrier has no need to have read access, for the most part, so write-only privs is fine.)
It's how the CIA were found kidnapping people in Italy. They'd been traced througout all of Europe by means of their cell-phones. This was public knowledge at the time of the Italian government complaints, it was public knowledge at the time that the police wanted easier access to reduce both governmental and non-governmental kidnaps, why the surprise now?
I'm not keen on the idea, but damnit the CIA example does illustrate that it may be a necessary tool for protection against governmental abuses. I'd argue that if that line is accepted, then the information should be stored in a manner that prevents access outside of a lawful enquiry authorized by a recognized court or a lawful query by the monitored individual as per the European data protection standards. How you'd enforce that is difficult.
First off, you want access to Google Earth and survey the terrain for any vegetation bands that indicate a subsurface anomaly. If the crater is too small for Google Earth's resolution, then use a weather balloon and a camera. If there's no vegetation, or it's too thin to show anomalies up, try a camera that can see into the infrared and take the picture at dusk. The difference in subsurface features will produce a difference in heat output.
That tells you where a crater is and which direction it is facing, therefore it will tell you which direction the ellipse for the strewn field will need to point.
A magnetometer is probably a better bet than GPR (which they've tried in the past without much luck). Combine it with a resistivity meter. Meteorites all contain iron AND nickel (and other trace elements). By knowing the resistivity, you can distinguish a meteorite from any other type of iron. Depending on the age of the impact and climate, you may also be able to detect debris from how it has altered soil chemistry via this method.
For the magnetometer, you want a proton magnetometer/gradiometer, as that's the most sensitive. The link is to a site on how to build one.
They have the world's largest metal detector, but you should be able to make one larger. Furthermore, it's a loop so it is detecting metal above the detector as well as in the ground. What you ACTUALLY want is for the detector to only look at the ground. A suitable reflector should not only achieve this but double the sensitivity at the same time.
There was a time, not that long ago, when someone faxed Verisign a request for the private keys for Microsoft's SSL certificates and Verisign responded by handing the keys to them. No verification that the person was legit. DNS providers were just as vulnerable, with people sending in requests for zone transfers by e-mails with forged headers, faxes, letters on stationary not bearing any corporate logo. It worked often enough for there to be numerous scandals.
As for China managing to trick the top-tier routers to re-route half the world's Internet through their packet sniffers... Well, I never was a fan of BGP, and I've grown to loath it all the more.
Getting back to SSL, first nobody should be using SSL 3.0 any more. TLS 1.2 is the current standard and has signficant improvements. Sadly, none that would install a brain into the heads of PHBs or half-asleep cert techs, but it's better than nothing.
Second, let's look at how other people solve this problem. In the physical world, official documents to do with identity usually require at least one witness to countersign and a recognized notary office to stamp the document to reduce the risk of tampering. In the GnuPG/PGP world, it is not unusual to have keys digitally signed by "witnesses" and GnuPG uses an algorithm to reduce the risk of tampering. So clearly, these kinds of procedures have a digital parallel in use.
How would this work in SSL? Well, you could have it so that if organization A knows that organization B's certificate is genuine and correct, organization A could counter-sign B's SSL/TLS certificate as an extra layer of trust. (If a fake Google certificate had a few dozen counter-signatures, all from Iran, it shouldn't be hard to figure out it's fake.)
Or there could be secure public fingerprint servers, where instead of a simple upload (as per MIT's keyserver), the verification of identity by the keyserver owners was every bit as strict as implied by the certificate grade. The cert fingerprint would then be uploaded by the owners and digitally signed by them. A browser, on seeing a new key, could then ask if you wanted to verify the key against one of the known public fingerprint servers rather than giving a technical analysis most users can't understand.
Or we could dump the SSL/TLS approach and go with a different site authentication mechanism. It's not like there's a shortage of them, it's more that Netscape implemented SSL and so nobody really bothered with trying to adapt the others. (Ok, there was a short-lived SHTTP, in addition to HTTPS, but I can't think of any other real effort for website authentication since then. Site-to-host authentication should be standard for all services, since the connection has nothing to do with the service, it's just a connection between a site and a host.)
Slashdot Mirror
Not quite. Until the cat-operated remotely-operated opposable thumb device is complete, humans will also be needed to open doors, change TV channels and write lolcat captions. Cats have progressed on the last of those, with the new plug-in for speech recognition devices, but it is limited to the Breaking News section at present.
I'd worry about anyone living in a place with such a weird name, but I think we're basically on the same page and I think we're in agreement that there is no practical reason (cost included) as to why any community, including rural ones, should have poor connectivity.
I'm looking at that picture, particularly North May Road. I'm seeing houses that can be served by communal taps there. Fiber optic =modules= (never mind the rest of the router) can run upwards of $8000 a throw. Buy one for two or three houses and run cheap lines from the communal point, you end up saving a lot of money. Remember, the object is to prove this can be done cheaply. It may not be the best technologically, but if I can halve the costs without impacting bandwidth then my solution is (by definition) twice as cheap.
My claim is that the critics are inflating costs and looking at cases that simply don't exist in nature. Your own photo confirms that, with well-defined groupings and non-random distributions. In that example, I'd probably use the village to the right as one of the points for the outermost ring. The junction of Oak and Center seems a sensible point. For the village, you'd probably want to radiate out with the spokes passing through the middle of each block. A single block is small enough that a single router can run CAT6 to each house within the block and remain well within range. You don't need many villages, or indeed many houses per block, for the savings to significantly offset the cost of such a project.
For the more isolated dwellings, as I said, two or three are usually within 200' of a central point where you could have a communal tap.
Again, it's not the technologically ideal solution, but it's cheap enough that the claim that it's financially impossible is falsified.
To defuse the tensions, I'll agree to a communications breakdown and we can ignore the blame game. Unless you want to blame Microsoft, I'll go with that.
Fibre to each house, although technologically the best solution, is problematic. Fibre-capable routers cost money. The best compromise is to have fibre to as few houses as you can absolutely get away with (which will be all farmhouses, some McMansions and isolates) and then have communal taps wherever two or more end-points are going to be within range of a cheaper option.
Even when you have fibre running to a house, not many computers will have fibre-capable network cards and you really don't want multiple fibre-capable routers inside. So the inside will have to be CAT6 and therefore the ports from the router to the inside will all have to be CAT6. As far as the house is concerned, it's getting one or more CAT6 lines and it doesn't see anything beyond that point.
Then I will paraphrase what I've said across the posts.
First, plot the rural end-points.
Second, group them such that each group can be fitted to a line, curve or elipse, such that the distance required to build a spanning tree* between the groups plus the sum of the length of the groups is minimal AND the shortest distance from the line, curve or elipse to any given point within the group is minimized.
Third, fill out your spanning tree and groups with fibre at a depth at which ground temperatures will remain relatively uniform OR providing the fibre with a jacket such that the temperature variation is kept to a minimum.
Fourth, run fibre from the nearest dark fibre to the closest point in the spanning tree*.
Finally, where distances lie within the range of CAT6 (and if you've fitted those shapes correctly they damn well all aught to be), run CAT6 from the nearest point in the appropriate group to the location. You may well be able to get multiple locations off a single fibre tap in most village settings. Individual farmhouses will probably end up being one tap per house.
You now have CAT6 to each house and not have to run it rural distances. Whoopee. And all with your standard A-level plotting functions, some SIMPLEX and the knowledge that rural buildings aren't randomly distributed but are almost invariably on an extremely basic pattern.
The myth of the expensive rural network comes from the idea that you have to allow for randomly-placed buildings, maximizing the overall distances and maximizing the joins in the topology. That simply never happens. The pattern may be based on the geography (the norm for farming communities, since it's cheaper to build on flat land than on the side of a steep slope), it may be based on grids, and in the case of intelligent villages, it may be based around some central point. You can ALWAYS exploit these patterns.
*In some cases, such as running lines up river or glacial valleys, you may want to break with the strict tree topology and opt for a graph. It adds redundancy, reduces latency and does so at not a whole lot of overhead.
Look, it's quite simple. I said nothing in my original post about running CAT6 across rural distances and made it explicit in my follow-up that you'd use fibre for the long-distance (including "last mile") and CAT6 only at the last moment (since routers that support fibre are generally expensive, so you don't want more of them than necessary). In rural towns and villages you find buildings next to each other. Why have fibre to both when you can have fibre to the midpoint between them and 50' at absolute worst of CAT6 to each?
Why are you insisting on picking interpretations that clearly don't make sense when I've already stated that a solution exists? If a solution exists, then stop and think about what that solution might be rather than yammering on about a flawed understanding you have for which NO solution exists? This isn't rocket science. If you are asked to solve for X, then don't go telling me what's wrong with solving for Y. You're not asked to solve for Y.
I'll leave you to re-read the bit about dark fibre. And then look for the bit in my original post about running CAT6 across rural distances (amazingly, you won't find it). And then I expect you to say something sensible.
Quite possibly on the lone programmer, almost certainly on the code review. The NSA has some nice whitepapers on how to prevent SQL injection attacks, though they could really be summarized as "follow parent post's advice".
I've probably lived in more rural communities in more countries than you could shake a stick at, so cut the wise-ass remarks. If I say I know damn well that you can get CAT6 to people's houses, then I suggest you start by asking how, not telling me that it can't be done. I won't say the problem's not solvable unless I've actually done the work to know it is solvable and have the engineering skills to know what the limits of theory are in practice. The people who get things done are not the ones who say it can't be done. The ones who get things done are the ones who establish IF, WHEN and HOW -- questions you utterly fail to ask.
If you haven't asked those questions for each and every damn article you read and each and every post you reply to, you have failed.
There is, as other posters have noted, plenty of dark fibre. Communities, ESPECIALLY rural ones (and my mother's side comes from North Dakota, so I know how rural things get), have a central point. They're not randomly dotted around.
Option 1: For a close community, you find a central point and run a tap from the nearest dark fibre to that point. That gives you a rural hub to run from.
Option 2: You run a ring of fibre round the community, again running a tap from the nearest pre-existing dark, with branches as necessary. Use a curve-fitting algorithm for different groups of locations. You'll end up with everything inside CAT6 range.
Option 3: For simple street-based communities, run fibre along the street and have a switch convert to CAT6 every N houses the way cable does.
Where new fibre is being run in areas (such as North Dakota) where temperatures can vary wildly, either run the lines about 5-6 inches below the ground (where temperatures will remain essentially constant) or jacket the damn thing.
You are absolutely correct and I'd extend that to say that since we don't know if the attackers were able to obtain the master signing key or not (that key was not amongst the revoked), the risks caused by the embargo could be far worse than is currently known.
Well, if home sites used a web proxy cache (eg: Squid) and sites didn't rely on massive amounts of bandwidth, we'd not have that problem.
Also, if wireless routers used directional aerials once a connection had been established, you'd have less risk of interference between devices and therefore more bandwidth available (since there'd be less sharing). In fact, you could probably get away with just having a bunch of fixed-position loop aerials (12 should be sufficient) and scrap the omnidirectional reception altogether. A docecahedron would look cooler, too.
Wireless is also overused, which is why the lack of security on it matters so much. Despite what the naysayers may claim, even in rural areas in the US it would not cost that much to have CAT6 to each house, and at that point no more expensive to run it through the house than it is to run cable.
The extent of the problem is surely a matter of whether the signing key was obtained or not. If the attackers obtained that, then revoking the certs issued on the CA's computer are almost immaterial as the attacker can continue issuing certs on their own computer. Gah, this is such a mess.
This has been debated endless times, as to when it is best to reveal that a vulnerability exists, with one camp arguing that it's best to delay announcements until there is no risk that the announcement will increase the degree of exploitation, and the other arguing that unannounced exploits are ALWAYS a danger, that you should not assume that those who are potential threats are ignorant simply because the users are.
As you can probably gather, I tend to be in the latter group. It doesn't take a child long to figure out that whether they can see you has no bearing on whether you can see them. Why it takes security experts well into their adulthood to figure that out (and some never do) is beyond me.
Few things that are supposed to be "human condition" really are. That's usually just an excuse to not dig deeper. In this case, Mozilla happened to "err" on the side of non-disclosure just about the time it was releasing a new browser and really didn't need people mistaking the messenger for the message. Far better to let people worry about the security of other browsers.
Elastons are the "new thing" in computer graphics, so a benchmark that involves running the software used to create the APS' video would seem "fair".
Even the official comments will have disclaimers. I'm surprised the disclaimers don't have disclaimers. Not because I'm "for" one side or the other, but because I know that companies are risk-averse and lawyers like to add stuff they can charge for later.
If they're going to have the data, then it damn well had best be secure by law for precisely that reason. I don't give a rat's ass if the database gets pwnd by someone if it's encrypted and the carrier only has half the decryption key (the other half being sealed so that the carrier can't access the data except under court order or by DPA request), provided the key is long enough. What good is an encrypted database to a thief?
(The great thing about PKI is that you can encrypt data without being able to then decrypt it. The carrier has no need to have read access, for the most part, so write-only privs is fine.)
It's how the CIA were found kidnapping people in Italy. They'd been traced througout all of Europe by means of their cell-phones. This was public knowledge at the time of the Italian government complaints, it was public knowledge at the time that the police wanted easier access to reduce both governmental and non-governmental kidnaps, why the surprise now?
I'm not keen on the idea, but damnit the CIA example does illustrate that it may be a necessary tool for protection against governmental abuses. I'd argue that if that line is accepted, then the information should be stored in a manner that prevents access outside of a lawful enquiry authorized by a recognized court or a lawful query by the monitored individual as per the European data protection standards. How you'd enforce that is difficult.
Damn, the computer mis-moderated, so I'm going to have to cancel the mod with a post. That's a brilliant overview!
That'll work. Thanks for the added info!
Well, crypto is still regarded as munitions. Perhaps Microsoft is going to use this to say "we're not breaking the arms embargo but Firefox is"?
Maybe neo00's family gets very passionate about their secret apple pie recipes.
First off, you want access to Google Earth and survey the terrain for any vegetation bands that indicate a subsurface anomaly. If the crater is too small for Google Earth's resolution, then use a weather balloon and a camera. If there's no vegetation, or it's too thin to show anomalies up, try a camera that can see into the infrared and take the picture at dusk. The difference in subsurface features will produce a difference in heat output.
That tells you where a crater is and which direction it is facing, therefore it will tell you which direction the ellipse for the strewn field will need to point.
A magnetometer is probably a better bet than GPR (which they've tried in the past without much luck). Combine it with a resistivity meter. Meteorites all contain iron AND nickel (and other trace elements). By knowing the resistivity, you can distinguish a meteorite from any other type of iron. Depending on the age of the impact and climate, you may also be able to detect debris from how it has altered soil chemistry via this method.
For the magnetometer, you want a proton magnetometer/gradiometer, as that's the most sensitive. The link is to a site on how to build one.
They have the world's largest metal detector, but you should be able to make one larger. Furthermore, it's a loop so it is detecting metal above the detector as well as in the ground. What you ACTUALLY want is for the detector to only look at the ground. A suitable reflector should not only achieve this but double the sensitivity at the same time.
There was a time, not that long ago, when someone faxed Verisign a request for the private keys for Microsoft's SSL certificates and Verisign responded by handing the keys to them. No verification that the person was legit. DNS providers were just as vulnerable, with people sending in requests for zone transfers by e-mails with forged headers, faxes, letters on stationary not bearing any corporate logo. It worked often enough for there to be numerous scandals.
As for China managing to trick the top-tier routers to re-route half the world's Internet through their packet sniffers... Well, I never was a fan of BGP, and I've grown to loath it all the more.
Getting back to SSL, first nobody should be using SSL 3.0 any more. TLS 1.2 is the current standard and has signficant improvements. Sadly, none that would install a brain into the heads of PHBs or half-asleep cert techs, but it's better than nothing.
Second, let's look at how other people solve this problem. In the physical world, official documents to do with identity usually require at least one witness to countersign and a recognized notary office to stamp the document to reduce the risk of tampering. In the GnuPG/PGP world, it is not unusual to have keys digitally signed by "witnesses" and GnuPG uses an algorithm to reduce the risk of tampering. So clearly, these kinds of procedures have a digital parallel in use.
How would this work in SSL? Well, you could have it so that if organization A knows that organization B's certificate is genuine and correct, organization A could counter-sign B's SSL/TLS certificate as an extra layer of trust. (If a fake Google certificate had a few dozen counter-signatures, all from Iran, it shouldn't be hard to figure out it's fake.)
Or there could be secure public fingerprint servers, where instead of a simple upload (as per MIT's keyserver), the verification of identity by the keyserver owners was every bit as strict as implied by the certificate grade. The cert fingerprint would then be uploaded by the owners and digitally signed by them. A browser, on seeing a new key, could then ask if you wanted to verify the key against one of the known public fingerprint servers rather than giving a technical analysis most users can't understand.
Or we could dump the SSL/TLS approach and go with a different site authentication mechanism. It's not like there's a shortage of them, it's more that Netscape implemented SSL and so nobody really bothered with trying to adapt the others. (Ok, there was a short-lived SHTTP, in addition to HTTPS, but I can't think of any other real effort for website authentication since then. Site-to-host authentication should be standard for all services, since the connection has nothing to do with the service, it's just a connection between a site and a host.)