But I believe that employee wages are at the top of the list in Canada. The very first debt that must be paid down is employee wages. THEN secured creditors, etc....
It's not uncommon for some jurisdictions (British Columbia, Canada, for one) to make it illegal to sell liquor (abusive, addictive substance) on credit.
Now.. I'm a cash advocate. I believe in cash. Completely.
Do I use credit cards, atm cards, cheques, etc? Of course> I LIKE them. They are convenient.. and I know I'm trading some privacy for convenience by using them. I have bank accounts. Same deal there.
But they are all services to HELP ME DEAL with my cash... and I still view it that way.
Fundamentally, I can still go the bank, withdraw all my cash, and go somewhere else and deposit it, anonymously.. and that's what it's all about.
Right.. this makes sense,though, doesn't it?
I mean, a court can also demand that you tell the truth about a conversation you had. Of course, if there is no evidence, you can lie...
A court asking me for the keys to some information they found is one thing.. mandatory snooping on all information is another.
You could be asked to do the same in the US, I'm sure... unless they plead the 5th ammendment or something.
Firstly, old references tend to be no good after a while.... if your bank reference is 5 years old... I doubt it will mean much.
Secondly.. in general, those who pay their debts continue to do so.
Thirdly.. a bank isn't going to suddenly let you scam 500,000 bucks or something just because you paid off a couple loans.
IT's not 'extremely complicated'. If you want a bank to loan you money, IT's YOUR responsibility to provide them with evidence that you are trustworthy.
Sorry. That logic is like saying that because someone with a gun could come in and shoot you, you should just obey anyone who might have license to buy a gun.
No, it's NOT wrong of them to go looking for information about you if they are going to loan you money. Background information is very important.
And it can be obtained in other ways. Witness europe... you don't have a unique ID for them to track.. but try dealing with a bank, and you have to provide REFERENCES. That's a foreign concept here in North America, because we are used to these credit reporting agencies doing it for us.
Your employer has your SSN, yes, because he's doing things on your behalf.
Also... credit agencies do not specifically REQUIRE your ssn, and any non-employer type who asks for it usually has an alternate way for you to identify yourself as well.
Is that you do not even NEED identification to travel on airlines. It's acutally ILLEGAL for them to refuse to let you fly if you don't provide ID.
Now.. most clerks will at first say 'but you have to sir'. But if you check with their supervisor, you will find that's not the case. FAA regulations clearly state what to do if a person doesn't have state-given identification.. and the only differences are in how they handle your baggage (making sure you are on the plane before putting your bag on the plane, in some cases, inspecting the bag thoroughly)
I can see it now: mandatory ID for flying. So the government knows who and where you are at all times. Next you'll need ID to cross state lines... or board a bus, eventually to buy groceries.
In that news survey, said they were willing to give up some privacy if it would have prevented the attacks. Well.. what a loaded question.
Would they also be willing to give up that privacy if it would have both prevented those attacks, and meant the government now recorded everything you say? I doubt it.
What if they had outlawed any interstate travel wtihout a license to be presented at each state border? Hmm.. I doubt it.
Also... what's with all the buzz about increased airline security? These hijackers could have used *anything* and accomplished their mission. They did not have big, scary guns or deadly weapons. They had tiny sharp objects, and the threat of a bomb.
I wonder if any changes will be made to FAA regulations regarding travelling without presenting identification (You CAN do this, perfectly legally, by the way... the airlines are NOT allowed to demand identification.. though they have different procedures to follow if you don' thave any, regarding handling of your bags)
The reason government can do wiretaps? because it's possible.. simple. They cannot force you to speak on the phone, or in a language they can understand, though.
The government cannot forbid people from whispering in each other's ear in a huge underground cave (I mean, somewhere they can't eavesdrop)... so why should they be able to forbid you to whisper at a distance, using encryption?
You see.. NONE of these things would have prevented this attack.
You know.. it's funny. On the movies, the night of the attack, on TV, I saw a show all about some kind of post-terrorism america, where you had to have a license to do *anything*. Buying groceries? You had to have a license, and present it, and everything was tracked... in order to prevent terrorism.
First.. these are not all 'microsofts' ideas.. they are very common things that, if most of us think about it, make sense.
As for the distributed web-site thing... sounds a lot like freenet, actually.. information is cached near where it is requested, so others in the area can obtain the information faster, and it becomes more widespread.
The elliptic part... that's not entirely relevant to what they are saying, or to IBE.
What essentially happens here is a key authority generates your private key... and your email address is your public key. SOunds fine.. very efficient.. except that the key authority has copies of *everyone's* key (and knows how to re-generate it, if if they don't keep it)
Let me clarify then...
I've seen a lot of medium-sized operations switch to exchange because of all the 'features'... and basically never use them. THey end up with primarily, a mail server.
I saw one company switch to it just so they could use shared email accounts, for doing tech support.
I never said I would walk into a 'major corporation' and tell them they only need email. Many corporations have big infrastructure that you coldn't change with an army.
I checked my credit card contract.
And as I though...
I am liable for up to $50 of fraudulent charges if they are a result of my *card being stolen*, and I haven't reported it.
The language is quite explicitly clear. I am only liable if my card is physically stolen (lost, etc..).
The $50 limit you specify is a legal one; credit card issuers cannot produce, say, a cardholder agreemnet that makes you responsible for, say, $200 if the card is used incorrectly.. becauset the law says so.
If I were to post my card number to every BBS, the card company could hold me as being negligent; the cardholder agreement does discuss responsible use of the card. And responsible use includes letting them know when it's being used fraudulently.
Now.. maybe, just maybe, my cardholder agreement for my generic classic Visa from the Royal Bank of Canada is better than every other credit card agreement out there... but I doubt it.
I am only resonsible for (potentially) up to $50 in fraudulent charges resulting from the theft of my CARD.
No. They are NOT expected to know that, though most drivers probably do.
Some drivers go to service stations for all of the above, and call their local auto-association to change flats.
You are correct in that most people DO know basic automotive maintenance, even though they are not rquired to. I would expect, also, that most computer administrators would know some basic maintenance.
Of course, with computers & internet access being so cheap and easily available.. what do you expect.
Nope! I'm sorry.. The unix world is no different. You have to update your code when patches become available as vulnerabilities are discovered. The exact same argument would apply.
Having an unpatches system months later.. fair enough you say it might not be the users fault.. or not fair to blame them. but it's not microsoft's fault.. what more can they do than publish and make available the fix?
You got me there. I should clarify, for people like you, that we obviously aren't talking about MS DOS here. Or WinCE. I'd imagine you are just in a bad mood or something?
I'd think most readers would find it obvious what we were discussing. Apparently you need some assistance.
Win2k can't hide anything from the administrator if you set it correctly. Neither will it lie about file extensions if you set them correclty. Neither of those has anything to do with network security, either.
And when I say 'system'.. what the hell did you think I meant? I meant a system involving Microsoft products. You can quabble over the exact definition all you like. NT is a product, so is Windows 2000. NT is also a kernel. Linux is a kernel, and also a product. Blah blah blah..
I'm sorry, but from a realistic point of view, the fact that Windows ships with some services that need to be disabled does not equate to being 'hard to secure'.
A simple procedure applied to new systems fixes it up quickly.
Unix systems have traditionally been no different. Certainly, the openbsd distribution ships with nothing enabled. Fine.... but in the hands of someone unskilled, it becomes just as unsecure as anything else if they start enabling services they need without the proper diligence.
I don't dispute that OpenBSD, indeed, most of the free unixes are basically secure out of the box, where windows & IIS and stuff are not.. but that does not mean they are 'hard to secure', it just means you have to actually take some measures to secure it.
None of my machines have been infected. I follow standard, easy to find methods for securing my systems. Hmmm.....
Many, many people who run the OS have not done *anything, whatsoever* to secure their system out of the box. THey haven't even TRIED.
The presence of this worm is indicative of the average knowledge and aptitude of those running the infected systems... and NOT an indicator of the quality of the OS.
Oh.. I'll agree that it's easier to find information about how to secure unix systems... and the admin generally has a better knowledge of how a new application affects his security.. but in general, this is the case with windows too.
Sorry, I was busy changing continents yet again....
That wasn't a troll. I dispute being called a paid MS troll. I avoid using MS wherever possible, and I dislike them in general.
But having run many, many systems... I'll grant that MS is slightly harder to secure.. in that it's harder to get the information you need.... and that it may not come 'as secure' out of the box....but any sufficiently busy or large server has the same problem. You install software, you have to be aware of what the impact is on the system.
Yes, lots of people are talking about how MS is 'marketed to a different audience'. Or about how the presence of these new 'worms' shows that it's harder to secure... blah blah blah.
To the guy talking about MSDOS and Win98 being 'insecure locally'.. get a grip. That's not the discussion here.
Running windows boxes securely is no harder than running unix boxes securely, I'm sorry. You have to take different factors into account, and you have to get your information from different sources, yes...
And yes, MS policy on publishing patches for exploits might be bad....
But still: blaming home users for not having secure web servers? It's because they were ignorant of how to properly run them, in most cases. Saying that is because it's supposed to be 'easy' to use.. well.. why did the user pick it in the first place?
Uhh.. hence the reason for building this thing.....
You can predict climate a change a lot more easily than you can predict the weather... thats' my point.
You perhaps haven't worked in a real environment...
When you buy a NAS box or something.. you aren't concerned about it being super multi-purpose.
I don't *care* if I can install a web server on a box or not.. when I want a web server, I buy it.
Same goes for Unix. I mean, it's nice knowing some of your servers can double as other things... (more difficult/prohibitive with windows)... but you still don't do it. When you build a big database server.. you don't use it as your web server as well. Etc... etc.. etc..
Slashdot Mirror
But I believe that employee wages are at the top of the list in Canada. The very first debt that must be paid down is employee wages. THEN secured creditors, etc....
It's not uncommon for some jurisdictions (British Columbia, Canada, for one) to make it illegal to sell liquor (abusive, addictive substance) on credit.
Now.. I'm a cash advocate. I believe in cash. Completely.
Do I use credit cards, atm cards, cheques, etc? Of course> I LIKE them. They are convenient.. and I know I'm trading some privacy for convenience by using them. I have bank accounts. Same deal there.
But they are all services to HELP ME DEAL with my cash... and I still view it that way.
Fundamentally, I can still go the bank, withdraw all my cash, and go somewhere else and deposit it, anonymously.. and that's what it's all about.
Why? The only reason you don't want to down the machine for a kernel upgrade is ego? To show a big uptime?
In the *real* world, it's okay to reboot a server as long as you can schedule it to an appropriate time.
Right.. this makes sense,though, doesn't it?
I mean, a court can also demand that you tell the truth about a conversation you had. Of course, if there is no evidence, you can lie...
A court asking me for the keys to some information they found is one thing.. mandatory snooping on all information is another.
You could be asked to do the same in the US, I'm sure... unless they plead the 5th ammendment or something.
Well.. let's get something straight.
Firstly, old references tend to be no good after a while.... if your bank reference is 5 years old... I doubt it will mean much.
Secondly.. in general, those who pay their debts continue to do so.
Thirdly.. a bank isn't going to suddenly let you scam 500,000 bucks or something just because you paid off a couple loans.
IT's not 'extremely complicated'. If you want a bank to loan you money, IT's YOUR responsibility to provide them with evidence that you are trustworthy.
Sorry. That logic is like saying that because someone with a gun could come in and shoot you, you should just obey anyone who might have license to buy a gun.
No, it's NOT wrong of them to go looking for information about you if they are going to loan you money. Background information is very important.
And it can be obtained in other ways. Witness europe... you don't have a unique ID for them to track.. but try dealing with a bank, and you have to provide REFERENCES. That's a foreign concept here in North America, because we are used to these credit reporting agencies doing it for us.
Your employer has your SSN, yes, because he's doing things on your behalf.
Also... credit agencies do not specifically REQUIRE your ssn, and any non-employer type who asks for it usually has an alternate way for you to identify yourself as well.
Think outside the box man.
Is that you do not even NEED identification to travel on airlines. It's acutally ILLEGAL for them to refuse to let you fly if you don't provide ID.
Now.. most clerks will at first say 'but you have to sir'. But if you check with their supervisor, you will find that's not the case. FAA regulations clearly state what to do if a person doesn't have state-given identification.. and the only differences are in how they handle your baggage (making sure you are on the plane before putting your bag on the plane, in some cases, inspecting the bag thoroughly)
I can see it now: mandatory ID for flying. So the government knows who and where you are at all times. Next you'll need ID to cross state lines... or board a bus, eventually to buy groceries.
So... Why don't you just go ahead and take charge of fixing these 'obvious' problems.
Oh. Reiserfs. It's got some things that are not good... so? Who said you had to use it?
And to boot.. what's preventing you from using 2.2.x?
The soviets had trouble removing them because the US was *helping* them, against the russians.
Why are you burnt out? Why do you dislike your work? Is it because of the current job, or because you feel that your career is at a dead end?
An IT union... absolutely not. Are you mistreated in some way? Is the company screwing you over? why do you need a union?
Insane hours? Who is setting your hours? You know, most state laws have rules regarding working hours....
In that news survey, said they were willing to give up some privacy if it would have prevented the attacks. Well.. what a loaded question.
Would they also be willing to give up that privacy if it would have both prevented those attacks, and meant the government now recorded everything you say? I doubt it.
What if they had outlawed any interstate travel wtihout a license to be presented at each state border? Hmm.. I doubt it.
Also... what's with all the buzz about increased airline security? These hijackers could have used *anything* and accomplished their mission. They did not have big, scary guns or deadly weapons. They had tiny sharp objects, and the threat of a bomb.
I wonder if any changes will be made to FAA regulations regarding travelling without presenting identification (You CAN do this, perfectly legally, by the way... the airlines are NOT allowed to demand identification.. though they have different procedures to follow if you don' thave any, regarding handling of your bags)
The reason government can do wiretaps? because it's possible.. simple. They cannot force you to speak on the phone, or in a language they can understand, though.
The government cannot forbid people from whispering in each other's ear in a huge underground cave (I mean, somewhere they can't eavesdrop)... so why should they be able to forbid you to whisper at a distance, using encryption?
You see.. NONE of these things would have prevented this attack.
You know.. it's funny. On the movies, the night of the attack, on TV, I saw a show all about some kind of post-terrorism america, where you had to have a license to do *anything*. Buying groceries? You had to have a license, and present it, and everything was tracked... in order to prevent terrorism.
First.. these are not all 'microsofts' ideas.. they are very common things that, if most of us think about it, make sense.
As for the distributed web-site thing... sounds a lot like freenet, actually.. information is cached near where it is requested, so others in the area can obtain the information faster, and it becomes more widespread.
The elliptic part... that's not entirely relevant to what they are saying, or to IBE.
What essentially happens here is a key authority generates your private key... and your email address is your public key. SOunds fine.. very efficient.. except that the key authority has copies of *everyone's* key (and knows how to re-generate it, if if they don't keep it)
Let me clarify then...
I've seen a lot of medium-sized operations switch to exchange because of all the 'features'... and basically never use them. THey end up with primarily, a mail server.
I saw one company switch to it just so they could use shared email accounts, for doing tech support.
I never said I would walk into a 'major corporation' and tell them they only need email. Many corporations have big infrastructure that you coldn't change with an army.
I checked my credit card contract.
And as I though...
I am liable for up to $50 of fraudulent charges if they are a result of my *card being stolen*, and I haven't reported it.
The language is quite explicitly clear. I am only liable if my card is physically stolen (lost, etc..).
The $50 limit you specify is a legal one; credit card issuers cannot produce, say, a cardholder agreemnet that makes you responsible for, say, $200 if the card is used incorrectly.. becauset the law says so.
If I were to post my card number to every BBS, the card company could hold me as being negligent; the cardholder agreement does discuss responsible use of the card. And responsible use includes letting them know when it's being used fraudulently.
Now.. maybe, just maybe, my cardholder agreement for my generic classic Visa from the Royal Bank of Canada is better than every other credit card agreement out there... but I doubt it.
I am only resonsible for (potentially) up to $50 in fraudulent charges resulting from the theft of my CARD.
No. They are NOT expected to know that, though most drivers probably do.
Some drivers go to service stations for all of the above, and call their local auto-association to change flats.
You are correct in that most people DO know basic automotive maintenance, even though they are not rquired to. I would expect, also, that most computer administrators would know some basic maintenance.
Of course, with computers & internet access being so cheap and easily available.. what do you expect.
Nope! I'm sorry.. The unix world is no different. You have to update your code when patches become available as vulnerabilities are discovered. The exact same argument would apply.
Having an unpatches system months later.. fair enough you say it might not be the users fault.. or not fair to blame them. but it's not microsoft's fault.. what more can they do than publish and make available the fix?
You got me there. I should clarify, for people like you, that we obviously aren't talking about MS DOS here. Or WinCE. I'd imagine you are just in a bad mood or something?
I'd think most readers would find it obvious what we were discussing. Apparently you need some assistance.
Win2k can't hide anything from the administrator if you set it correctly. Neither will it lie about file extensions if you set them correclty. Neither of those has anything to do with network security, either.
And when I say 'system'.. what the hell did you think I meant? I meant a system involving Microsoft products. You can quabble over the exact definition all you like. NT is a product, so is Windows 2000. NT is also a kernel. Linux is a kernel, and also a product. Blah blah blah..
I'm sorry, but from a realistic point of view, the fact that Windows ships with some services that need to be disabled does not equate to being 'hard to secure'.
A simple procedure applied to new systems fixes it up quickly.
Unix systems have traditionally been no different. Certainly, the openbsd distribution ships with nothing enabled. Fine.... but in the hands of someone unskilled, it becomes just as unsecure as anything else if they start enabling services they need without the proper diligence.
I don't dispute that OpenBSD, indeed, most of the free unixes are basically secure out of the box, where windows & IIS and stuff are not.. but that does not mean they are 'hard to secure', it just means you have to actually take some measures to secure it.
None of my machines have been infected. I follow standard, easy to find methods for securing my systems. Hmmm.....
Many, many people who run the OS have not done *anything, whatsoever* to secure their system out of the box. THey haven't even TRIED.
The presence of this worm is indicative of the average knowledge and aptitude of those running the infected systems... and NOT an indicator of the quality of the OS.
Oh.. I'll agree that it's easier to find information about how to secure unix systems... and the admin generally has a better knowledge of how a new application affects his security.. but in general, this is the case with windows too.
Sorry, I was busy changing continents yet again....
That wasn't a troll. I dispute being called a paid MS troll. I avoid using MS wherever possible, and I dislike them in general.
But having run many, many systems... I'll grant that MS is slightly harder to secure.. in that it's harder to get the information you need.... and that it may not come 'as secure' out of the box....but any sufficiently busy or large server has the same problem. You install software, you have to be aware of what the impact is on the system.
Yes, lots of people are talking about how MS is 'marketed to a different audience'. Or about how the presence of these new 'worms' shows that it's harder to secure... blah blah blah.
To the guy talking about MSDOS and Win98 being 'insecure locally'.. get a grip. That's not the discussion here.
Running windows boxes securely is no harder than running unix boxes securely, I'm sorry. You have to take different factors into account, and you have to get your information from different sources, yes...
And yes, MS policy on publishing patches for exploits might be bad....
But still: blaming home users for not having secure web servers? It's because they were ignorant of how to properly run them, in most cases. Saying that is because it's supposed to be 'easy' to use.. well.. why did the user pick it in the first place?
I've *never* had a problem with any of my boxes.
Uhh.. hence the reason for building this thing.....
You can predict climate a change a lot more easily than you can predict the weather... thats' my point.
You perhaps haven't worked in a real environment...
When you buy a NAS box or something.. you aren't concerned about it being super multi-purpose.
I don't *care* if I can install a web server on a box or not.. when I want a web server, I buy it.
Same goes for Unix. I mean, it's nice knowing some of your servers can double as other things... (more difficult/prohibitive with windows)... but you still don't do it. When you build a big database server.. you don't use it as your web server as well. Etc... etc.. etc..