If you look you will find that pretty much every bank has RC4 as their top cipher in the list. This is due to the fact that, while relatively weak, there are no known attacks against the cipher itself (other than brute force).
As has been mentioned before in this thread, use the Let's Encrypt protocol to get a publicly valid cert for free, set up your own internal CA or just use self signed certs... not hard.
I am sure that most governments have at least once CA in their pocket these days.
And, really, no matter what system is in place, governments will always have wire-level access and all kinds of backdoor agreements with manufacturers.
This move is not intended to curb government surveillance though (although it does add at least one more barrier to the process).
The first step toward a more secure system is to get rid of the insecure parts.
Anyway, I am pretty sure the HTTP 2.0 standard is going to be secure by default so this is just getting ahead of the ball.
Great that they are thinking about security on the device long before they are implemented... but, I would think that it would be way more important to think about the connection these things are communicating over first...
Seems to me that battlefield and rural areas would have the least reliable network connection possible. I would think that the bar would need to be raised in this area before SURGERY could be accomplished.
I have been saying this for years and I almost believe it myself now.
The fact is, I have biases and these biases shift over time.
I always tell myself that I am giving people the best advice I can, but upon self analysis, I hardly ever recommend MACs to people because I just sort of don't like Apple because of encounters I have had over the years with zealot fanboys. I sort of have the same feelings toward Cisco.... every Cisco tech I have ever met looked down their nose at me... for that reason I normally deploy Adtran, HP or SonicWALL.
I guess my point is that we all like to think that we are being unbiased and use the tools that work best, but my feeling is that most people just end up using the tools they are most comfortable with and carry stories that help justify their decisions.
I really don't think that it is drugs that "turn a large majority of their users into slobbering idiots", this attitude is part of the problem.
I think that drugs are a side effect of a larger more fundamental issue in those people's lives. I mean, who doesn't like feeling good? Drugs can make you feel really, really good.
I think it is just that most people don't know how to talk about drugs because they can't, we don't let them. What they are going through is outside the experience of non-drug users and furthermore we are taught to demonize them because "drugs are bad, mmmmmkay?.
Drug users have to hide their use from everyone except the people that are doing it with them.
You get an echo chamber effect and bad decisions are cascaded because there is no voice of reason any more, just voices of contempt and disgust coming from the communities outside.
It was the cheaper consumer models that were affected. Retail profit margins are so thin that manufacturers and retailers make up for it with preloaded crapware.
This may have been true at one time, but I don't think it is the case any longer. I think that the ubiquity of cheap components and the falling price of Windows for OEMs, the profit margins have been steadily increasing over the years.
I think it is just that OEMs have become dependent on the revenue stream they get from app developers who want their software included in the base image.
Slashdot Mirror
This is exactly what the Let's Encrypt standard will do.
If you look you will find that pretty much every bank has RC4 as their top cipher in the list. This is due to the fact that, while relatively weak, there are no known attacks against the cipher itself (other than brute force).
As has been mentioned before in this thread, use the Let's Encrypt protocol to get a publicly valid cert for free, set up your own internal CA or just use self signed certs... not hard.
This is really a separate issue though.
I am sure that most governments have at least once CA in their pocket these days.
And, really, no matter what system is in place, governments will always have wire-level access and all kinds of backdoor agreements with manufacturers.
This move is not intended to curb government surveillance though (although it does add at least one more barrier to the process).
The first step toward a more secure system is to get rid of the insecure parts.
Anyway, I am pretty sure the HTTP 2.0 standard is going to be secure by default so this is just getting ahead of the ball.
This for sure.
It is seen time-and-again, candidate promises x, y and z and delivers nothing but the same old crap then blames gridlock and infighting as the cause.
I get the sense, more and more, that political theatre is more script than actual debate.
Great that they are thinking about security on the device long before they are implemented... but, I would think that it would be way more important to think about the connection these things are communicating over first...
Seems to me that battlefield and rural areas would have the least reliable network connection possible. I would think that the bar would need to be raised in this area before SURGERY could be accomplished.
2+2=5
I am with you.
I really feel that by making drugs illegal and taboo we make it
These points alone play a big part in setting some people on to a dark path.
You understood the message he was trying to convey didn't you?
I don't believe in these mythical "progressives" and "conservatives" you speak of.
People are just people... they are a mixture of all ideologies.
The fact that you regurgitate this rhetoric would imply that you are in an echo chamber much like the ones you rail against.
Yep... exploiting loopholes... nothing more Mercan than that!
I have been saying this for years and I almost believe it myself now.
The fact is, I have biases and these biases shift over time.
I always tell myself that I am giving people the best advice I can, but upon self analysis, I hardly ever recommend MACs to people because I just sort of don't like Apple because of encounters I have had over the years with zealot fanboys. I sort of have the same feelings toward Cisco.... every Cisco tech I have ever met looked down their nose at me... for that reason I normally deploy Adtran, HP or SonicWALL.
I guess my point is that we all like to think that we are being unbiased and use the tools that work best, but my feeling is that most people just end up using the tools they are most comfortable with and carry stories that help justify their decisions.
Or.... you know... once a (day|week|month|year) download the pictures...
Agreed! I will sometimes go to another floor if my "regular" stall is not available...
100% correct. I would mod you up except I already posted in this thread.
I really don't think that it is drugs that "turn a large majority of their users into slobbering idiots", this attitude is part of the problem.
I think that drugs are a side effect of a larger more fundamental issue in those people's lives. I mean, who doesn't like feeling good? Drugs can make you feel really, really good.
I think it is just that most people don't know how to talk about drugs because they can't, we don't let them. What they are going through is outside the experience of non-drug users and furthermore we are taught to demonize them because "drugs are bad, mmmmmkay?.
Drug users have to hide their use from everyone except the people that are doing it with them.
You get an echo chamber effect and bad decisions are cascaded because there is no voice of reason any more, just voices of contempt and disgust coming from the communities outside.
My understanding is that this exploit simply requires you to have outbound SMB ports open.
In my experience, most firewall setups (especially those in companies who don't have dedicated IT staff) allow unrestricted outbound communications.
Do you need some sort of auto-run action upon insertion of the USB stick in order for this to work?
Seems crazy that you would have a policy to automatically execute anything.
A man must be gay to kiss another man?
Are people really going to end up owning cars in the end (far future)?
I think it will be an uber style model eventually were nobody owns a car but everyone has equal access to one.
In this situation, the company owner would be the one with the license and liability to operate it.
I mean, you could choose from phantom fears or some celestial voice...
Yeah, I was a field tech for a number of years and would often have to clean up the mess left by other "techs".
It would always make me wonder how these people got employed in the first place....
...Until I learned about technical recruiters... then it all made sense.
I agree, I don't even have any kids, but this made me cry.
I think that this is probably the best trait any human can have: compassion.
I think we should throw a waterproof GPS down that hole and track where the exit is...
It was the cheaper consumer models that were affected. Retail profit margins are so thin that manufacturers and retailers make up for it with preloaded crapware.
This may have been true at one time, but I don't think it is the case any longer. I think that the ubiquity of cheap components and the falling price of Windows for OEMs, the profit margins have been steadily increasing over the years.
I think it is just that OEMs have become dependent on the revenue stream they get from app developers who want their software included in the base image.