Fair Use should allow us to convert our DVDs to a format watchable on the iPod. The DMCA, of course, forbids this if the DVD is copy protected.
Perhaps your average person would still pay for this service rather than doing it themselves if it was legal, but at the same time, one-click packages could come out for people to buy to do this for them.
Lost, Season 1 is going for $38 on Amazon.com. That's for 24 episodes, so right about $1.50 per episode. And that's for 720x480, nice packaging, and discs that will probably last longer than any media on which you back up another file. As of now, for $2, you get a single-serving episode at 320x240. You get no packaging, and you can't just pop it in your DVD player to watch it. The only real benefit is that you get to watch it/now/ if you either can't get ABC (our OTA signal is really snowy) or happen to miss the show, you can get it on-demand.
To me, this is a ripoff. Particularly for shows like Lost and Housewives, where the stories are serial and build on previous episodes. I don't mind listening to music out of order or even only listening to one track from a CD, but you'll never hear someone say, "Hey, that 5th episode of Lost was really outstanding, I think I'd like to have a permanent copy of that on my computer." This is all the more relevant as TV shows make it to DVD just a few months after the end of a season.
You're paying more for less just so you can get it now. If you are serious about TV, you'll have a PVR to time-shift TV and you'll buy DVDs for archiving. If you aren't serious about TV, you'll certainly never buy the episodes online.
What's wrong with these types of stories? The whole point of free speech is that you can say things that other people won't necessarily like. Until you can show a real causal relationship between rape fantasy stories and actual rape, you simply cannot say that such stories are dangerous. If they're not dangerous, they should be allowed in a country which allows freedom of speech.
The same goes for child molestation, although people often confuse this point. Creating a video or image in which a participant in a sexual act is a minor is illegal. However fictitious writing in which this occurs is not. There exist novels in which rape and child rape/molestation is describe in almost graphic detail--should these books be banned because of the content? If you believe they should be, you are perhaps too far gone to argue with. If you don't believe they should be, why does the leap to erotica create the necessity to ban it, particularly when there is no evidence that such fiction incites people to commit the act itself?
It would seem that providing source code shouldn't fall under this anyway. I give you the source and tell you to do whatever you want with it. You build it, run it, and it does something bad. Well you should have audited it.
Funny you mention the TV analogy...with most non-free TV services, you WOULD have to pay extra to use PIP. Any signal which requires a decoder box (digital cable, satellite, etc) generally gives you a certain number of outputs per box. If that output is 1, then to use PIP on your TV (at least, to use it usefully) you'd have to buy another box and pay the subscription for it.
Their reputation won't be shot. They have a near monopoly on music. For radio, they're even tighter. And people are sheep who, even if they hear about this decision and even if they realize that the music they are buying feeds the RIAA, will still buy the music because they want it.
It's like the government. As long as Americans keep being able to buy their SUVs and electronics and fast food, they'll never stand up to the things their government is doing wrong. They are happy in their little consumer world.
It still isn't a worm in the traditional computer sense because it does not burrow through the network. This is more like tentacles that reach out, muck around with a computer, then pull back and look for a new target.
As I understand it, preshared-key WPA is little or no more secure than WEP. It may depend upon your key.
But to maybe help out the poster, check that both ends of the connection are using the same numbered key (i.e. most implementations allow you to store and rotate up to 4 keys--in my experience, the keys and key numbers must match on both ends for it to work). Since I don't think this applies to WPA and certainly not to unencrypted, it may be that this is the cause. It certainly fixed my WEP network awhile back.
Also, ensure that you're actually using hex keys or passwords using the same hash on both ends. I've seen many people put in a real hex key on the host and put the same key in the "password" field on the router, which then converts the key into a new hex key using a hash. Clearly, that won't work.
No Palm smartphone (or PDA for that matter) lets you open an SSH session and then switch applications while maintaining that session. To me, that is the single biggest flaw in Palm-based smartphones, and it's a killer flaw if you ask me.
To be honest, there's nothing that the Palm phone does that the PPC phone doesn't (at least, nothing I need). The PPC phone has much, much better handwriting recognition and the ability to multitask network applications. Both types of units play media, if that's your bag. A few PocketPC phones even have WiFi as an option, something the Treo line can't claim (I can't speak for non-Palm PalmOS smartphones).
What does Palm have? They've got really great PIM apps, and pretty good hardware. PPC has acceptable ones, but the rest of the features overall seem much better.
I'd really be looking forward to this PPC Treo if only the screen was larger. Many PPC apps assume 240x320, which means some things may not show up on the screen correctly. Whether I pick one of these up is mostly going to be a matter of which 3rd party apps fail in this way.
How random are these searches, anyway? Do they use a true RNG or just a PRNG? And let's not forget that it can be random while still being weighted. If I roll a die that has 5 1s and 1 6, the outcome is still random even if it's much more likely that a 1 will show up than a 6.
They may bring out new handhelds quickly, but none of them are strict upgrades. Not one of the new handheld systems is a superset of another, and with each one is a flaw that keeps me from moving on entirely from my GBA.
Flaws: GBA: No backlight, Start+Select buttons on the right side. No X & Y buttons, an anti-feature plaguing the entire Game Boy line.
GBA SP: No standard headphone jack. Cannot listen to headphones while charging. Too small for my hands (they cramp after a short period of playing on the SP).
GBA Micro: No GB/GBC compatibility. I haven't played one of these, so I don't know whether I'd be able to play it comfortably, but at least it's more like the style of the old GBA.
Nintendo DS: Doesn't play GB/GBC games. Input for native games can be unwieldy (though I guess this is only a flaw for individual games.) Annoying nag screen before each game. Cannot link to other Gameboys/Gamecube.
What I really want is a Nintendo DS with full backwards compatibility, including using the wireless link to replace the standard link cable for GBA games. Unfortunately, it doesn't look like this is going to be a reality.
The problem with your multi-client hack is that you'll be limited by the size of the file. Once both clients have that file, they won't be uploading to each other any more. With a large enough file, this could still boost your ratio--but you have to download the file in the first place.
Well it seems that this could completely demolish the protocol. If everyone used this and then set their upload to the minimum (what, 1kbps?) it would take forever and a day to get files from Bittorrent.
I wouldn't let someone make a copy of my driver's license unless I really felt I could trust them, regardless of whether or not I'm selling something legally.
Dumb dum dum dum? I hope you aren't talking about him. It's not at all "dumb" to learn that you can get $50 for pretty much nothing. Now if you'd caught him early and beat the crap out of him, yeah, it'd be dumb to try again.
It's actually fairly common for manufacturers to have lower-end products that are identical to the higher-end products, only with functionality disabled. I believe ATI and Nvidia have both done this on their graphics cards...basically disabling piplines and underclocking the GPU on the cheaper products. Intel and AMD similarly sell chips knowing that they can run at a higher frequency, but clocked lower and for a cheaper price. They even went through a certain amount of effort to reduce overclocking.
There are security risks that he didn't cover that aren't buffer overflows and whatnot. What about SUID shell scripts? Predictable temp files? The security he outlined wouldn't really protect against the attacks used in these situations, and knowing that they exist and how they work would help you to avoid creating these situations.
Further, points 1 and 2 are essentially the same things, just reworded.
Point 4 is somewhat mistitled. I do think learning the basics of how exploits work is important to creating sturdier code. Otherwise, you'd just write stuff that's vulnerable to buffer overflow constantly.
Point 5... Where do I begin? The problem is NOT self-correcting. I work for a university, and every year we get students asking us how some bank got their university e-mail address and "Should I respond to them?" For every one that does that, probably 10 actually respond. He also seems to think that there is a technical solution to "attachments and phishing" but never explains the technical solution to phishing. Presumably it is to only allow e-mails from a whitelist, given his default-deny ideas. Well frankly, that isn't going to work for most people.
Point 6 I agree with to an extent. The problem comes when everyone adopts this strategy--no innovation actually gets implemented! Also, technologies that are developed to fill a need often cannot be "waited on" in the manner that he describes. Also, on the patch-level, this may not be workable either. If you have a critical vulnerability, you can't afford to wait until everyone else has tried the patch. You definitely want to test it before deploying it, but that's along a different line of thought.
Overall, some interesting ideas, but as you say, many aren't really security ideas. They're SOP for lots of companies, though.
Yes, service packs are upgrades, but supporting SP2 is like supporting a new major Windows release. So many things were changed around, and many of them were defaults that users weren't changing themselves.
Supporting WinXP Service pack 0 or 1 were virtually identical to each other. Same for Windows 2000 Service packs 1-4. But SP2 was a completely different ballgame.
Most PDAs (including phone PDAs) can act as mp3 players. I think what would make a unit like this killer for me would be an extended battery life. Most phone PDAs seem to last you the day, but then you have to charge up, and that's not considering extended music listening. Not that great.
Could you please point me to a place on that site where the owner claims that a non-Vista version of Windows is the right tool for hosting a forum?
Until you can, you've completely failed to prove your point, because nowhere in the post nor on the site itself do I see him claiming that Windows is appropriate for forum-hosting, much less "the right tool for the job." You're just making stuff up in order to try to win an argument (because I/highly/ doubt you've gone and read a single word on those forums)
(and if the Mexican comment was supposed to be some sort of sideways slur, you're off-target. I'm actually as white as they come, but if you're looking for something more appropriate, try "mick")
Slashdot Mirror
Fair Use should allow us to convert our DVDs to a format watchable on the iPod. The DMCA, of course, forbids this if the DVD is copy protected.
Perhaps your average person would still pay for this service rather than doing it themselves if it was legal, but at the same time, one-click packages could come out for people to buy to do this for them.
Lost, Season 1 is going for $38 on Amazon.com. That's for 24 episodes, so right about $1.50 per episode. And that's for 720x480, nice packaging, and discs that will probably last longer than any media on which you back up another file. As of now, for $2, you get a single-serving episode at 320x240. You get no packaging, and you can't just pop it in your DVD player to watch it. The only real benefit is that you get to watch it /now/ if you either can't get ABC (our OTA signal is really snowy) or happen to miss the show, you can get it on-demand.
To me, this is a ripoff. Particularly for shows like Lost and Housewives, where the stories are serial and build on previous episodes. I don't mind listening to music out of order or even only listening to one track from a CD, but you'll never hear someone say, "Hey, that 5th episode of Lost was really outstanding, I think I'd like to have a permanent copy of that on my computer." This is all the more relevant as TV shows make it to DVD just a few months after the end of a season.
You're paying more for less just so you can get it now. If you are serious about TV, you'll have a PVR to time-shift TV and you'll buy DVDs for archiving. If you aren't serious about TV, you'll certainly never buy the episodes online.
What's wrong with these types of stories? The whole point of free speech is that you can say things that other people won't necessarily like. Until you can show a real causal relationship between rape fantasy stories and actual rape, you simply cannot say that such stories are dangerous. If they're not dangerous, they should be allowed in a country which allows freedom of speech.
The same goes for child molestation, although people often confuse this point. Creating a video or image in which a participant in a sexual act is a minor is illegal. However fictitious writing in which this occurs is not. There exist novels in which rape and child rape/molestation is describe in almost graphic detail--should these books be banned because of the content? If you believe they should be, you are perhaps too far gone to argue with. If you don't believe they should be, why does the leap to erotica create the necessity to ban it, particularly when there is no evidence that such fiction incites people to commit the act itself?
It would seem that providing source code shouldn't fall under this anyway. I give you the source and tell you to do whatever you want with it. You build it, run it, and it does something bad. Well you should have audited it.
Funny you mention the TV analogy...with most non-free TV services, you WOULD have to pay extra to use PIP. Any signal which requires a decoder box (digital cable, satellite, etc) generally gives you a certain number of outputs per box. If that output is 1, then to use PIP on your TV (at least, to use it usefully) you'd have to buy another box and pay the subscription for it.
Their reputation won't be shot. They have a near monopoly on music. For radio, they're even tighter. And people are sheep who, even if they hear about this decision and even if they realize that the music they are buying feeds the RIAA, will still buy the music because they want it.
It's like the government. As long as Americans keep being able to buy their SUVs and electronics and fast food, they'll never stand up to the things their government is doing wrong. They are happy in their little consumer world.
It still isn't a worm in the traditional computer sense because it does not burrow through the network. This is more like tentacles that reach out, muck around with a computer, then pull back and look for a new target.
there goes Linux...
Where the hell do you get that notion? DeCSS is not a part of Linux.
As I understand it, preshared-key WPA is little or no more secure than WEP. It may depend upon your key.
But to maybe help out the poster, check that both ends of the connection are using the same numbered key (i.e. most implementations allow you to store and rotate up to 4 keys--in my experience, the keys and key numbers must match on both ends for it to work). Since I don't think this applies to WPA and certainly not to unencrypted, it may be that this is the cause. It certainly fixed my WEP network awhile back.
Also, ensure that you're actually using hex keys or passwords using the same hash on both ends. I've seen many people put in a real hex key on the host and put the same key in the "password" field on the router, which then converts the key into a new hex key using a hash. Clearly, that won't work.
At least this is one story that no one can claim is Slashvertising :)
No Palm smartphone (or PDA for that matter) lets you open an SSH session and then switch applications while maintaining that session. To me, that is the single biggest flaw in Palm-based smartphones, and it's a killer flaw if you ask me.
To be honest, there's nothing that the Palm phone does that the PPC phone doesn't (at least, nothing I need). The PPC phone has much, much better handwriting recognition and the ability to multitask network applications. Both types of units play media, if that's your bag. A few PocketPC phones even have WiFi as an option, something the Treo line can't claim (I can't speak for non-Palm PalmOS smartphones).
What does Palm have? They've got really great PIM apps, and pretty good hardware. PPC has acceptable ones, but the rest of the features overall seem much better.
I'd really be looking forward to this PPC Treo if only the screen was larger. Many PPC apps assume 240x320, which means some things may not show up on the screen correctly. Whether I pick one of these up is mostly going to be a matter of which 3rd party apps fail in this way.
Not to mention that their competition--PalmOS--is no longer a part of the company that is producing the PocketPC Palm.
How random are these searches, anyway? Do they use a true RNG or just a PRNG? And let's not forget that it can be random while still being weighted. If I roll a die that has 5 1s and 1 6, the outcome is still random even if it's much more likely that a 1 will show up than a 6.
They may bring out new handhelds quickly, but none of them are strict upgrades. Not one of the new handheld systems is a superset of another, and with each one is a flaw that keeps me from moving on entirely from my GBA.
Flaws:
GBA: No backlight, Start+Select buttons on the right side. No X & Y buttons, an anti-feature plaguing the entire Game Boy line.
GBA SP: No standard headphone jack. Cannot listen to headphones while charging. Too small for my hands (they cramp after a short period of playing on the SP).
GBA Micro: No GB/GBC compatibility. I haven't played one of these, so I don't know whether I'd be able to play it comfortably, but at least it's more like the style of the old GBA.
Nintendo DS: Doesn't play GB/GBC games. Input for native games can be unwieldy (though I guess this is only a flaw for individual games.) Annoying nag screen before each game. Cannot link to other Gameboys/Gamecube.
What I really want is a Nintendo DS with full backwards compatibility, including using the wireless link to replace the standard link cable for GBA games. Unfortunately, it doesn't look like this is going to be a reality.
The problem with your multi-client hack is that you'll be limited by the size of the file. Once both clients have that file, they won't be uploading to each other any more. With a large enough file, this could still boost your ratio--but you have to download the file in the first place.
Well it seems that this could completely demolish the protocol. If everyone used this and then set their upload to the minimum (what, 1kbps?) it would take forever and a day to get files from Bittorrent.
I wouldn't let someone make a copy of my driver's license unless I really felt I could trust them, regardless of whether or not I'm selling something legally.
Dumb dum dum dum? I hope you aren't talking about him. It's not at all "dumb" to learn that you can get $50 for pretty much nothing. Now if you'd caught him early and beat the crap out of him, yeah, it'd be dumb to try again.
It's actually fairly common for manufacturers to have lower-end products that are identical to the higher-end products, only with functionality disabled. I believe ATI and Nvidia have both done this on their graphics cards...basically disabling piplines and underclocking the GPU on the cheaper products. Intel and AMD similarly sell chips knowing that they can run at a higher frequency, but clocked lower and for a cheaper price. They even went through a certain amount of effort to reduce overclocking.
There are security risks that he didn't cover that aren't buffer overflows and whatnot. What about SUID shell scripts? Predictable temp files? The security he outlined wouldn't really protect against the attacks used in these situations, and knowing that they exist and how they work would help you to avoid creating these situations.
Agreed.
Further, points 1 and 2 are essentially the same things, just reworded.
Point 4 is somewhat mistitled. I do think learning the basics of how exploits work is important to creating sturdier code. Otherwise, you'd just write stuff that's vulnerable to buffer overflow constantly.
Point 5... Where do I begin? The problem is NOT self-correcting. I work for a university, and every year we get students asking us how some bank got their university e-mail address and "Should I respond to them?" For every one that does that, probably 10 actually respond. He also seems to think that there is a technical solution to "attachments and phishing" but never explains the technical solution to phishing. Presumably it is to only allow e-mails from a whitelist, given his default-deny ideas. Well frankly, that isn't going to work for most people.
Point 6 I agree with to an extent. The problem comes when everyone adopts this strategy--no innovation actually gets implemented! Also, technologies that are developed to fill a need often cannot be "waited on" in the manner that he describes. Also, on the patch-level, this may not be workable either. If you have a critical vulnerability, you can't afford to wait until everyone else has tried the patch. You definitely want to test it before deploying it, but that's along a different line of thought.
Overall, some interesting ideas, but as you say, many aren't really security ideas. They're SOP for lots of companies, though.
Yes, service packs are upgrades, but supporting SP2 is like supporting a new major Windows release. So many things were changed around, and many of them were defaults that users weren't changing themselves.
Supporting WinXP Service pack 0 or 1 were virtually identical to each other. Same for Windows 2000 Service packs 1-4. But SP2 was a completely different ballgame.
Most PDAs (including phone PDAs) can act as mp3 players. I think what would make a unit like this killer for me would be an extended battery life. Most phone PDAs seem to last you the day, but then you have to charge up, and that's not considering extended music listening. Not that great.
You know, that would confuse people who are /completely/ colorblind :)
Could you please point me to a place on that site where the owner claims that a non-Vista version of Windows is the right tool for hosting a forum?
/highly/ doubt you've gone and read a single word on those forums)
Until you can, you've completely failed to prove your point, because nowhere in the post nor on the site itself do I see him claiming that Windows is appropriate for forum-hosting, much less "the right tool for the job." You're just making stuff up in order to try to win an argument (because I
(and if the Mexican comment was supposed to be some sort of sideways slur, you're off-target. I'm actually as white as they come, but if you're looking for something more appropriate, try "mick")