How long will it be before the FBI goes publicly on the attack?
Freedom Hosting was, from what I've been reading over the last couple of days, not only taken over by the FBI and used to inject this code but it also probably hosted half of all child porn *.onion sites extant.
Demonizing the pervs seems like a good way to distract people from the fact that a state entity is now actively running malware that attacks everybody. I'm surprised it hasn't started already.
Does that mean that the FBI was running the site while it still hosted child porn?
I think you could if there was no real basis for that requirement, since to be in the US they have to be able to speak English, requiring a Hindi speaker would be absurd.
American companies outside of the US often require a high level of English as a skill for people they hire so that communication within the company remains practical.
Why should an Indian company like Infosys follow different rules?
Many of the people using Tor in restrictive countries won't have the luxury of switching away from Windows. Even if they don, they won't necessarily know how.
Secondly, it's poor advice. The vulnerability affects Firefox 17....and Firefox is up to 22 now I think. Wouldn't it make more sense for them to make sure the tor browser is hardened and recommend people to use that?
Finally, Using a more recent windows version is actually good for security. ASLR, DEP, a rudimentary MAC implementation, UAC...despite what people say, Windows is actually one of the better operating systems security wise these days. Not just because of the preventive technology that most other OS's don't have (OS X has a lacking and broken implementation, most linux distros are not as complete in their implementations..), but because Microsoft started taking security seriously and vulnerabilities are rare these days.
Whatever, bring on the irrational arguments and Microsoft hate. Is it really too much for a forum of tech nerds to be objective in their analysis?
It would be interesting to know how the 'state' that developed Flame acquired the MS certificate in question.
- compromised using tech that the NSA has that we don't know about?
- bought off the black market after being stolen by some other entity?
- or just given by MS to the 'state'..?
Because no other operating systems or applications have zero day bugs....
Users can not secure themselves against invasive hacking by the US Government.
The best that can be done is probably a VM that's been stripped down to essentials and does nothing but TOR but even that isn't going to keep the NSA out if they want in.
But it would still be better than the current situation where no one knows and we are just trusting their word, which seems to amount to nothing. In addition that type of practice could invoke a change where if your job is solely in the US they cannot have that type of requirement.
It was an example. It's long standing industry practice to tune an RFP based on what the person / company is selling to block competition.
Not sure that you could legally block a company from stating a requirement for a position - even speaking Hindi.
Personally I think any position that is to be sent to a H1B must be posted on a site like USA jobs, then after a certain period of time if no candidate shows up than they can send it over for the visa. All the resumes on the site should be searchable (redacted of identifying data) to ensure they are not cheating. This paid for byt he company wanting to get the visa.
They could just make one of the requirements to speak Hindi (due to having to communicate with the other employees of Infosys).
"Master's degree in information systems and 17 years of experience" does not tell us that she was more qualified than the Bangladeshi hired. I have interviewed too many people who look good on paper only.
It's not a question of who was more qualified.
The law is that they cannot hire someone H1-B unless they cannot find an American who is qualified.
In the United States of Politically Correct America, it is very hard to prove reverse discrimination
I know it's difficult for some to understand, but THERE IS NO SUCH THING AS "REVERSE" DISCRIMINATION. There is only discrimination, regardless if you are white, black, brown, male, female, or transgender.
Reverse discrimination is useful in discussion as it is not the same concept as general discrimination.
Reverse discrimination is specifically the majority group that is being discriminated against.
For example, in the US there is social acceptance of the United Negro College Fund but not for the United Caucasian College Fund.
You are right only if they made her an offer she refused by demanding more than market pay. They didn't make her an offer, so how do they know she wouldn't work for their desired fee? They don't. They rejected her without proper legal consideration. They broke the law.
You also have to define the 'market' in 'market pay' as the global market pays less than the domestic market.
My company recently adopted a no H1-B visa policy because we're doing a bit of military work, or so I assume (they really don't tell me anything). We've had a rec open for a hot-shot algorithms geek since January, and trust me, the applicants are not beating a path to our door. This is a fantastic job for the right guy, and it kills me that we're having trouble finding someone to fill it.
The last super-algorithms programmer we hired was from IIT Madras. He's amazing. Before that, we hired an equally amazing white guy right out of college with a BS degree. Good talent is hard to find right now, which is why I think this class action lawsuit is doomed. Maybe it could have gotten some traction in 2010.
Shameless plug: if you're a super-geek, work well with others (so many of us don't), and live near RTP in NC, or Winston-Sallem, send me a resume.
Even if you're right and good talent is hard to find (without going into particulars like what companies are willing to pay based on 'market rates'), it doesn't mean that Infosys specifically is innocent of wrongdoing. Assuming this woman and others like her can document that they were refused positions they were qualified for in favor of non American workers they might just win.
If it can be proven however that they regularly pass over US citizens for the sole reason that H1B workers are the more cost effective option, they're probably going to be facing a slap on the wrist and some political posturing at the very least.
Computer Intrusion is illegal, and the FBI knows that.
So is spying on someone without a warrant, and given that they can't know who they're spying on, I don't see how they could possibly have obtained a warrant for this action.
I hope the TOR user community sues them. Very roughly. And with extreme prejudice.
The US has gotten way too fucking big for it's britches.
I used to think maybe there was justification for the anti-terrorism attitude that the US has.
I've changed my mind.
My sympathies now lie with those who rise up against these goddamn born-again Nazis in their attempt at world domination.
You go, Al Queda!
Regardless of how poorly the US government behaves it does not justify supporting Al Qaeda or their tactics which are largely against civilians.
If you want to declaim the US government go right ahead - but in this case the enemy of your enemy is still fucking crazy and should not be supported regardless.
I wonder about the legality of FBI's action here. Ok, I guess they have some kind of search order/wiretap order for "investigating pedophiles" against one specific site, but what about collateral damage? I mean they shut down an email service used by normal people as well. They did track and spy on activities on normal law abiding citizens. Did they effectively break into a big number of law abiding citizen's machines against whom no search or writetap orders were issued?
Or can FBI hack anyone at will without any legal oversight? I don't remember getting the memo where such behaviour from a government agency is legal.
Well I guess we can stop pretending we live in a law-abiding democratic world. It's an oligarchy run by the banks, the rich, lobyists and professional politicans, and scew everyone else...
--Coder
It's only important that it's illegal if if:
- a) they get caught
- b) you can prove it
- c) you can do something about it
- d) what you can do about it is enough to make any substantial difference
While it's true that doctors and hospitals set their own prices for the uninsured, that doesn't mean the uninsured are being screwed. In practice, it's often just the opposite: if you're paying directly, they'll give you a significant discount to not have to deal with the insurer. However, if they submit a claim to your insurer on your behalf, they can't give you that discount. I know a number of people who have encountered cash prices less than half what the insurer would be billed, from both dentists and doctors.
I remember reading an article (which I can't find at the moment) that there are three categories of prices for any given medical cost in the US:
- the least expensive being what the US government pays (ie title 19)
- the next least expensive being what the large insurers / MMOs pay after negotiations with the medical providers
- the most expensive being the uninsured who are charged whatever the medical providers want to charge
The last being much more expensive than either of the first two.
I do note the word 'cash' in your statement - were there any records of the services provided or was this really under the table?
It's not changing the tax rate, it's introducing a new tax that was never there before. And that's even ignoring the fact that you'll need a lawyer to interpret the law, and decide which types of job will require the new tax, and which will not.
Or you can follow the age old IRS proverb of "If in doubt, tax it" (paraphrased)
I won't comment on the rest of what you've written because, while excessive, I don't particularly disagree with it.
I will point out that you in the UK shouldn't be throwing stones when it comes to your government spying on it's own and other civilian populations.
Your governments (plural as in over time) are puppets twice over - to your royalty and to the USA - and they do whatever their masters say...never mind that a lot of the UK population does worship your royal family, nazi sons and all.
The National Security Agency revealed to an angry congressional panel on Wednesday that its analysis of phone records and online behavior goes exponentially beyond what it had previously disclosed.
If it's true that members of Congress are angry, that's favorable news! Maybe they can be persuaded to get off their butts and do something about this.
They only thing they're angry about is the fact that people found out.
Or they are afraid that they themselves are being monitored along with the proles.
Slashdot Mirror
How long will it be before the FBI goes publicly on the attack?
Freedom Hosting was, from what I've been reading over the last couple of days, not only taken over by the FBI and used to inject this code but it also probably hosted half of all child porn *.onion sites extant.
Demonizing the pervs seems like a good way to distract people from the fact that a state entity is now actively running malware that attacks everybody. I'm surprised it hasn't started already.
Does that mean that the FBI was running the site while it still hosted child porn?
1 + 1 = 3
This is a correct answer. Do you know why?
It was calculated in Excel?
Wait, no...it was copied by a Xerox?
that isn't going to keep the NSA out if they want in.
You don't need to be 100%, you just need to be secure enough that it's easier for them to use legal channels
100% ?
Do you seriously think that anything that we have available to us isn't already compromised three different ways by the NSA?
I think you could if there was no real basis for that requirement, since to be in the US they have to be able to speak English, requiring a Hindi speaker would be absurd.
American companies outside of the US often require a high level of English as a skill for people they hire so that communication within the company remains practical.
Why should an Indian company like Infosys follow different rules?
+1 Informative, thanks -
Many of the people using Tor in restrictive countries won't have the luxury of switching away from Windows. Even if they don, they won't necessarily know how.
Secondly, it's poor advice. The vulnerability affects Firefox 17....and Firefox is up to 22 now I think. Wouldn't it make more sense for them to make sure the tor browser is hardened and recommend people to use that?
Finally, Using a more recent windows version is actually good for security. ASLR, DEP, a rudimentary MAC implementation, UAC...despite what people say, Windows is actually one of the better operating systems security wise these days. Not just because of the preventive technology that most other OS's don't have (OS X has a lacking and broken implementation, most linux distros are not as complete in their implementations..), but because Microsoft started taking security seriously and vulnerabilities are rare these days.
Whatever, bring on the irrational arguments and Microsoft hate. Is it really too much for a forum of tech nerds to be objective in their analysis?
http://www.zdnet.com/blog/btl/microsoft-certificate-used-to-sign-flame-malware-issues-warning/78980
It would be interesting to know how the 'state' that developed Flame acquired the MS certificate in question.
- compromised using tech that the NSA has that we don't know about?
- bought off the black market after being stolen by some other entity?
- or just given by MS to the 'state'..?
Looks like the NSA is up to their old dirty tricks: http://arstechnica.com/tech-policy/2013/08/researchers-say-tor-targeted-malware-phoned-home-to-nsa/ ... And yes, I second the motion to stop using Windows -- its full of zero day bugs like this. Not a day goes by where you don't hear about a new zero day attack focused on Windows, and its been that way for decades.
Because no other operating systems or applications have zero day bugs....
Users can not secure themselves against invasive hacking by the US Government.
The best that can be done is probably a VM that's been stripped down to essentials and does nothing but TOR but even that isn't going to keep the NSA out if they want in.
But it would still be better than the current situation where no one knows and we are just trusting their word, which seems to amount to nothing. In addition that type of practice could invoke a change where if your job is solely in the US they cannot have that type of requirement.
It was an example. It's long standing industry practice to tune an RFP based on what the person / company is selling to block competition.
Not sure that you could legally block a company from stating a requirement for a position - even speaking Hindi.
Personally I think any position that is to be sent to a H1B must be posted on a site like USA jobs, then after a certain period of time if no candidate shows up than they can send it over for the visa. All the resumes on the site should be searchable (redacted of identifying data) to ensure they are not cheating. This paid for byt he company wanting to get the visa.
They could just make one of the requirements to speak Hindi (due to having to communicate with the other employees of Infosys).
"Master's degree in information systems and 17 years of experience" does not tell us that she was more qualified than the Bangladeshi hired. I have interviewed too many people who look good on paper only.
It's not a question of who was more qualified.
The law is that they cannot hire someone H1-B unless they cannot find an American who is qualified.
I know it's difficult for some to understand, but THERE IS NO SUCH THING AS "REVERSE" DISCRIMINATION. There is only discrimination, regardless if you are white, black, brown, male, female, or transgender.
Reverse discrimination is useful in discussion as it is not the same concept as general discrimination.
Reverse discrimination is specifically the majority group that is being discriminated against.
For example, in the US there is social acceptance of the United Negro College Fund but not for the United Caucasian College Fund.
You are right only if they made her an offer she refused by demanding more than market pay. They didn't make her an offer, so how do they know she wouldn't work for their desired fee? They don't. They rejected her without proper legal consideration. They broke the law.
You also have to define the 'market' in 'market pay' as the global market pays less than the domestic market.
My company recently adopted a no H1-B visa policy because we're doing a bit of military work, or so I assume (they really don't tell me anything). We've had a rec open for a hot-shot algorithms geek since January, and trust me, the applicants are not beating a path to our door. This is a fantastic job for the right guy, and it kills me that we're having trouble finding someone to fill it.
The last super-algorithms programmer we hired was from IIT Madras. He's amazing. Before that, we hired an equally amazing white guy right out of college with a BS degree. Good talent is hard to find right now, which is why I think this class action lawsuit is doomed. Maybe it could have gotten some traction in 2010.
Shameless plug: if you're a super-geek, work well with others (so many of us don't), and live near RTP in NC, or Winston-Sallem, send me a resume.
Even if you're right and good talent is hard to find (without going into particulars like what companies are willing to pay based on 'market rates'), it doesn't mean that Infosys specifically is innocent of wrongdoing. Assuming this woman and others like her can document that they were refused positions they were qualified for in favor of non American workers they might just win.
If it can be proven however that they regularly pass over US citizens for the sole reason that H1B workers are the more cost effective option, they're probably going to be facing a slap on the wrist and some political posturing at the very least.
FTFY
Computer Intrusion is illegal, and the FBI knows that.
So is spying on someone without a warrant, and given that they can't know who they're spying on, I don't see how they could possibly have obtained a warrant for this action.
I hope the TOR user community sues them. Very roughly. And with extreme prejudice.
The US has gotten way too fucking big for it's britches.
I used to think maybe there was justification for the anti-terrorism attitude that the US has.
I've changed my mind.
My sympathies now lie with those who rise up against these goddamn born-again Nazis in their attempt at world domination.
You go, Al Queda!
Regardless of how poorly the US government behaves it does not justify supporting Al Qaeda or their tactics which are largely against civilians.
If you want to declaim the US government go right ahead - but in this case the enemy of your enemy is still fucking crazy and should not be supported regardless.
I wonder about the legality of FBI's action here. Ok, I guess they have some kind of search order/wiretap order for "investigating pedophiles" against one specific site, but what about collateral damage? I mean they shut down an email service used by normal people as well. They did track and spy on activities on normal law abiding citizens. Did they effectively break into a big number of law abiding citizen's machines against whom no search or writetap orders were issued?
Or can FBI hack anyone at will without any legal oversight? I don't remember getting the memo where such behaviour from a government agency is legal.
Well I guess we can stop pretending we live in a law-abiding democratic world. It's an oligarchy run by the banks, the rich, lobyists and professional politicans, and scew everyone else...
--Coder
It's only important that it's illegal if if:
- a) they get caught
- b) you can prove it
- c) you can do something about it
- d) what you can do about it is enough to make any substantial difference
This is proof we're still living in a relatively free country! They didn't die in a hail of military-grade automatic weapons fire.
FTFY.
At what point though, do you cross that line between a free country and an overly invasive not so free country?
This needs to stop.
When they come to your house you tell them to fuck off and come back with a warrant. Cooperating only encourages them.
And get on the no fly list?
No thanks.
I just moved house...far away.
"You are not required, nor should you allow any law enforcement officer into your home or business without a search warrant."
And just how difficult is it these days for the Feds to get a search warrant from the invisible national security legal system?
That's the way I see this ending, pretty much.
It's amazed me that he hasn't been "accidentally" killed in a plane crash, or other public disaster; it's not like the Russian Govt cares.
It Does amaze me that America is now a place to seek asylum From. :facepalm:
Putin probably gets a lot of kudos domestically for not doing what the USA wants.
While it's true that doctors and hospitals set their own prices for the uninsured, that doesn't mean the uninsured are being screwed. In practice, it's often just the opposite: if you're paying directly, they'll give you a significant discount to not have to deal with the insurer. However, if they submit a claim to your insurer on your behalf, they can't give you that discount. I know a number of people who have encountered cash prices less than half what the insurer would be billed, from both dentists and doctors.
I remember reading an article (which I can't find at the moment) that there are three categories of prices for any given medical cost in the US:
- the least expensive being what the US government pays (ie title 19)
- the next least expensive being what the large insurers / MMOs pay after negotiations with the medical providers
- the most expensive being the uninsured who are charged whatever the medical providers want to charge
The last being much more expensive than either of the first two.
I do note the word 'cash' in your statement - were there any records of the services provided or was this really under the table?
It's not changing the tax rate, it's introducing a new tax that was never there before. And that's even ignoring the fact that you'll need a lawyer to interpret the law, and decide which types of job will require the new tax, and which will not.
Or you can follow the age old IRS proverb of "If in doubt, tax it" (paraphrased)
I won't comment on the rest of what you've written because, while excessive, I don't particularly disagree with it.
I will point out that you in the UK shouldn't be throwing stones when it comes to your government spying on it's own and other civilian populations.
Your governments (plural as in over time) are puppets twice over - to your royalty and to the USA - and they do whatever their masters say...never mind that a lot of the UK population does worship your royal family, nazi sons and all.
I.e. if the connection is "read something that a suspect may have posted in a site", we should be all in that list, plus everyone 2 hops away from us.
That's why I only post when I'm logged in under your username
The first paragraph of TFA is:
If it's true that members of Congress are angry, that's favorable news! Maybe they can be persuaded to get off their butts and do something about this.
They only thing they're angry about is the fact that people found out.
Or they are afraid that they themselves are being monitored along with the proles.