What isn't a concern for you doesn't make it a solution that could be implemented widely. So no, the loss of service workers is not an acceptable loss.
Of course, there is the customer service difference
Yes, Dell will send a tech out to fix your problem while Apple makes you make an appointment with a "genius" who will sit there and pick his nose while declaring everything a "logic board problem".
As I said, not Samsung's fault, not Google's fault, and quite critically to the very core of my original post: Nothing at all to do with vendors not updating the Android version.
Samsung issued security updates to the S4 mini in April this year, and before that November last year. Sounds like your shitty carrier is getting in the way.
You sound like a sysadmin who doesn't pay very much attention. I'm running the 16.04 LTS release of Ubuntu. I installed it last year with kernel version 4.4.0-7.22 (Ubuntu numbering), actually a 4.4.2 mainline kernel. Since April last year there have been 51 kernel security updates each requiring a reboot to apply to my Linux machine which means that on average my Ubuntu server gets rebooted twice as often as my Windows machine for the purposes of applying an update.
Speaking of, I just logged into SSH to double check this before posting. Guess what greeted me:
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-93-generic x86_64)
0 packages can be updated. 0 updates are security updates.
*** System restart required *** No mail.
I'm going to eat some humble pie and admit that my server with an up-time of 41 days is now 4 kernel updates behind because I haven't rebooted in a while. Hopefully no security updates.
Yes. Sometimes by policy e.g. Stack-Ranking firing the bottom x%: See GE, Honeywell, Oracle. Sometimes by value performance: e.g. Fire everyone without x billable hours: See every consultant every. Usually though it's just used as a way to get rid of really poor people: e.g. consistent fuckups who shouldn't have been hired in the first place.
There are a few companies (usually some of the larger monsters) that take the view of a failing employee is a failing in management and they move their dead weight from department to department trying desperately not to replace the worthless because the HR process sucks and "oh they have company knowledge so they must be good at *something*".
Or on the opposite end of the spectrum: "You did what to the production server? Go home and don't come back!"
Companies come in all sorts. Management textbooks describe all these forms of HR management. Unfortunately what is clear in all management material is that nothing is good or bad. What works in one case doesn't work in another, and there's never a right answer (though you find out the wrong answer when you sink the company).
3. Machines with USB-A ports tend to have a lot of them. Most standard-sized laptops have 3-5 of them, desktops have 6-10. I've yet to see a computer with USB-C provide more than two such ports. It does not help spur adoption when the number of ports available amount to "one to charge, one for the hub for all the other things".
Err that's called an adoption phase. Would you prefer to go all out Macbook on the standard and dongle the dongle dongle so you can dongle your way to dongle town?
You just said it yourself that you've seen few devices use USB-C for anything other than charging. How can you follow that with a complaint that there are not enough USB-C ports on a computer?
But now I need to worry about injection attacks when connecting to a power source. WTF?
If you worry about that maybe also worry about getting hit by a meteor, getting struck by lightining, waking up in the middle of the night and finding out Santaclause doesn't actually exist and he was your father all along and your family is to blame for the crappy presents and not that Santa was very busy on Christmas eve. That's before we start talking about terrorists, Obama going on a shooting rampage due to lack of gun control and Trump sleep walking, hitting the big red nuclear button in the oval office and Tweeting "LOL".
I get what I'm trying to say is, chill out man. Injection attacks are about as common as all the other interface based attacks that we have not seen over the years, such as the ability to kill a laptop through its USB socket, DMA of USB and Firewire, and didn't we at some point talk about how dangerous it was to connect to a global network?
Well that last one you probably should worry about... a little... don't let it keep you up at night.
Yeah you have to start somewhere. Typically you start at the devices, or you start with a transition phase. Kind of like my HP which has both USB-A and USB-C ports. Remember how many motherboards shipped with PS2 connectors AND USB ports?
If you're over 30 and remember that time as well, and still think USB-C is a net win, you'll be the first I've met.
I'm over 30. I remember that time. I remember when USB-A first came out. I remember all of the same complaints you made right now being applied to it back then. Don't know if your computer can support a mouse, or a HDD, who knows. It was a dogs breakfast. I remember spending a weekend trying to get a USB printer working before I just went back to the Centronics interface that it also had. I remember the clusterfuck that was supporting USB keyboards but not being able to do anything outside of Windows with them, including editing the BIOS, yeah I kept a whole spare keyboard laying around just in case the computer screwed up and the USB one didn't work.
I remember that any adoption of anything that tries to be universal having teething issues.
Pat the baby, let it grow into a capable adult, don't shake it in rage giving it braindamage.
I bet you it won't change even slightly. Human behavior to punishment far favours the chance of the punishment being inflicted over the severity of the punishment.
But I get it, America still hasn't imprisoned enough people. It's like a game of Pokemon. Gotta catch em all.
Wait a second, just how long did you keep your kids in the basement? If you keep someone in there for dozens of years then they definitely aren't kids any more...
24 years.
And you're a bad person
Pfft you sound like my jury. I'm not all bad. I even left 3 of her newborn children down there with her to keep her company.
It allows an attacker to MITM one specific machine on a network. The rest relies on phishing attacks or other attacks to mimic and take over a connection. Even then that's a HUUUUGE amount of effort to get at a single user.
The attack vector gains access to attempt to exploit other vectors, nothing more. What this attack vector allows a person to do is anything they could previously do at any internet cafe, restaurant, airport, hotel, or any other place with open WiFi, and less. The "less" bit being the requirement to exploit each target individually rather than all of them at once.
Despite the media coverage this is actually one huge yawn.
Why should Theo wait around for everyone else and leave his users vulnerable?
The whole point of an embargo is to maximize security. OpenBSD users weren't vulnerable. Until yesterday only a very select few people even knew how to perform the attack. On the flip side Theo by breaking the embargo not only made other users vulnerable, but also his own given that most of them probably wouldn't have considered the urgency of patching before it hit international news.
But for MONTHS?
You're not talking about a bug in Chrome here. We're talking about a but in WiFi affecting every OS and many millions of embedded devices as well as network devices. Again the length of time was chosen to maximise safety for users, not the other way around.
Does anyone really think this flaw didn't leak out to the bad guys from one of the vendors the second they where notified?
Well yes, unless the bad guys were using OpenBSD in which case we all know exactly who to blame.
What a silly statement. Because not all vendors are the same? I just gave you an example of 2 devices which are almost twice as old running versions of Android far earlier than the Nexus. Don't put Google on some pedestal of perfection that other's can't reach or even exceed.
What google decides to push specifically to the Nexus 5 has nothing to do with what fixes they apply to Android, fixes which they patch all the way to KitKat.
I mean how the security patch level is now completely independent of the Android version you are running. Just like which windows hotfix is installed is completely independent of which version of windows you are running.
If you see an update that specifically says wpa_supplicant was updated, please post a reply.
Put your own effort in. A list of CVEs patched each month in the security framework is published at source.android.com/security including every version of android to which it gets patched. It's on a monthly release cycle so check it in 2 weeks.
That's not a guarantee. Google has pushed out security updates for devices past it's guaranteed security update window in the past. But all in all you're still talking about a single device. The problem is ultimately one of vendors. In the security and core OS the issue is long solved.
E.g. 2017-09-01 security update which I got on my more than 3 year old Samsung devices has been back ported all the way to KitKat, and I actually own a Tab 3 which still runs KitKat which received a security update earlier this year.
Point is it makes zero sense to gauge the likelihood of getting an upgrade based on which version of Android you're running..... Unless you're running 4.3 in which case the answer is a resounding no since the security framework didn't exist prior to then.
Slashdot Mirror
Sure feed the prison industrial complex. That has served America so well in the past.
I mean seriously have you not realised the prison doesn't seem to solve anything? Your recidivism numbers alone should show that.
What isn't a concern for you doesn't make it a solution that could be implemented widely. So no, the loss of service workers is not an acceptable loss.
Only if you don't rely on any web based software. Enjoy your actual copy of Office while you still can.
Nothing says horrible like a company who distances themselves from a patent they filed without ever actually implementing or selling the technology.
And yet this is one of the most commented on articles in the front page. I guess that means the clickbait is working.
Of course, there is the customer service difference
Yes, Dell will send a tech out to fix your problem while Apple makes you make an appointment with a "genius" who will sit there and pick his nose while declaring everything a "logic board problem".
As I said, not Samsung's fault, not Google's fault, and quite critically to the very core of my original post: Nothing at all to do with vendors not updating the Android version.
What I had in mind was that Windows wants to reboot pretty much once per week.
Microsoft doesn't roll patches out that often. You have a problem with your install or some application.
If you go to the gym I agree. If you don't feel the urgent need to drive 20m to your mailbox then no, exercise and the need to go somewhere overlap.
Samsung issued security updates to the S4 mini in April this year, and before that November last year. Sounds like your shitty carrier is getting in the way.
It's also very rare.
You sound like a sysadmin who doesn't pay very much attention. I'm running the 16.04 LTS release of Ubuntu. I installed it last year with kernel version 4.4.0-7.22 (Ubuntu numbering), actually a 4.4.2 mainline kernel. Since April last year there have been 51 kernel security updates each requiring a reboot to apply to my Linux machine which means that on average my Ubuntu server gets rebooted twice as often as my Windows machine for the purposes of applying an update.
Speaking of, I just logged into SSH to double check this before posting. Guess what greeted me:
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.4.0-93-generic x86_64)
* Documentation: https://help.ubuntu.com/
* Management: https://landscape.canonical.co...
* Support: https://ubuntu.com/advantage
0 packages can be updated.
0 updates are security updates.
*** System restart required ***
No mail.
I'm going to eat some humble pie and admit that my server with an up-time of 41 days is now 4 kernel updates behind because I haven't rebooted in a while. Hopefully no security updates.
Are performance-based firings really a thing?
Yes. Sometimes by policy e.g. Stack-Ranking firing the bottom x%: See GE, Honeywell, Oracle.
Sometimes by value performance: e.g. Fire everyone without x billable hours: See every consultant every.
Usually though it's just used as a way to get rid of really poor people: e.g. consistent fuckups who shouldn't have been hired in the first place.
There are a few companies (usually some of the larger monsters) that take the view of a failing employee is a failing in management and they move their dead weight from department to department trying desperately not to replace the worthless because the HR process sucks and "oh they have company knowledge so they must be good at *something*".
Or on the opposite end of the spectrum: "You did what to the production server? Go home and don't come back!"
Companies come in all sorts. Management textbooks describe all these forms of HR management. Unfortunately what is clear in all management material is that nothing is good or bad. What works in one case doesn't work in another, and there's never a right answer (though you find out the wrong answer when you sink the company).
3. Machines with USB-A ports tend to have a lot of them. Most standard-sized laptops have 3-5 of them, desktops have 6-10. I've yet to see a computer with USB-C provide more than two such ports. It does not help spur adoption when the number of ports available amount to "one to charge, one for the hub for all the other things".
Err that's called an adoption phase. Would you prefer to go all out Macbook on the standard and dongle the dongle dongle so you can dongle your way to dongle town?
You just said it yourself that you've seen few devices use USB-C for anything other than charging. How can you follow that with a complaint that there are not enough USB-C ports on a computer?
But now I need to worry about injection attacks when connecting to a power source. WTF?
If you worry about that maybe also worry about getting hit by a meteor, getting struck by lightining, waking up in the middle of the night and finding out Santaclause doesn't actually exist and he was your father all along and your family is to blame for the crappy presents and not that Santa was very busy on Christmas eve. That's before we start talking about terrorists, Obama going on a shooting rampage due to lack of gun control and Trump sleep walking, hitting the big red nuclear button in the oval office and Tweeting "LOL".
I get what I'm trying to say is, chill out man. Injection attacks are about as common as all the other interface based attacks that we have not seen over the years, such as the ability to kill a laptop through its USB socket, DMA of USB and Firewire, and didn't we at some point talk about how dangerous it was to connect to a global network?
Well that last one you probably should worry about ... a little ... don't let it keep you up at night.
Yeah you have to start somewhere. Typically you start at the devices, or you start with a transition phase. Kind of like my HP which has both USB-A and USB-C ports. Remember how many motherboards shipped with PS2 connectors AND USB ports?
If you're over 30 and remember that time as well, and still think USB-C is a net win, you'll be the first I've met.
I'm over 30. I remember that time. I remember when USB-A first came out. I remember all of the same complaints you made right now being applied to it back then. Don't know if your computer can support a mouse, or a HDD, who knows. It was a dogs breakfast. I remember spending a weekend trying to get a USB printer working before I just went back to the Centronics interface that it also had. I remember the clusterfuck that was supporting USB keyboards but not being able to do anything outside of Windows with them, including editing the BIOS, yeah I kept a whole spare keyboard laying around just in case the computer screwed up and the USB one didn't work.
I remember that any adoption of anything that tries to be universal having teething issues.
Pat the baby, let it grow into a capable adult, don't shake it in rage giving it braindamage.
I think USB-C is a net win. Pleased to meet you.
I bet you it won't change even slightly. Human behavior to punishment far favours the chance of the punishment being inflicted over the severity of the punishment.
But I get it, America still hasn't imprisoned enough people. It's like a game of Pokemon. Gotta catch em all.
Wait a second, just how long did you keep your kids in the basement? If you keep someone in there for dozens of years then they definitely aren't kids any more...
24 years.
And you're a bad person
Pfft you sound like my jury. I'm not all bad. I even left 3 of her newborn children down there with her to keep her company.
It allows an attacker to MITM one specific machine on a network. The rest relies on phishing attacks or other attacks to mimic and take over a connection. Even then that's a HUUUUGE amount of effort to get at a single user.
The attack vector gains access to attempt to exploit other vectors, nothing more. What this attack vector allows a person to do is anything they could previously do at any internet cafe, restaurant, airport, hotel, or any other place with open WiFi, and less. The "less" bit being the requirement to exploit each target individually rather than all of them at once.
Despite the media coverage this is actually one huge yawn.
Why should Theo wait around for everyone else and leave his users vulnerable?
The whole point of an embargo is to maximize security. OpenBSD users weren't vulnerable. Until yesterday only a very select few people even knew how to perform the attack. On the flip side Theo by breaking the embargo not only made other users vulnerable, but also his own given that most of them probably wouldn't have considered the urgency of patching before it hit international news.
But for MONTHS?
You're not talking about a bug in Chrome here. We're talking about a but in WiFi affecting every OS and many millions of embedded devices as well as network devices. Again the length of time was chosen to maximise safety for users, not the other way around.
Does anyone really think this flaw didn't leak out to the bad guys from one of the vendors the second they where notified?
Well yes, unless the bad guys were using OpenBSD in which case we all know exactly who to blame.
so why would any other vendor?
What a silly statement. Because not all vendors are the same? I just gave you an example of 2 devices which are almost twice as old running versions of Android far earlier than the Nexus. Don't put Google on some pedestal of perfection that other's can't reach or even exceed.
What google decides to push specifically to the Nexus 5 has nothing to do with what fixes they apply to Android, fixes which they patch all the way to KitKat.
You mean the Google Play Services thing?
No. That was introduced in Marshmallow.
I mean how the security patch level is now completely independent of the Android version you are running. Just like which windows hotfix is installed is completely independent of which version of windows you are running.
If you see an update that specifically says wpa_supplicant was updated, please post a reply.
Put your own effort in. A list of CVEs patched each month in the security framework is published at source.android.com/security including every version of android to which it gets patched. It's on a monthly release cycle so check it in 2 weeks.
Zero. Having network access is only a single layer in a security system. The loss of encryption here should not cause you to be in any great risk.
I mean you do still use SSL, passwords, and have up to date and patched OSes inside your network right?
RIGHT!?!
That's not a guarantee. Google has pushed out security updates for devices past it's guaranteed security update window in the past. But all in all you're still talking about a single device. The problem is ultimately one of vendors. In the security and core OS the issue is long solved.
E.g. 2017-09-01 security update which I got on my more than 3 year old Samsung devices has been back ported all the way to KitKat, and I actually own a Tab 3 which still runs KitKat which received a security update earlier this year.
Point is it makes zero sense to gauge the likelihood of getting an upgrade based on which version of Android you're running. .... Unless you're running 4.3 in which case the answer is a resounding no since the security framework didn't exist prior to then.
I have a Galaxy S4, last patch was in March. I have an S5 last patch was 3 weeks ago.
Prior to that there existed no patching framework as it was only introduced in KitKat.