If anyone, you should know that there may well be a reason to "cripple" hardware despite its possible ability to function at higher spec. CPUs and graphics card anyone? What happens when an i7 CPU doesn't quite pass the QA tests? Switch off the cores that didn't pass and sell it as an i3. How many here have "unlocked" cores of cheap CPUs to turn it into a more powerful one? Do you think Intel does that because they enjoy making CPUs then sell them cheaply with some cores switched off for... reasons? Or could it rather be that they switch off the cores because they fail inspection and can't be relied on, and it's still more interesting for Intel to sell it at a lower price than to throw it away?
I could imagine the same applies to other hardware.
A certificate that doesn't match the page it is supposedly for or a self signed certificate that isn't part of the browsers trust chain is already detected and reported, what's the news?
If people really gave a shit about it, they already could. It is already very possible, with every browser out there, to identify broken certificate chains and bogus certificates. Every single browser out there first displays a "this connection is not secure" warning. Chrome adds a red URL bar with a big, red "NOT SECURE!" next to it.
You know what really bugged me to no end? That the only thing HSTS added to the mix was that people are now complaining about a page not letting them in because "something is broken in the browser". And they want to do that away. And if you try to explain, what you get is a "hey, what do you want, it's encrypted so it's safe, just get rid of that certifithingamajig there."
You forgot to remove a feature people actually used and replace it with some stupid gimmick nobody asked for to give tech journalists something to write about.
Hopefully not. Because then all they have to do is beat you senseless, unlock your phone by pointing it at your unconscious face and deactivate the facial recognition feature to take it home.
Gee, and I thought the fingerprint sensor was easy to fool. Had I known Apple would give phone thieves a better feature just one generation later, I wouldn't have invested the effort to develop something.
Popularity can also be a flash in the pan. Ruby, anyone? How about Rust? Is Go still going or can we add it to the pile of "once been hip" languages?
Python suffers from a very, very serious problem when it comes to long term popularity: Code longevity. Ponder for a moment what kind of stuff you code in Python. Code that you refine and improve over time? Or is it more your tool to whip something together on the spot?
Then tell me what interest the Russian government has in my computer. If I was a citizen of Russia, I sure as hell would avoid it like the plague, but then again, as a US citizen I'd avoid any and all AV software based in the US as well.
Consider: There might be someone sitting right now in a museum making a copy of an old Babylonian stone tablet to preserve it. But when was the last time you've seen someone even touch a floppy?
Actually, it does. Or rather, it makes an auditor and a security expert with cushy jobs look for a new one. And thus they'll both do what's necessary to keep this from happening. If they're smart, at least.
We have PCI-DSS for companies that deal with credit card information. Why not for companies that store even more sensitive information that potentially allows a criminal to pretty much take over my life by essentially stealing my identity?
The damage here is way more serious than ANYTHING the loss of a million credit card numbers could mean. Could it be that it's just us that have to foot the bill instead of Visa and Mastercard?
No, that can't be. Government represents the people, right?
Fuckers, I hope some Supreme Court judge alongside of a few congresscritters get hit badly with this breach. I usually don't wish bad things to happen to anyone, but I really hope that one of them has their identity stolen, their credit rating trashed and their life basically ruined by this hack.
Because ONLY then we'll FINALLY see something happen.
Slashdot Mirror
If anyone, you should know that there may well be a reason to "cripple" hardware despite its possible ability to function at higher spec. CPUs and graphics card anyone? What happens when an i7 CPU doesn't quite pass the QA tests? Switch off the cores that didn't pass and sell it as an i3. How many here have "unlocked" cores of cheap CPUs to turn it into a more powerful one? Do you think Intel does that because they enjoy making CPUs then sell them cheaply with some cores switched off for ... reasons? Or could it rather be that they switch off the cores because they fail inspection and can't be relied on, and it's still more interesting for Intel to sell it at a lower price than to throw it away?
I could imagine the same applies to other hardware.
A certificate that doesn't match the page it is supposedly for or a self signed certificate that isn't part of the browsers trust chain is already detected and reported, what's the news?
If browsers complained about SSL errors, questionable, dated ciphers and odd configurations, a lot of pages would be considered "insecure".
Want proof? Take your favorite webpage and get a report from SSLlabs about it. And if you want more, throw the page against Securityheaders, too.
If you don't mind losing some sleep, try it with your favorite online banking page.
If people really gave a shit about it, they already could. It is already very possible, with every browser out there, to identify broken certificate chains and bogus certificates. Every single browser out there first displays a "this connection is not secure" warning. Chrome adds a red URL bar with a big, red "NOT SECURE!" next to it.
You know what really bugged me to no end? That the only thing HSTS added to the mix was that people are now complaining about a page not letting them in because "something is broken in the browser". And they want to do that away. And if you try to explain, what you get is a "hey, what do you want, it's encrypted so it's safe, just get rid of that certifithingamajig there."
You cannot fix stupid.
You forgot to remove a feature people actually used and replace it with some stupid gimmick nobody asked for to give tech journalists something to write about.
By making a case that has a hole in the relevant spot. Duh.
Hopefully not. Because then all they have to do is beat you senseless, unlock your phone by pointing it at your unconscious face and deactivate the facial recognition feature to take it home.
Gee, and I thought the fingerprint sensor was easy to fool. Had I known Apple would give phone thieves a better feature just one generation later, I wouldn't have invested the effort to develop something.
Get a job, get a boss, there you go.
#whitespacesmatter
That cannot be compatible with the 8th.
Popularity can also be a flash in the pan. Ruby, anyone? How about Rust? Is Go still going or can we add it to the pile of "once been hip" languages?
Python suffers from a very, very serious problem when it comes to long term popularity: Code longevity. Ponder for a moment what kind of stuff you code in Python. Code that you refine and improve over time? Or is it more your tool to whip something together on the spot?
You know, the kind that a few friends with lead pipes can fix quickly and with a lasting effect.
What is this Best Buy and why is it considered a story when they sell or don't sell something?
Is there really someone left who buys software offline?
Lies! All lies!
At least if you ask a Pole or a Finn.
Then tell me what interest the Russian government has in my computer. If I was a citizen of Russia, I sure as hell would avoid it like the plague, but then again, as a US citizen I'd avoid any and all AV software based in the US as well.
This works as long as you only have computer savvy users that do not have to deal with potentially infected files on a daily base.
I do not want to see the HR department that runs without antivirus.
I wouldn't be so sure about this.
Consider: There might be someone sitting right now in a museum making a copy of an old Babylonian stone tablet to preserve it. But when was the last time you've seen someone even touch a floppy?
Well, it's endorsed by the NSA.... by saying they don't like it.
And it's only twice as expensive.
McAfee is good enough for a racket. It comes in a nice looking box.
Spending lots of bucks to get what you have for free in every other contemporary phone.
Now I'm curious. Could you name one such practice that was PCI compliant? And (also important), when was it compliant?
Well, if you word it like this, I can see the merit of an otherwise ludicrous idea...
Actually, it does. Or rather, it makes an auditor and a security expert with cushy jobs look for a new one. And thus they'll both do what's necessary to keep this from happening. If they're smart, at least.
We have PCI-DSS for companies that deal with credit card information. Why not for companies that store even more sensitive information that potentially allows a criminal to pretty much take over my life by essentially stealing my identity?
The damage here is way more serious than ANYTHING the loss of a million credit card numbers could mean. Could it be that it's just us that have to foot the bill instead of Visa and Mastercard?
No, that can't be. Government represents the people, right?
Fuckers, I hope some Supreme Court judge alongside of a few congresscritters get hit badly with this breach. I usually don't wish bad things to happen to anyone, but I really hope that one of them has their identity stolen, their credit rating trashed and their life basically ruined by this hack.
Because ONLY then we'll FINALLY see something happen.