Slashdot Mirror


User: Anthony+Mouse

Anthony+Mouse's activity in the archive.

Stories
0
Comments
1,629
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,629

  1. Re:Does Safari for iPad support DNSSEC? on Ask Slashdot: Does SSL Validation Matter? · · Score: 1

    Now I understand where you're coming from. But I've found that any warning at all pushes some customers away. I used to warn visitors that their IE 7 web browser was out of date until I got sternly worded notices from a prospective customer who claimed that some tool required for doing his job was incompatible with IE 8.

    You have to admit that Internet Explorer is a bit of a special case. Microsoft made it easy for web developers to make Windows and IE-only sites using Active X controls with the earlier versions, then realized what a security failure those "features" were and had to remove or break them in the later versions to get past the security nightmare. For most other platforms, anything supported in version N is also supported in version N+1. And the solution that most companies use to work around the IE problem would work just as well as a recommendation for website visitors: Install Firefox or Chrome and use that for all your normal web browsing, but without upgrading Internet Explorer so that can still be used with the ancient cruft that requires it. Or, if explaining all that to the users in a warning is too complicated, just tell Firefox 3.x users "this site is more secure if you use the latest version of Firefox with the DNSSEC add-on" and give exactly the same warning to users of older versions of IE: "this site is more secure if you use the latest version of Firefox with the DNSSEC add-on."

    Incidentally, when are businesses going to learn to stop letting themselves get kicked in the teeth like this? We ran into an issue like this a while ago: The accounting people had an application that required IE6, the advertising people had an application that required IE7 or higher (and not Firefox or Webkit). Then they decided the accounting people needed to be able to audit numbers in the advertising system. Say hello to third party hacks or virtual machines to get them both running on the same computer.

    Then they'll think they have a fake AV problem.

    And if they take it to anyone to try to get it fixed, one look at it and the tech will fix it by installing support for DNSSEC, no?

    Then they'll respond to inquiries with "We've discontinued that model, and we do not produce system software updates for discontinued hardware. To make these warnings go away, pay the ETF and buy this year's model of our device."

    Right, and then the hardware maker will be the one losing customers because their customers will realize that they're subjecting themselves to a single vendor who only supports their devices for half as long as people actually continue to own them.

  2. Re:Does Safari for iPad support DNSSEC? on Ask Slashdot: Does SSL Validation Matter? · · Score: 1

    If a site offers only a DNSSEC cert and not a domain-validated CA cert, people without the plug-in who click through to check out will get a self-signed certificate warning and think the business isn't reputable.

    The idea is not to get rid of CAs while some large fraction of people can't use DNSSEC. The idea is to use both in the interim, but push your customers toward getting their platforms to support DNSSEC by warning them whenever they connect without it, so that the day when you can eliminate the CAs comes sooner.

    Even with users who have locked platforms or don't have administrative privileges, if half the web pages they visit start telling you that you need a security update, some of those users are going to contact their administrators or platform maintainers asking for a fix. And it's in their interest to actually produce the fix, both because it gets the users to stop inquiring about it and because it stops making them look bad for maintaining a platform without a valuable security feature.

    Once all major platforms have DNSSEC support available in one way or another, you can change the warning to say that the user's existing configuration will soon be unsupported. Then after a bit longer, change the warning to say that the lack of DNSSEC support is why they're about to get a scary message from their browser because the site is using self-signed certificate for the small percentage of users without DNSSEC support.

  3. Re:They'll just visit your competitor on Ask Slashdot: Does SSL Validation Matter? · · Score: 2

    There are a lot of things that I'm waiting for "until such time as", but I don't foresee "such time" happening within one investment horizon.

    Just because you can't do it immediately doesn't mean it isn't worth pursuing.

    They won't follow that link; they'll just visit the site's competitor.

    I don't see how that would drive traffic to competitors. It doesn't make your service unavailable, it only reminds your customers that they should update their software. For example, try installing the latest version of Firefox while you have an out of date Flash player: As soon as the install finishes you get a page telling you that your Flash player needs an update and supplying a link to Adobe's website to download the update.

    This is true especially in cases where no update to support DNSSEC is available at all for a given platform.

    DNSSEC doesn't strictly require platform support. Someone could pretty easily create a DNSSEC resolver as a browser plugin similar to this one for any given browser.

  4. Re:Web of trust enriches airlines on Ask Slashdot: Does SSL Validation Matter? · · Score: 1

    Is there something wrong with just putting the certificates in the DNS and using DNSSEC?

  5. Re:Get DNSSEC hosted SSL-keys working on Ask Slashdot: Does SSL Validation Matter? · · Score: 3, Insightful

    There is nothing that says you can't use DNSSEC for any clients that support it and certificates signed by traditional CAs for those that don't, until such time as there are so few non-DNSSEC supporting clients that you can do away with the CAs.

    You can even put a scary message on web pages for non-DNSSEC supporting clients saying (truthfully) how their computer is insecure and pointing them to a place where they can update their software to support DNSSEC.

  6. Re:The Supreme Court disagrees on Court: Domain Seizures Don't Violate Free Speech · · Score: 1

    You're confusing copyright with copyright enforcement. Copyright is to some extent in conflict with the first amendment, but there are a bunch of things built into it that try to keep it from actually conflicting: The idea/expression dichotomy, fair use, etc.

    And just because copyright itself, i.e. verbatim copying of others' expression, doesn't violate the first amendment doesn't mean that copyright enforcement mechanisms get a free pass. For example, the government obviously can't prohibit all anonymous speech for the sake of copyright enforcement, because anonymous speech is protected by the first amendment. It seems obvious to me that they also shouldn't be allowed to impede anyone's speech merely on an accusation by the government or a copyright holder before the prospective speaker is given any opportunity to present a defense, in the same way that they can't when a speaker is accused of e.g. defamation.

  7. Re:The message is clear: on Court: Domain Seizures Don't Violate Free Speech · · Score: 1

    They apply to the US domain rojadirecta.com. (gTLDs with US registrars are arguably under US jurisdiction.)

    Let's consider the telephone analogy. You're saying that if I live in Puerto Rico and I have a cell phone with AT&T, the fact that AT&T is a US company allows the US government to seize my phone number if I conduct business in Puerto Rico using my phone which is perfectly legal there but illegal in the US. Does that sound right to you?

    And that's before the more convincing argument, which is the turn-the-tables argument: Is this really how you want the world to work? US companies would have to abide by the laws of any countries where any of their domain registrars, phone companies, software developers, etc. do business: UK defamation laws, French "moral rights", German censorship of anything they consider propaganda, and let's not even get started on China and Russia. No one wants that.

    On top of that, as a result of legitimate businesses not wanting to be subjected to every country in the world's laws, you would end up with a fragmented internet. Each country would have their own registrars, ISPs, etc. and no one would subscribe to one outside of their own country for fear of being subjected to the laws of countries where the service provider does business. And that destroys the enforcement mechanism. So you create fragmentation, prevent US companies from competing abroad since their customers are afraid of being subjected to US laws, seize domains without due process and with a high risk of mistake, and all the while there is no enforcement benefit in doing so.

  8. Re:Summary is sensationalistic on Google's Self Driving Car Crashes · · Score: 2, Insightful

    The other thing to consider is who is at fault for the collision. There are situations where, it doesn't matter who you are, you can't avoid a collision through no fault of your own. Example: You're driving in a construction zone with a car to your left and a construction barrier to your right. A deer jumps over the barrier and lands two feet in front of your car. You only get to choose whether you hit the deer, the barrier or the car to your left. There is no choice that avoids a collision. If a self-driving car is put in that situation, it has the same alternatives, and we shouldn't be at all surprised when some similar situation ultimately occurs.

  9. Re:Can still charge on Harnessing Interference For Faster Wireless Data · · Score: 1

    Given no amount of bandwidth is truly "boundless" or "infinite", some joker will come up with some way to saturate the line 24/7

    Nope, not buying it. The demand for bandwidth is not infinite. Just look at ethernet in a typical business network with a normal file server, traffic to the internet, etc. There is just no scarcity there anymore: Even if you have a "fast" file server, the bottleneck is the disk array, not the 10GbE uplink to the switch. Nothing normal people do even remotely taxes a network with gigabit to the users and 10GbE to the servers.

    The fact is that consumption does not increase linearly with capacity because the more capacity the network has, the more likely it is that the bottleneck lies somewhere else, and increasing capacity only causes network utilization to increase where the network was previously the bottleneck. There comes a point where increasing capacity will not cause any increase in utilization whatsoever by 99.9999+% of users. Even if there exists a couple of asshats who just consume all available bandwidth for sport, there are very few of them and their cost can be amortized into pennies across the millions of normal users who don't do that.

  10. Re:google ip theft on Nortel Patent Sale Gets DoJ Review · · Score: 1

    Your entire post is wrong because you're confusing copyright (which the GPL uses) with software patents (which are the things that Google -- and everyone else -- is violating, because it is impossible to make any nontrivial software without doing so).

  11. Re:So one intent is better than another? on Nortel Patent Sale Gets DoJ Review · · Score: 1

    a rectangular block with an edge-to-edge screen

    This is just ridiculous.

    Let's say that you want to design a phone with the following design consideration: It should have a large screen, but the phone itself should otherwise be as small as possible. What do you imagine it would look like, if not that?

  12. Re:So one intent is better than another? on Nortel Patent Sale Gets DoJ Review · · Score: 1

    How are either offensive or defensive patents better than the other really?

    The thing that amazes me is that people don't seem to understand what that even means. A patent is, as the analogy goes, a nuclear weapon. It is not a missile defense shield. Its defensive use exists only in the sense that having it will cause your competitors to fear your retaliation if they attack you. It remains the case that you can either assert it or not, and taking the option off the table would make the patent worthless defensively as well as offensively.

    More importantly, the idea of using an inherently offensive weapon defensively is that it will avoid the war in the first instance. They've already filed the lawsuits. If you are already waging the war, a weapon can hardly serve as a deterrent. At best it's the threat of another attack hanging over settlement negotiations.

    All of this seems like asking the wrong question. It seems clear to me that their goal in buying these patents is not to shore up their patent portfolios, which were already sufficient and in any event can't serve as a deterrent to a war already being fought. And I'm not at all sure they even necessarily wanted use these specific patents offensively. The purpose was rather to deny Google the means to defend Android from their existing attacks.

  13. Re:We had this happen at a previous job on Ask Slashdot: Dealing With the Business Software Alliance? · · Score: 1

    You've misspelled trillions.

  14. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    I don't think you're getting what I'm saying.

    Governments don't control currency exchange rates outside their own borders. They can only do things that affect exchange rates. In particular, increasing the value of a currency is extremely difficult, because you have to either grow your economy (which is hard to do) or remove existing currency from circulation (which is very expensive).

    On the other hand, reducing their value of currency is easy -- you make more of it. And then you get inflation, which almost a synonym for currency devaluation. The idea that you could give every man, woman and child $30K without causing any inflation is ridiculous. The thing to keep in mind is that that doesn't disqualify it from being a good idea: It would cause the nominal price of goods and services to increase somewhat, but who cares? Everybody has an extra thirty grand to cover the higher prices.

    This is especially true because of the fact that doubling the income of everyone won't double the price of everything, even if it will increase prices by more than nothing. For one thing, a large chunk of that money would immediately be destroyed, because people would use it to pay their debts and paying a debt "destroys" money. If you want to be especially effective, give everybody $50K but for anyone who has a mortgage or any other form of debt you require that they take it as a $50K credit against their debt principal rather than as cash. See what effect you get on the economy when half of everybody's paycheck isn't going to interest payments anymore. (But the banks would hate it with the fire of a thousand stars, obviously.)

  15. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    And then the hyperinflation cycle starts.

    Not if you do it right. You don't have to print all $15T in one year. Make sure that the number of outstanding bonds maturing each year is roughly consistent, and if not then at the outset buy bonds on the open market which mature in years when too many bonds mature and pay for them by issuing new bonds that mature in years when not as many outstanding bonds mature. Then you print a moderate amount each year to cover the bonds which mature in the same year, so that over a period of a decade or two most of the debt is paid and the remainder is of a manageable size. The amount per year wouldn't be out of line with what they've already been printing over the last couple of years.

    And moderate inflation would cut significant hole out of the continuing housing crisis by making the nominal value of people's homes greater compared with the amount they owe on their mortgages.

    The hardest part is actually going a decade or two with an approximately balanced budget, because you're not borrowing any new money and the money being printed is going to pay off the existing debt.

  16. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    You're assuming they need to continue to borrow money. If they start printing instead of borrowing then no new bonds issue for which higher interest must be paid.

  17. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    No, infrastructure spending doesn't increase employment. At best it's a net breakeven.

    It's breakeven if you create a broad-based tax and spend it on a diverse set of arbitrary projects. In a specific instance it depends entirely on what you tax and what you do with the money. If you tax things that are wasteful, harmful or inefficient (e.g. cigarettes, foreign oil, low-deductible or supplemental insurance policies, luxury goods) and spend the money on economically positive projects (e.g. highway construction, installing fiber/conduit, student loan forgiveness, small business loan subsidies) then the net economic effect can be positive. If you tax things that are economically beneficial (e.g. road use, small businesses, internet access, computing devices) and spend the money on wasteful projects (e.g. no-bid contracts, war, handouts, corporate welfare) then you will cause economic harm.

    In general the key is to keep spending targeted. If you have any single program which is consuming more than $100B/year, chances are you would be better off to reduce its budget and either spend it on something else or lower taxes on economically efficient activities.

  18. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    That's the point of the exercise. You take the coin and deposit it at the federal reserve and they credit your account with $5T. Then you tell them you want to withdraw $100B, they debit your account by that much, print the money and give it to you.

    This is the exact same thing as what happens when the government issues bonds. The federal reserve buys them with money it printed. The only thing different about this is that it gets around the debt limit.

  19. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    Right, sorry. You do have the alternative of raising taxes and then setting fire to the money you've collected. Assuming you're not concerned about the ensuing riot.

  20. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    That rule is pure psychology based on greed...

    It's not psychology, it's supply and demand. If you print money then you create new demand. Whoever has the money wants to spend it and get stuff. But there are things that have inelastic supply -- you can't cost-effectively create new land or petroleum, so the holders of the new money get into a bidding war over those finite resources and the price goes up.

  21. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 1

    That should read: and shifting that marker only punishes savers and rewards debtors, dammit

    Your observation is true, but you're failing to consider that in recent times the debtors have been the US government and its citizens and the savers have been China and bankers. And if you said "shifting that marker only punishes China and bankers and rewards taxpayers and mortgage holders" then people might be inclined to come to a different conclusion about the desirability of that course of action.

  22. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 2

    China says their yuan is worth X amount of dollars and the US says the dollar is worth X amount of euros.

    That's not how that works. The US doesn't set the exchange rate for dollars, the market does. China can only set their exchange rate by intentionally devaluing the yuan by printing them until the exchange rate falls to hit the desired level, and then they get to spend the yuan they printed, generally by buying US dollars and treasury bonds. If you want to intentionally go the other way, you have to provide real value to someone (e.g. labor or resources) in the amount of the currency you want to remove from circulation and then destroy that currency. Nobody wants to do that.

  23. Re:Inflation on Seigniorage Hack Could Resolve Debt Limit Crisis · · Score: 4, Insightful

    A temporary measure at best ... as the bonds are paid off money gets destroyed again. Newly minted money inflates the money supply irreversibly.

    But that's the thing. The bonds never get paid off.

    As a factual matter, issuing bonds actually causes more inflation than printing money. Because financial institutions use bonds and cash basically interchangeably, but bonds collect interest. What that means is that if you print a trillion dollars today, it causes a trillion dollars worth of assets to be created on paper today, and that trillion dollars sticks around indefinitely. If you issue a trillion dollars worth of bonds, a trillion dollars worth of assets is created on paper, but when the bonds mature you have to pay back the money with interest. The bonds are never paid with tax money because that would be economically catastrophic -- it would require raising taxes while cutting spending, which is the recipe for a depression. (This is especially so once the interest payments become a nontrivial fraction of the economy and no dent can be made in the principal without first applying substantial tax revenues to the interest.) So maturing bonds are always paid by just issuing more bonds. $1T worth of paper assets turns into $1.2T, then the $1.2T turns into $1.5T and so on. All those extra bonds sit in banks as reserve the same way cash does, which allows banks to make more loans and produce more inflation.

    Ironically, the only way to eliminate the debt without the aforementioned economic catastrophe is to ultimately print money to pay the bonds. And then you end up printing the principal plus the interest, instead of getting out ahead of it and just printing the principal on day one.

  24. Re:I feel like I should... on Security Expert Slams Google+ Pseudonym Policy · · Score: 1

    I'm sure I'm being trolled here considering that of your last 20 posts, 100% of them across five different stories have consisted entirely of criticism of Google, but I'll bite:

    The only reason Google doesn't like anonymity is because they want to get their hands on your personal data to sell it to advertisers.

    Advertisers don't really care about your real name. You can't use just a real name to identify someone because they aren't unique. You can use a name and a bunch of other information, but you can just as well use only the other information even without the name.

    The reason Google wants people to use their real names is that it bootstraps the network. People know each other's names, they don't necessarily know each other's pseudonyms. If everyone signs up for Google+ under a pseudonym then when a new user signs up and goes to search for friends to add to their circles, they can't find as many of them. Maybe they can't find anyone. That makes them far less likely to come back to the service. Incidentally, this is why Facebook had the same policy in the beginning. And I would expect Google, like Facebook, to relax it once the network has a critical mass of users.

  25. Re:Will educating lamens help change the climate? on When Patents Attack — the NPR Version · · Score: 1

    Software patents have always been about raising the cost of entry to new competitors.

    Yes and no. That is certainly an advantage of software patents to large corporations, but it is weighed against on the other side by subjecting the large corporations to shakedowns by patent trolls. Ask Microsoft if they think i4i deserves more than a quarter of a billion dollars of Microsoft's money. To say nothing of what will happen one of these days when a patent troll gets a permanent injunction against a major software company for a patent claim that can't be worked around without breaking protocol or file format compatibility with the version currently in use by customers.

    At the end of the day, the only winners when it comes to software patents are the lawyers. They get paid when companies stockpile patents for defensive purposes. They get paid when their employers file a patent lawsuit. And they get paid when their employers get sued over patents. And all of that paying the lawyers comes out of the coffers of companies that could otherwise be spending that money innovating. The only way the lawyers lose is if people decide that the purpose of software patents should not be full employment for patent lawyers, and get rid of them.