You know that Micro$oft will "react" quite badly to this. It's one thing to be Linux where the look and feel is totally different, but if you manage to get a reverse engineered solution for Windows even close to viable, the long knives will come out.
I foresee one of two things happening... 1. The project fails because it is TOO large for the possible gains it could provide and takes too long to get working. 2. The project is successful but M$ kills it by FUD and actual legal action. Both of these are equally possible. If the second option happens, I give them about a snowballs chance of going head to head with M$ and coming out with a commercially viable Windows clone.
I have a solution to that... How about you do the event in a time zone closer to the audience with the most money? There are plenty of south American countries who would love to host the games.
On a serious note... If NBC wants exclusive coverage, they are going to have to outlaw all cameras and electronic devices except by credential reporters who have singed an NDA while strip searching the spectators to make sure nobody gets one in. Cell phone jammers might be a good idea too.
And it infects Linux machines? LOL Got to love reporters... Still, one should take this as a warning and do something to prevent something worse from happening. Which is the thrust of my concerns. Don't use administrator accounts, turn off auto-run and keep an up to date virus scanner in place should be the *minimum* for just about any machine....
A movie review is actually a refreshing change of pace and what could be more nerdy than a comic book based movie? Besides, all the major new papers have movie reviews.....
First, the reporter that wrote this article obviously doesn't understand the difference between Linux and Windows. Stuxnet is decidedly a *windows* issue and is not going to be a problem for a Linux SCADA system.
Second, Who in their right mind lets a rouge USB stick even onto the station, much less inserted, mounted and code executed from it? I don't care if it's Linux, windows or anything else, you simply do not allow unknown USB devices to get mounted without at least doing some kind of scan before you do anything with the data/programs it contains. These devices should NOT be allowed, even in the astronaut's pocket, unless they have been scanned.
Third, What kind of Linux system admin gives out enough privileges to make *any* kind of virus/Trojan or other security issue to infect a Linux workstation/server by a user? You DON'T give out root access to just anybody without a good reason and a minimum level of training.
So, my recommendations? 1. Ban all rouge USB devices by policy and make a rule that they are not to be flown unless they've been declared and scanned. 2. Disable auto-mount/auto-run on EVERY system on the station that has an accessible USB port or optical drive. 3. Remove direct root/administrator access from all systems, except when absolutely necessary. Force everybody to be non-privileged "users" when accessing the station's systems. 4. On every system that the users routinely access (and all other ones as possible) install and run a real time virus scanner which is kept up to date, with static scans made at least weekly.
Better than you, apparently. Those were bogus charges so the real money could go to secret shit.
Nope. Those where *valid* charges for actual items ordered by the government. The hammers where delivered to specifications that included specifics about the metal used, the shape and weight to exacting tolerances and documentation and testing procedures to verify everything was as specified. Same with the toilet seats, which where for specific aircraft use.
The Secret stuff you are talking about was and continues to be funded in a shadow budget that only shows up as a line item on the real budget. These "black" projects are not funded by over priced purchases for other things. Government purchasing regulations would not permit such foolishness and the demands of security make it a stupid idea.
I used to work for the department of defense (U.S. Navy) as an electronics engineer. I've seen how the procurement process works and why the government pays sooo much money for what you get from it. Sometimes it is because the government over specifies what it needs and makes things so complex that it adds to the price, some times it is the contractors pushing the price up (or selling substandard parts) to make a few extra dollars. Most of the time it's really about the lack of a motive to be efficient and looking for ways to do a better job for less cost coupled with the limitations of the contracting process. It's just easier and less dangerous to one's career to just do what worked in the past because nobody rewards you for saving a few bucks but they will hang you out to dry if you mess up.
As I understood this suggestion, one was to go pickup a pile of identical USB to serial converters and USB hubs and just wire them all up. There will be nothing unique between the devices except how they are connected to the host USB hub and in which order the devices are initialized.
Which makes my point. I'm not saying that the order is not set, but that anytime you make a change to the hardware configuration by plugging something in or removing a device you may unknowingly move a whole bunch of stuff in a way you don't understand. This might force you to have to go back though 120+ devices per host port and sort out what port is which device, just because something changed.
Consider what happens if one of your first 50 devices fails (say it comes unplugged or the cable breaks). What a MESS it's going to be sorting all that out.
No, I would not recommend this solution for any kind of "production" environment. Go get some serial port servers and do this right. Your life will be easier and the amount of time you save over the life of the system will more than pay for the hardware.
Problem with this is that every time you plug in a new USB device, you are likely to totally hose the device names on the next reboot. It is *really* hard to tell what order your USB devices will be initialized and in this case it will be a serious issue trying to sort out what port is which every time you want to add or remove a device.
There are benefits to keeping things standard and as long as you implement reasonable security configurations and don't allow non-local root logins, I don't see any real reason to change root in most cases. Your life (and the lives of admins to come behind you) will be much easier.
As I point out, eventually you are going to have to trade your currency for something. This is always where the risks are for laundering money, because it is the transaction that makes the illicit look legal. With cash, you just walk up and hand over the bills. There is no record of where all that cash came from and while it might be flagged as suspicious, there is no way to trace the money. But if you get caught paying in BitCoin, or redeeming your BitCoin for cash, then you just handed law enforcement a total record of every transaction in and out of your wallet.
Folks are getting bent out of shape over NSA monitoring cell phone metadata, yet BitCoin publicly publishes the equivalent data in the data blocks that come with the coins. All the stuff that the NSA can do by sifting though this call data can be done by sifting though the BitCoin data blocks. So once you catch one bad guy, you now have the means to go back and find out *every* wallet he had transactions with. Chances are, many of those will be bad guys too. Catch enough bad guys using BitCoin and you can go back and discover what was going on using basic data mining techniques and start making associations to people you didn't know where involved.
So sure, authorities may not know NOW who is who, but if they keep snooping long enough they might find out. And when they find out, the whole network will be at risk of discovery.
Dory: [sees a very small baby jellyfish] I shall call him Squishy and he shall be mine and he shall be my Squishy Come on, Squishy Come on, little Squishy...
[makes baby talk and slowly touches the jellyfish, getting shocked]
Dory: [pulling her fin away quickly] Ow! Bad squishy, bad squishy!
True, but eventually to get your money out of the Maytag you will have to convert it to another currency so you can buy something. All law enforcement has to do is catch you converting your BitCoin or associate your wallet(s) with you and they can trace everything.
The problem with money laundering is always the same. You have illegal assets that you either have to hide by not spending (and where's the fun in that) or make them look like legitimate assets so you can use them. BitCoin doesn't make this conversion any easier than laundering that briefcase of $20's and you add that every transaction you do is forever documented in the block-chain of the coins and I would see this as *very* risky. If law enforcement ever ties you to a wallet, they can go back and find every transaction you ever made using that wallet. Which is totally not true if they catch you with a briefcase of real money.
So they finally found their sacrificial lamb? Who-rah...
I got to say, that took a LONG time. Just not as long as the fix is going to take.
Typical political decisions making a bloody mess out of what should have been a simple thing to build. This is why government needs to NOT be doing this kind of thing. Anybody remember the $200 hammer, or the $500 toilet seat from decades past? Well, now instead of just being a feature of the DOD, it's going to be a part of every citizen's life (and many of their deaths) though health care. It's going to be insanely expensive and not work well, if at all. Just like this website project.
This is the thing about BitCoin I never understood. The proponents of BitCoin claim that it was untraceable, but all transactions are traceable by looking at who spent the coin and who owns it now, at least by their public key. This information is included in the data blob that IS the coin and lots of people have to observe the transaction before it becomes valid. You may not know who's key is who's, but you certainly can trace ownership of the BitCoin.
So, you may not know who owns a single coin, but though simple observation of transactions and a bit of foot work you can easily piece together who's who and who's spending their coins on what. It becomes a data mining operation with a bit of detective work to trace where folks are converting traditional currency into and out of BitCoin. Which is totally different than trading say dollars in currency. You *might* be able to trace currency transactions though things like DNA traces left on the bills or serial numbers (if you know them), but if somebody passes a briefcase of money around, there will be no way to trace each transaction that might have taken place.
Think about it.... Why don't computers program themselves?
Well, airplanes don't fly themselves either. Drones either require pilots (and lots of infrastructure) or software that has limits. You put a pilot in the airplane to avoid the infrastructure required to put the pilot on the ground or having to write the software to do what a pilot does.
Can you say "Air Cannon"? Haven't you watched the "Pumpkin Chunkin" contest on TV? They are trowing small pumpkins nearly a mile... I don't imagine throwing a 4 lb bird is going to be a problem, thawed or frozen.
Slashdot Mirror
You know that Micro$oft will "react" quite badly to this. It's one thing to be Linux where the look and feel is totally different, but if you manage to get a reverse engineered solution for Windows even close to viable, the long knives will come out.
I foresee one of two things happening... 1. The project fails because it is TOO large for the possible gains it could provide and takes too long to get working. 2. The project is successful but M$ kills it by FUD and actual legal action. Both of these are equally possible. If the second option happens, I give them about a snowballs chance of going head to head with M$ and coming out with a commercially viable Windows clone.
Good luck storming the castle boys!
I have a solution to that... How about you do the event in a time zone closer to the audience with the most money? There are plenty of south American countries who would love to host the games.
On a serious note... If NBC wants exclusive coverage, they are going to have to outlaw all cameras and electronic devices except by credential reporters who have singed an NDA while strip searching the spectators to make sure nobody gets one in. Cell phone jammers might be a good idea too.
I've seen pictures of the launch facilities in Russia.. I would not recommend you pick up *anything* unless you dropped it, and even then carefully.
And it infects Linux machines? LOL Got to love reporters... Still, one should take this as a warning and do something to prevent something worse from happening. Which is the thrust of my concerns. Don't use administrator accounts, turn off auto-run and keep an up to date virus scanner in place should be the *minimum* for just about any machine....
It's on Slashdot right? That means it's news for nerds.
What's more nerdy than a comic book based movie? Check: Nerdy
How it matters? You got me there.
But we've had lots of stuff that didn't matter posted here...
Yes, but the whovians all *think* it is clever, which is all that counts... At least to them.
You are not from around here, are you?
A movie review is actually a refreshing change of pace and what could be more nerdy than a comic book based movie? Besides, all the major new papers have movie reviews.....
Damn spell check...
First, the reporter that wrote this article obviously doesn't understand the difference between Linux and Windows. Stuxnet is decidedly a *windows* issue and is not going to be a problem for a Linux SCADA system.
Second, Who in their right mind lets a rouge USB stick even onto the station, much less inserted, mounted and code executed from it? I don't care if it's Linux, windows or anything else, you simply do not allow unknown USB devices to get mounted without at least doing some kind of scan before you do anything with the data/programs it contains. These devices should NOT be allowed, even in the astronaut's pocket, unless they have been scanned.
Third, What kind of Linux system admin gives out enough privileges to make *any* kind of virus/Trojan or other security issue to infect a Linux workstation/server by a user? You DON'T give out root access to just anybody without a good reason and a minimum level of training.
So, my recommendations? 1. Ban all rouge USB devices by policy and make a rule that they are not to be flown unless they've been declared and scanned. 2. Disable auto-mount/auto-run on EVERY system on the station that has an accessible USB port or optical drive. 3. Remove direct root/administrator access from all systems, except when absolutely necessary. Force everybody to be non-privileged "users" when accessing the station's systems. 4. On every system that the users routinely access (and all other ones as possible) install and run a real time virus scanner which is kept up to date, with static scans made at least weekly.
Sure they can *order* stuff, it's just the *delivery* charges are out of this world.
Better than you, apparently. Those were bogus charges so the real money could go to secret shit.
Nope. Those where *valid* charges for actual items ordered by the government. The hammers where delivered to specifications that included specifics about the metal used, the shape and weight to exacting tolerances and documentation and testing procedures to verify everything was as specified. Same with the toilet seats, which where for specific aircraft use.
The Secret stuff you are talking about was and continues to be funded in a shadow budget that only shows up as a line item on the real budget. These "black" projects are not funded by over priced purchases for other things. Government purchasing regulations would not permit such foolishness and the demands of security make it a stupid idea.
I used to work for the department of defense (U.S. Navy) as an electronics engineer. I've seen how the procurement process works and why the government pays sooo much money for what you get from it. Sometimes it is because the government over specifies what it needs and makes things so complex that it adds to the price, some times it is the contractors pushing the price up (or selling substandard parts) to make a few extra dollars. Most of the time it's really about the lack of a motive to be efficient and looking for ways to do a better job for less cost coupled with the limitations of the contracting process. It's just easier and less dangerous to one's career to just do what worked in the past because nobody rewards you for saving a few bucks but they will hang you out to dry if you mess up.
As I understood this suggestion, one was to go pickup a pile of identical USB to serial converters and USB hubs and just wire them all up. There will be nothing unique between the devices except how they are connected to the host USB hub and in which order the devices are initialized.
Which makes my point. I'm not saying that the order is not set, but that anytime you make a change to the hardware configuration by plugging something in or removing a device you may unknowingly move a whole bunch of stuff in a way you don't understand. This might force you to have to go back though 120+ devices per host port and sort out what port is which device, just because something changed.
Consider what happens if one of your first 50 devices fails (say it comes unplugged or the cable breaks). What a MESS it's going to be sorting all that out.
No, I would not recommend this solution for any kind of "production" environment. Go get some serial port servers and do this right. Your life will be easier and the amount of time you save over the life of the system will more than pay for the hardware.
The transaction is *forever* recorded in the data block of the BitCoin, while the $300 in cash is untraceable for the most part.
I hear "I'm bored and I need something frustrating to do with my time."
Problem with this is that every time you plug in a new USB device, you are likely to totally hose the device names on the next reboot. It is *really* hard to tell what order your USB devices will be initialized and in this case it will be a serious issue trying to sort out what port is which every time you want to add or remove a device.
Now *how* would an intruder get root?
Sarcasm, aside...
There are benefits to keeping things standard and as long as you implement reasonable security configurations and don't allow non-local root logins, I don't see any real reason to change root in most cases. Your life (and the lives of admins to come behind you) will be much easier.
As I point out, eventually you are going to have to trade your currency for something. This is always where the risks are for laundering money, because it is the transaction that makes the illicit look legal. With cash, you just walk up and hand over the bills. There is no record of where all that cash came from and while it might be flagged as suspicious, there is no way to trace the money. But if you get caught paying in BitCoin, or redeeming your BitCoin for cash, then you just handed law enforcement a total record of every transaction in and out of your wallet.
Folks are getting bent out of shape over NSA monitoring cell phone metadata, yet BitCoin publicly publishes the equivalent data in the data blocks that come with the coins. All the stuff that the NSA can do by sifting though this call data can be done by sifting though the BitCoin data blocks. So once you catch one bad guy, you now have the means to go back and find out *every* wallet he had transactions with. Chances are, many of those will be bad guys too. Catch enough bad guys using BitCoin and you can go back and discover what was going on using basic data mining techniques and start making associations to people you didn't know where involved.
So sure, authorities may not know NOW who is who, but if they keep snooping long enough they might find out. And when they find out, the whole network will be at risk of discovery.
Dory: [sees a very small baby jellyfish] I shall call him Squishy and he shall be mine and he shall be my Squishy Come on, Squishy Come on, little Squishy...
[makes baby talk and slowly touches the jellyfish, getting shocked]
Dory: [pulling her fin away quickly] Ow! Bad squishy, bad squishy!
COOL! I'll bring the bread and you bring the Peanut butter OK?
True, but eventually to get your money out of the Maytag you will have to convert it to another currency so you can buy something. All law enforcement has to do is catch you converting your BitCoin or associate your wallet(s) with you and they can trace everything.
The problem with money laundering is always the same. You have illegal assets that you either have to hide by not spending (and where's the fun in that) or make them look like legitimate assets so you can use them. BitCoin doesn't make this conversion any easier than laundering that briefcase of $20's and you add that every transaction you do is forever documented in the block-chain of the coins and I would see this as *very* risky. If law enforcement ever ties you to a wallet, they can go back and find every transaction you ever made using that wallet. Which is totally not true if they catch you with a briefcase of real money.
So they finally found their sacrificial lamb? Who-rah...
I got to say, that took a LONG time. Just not as long as the fix is going to take.
Typical political decisions making a bloody mess out of what should have been a simple thing to build. This is why government needs to NOT be doing this kind of thing. Anybody remember the $200 hammer, or the $500 toilet seat from decades past? Well, now instead of just being a feature of the DOD, it's going to be a part of every citizen's life (and many of their deaths) though health care. It's going to be insanely expensive and not work well, if at all. Just like this website project.
This is the thing about BitCoin I never understood. The proponents of BitCoin claim that it was untraceable, but all transactions are traceable by looking at who spent the coin and who owns it now, at least by their public key. This information is included in the data blob that IS the coin and lots of people have to observe the transaction before it becomes valid. You may not know who's key is who's, but you certainly can trace ownership of the BitCoin.
So, you may not know who owns a single coin, but though simple observation of transactions and a bit of foot work you can easily piece together who's who and who's spending their coins on what. It becomes a data mining operation with a bit of detective work to trace where folks are converting traditional currency into and out of BitCoin. Which is totally different than trading say dollars in currency. You *might* be able to trace currency transactions though things like DNA traces left on the bills or serial numbers (if you know them), but if somebody passes a briefcase of money around, there will be no way to trace each transaction that might have taken place.
Think about it.... Why don't computers program themselves?
Well, airplanes don't fly themselves either. Drones either require pilots (and lots of infrastructure) or software that has limits. You put a pilot in the airplane to avoid the infrastructure required to put the pilot on the ground or having to write the software to do what a pilot does.
Only when frozen... ;)
Can you say "Air Cannon"? Haven't you watched the "Pumpkin Chunkin" contest on TV? They are trowing small pumpkins nearly a mile... I don't imagine throwing a 4 lb bird is going to be a problem, thawed or frozen.