S/MIME which used asymmetric encryption through the entire message and was thus cripplingly slow
This is untrue. S/MIME always used asymmetric encryption to wrap a symmetric key, and the symmetric key to encrypt the data. http://www.rfc-editor.org/rfc/...
Obtain the keys from a manufacturer in one nation hostile to the NSA, permute them in another?
Or how about generating 1/2 the key in one country and 1/2 the key in another?
So... manufacture all the devices, then ship them to another country, to a facility under a different organization's control, modify them all, then ship them out for distribution?
Not sure about the Google and Android solutions, but you don't need a network or cell connection to use ApplePay
Nor with Google Wallet.
Also, I dunno about you, but I always have my phone in my pocket, just has handy as my wallet, but with my wallet, I need to remove a card, swipe it, and usually either sign or enter a code.
My phone is actually handier than my wallet, because I use my wallet less and keep it in a less accessible pocket. Actually, most of the time while I'm in a checkout line my phone isn't in my pocket, it's in my hand.
(Disclaimer: I work for Google and bits of my code support Google Wallet. However, I was a fan of NFC payment before joining Google, and whether it's Google, Apple or someone else I'm really glad to see it finally taking off.)
The first article says they are just storing a secret key on the SIM and on the network provider's systems. That is just dumb and was totally insecure even before this happened. They should be using privat/public key pairs in which the private key is generated on and never leaves the SIM.
Symmetric cryptography is not "totally insecure", and there's no reason to accept the complexity, large key size and performance hit of asymmetric cryptography when there's a perfectly reasonable key distribution mechanism in place. Further, your proposal wouldn't even help... who cares if the private key was never off the chip? Given a public key how do you know that the corresponding private key was ever on any chip? Answer: You need to obtain the public key in a secure fashion in a controlled environment, such as during manufacturing. If you drill down on the requirements for the context and process needed to identify that public key as trustworthy you find that you have exactly the same requirements for a secure symmetric key injection, which is much simpler and easier to manage.
And as for attack by NSA/GCHQ, if those are your opponents, and they're actually focused on you, you can't win. At most you can make them work for it a bit, but not very much. So it really doesn't make much sense to include national intelligence agencies in your threat model.
Heh. I'm wrong a lot, definitely. Anyone who says they aren't is lying.
In that particular case, however, I never said what you claim I did. I never took a position one way or the other on hosts files as an ad-blocking tool. I just said you're annoying... and I greatly appreciate your continuing to demonstrate the fact!
It comes from this article, which if you haven't seen, you might enjoy reading.
Thanks. I actually read The Cathedral & The Bazaar shortly after ESR published it, and have read it several times since. I'm really not sure how the "many eyes" notion got associated with Torvalds in my head.
The [many-eyes] hypothesis doesn't even come into play until the existence of the bug is known.
If that is so, then it doesn't help much with security, where finding exploitable bugs (and doing so before they are exploited) is usually the hard part.
Precisely. It's not that the hypothesis is wrong, it's just that it doesn't apply.
This doesn't reduce the value of open source for security software, because while it gives both white hats and black hats a great deal of help with finding vulnerabilities, the nature of security research means that the white hat side benefits more. Open source software, developed in public, also makes it more difficult for the likes of the NSA to insert back doors, because it's not just a matter of paying (or threatening) some company to insert the compromise. That's not to say it can't be done. I'm quite certain it is done. But it's harder, and it's more likely to be discovered and removed.
This. The problem with porn is that it presents an extremely skewed view of sex, which can seriously interfere with a normal, healthy sex life. Most people don't look like porn stars, and many -- especially women -- have no interest in doing many of the acts commonly portrayed. Anal sex, for example, is a porn staple but something relatively few women have any interest in. Porn also presents sex as a casual and purely physical thing for the most part, which leads people -- especially but not exclusively young people -- to see casual hookups as a good thing, while in reality most people who pursue a lifestyle of casual sex find it to be unfulfilling. And then there are the dangers of unprotected sex, which porn also portrays and thereby encourages.
I've read stories of men who found that they had to close their eyes and envision their favorite porn star in order to climax with their girlfriend or wife. That is really, really sad, because it means that they're missing out on the deepest part of the sexual experience, the bonding with a life partner.
In a nutshell, porn can and often does ruin real sex, replacing it with a shallow imitation.
Yeah, but you can just shove them all in a folder and forget about them and use whatever third party apps you want. Or you can root your phone and erase or lock them down.
Or disable them. They're still on the/system partition then, but can't run and their icons don't show up.
Newer versions of Android (I'm wanting to say 4.3 or above, but I'm not certain) allow you to disable those, which includes removing the icon for them and making sure they can't run.
An electrical outlet is not at the boundary of a closed thermodynamic system. With an electric car, the waste heat is produced at the power plant before the energy is converted to electricity and sent on its way to you in the first place.
Of course. And there are also transmission losses. However, large plants have significantly higher efficiencies than small engines. Net, EVs powered by oil-fired power plants use less oil per mile traveled than gasoline engines, by a large margin, even when you include electric cabin heat.
I looked it up to verify and actually it's about a 10% loss, so 90% efficiency. There are several manufacturers, so quite a bit of information available on-line. Here's one: http://www.evwireless.net/
But how much pollution is created with the creation of solar panels?
Large scale solar power plants don't usually use solar panels. They are of the Concentrated Solar Power variety. The environmental impact of producing the large number of mirrors and motorized mounts required for these plants is pretty small.
If she neglects filling up the tank when it gets low, she'll likely also neglect plugging in the car at night.
If this is a problem, it's fairly easy to mitigate, assuming you have a dedicated parking spot (e.g. a garage): Install wireless charging. You take a hit on charging efficiency of about 25%, but considering that electricity is 1/4 the cost of gasoline that's not a killer. With that, every time you park at home, you're charging.
I've seriously considered installing it for my Nissan LEAF. It's kind of pricey, though, about $4K for a system. That would be okay if I were certain I could use it for 20 years or so, but the industry is in its infancy and standards aren't yet well-established.
Slashdot Mirror
S/MIME which used asymmetric encryption through the entire message and was thus cripplingly slow
This is untrue. S/MIME always used asymmetric encryption to wrap a symmetric key, and the symmetric key to encrypt the data. http://www.rfc-editor.org/rfc/...
Blame Google for not implementing it in Gmail -- Then they wouldn't be able to get ad revenue and user metrics from their "free" email service.
Google is working on it: http://googleonlinesecurity.bl...
Obtain the keys from a manufacturer in one nation hostile to the NSA, permute them in another? Or how about generating 1/2 the key in one country and 1/2 the key in another?
So... manufacture all the devices, then ship them to another country, to a facility under a different organization's control, modify them all, then ship them out for distribution?
That's not going to increase costs at all :-)
Not sure about the Google and Android solutions, but you don't need a network or cell connection to use ApplePay
Nor with Google Wallet.
Also, I dunno about you, but I always have my phone in my pocket, just has handy as my wallet, but with my wallet, I need to remove a card, swipe it, and usually either sign or enter a code.
My phone is actually handier than my wallet, because I use my wallet less and keep it in a less accessible pocket. Actually, most of the time while I'm in a checkout line my phone isn't in my pocket, it's in my hand.
(Disclaimer: I work for Google and bits of my code support Google Wallet. However, I was a fan of NFC payment before joining Google, and whether it's Google, Apple or someone else I'm really glad to see it finally taking off.)
The first article says they are just storing a secret key on the SIM and on the network provider's systems. That is just dumb and was totally insecure even before this happened. They should be using privat/public key pairs in which the private key is generated on and never leaves the SIM.
Symmetric cryptography is not "totally insecure", and there's no reason to accept the complexity, large key size and performance hit of asymmetric cryptography when there's a perfectly reasonable key distribution mechanism in place. Further, your proposal wouldn't even help... who cares if the private key was never off the chip? Given a public key how do you know that the corresponding private key was ever on any chip? Answer: You need to obtain the public key in a secure fashion in a controlled environment, such as during manufacturing. If you drill down on the requirements for the context and process needed to identify that public key as trustworthy you find that you have exactly the same requirements for a secure symmetric key injection, which is much simpler and easier to manage.
And as for attack by NSA/GCHQ, if those are your opponents, and they're actually focused on you, you can't win. At most you can make them work for it a bit, but not very much. So it really doesn't make much sense to include national intelligence agencies in your threat model.
You're wrong a lot from what I read here http://slashdot.org/comments.p...
Heh. I'm wrong a lot, definitely. Anyone who says they aren't is lying.
In that particular case, however, I never said what you claim I did. I never took a position one way or the other on hosts files as an ad-blocking tool. I just said you're annoying... and I greatly appreciate your continuing to demonstrate the fact!
No reason to leave me hanging. I expect you to respond to EVERY post I make. Don't slack!
To quote you:
An efficient system wouldn't produce the waste heat to begin with.
Pedantically, I was wrong. But I think it was obvious I was speaking of a system producing so much waste heat that it was usable for cabin heating.
I missed you, man. What happened, anyway? Why did you disappear?
It comes from this article, which if you haven't seen, you might enjoy reading.
Thanks. I actually read The Cathedral & The Bazaar shortly after ESR published it, and have read it several times since. I'm really not sure how the "many eyes" notion got associated with Torvalds in my head.
The [many-eyes] hypothesis doesn't even come into play until the existence of the bug is known.
If that is so, then it doesn't help much with security, where finding exploitable bugs (and doing so before they are exploited) is usually the hard part.
Precisely. It's not that the hypothesis is wrong, it's just that it doesn't apply.
This doesn't reduce the value of open source for security software, because while it gives both white hats and black hats a great deal of help with finding vulnerabilities, the nature of security research means that the white hat side benefits more. Open source software, developed in public, also makes it more difficult for the likes of the NSA to insert back doors, because it's not just a matter of paying (or threatening) some company to insert the compromise. That's not to say it can't be done. I'm quite certain it is done. But it's harder, and it's more likely to be discovered and removed.
Yay, my AC stalker is back!
This. The problem with porn is that it presents an extremely skewed view of sex, which can seriously interfere with a normal, healthy sex life. Most people don't look like porn stars, and many -- especially women -- have no interest in doing many of the acts commonly portrayed. Anal sex, for example, is a porn staple but something relatively few women have any interest in. Porn also presents sex as a casual and purely physical thing for the most part, which leads people -- especially but not exclusively young people -- to see casual hookups as a good thing, while in reality most people who pursue a lifestyle of casual sex find it to be unfulfilling. And then there are the dangers of unprotected sex, which porn also portrays and thereby encourages.
I've read stories of men who found that they had to close their eyes and envision their favorite porn star in order to climax with their girlfriend or wife. That is really, really sad, because it means that they're missing out on the deepest part of the sexual experience, the bonding with a life partner.
In a nutshell, porn can and often does ruin real sex, replacing it with a shallow imitation.
Rather, I'd say that it's a somewhat reduced inefficiency during the winter. An efficient system wouldn't produce the waste heat to begin with.
Not going to happen without violating the second law of thermodynamics.
Obviously, some waste heat will always be produced. Internal combustion engines, however, waste 75% of the input energy as heat.
He's back!
But there are no ways of generating power that don't produce waste heat.
Some produce much more than others, though.
Torvald's didn't say the "many eyes" thing at all. Eric S. Raymond did.
Really? Wow. I've had that attribution wrong for years. Thanks.
Yeah, but you can just shove them all in a folder and forget about them and use whatever third party apps you want. Or you can root your phone and erase or lock them down.
Or disable them. They're still on the /system partition then, but can't run and their icons don't show up.
Newer versions of Android (I'm wanting to say 4.3 or above, but I'm not certain) allow you to disable those, which includes removing the icon for them and making sure they can't run.
Starting with 5.0 there's another potential improvement: http://www.androidauthority.co...
An efficient system wouldn't produce the waste heat to begin with.
Let me know when you figure out how to burn something without producing heat.
There are lots of ways to generate power that don't involve burning anything.
An electrical outlet is not at the boundary of a closed thermodynamic system. With an electric car, the waste heat is produced at the power plant before the energy is converted to electricity and sent on its way to you in the first place.
Of course. And there are also transmission losses. However, large plants have significantly higher efficiencies than small engines. Net, EVs powered by oil-fired power plants use less oil per mile traveled than gasoline engines, by a large margin, even when you include electric cabin heat.
I looked it up to verify and actually it's about a 10% loss, so 90% efficiency. There are several manufacturers, so quite a bit of information available on-line. Here's one: http://www.evwireless.net/
But how much pollution is created with the creation of solar panels?
Large scale solar power plants don't usually use solar panels. They are of the Concentrated Solar Power variety. The environmental impact of producing the large number of mirrors and motorized mounts required for these plants is pretty small.
If she neglects filling up the tank when it gets low, she'll likely also neglect plugging in the car at night.
If this is a problem, it's fairly easy to mitigate, assuming you have a dedicated parking spot (e.g. a garage): Install wireless charging. You take a hit on charging efficiency of about 25%, but considering that electricity is 1/4 the cost of gasoline that's not a killer. With that, every time you park at home, you're charging.
I've seriously considered installing it for my Nissan LEAF. It's kind of pricey, though, about $4K for a system. That would be okay if I were certain I could use it for 20 years or so, but the industry is in its infancy and standards aren't yet well-established.
As Hog said, you waste it all in the summer. It's an added efficiency to the whole system in the winter.
Rather, I'd say that it's a somewhat reduced inefficiency during the winter. An efficient system wouldn't produce the waste heat to begin with.