Specifically, all corporate taxes paid come from three categories of individuals: consumers, who pay higher prices for items to cover the taxes; employees, who make lower wages to cover the taxes; and shareholders, who earn lower returns (and note that the two former categories are often also shareholders, via their pension plans). Suppliers can also lose, but they're generally corporations as well, with their own employees and investors who actually eat the loss. In the long run, though, the investors don't lose because capital flows away from lower returns and towards higher ones. So companies must find ways to keep their returns up to somewhere near the mean rate of return.
Once you understand that no taxes are paid by corporations, ever, then you should also recognize that corporate taxes are not only ultimately paid by individuals, but the individuals almost never realize they're paying it. How many people know their prices would be lower, wages higher, or pension more secure, if it weren't for corporate taxes? And, therefore, how many voters have any interest in opposing corporate taxation? To politicians and voters, corporate taxes look almost like free money. Ratchet up the corporate taxes and no people get hurt, just those nasty corporations. (Actually, politicians sometimes get even more value out of threatening corporate taxes than enacting them, since it tends to encourage said corporations to buy off, er, donate to their re-election funds.)
I assert that while taxes are necessary, the electorate should see and understand exactly what they're paying, so they can evaluate the value they're receiving for the money they're paying. Hidden taxes are evil, and therefore corporate taxes are evil, and should be abolished, not raised.
Not necessarily. Greenland ice core records show that in the past the planet has seen temperature shifts of up to 7 C in as little as 30 years. 7 C is huge. It's like transporting Moscow to Rome. Of course, we have no idea what caused such rapid changes in the past. It wasn't CO2 levels, or particulates.
i would not be surprised if humans died off within a couple centuries after that.
I would. If one or more isolated populations managed to survive more than a couple of generations after the event, I think it's highly likely that they'd continue to survive indefinitely. The worst of the changes would be past, and they'd clearly have learned how to survive in the new environment, else they'd have died sooner.
Human intelligence makes us highly adaptable, as evidenced by the extraordinary diversity of environments in which we live, and lived even before the advent of modern technology. Humans who lack the necessary knowledge of how to survive in a particular environment are at severe risk of death any place on the planet, but if they manage to survive for even a year or two, odds are that they'll have learned enough to be able to extend that time almost indefinitely.
Well that was my point about having very plastic brains. I'm not a neuroscientist, and I don't know how much details like (I have specifically four major appendages to control; two arms, two legs) are baked into the brain from day 0, vs. being just one of the configurations to which a very young brain can adapt.
You missed the point, I think.
The bionic foot in the article doesn't receive signals directly from the brain. It receives signals as they arrive at existing muscles. So we're talking about a brain that has already been wired naturally to control normally-grown muscles, and hijacking that message to also actuate motors. To use this process for additional limbs, you'd have to have a person who had grown those limbs to begin with.
But that hard work they did doesn't mean their success did not depend on their luck as much as it did on their work.
There's a great little (light, easy-to-read) book "The Drunkard's Walk: How Randomness Rules Our Lives" which explains this very well in the last chapter. The truth is that randomness plays a huge role in success and failure of all sorts of endeavors. BUT, as the book points out with extensive examples, that doesn't mean we're powerless and just have to accept whatever the random dice of fate serve up for us. We can work hard to weight the dice a little, but even more important, we control how many throws of the dice we get. Successful people are those who are smart, hard-working and persistent
Had SpaceX not gotten the NASA contract, Tesla would undoubtedly have suffered, and Musk would have been scrambling to save it. I'd give him good odds of succeeding, too, either with alternative financing, or by closing the doors and starting over, or... something. And maybe he wouldn't have managed it, but I guarantee he wouldn't just have given up and said "Well, bad luck, I'm out". Because people who would do that don't get to where Musk is, no matter how lucky they are.
Even now, I don't like the fact that i have to care exactly how they implement right to be forgotten.
Since the "right" is imposed by regulation, the best way to address that problem would be for the EU to define the standards and the process to be followed, and to provide regulatory oversight to ensure the legally required standards are being met, rather than punting the problem to Google to figure out.
Or get rid of the silly "right". That'd be even better, actually.
(Disclaimer: I work for Google but this post contains only my personal opinions.)
I think the answer here is that an NFL career pays rather better than an Academic one. If he can retire with his faculties intact, he won't have to chase grants and prizes to be comfortable.
This. Given that he's a lineman he's actually got a pretty good chance of avoiding CTE. Linemen collide on every play, but they do it at relatively low speed, since they only have about two feet in which to accelerate. If he's cautious with his head, careful with his money, and keeps his career short, Urschel has a good chance of walking away intact and independently wealthy after four or five years.
You describe the process in another comment as "Some Javascript downloaded from Google scans all the text you enter..." Oh, now I get it. So it doesn't log your keystrokes, it just monitors all the text you type. Thanks for the distinction.
What do you mean by "monitors"? It monitors the text you type in exactly the same way that your web browser does, or your keyboard, for that matter. That is, it performs local computations on your keystrokes. Your web browser takes the additional step (sometimes) of sending network messages if you type certain things. In that way, the password alert extension is different, because it never does that.
Look at the biggest killers in the past century -- Hitler, Stalin, Chairman Mao, etc.
Not just the last century, either. In terms of percentage of humanity extinguished, the biggest killer of all time was Genghis Khan. He was religious (Animist), but his aggression had nothing to do with religion and he was very tolerant of religious differences in the peoples he conquered. Assuming there were any left.
I don't expect that to be true for much longer. I'm not entirely sure it's true now, considering the fact that punching big holes in the skin means that additional structural reinforcement is required.
BTW, FalleStar, I reported your attack to the Password Alert team. They've made a number of changes which defeat your attack as well as a large class of similar attacks. The new release hasn't been pushed out to users yet, I don't think, but I'd expect you'll see an update before too much longer.
The Password Alert team thanks you for your report. Actually, they thanked me, but I didn't do anything other than pass messages, so I'm passing it along to you.
Too bad there's no Vulnerability Reward Program for Password Alert:-)
Some Javascript downloaded from Google scans all the text you enter, hashes it, and compares it with a locally-stored hash. It doesn't send any of what you type anywhere off your machine. Not wrong, or scary, and it's all open source so you can verify what it's doing. For that matter, you can use the Chrome dev tools to set breakpoints and step through it.
There have been some articles about this with respect to Google's cars, and making the cars act more like human drivers is a key piece of what Google is working on.
However that's about more subtle issues of body language and negotiation. As for the scenarios you cite, it's easy:
For example, huge puddle on the road, most humans would unwisely drive through it. What would AI do?
Most likely gently slow and stop. If it couldn't do that in time, it would go through. Remember that the self-driving car has 360 degree vision; so if what you're worried about is that it'll just suddenly slam on the brakes, it won't. It knows where the vehicles behind it are.
What about a hobo at the end of the offramp begging for change?
Give him space.
Would AI freak out about pedestrian on the road?
If you want to know, google it. There are a bunch of videos from Google, showing how the cars interact with pedestrians and cyclists. The article above from theoatmeal mentions that while the author was riding with it, he thought at one point the car was waiting when it should have gone, only to find out that the car had seen a cyclist approaching on the other side of a hedge. That's a case where the automated car acted different from a human driver, because it had more information than a human driver. And that was a good thing.
TLDR: there are more assholes than hobbyist cartographers.
Actually, I don't think there are. Keep in mind that MapMaker isn't new; it's been open for years and working reasonably well. There's just been an uptick in usage (valid and vandalism) that has swamped the old moderation system. So, they need to improve the moderation system, then it'll be back on line.
In fact, you can use AES but not the recommended default values. Satoshi did this with Bitcoin, just in case the NSA was recommending those values for a reason.
No, Satoshi did not change any values in AES. Satoshi chose a less-common curve for ECC, nothing to do with AES.
isn't it more work to make your own shitty encryption? are these people retarded?
Foolish, yes, but not completely retarded. If you look at the details, it's pretty clear that what they were trying to do was to build something really, really fast, so they could process huge volumes of packets on lower-spec hardware, with less generated heat, etc. There were valid reasons for putting in the extra work... but obviously the approach they chose was wrong.
But... it seems like your raw data would be protected from such side-channel attacks though if your home-grown encryption was the *first* line of defense instead - any vulnerabilities would then only expose the battle-tested encrypted stream, would they not?
I'm not sure what you're thinking of as "first" (which direction), but if you did something like this you'd want to make sure that AES, or similar, is what operates directly on your actual data. "Encrypting" the already AES-encrypted ciphertext with your homegrown thing can't reduce the security of AES, and can't expose anything via side channels because all it would expose is the AES-encrypted data.
OTOH, you're really, really unlikely to gain anything at all by doing that. If you want to defend yourself against an AES break, superencrypt with a different well-known and well-tested algorithm, ideally one that uses a very different construction.
However, if your system is insecure I guarantee AES won't be the reason. It'll be your key generation or key management practices, or misuse of block modes (e.g. reusing IVs or nonces), failing to authenticate, etc. And the non-experts who contemplate layering something on AES will almost certainly screw up some other piece of the puzzle and produce an insecure system.
Unless there's some interaction between the two, such that one reverses some property of the other, then the combination should be at least as secure as either. I don't expect that would be the case with any of the important algorithms.
However, you're not going to gain any security by doing that, either, unless you're hedging against the possibility that one of the two gets completely broken. I don't think that's very likely with something like AES. If you really want to make sure you've achieving good security, you should focus on the rest of what you're doing: encryption mode, source of randomness for IV and key generation, key management, etc. Those are the areas you're actually likely to have problems, not AES.
RTD has quite good service to DIA. When I lived near Boulder I almost always took the bus to the airport. It makes few stops, runs regularly and is inexpensive. If you haven't looked into it, you should.
No one who knows what they're doing creates new crypto for production work
In the generalized cases, I fully agree with you. However, the successful suites of cryptography software were written by someone, presumably someone who knew what they were doing, so I'd wager that the statement is a bit over broad. Might I suggest...Only a tiny fraction of people who know what they are doing even manage to do it successfully
No.
The statement is precisely accurate, not overbroad at all. Yes the suites were created... but not for production use. All of the bits and pieces were created first, then analyzed and attacked for years, and only then put into production.
And as the raft of SSL implementation and protocol bugs over the last year demonstrate quite conclusively, many of them are still put into production too soon.
Slashdot Mirror
Specifically, all corporate taxes paid come from three categories of individuals: consumers, who pay higher prices for items to cover the taxes; employees, who make lower wages to cover the taxes; and shareholders, who earn lower returns (and note that the two former categories are often also shareholders, via their pension plans). Suppliers can also lose, but they're generally corporations as well, with their own employees and investors who actually eat the loss. In the long run, though, the investors don't lose because capital flows away from lower returns and towards higher ones. So companies must find ways to keep their returns up to somewhere near the mean rate of return.
Once you understand that no taxes are paid by corporations, ever, then you should also recognize that corporate taxes are not only ultimately paid by individuals, but the individuals almost never realize they're paying it. How many people know their prices would be lower, wages higher, or pension more secure, if it weren't for corporate taxes? And, therefore, how many voters have any interest in opposing corporate taxation? To politicians and voters, corporate taxes look almost like free money. Ratchet up the corporate taxes and no people get hurt, just those nasty corporations. (Actually, politicians sometimes get even more value out of threatening corporate taxes than enacting them, since it tends to encourage said corporations to buy off, er, donate to their re-election funds.)
I assert that while taxes are necessary, the electorate should see and understand exactly what they're paying, so they can evaluate the value they're receiving for the money they're paying. Hidden taxes are evil, and therefore corporate taxes are evil, and should be abolished, not raised.
Global warming is a sloooooooooooooooooow process
Not necessarily. Greenland ice core records show that in the past the planet has seen temperature shifts of up to 7 C in as little as 30 years. 7 C is huge. It's like transporting Moscow to Rome. Of course, we have no idea what caused such rapid changes in the past. It wasn't CO2 levels, or particulates.
i would not be surprised if humans died off within a couple centuries after that.
I would. If one or more isolated populations managed to survive more than a couple of generations after the event, I think it's highly likely that they'd continue to survive indefinitely. The worst of the changes would be past, and they'd clearly have learned how to survive in the new environment, else they'd have died sooner.
Human intelligence makes us highly adaptable, as evidenced by the extraordinary diversity of environments in which we live, and lived even before the advent of modern technology. Humans who lack the necessary knowledge of how to survive in a particular environment are at severe risk of death any place on the planet, but if they manage to survive for even a year or two, odds are that they'll have learned enough to be able to extend that time almost indefinitely.
Frequently because I think the interviewer (probably not Musk) is some jackass who heard Google or Microsoft gives people brain teasers
Which is doubly annoying/funny because Google, at least, doesn't give people brain teasers.
Well that was my point about having very plastic brains. I'm not a neuroscientist, and I don't know how much details like (I have specifically four major appendages to control; two arms, two legs) are baked into the brain from day 0, vs. being just one of the configurations to which a very young brain can adapt.
You missed the point, I think.
The bionic foot in the article doesn't receive signals directly from the brain. It receives signals as they arrive at existing muscles. So we're talking about a brain that has already been wired naturally to control normally-grown muscles, and hijacking that message to also actuate motors. To use this process for additional limbs, you'd have to have a person who had grown those limbs to begin with.
But that hard work they did doesn't mean their success did not depend on their luck as much as it did on their work.
There's a great little (light, easy-to-read) book "The Drunkard's Walk: How Randomness Rules Our Lives" which explains this very well in the last chapter. The truth is that randomness plays a huge role in success and failure of all sorts of endeavors. BUT, as the book points out with extensive examples, that doesn't mean we're powerless and just have to accept whatever the random dice of fate serve up for us. We can work hard to weight the dice a little, but even more important, we control how many throws of the dice we get. Successful people are those who are smart, hard-working and persistent
Had SpaceX not gotten the NASA contract, Tesla would undoubtedly have suffered, and Musk would have been scrambling to save it. I'd give him good odds of succeeding, too, either with alternative financing, or by closing the doors and starting over, or... something. And maybe he wouldn't have managed it, but I guarantee he wouldn't just have given up and said "Well, bad luck, I'm out". Because people who would do that don't get to where Musk is, no matter how lucky they are.
It's not up to the EU to facilitate their compliance with the laws that have existed for decades.
But it is up to the EU to define what the laws mean. And they haven't done that. If you're going to regulate, regulate. If not, not.
Even now, I don't like the fact that i have to care exactly how they implement right to be forgotten.
Since the "right" is imposed by regulation, the best way to address that problem would be for the EU to define the standards and the process to be followed, and to provide regulatory oversight to ensure the legally required standards are being met, rather than punting the problem to Google to figure out.
Or get rid of the silly "right". That'd be even better, actually.
(Disclaimer: I work for Google but this post contains only my personal opinions.)
I think the answer here is that an NFL career pays rather better than an Academic one. If he can retire with his faculties intact, he won't have to chase grants and prizes to be comfortable.
This. Given that he's a lineman he's actually got a pretty good chance of avoiding CTE. Linemen collide on every play, but they do it at relatively low speed, since they only have about two feet in which to accelerate. If he's cautious with his head, careful with his money, and keeps his career short, Urschel has a good chance of walking away intact and independently wealthy after four or five years.
Don't forget RC2, which is pretty badly broken. Rivest does have a better track record than most cryptographers, though.
You're comparing AES to an easily-picked lock? You should make a YouTube video of AES cracking. You'll become wealthy.
You describe the process in another comment as "Some Javascript downloaded from Google scans all the text you enter..." Oh, now I get it. So it doesn't log your keystrokes, it just monitors all the text you type. Thanks for the distinction.
What do you mean by "monitors"? It monitors the text you type in exactly the same way that your web browser does, or your keyboard, for that matter. That is, it performs local computations on your keystrokes. Your web browser takes the additional step (sometimes) of sending network messages if you type certain things. In that way, the password alert extension is different, because it never does that.
Look at the biggest killers in the past century -- Hitler, Stalin, Chairman Mao, etc.
Not just the last century, either. In terms of percentage of humanity extinguished, the biggest killer of all time was Genghis Khan. He was religious (Animist), but his aggression had nothing to do with religion and he was very tolerant of religious differences in the peoples he conquered. Assuming there were any left.
they're heavier than windows
I don't expect that to be true for much longer. I'm not entirely sure it's true now, considering the fact that punching big holes in the skin means that additional structural reinforcement is required.
BTW, FalleStar, I reported your attack to the Password Alert team. They've made a number of changes which defeat your attack as well as a large class of similar attacks. The new release hasn't been pushed out to users yet, I don't think, but I'd expect you'll see an update before too much longer.
The Password Alert team thanks you for your report. Actually, they thanked me, but I didn't do anything other than pass messages, so I'm passing it along to you.
Too bad there's no Vulnerability Reward Program for Password Alert :-)
RTFA. It doesn't log keystrokes, and doesn't send anything off your machine.
Some Javascript downloaded from Google scans all the text you enter, hashes it, and compares it with a locally-stored hash. It doesn't send any of what you type anywhere off your machine. Not wrong, or scary, and it's all open source so you can verify what it's doing. For that matter, you can use the Chrome dev tools to set breakpoints and step through it.
There have been some articles about this with respect to Google's cars, and making the cars act more like human drivers is a key piece of what Google is working on.
Here are a couple:
http://www.govtech.com/fs/news/Googles-Self-Driving-Cars-Learning-to-Deal-with-the-Bizarre-.html
http://theoatmeal.com/blog/google_self_driving_car
However that's about more subtle issues of body language and negotiation. As for the scenarios you cite, it's easy:
For example, huge puddle on the road, most humans would unwisely drive through it. What would AI do?
Most likely gently slow and stop. If it couldn't do that in time, it would go through. Remember that the self-driving car has 360 degree vision; so if what you're worried about is that it'll just suddenly slam on the brakes, it won't. It knows where the vehicles behind it are.
What about a hobo at the end of the offramp begging for change?
Give him space.
Would AI freak out about pedestrian on the road?
If you want to know, google it. There are a bunch of videos from Google, showing how the cars interact with pedestrians and cyclists. The article above from theoatmeal mentions that while the author was riding with it, he thought at one point the car was waiting when it should have gone, only to find out that the car had seen a cyclist approaching on the other side of a hedge. That's a case where the automated car acted different from a human driver, because it had more information than a human driver. And that was a good thing.
TLDR: there are more assholes than hobbyist cartographers.
Actually, I don't think there are. Keep in mind that MapMaker isn't new; it's been open for years and working reasonably well. There's just been an uptick in usage (valid and vandalism) that has swamped the old moderation system. So, they need to improve the moderation system, then it'll be back on line.
In fact, you can use AES but not the recommended default values. Satoshi did this with Bitcoin, just in case the NSA was recommending those values for a reason.
No, Satoshi did not change any values in AES. Satoshi chose a less-common curve for ECC, nothing to do with AES.
isn't it more work to make your own shitty encryption? are these people retarded?
Foolish, yes, but not completely retarded. If you look at the details, it's pretty clear that what they were trying to do was to build something really, really fast, so they could process huge volumes of packets on lower-spec hardware, with less generated heat, etc. There were valid reasons for putting in the extra work... but obviously the approach they chose was wrong.
But... it seems like your raw data would be protected from such side-channel attacks though if your home-grown encryption was the *first* line of defense instead - any vulnerabilities would then only expose the battle-tested encrypted stream, would they not?
I'm not sure what you're thinking of as "first" (which direction), but if you did something like this you'd want to make sure that AES, or similar, is what operates directly on your actual data. "Encrypting" the already AES-encrypted ciphertext with your homegrown thing can't reduce the security of AES, and can't expose anything via side channels because all it would expose is the AES-encrypted data.
OTOH, you're really, really unlikely to gain anything at all by doing that. If you want to defend yourself against an AES break, superencrypt with a different well-known and well-tested algorithm, ideally one that uses a very different construction.
However, if your system is insecure I guarantee AES won't be the reason. It'll be your key generation or key management practices, or misuse of block modes (e.g. reusing IVs or nonces), failing to authenticate, etc. And the non-experts who contemplate layering something on AES will almost certainly screw up some other piece of the puzzle and produce an insecure system.
Unless there's some interaction between the two, such that one reverses some property of the other, then the combination should be at least as secure as either. I don't expect that would be the case with any of the important algorithms.
However, you're not going to gain any security by doing that, either, unless you're hedging against the possibility that one of the two gets completely broken. I don't think that's very likely with something like AES. If you really want to make sure you've achieving good security, you should focus on the rest of what you're doing: encryption mode, source of randomness for IV and key generation, key management, etc. Those are the areas you're actually likely to have problems, not AES.
RTD has quite good service to DIA. When I lived near Boulder I almost always took the bus to the airport. It makes few stops, runs regularly and is inexpensive. If you haven't looked into it, you should.
No one who knows what they're doing creates new crypto for production work
In the generalized cases, I fully agree with you. However, the successful suites of cryptography software were written by someone, presumably someone who knew what they were doing, so I'd wager that the statement is a bit over broad. Might I suggest...Only a tiny fraction of people who know what they are doing even manage to do it successfully
No.
The statement is precisely accurate, not overbroad at all. Yes the suites were created... but not for production use. All of the bits and pieces were created first, then analyzed and attacked for years, and only then put into production.
And as the raft of SSL implementation and protocol bugs over the last year demonstrate quite conclusively, many of them are still put into production too soon.