Part of it is in our heads. Also, we eat mammals, not creepy-crawlies, because mammals aren't poisonous. Meat (mammals, birds) is also highly concentrated food. Insect shells, legs, etc. aren't as good for food, and they are far more likely to be poisonous. Some bugs are poisonous themselves. Others, like flies, hang out in rotting meat which is full of bacteria and toxins. So we evolved to not eat bugs because bugs are likely to make us sick.
Of course, fungus is similar. Mushrooms are an acquired taste, not something that most people enjoy immediately, but with modern practices we can separate the edible fungus from the poisonous. We eat some edible fungus and smoke one of the poisonous ones.:)
Cats and dogs aren't "all in our heads", we have them for a reason, and that reason isn't food. Evolutionarily speaking, it's better to let your cat keep the rats away than to eat the cat. "Don't eat your friends" is a good idea, not just a cultural convention.
So if our "bank for banks" is largely run by their customers, I guess it's more of a central credit union than a central bank.
Of course, unlike Thailand and some other countries, in the "bank for banks" is separate from the Treasury Department, which is purely governmental. The Bank Of Thailand is both the banking facilitator like the Fed, and also the issuer and regulator of currency, like our Treasury Department. I think I like having them split like we do.
The Bank of Thailand is both the central bank, like the US Federal Reserve, and the issuer of currency, like the US Treasury Department. It is a government institution.
Here in the US, we've separated the two to some extent. The Treasury Department makes and enforces the rules, the government role. The Federal Reserve is more like a "central credit union" than a central bank - it's primary role is to serve as "bank for banks", where banks can deposit money or get 24 hour loans. In Thailand, as in many countries, the two functions are combined.
Currently about three billion pounds of KNO3 are made each year. Suppose the researcher's hopes come true and that is cut in half. That would mean only 1,500,000,000 pounds would be on the market each year. Of course, it's not just used for fertilizer, there are many other uses. But if you did replace all those other uses, there would only be enough KNO3 to make ten million bombs per year. Of course, horse stables are full of it, too - stale urine is potassium nitrate.
You know why you can't take liquids on airplanes? Hydrogen peroxide and nail polish remover. If you mix the two correctly, you get a VERY powerful explosive . (If you mix them incorrectly you get dead. Don't try it. It's a great explosive for SUICIDE bombers.)
Another frequently used and powerful explosive is aluminium powder. Yep, ground up tinfoil. Don't try that at home either, it might blow up while you're grinding it. Adding Parlon can help. Parlon is also known as Saran Wrap.
Grind up ping pong balls, that modern gunpowder, called smokeless powder.
So you see, to make any progress by banning stuff you would need to ban half the stuff in the grocery store. Oh, and don't forget to ban livestock, so everyone would have to be vegetarian. ( remember, where animals piss, potassium nitrate crystallizes.)
Every day, I see about 20 CVEs published with vendor fixes. So roughly 7,000 per year on the CVE list alone where the vendor fixes it promptly. Contrast that with the three or four per year that you are calling "time and time again".
When I submitted an issue that could have been used to easily DOS Wikipedia and many other sites, the vendor replied within a few hours. In 24 hours, wiki and a few other major targets were patched. Once those were patched, the vulnerability, with fix, was published on the appropriate lists the next day. So about two days to have the fix widely available, including a Debian package update.
The vendor asked me how I would like to be credited and I ask them to say "Ray Morris of bettercgi.com", adding a plug for my web site.
Another time, our company was the vendor. There wasn't a complete exploit, just a potential risk. We initiated automatic updates within 48 hours for those customers who allowed them. We then contacted the remaining customers, asking them to initiate an update.
For our other scare, we thought customer data may have been leaked. We discovered the problem ourselves, internally. I, as the president of the company, spent two days calling customers on the phone to explain the situation. So yeah, most of the time people who run companies have enough brains to do what is obviously the right course of action. Most of the time.
* it turns out the hacker who could see our customer data was almost certainly me. I logged stuff I shouldn't have.
As the last sentence of TFA mentions, this article is talking about the same temporary injunction that was on Slashdot a few days ago.
The headline is bogus. The ruling is that they have to wait until a full hearing, because you can't unpublish something once you've published it. There has been no ruling on the merits of the case.
How in the world can you spell? Clearly you absolutely refuse to learn anything from anyone.
Some of your thoughts are reasonable guesses. Thing is, you don't have to stick to those guesses when you're presented with facts by people who have actually done it.
Want to see an for yourself that it's possible for apps to ACCIDENTALLY overlay the prompt? Download open roads voyager, set it to overlay buttons, and open a root app.
When people open a root app and they get the same prompt they always get, they don't re-read it every time. They also don't get suspicious when the first click on "Ok" doesn't seem to work - the "same" prompt is still there.
> I'd be surprised if su applications don't [control the video memory]
Presumably if you root your phone, you'll at least check to see if it works. So at that moment you're expecting the prompt. When sudo is launched, that's when the malware requests root. That's one method. Another method is to use a video overlay to put a benign looking button on top of the prompt. As an overlay, the benign thing isn't clickable, the user is actually clicking on the hidden sudo prompt underneath.
Before assuming I have no experience, Google my name. Note you're also implying Steve Kondrick doesn't know what he's talking about. I guess Steve doesn't have any experience with rooted phone?
It seems there IS one person in this discussion who isn't a security professional. Guess who?
There isn't any law requiring a corporation to maximize profits. The Free Software Foundation is a corporation. Do you think they maximize profit? How about the Red Cross, another corporation? The ACLU?
The closest requirements that actually exist are: Directors and executives can't give THEMSELVES benefits at the expense of shareholders, aside from agreed salary and benefit packages. So they can't give company money (shareholder's money) to themselves.
They must act in furtherance of the purpose(s) stated in the articles of incorporation. Microsoft's articles, like most corporations, say only that it's purpose is for "any lawful business", so there's no restriction there.
If nobody and NOTHING ever calls sudo, yeah. Don't assume that all calls to sudo are you doing it on purpose. The risk is that malware could use sudo.
By way of comparison, Windows is somewhat similarly "secure unless you allow something to have elevated privileges". Compare that with a write-once DVD live system, where there is no such thing as altering the system.
On another note , the bill requiring that USPS catch up on their payments had four sponsors, two Democrats, two Republicans. None of Democrat senators objected to the bill. So the idea that this was a republican thing is just silly. It's a common sense thing.
With the economy sucking ass for the last five years, pension plans haven't received the investment returns they planned on, so some are a little behind what they expected. They invested the money as required, they just couldn't have predicted the worst economy since the great depression. That's a completely different thing than failing to invest at all and falling 40 years behind, as USPS did.
Since 1974, companies have been legally required to make those investments. The law is called ERISA. USPS now has to do the same.
If you Google "pension failure", you'll see about 20 stories about failed government pension plans for every 1 failed company plan. Why? Because companies are required to invest ahead of time and governments aren't. Governments are allowed to engage in the same boondoggle as USPS, so they fail. Just last week, Detroit's city workers found out they aren't getting the pensions they were promised. Should we do the same thing to postal workers?
Generally temporary injunctions like this are just until there is a full hearing. Volkswagen will probably have a fix in place by then, but the main purpose is to avoid doing irreversible damage until there can be a full hearing on the facts.
A temporary injunction is common in many types of cases and in no way indicates the court's opinion on the substantive issues. It's simply a recognition that they can't unpublish the information, so they need to wait until a decision is made before they publish. The same is often done with property disputes such as divorces. A temporary injunction orders both parties not to sell or otherwise dispose of the property until a decision is made as to ownership.
Ps - I don't care for the injunction. I would have preferred that the court hint at whether they think the case has merit, then let the researcher decide whether to release the information immediately, risking a successful suit for damages. The injunction, as a prior restraint on speech, is censorship. Still, it's best not to exaggerate the effect of the or intent of the injunction.
You can probably fix that H key in a few seconds by cleaning under it. Also, as the AC said, if your work is sloppy, people will think your work is sloppy.
There IS a problem for them. The problem is they were allowed to get forty years behind. Now they have to get caught up. Private companies generally don't get behind to begin with.
What they were doing is using today's revenue to pay retirement for employees who worked forty years ago. Now they have to switch to investing today's revenue for today's workers. Paying as you go, as they are now required to do, isn't a problem. That's how everyone other than government does it. The problem is the switch - catching up from being forty years behind.
It's a lot like they'd been living on credit cards for forty years. Now they are only allowed to spend what they make - and they have ten years in which to pay off the debt they had racked up.
That's a rumor put out by the union, and false. They have to ESTIMATE, not pay, what today's employees might collect 75 years from now.
When they hire a 20 year old worker, they are promising to continue paying that worker when he's 80 - which is 60 years from now. They have to make a written estimate of how much today's promises will cost them in the future.
This is standard stuff, what's called Generally Accepted Accounting Practices (GAAP). Every company that issues stock follows the same rules.
Actually private companies DO invest money so the pensions they promised will be paid. Typically, the employer sendd their part to an IRS or 401k account in the employee's name. That way, the money is there 40 years later while the employee is retired.
Occasionally, an employer will get caught screwing around with that and not properly investing that money on behalf of the employees they promised it to. That's called fraud. It's just that federal agencies were allowed to commit this type of fraud. With the internet, USPS may not have the revenue to in 40 years to cover the retirement pay for today's employees. That's why they now have to invest retirement pay for today's employees today, just like private companies do.
My MacBook most certainly does drive three displays. My Mac Pro drives four, is quad-core with 16 GB RAM, and is almost five years old. I bet one a couple years old, like mine, could be bought for a couple hundred bucks.
I used Linux exclusively for fifteen years. I contributed to the kernel. When the boss put me on a Mac, I was surprised to discover how familiar it felt. I can use it just like Linux, with exactly the same workflow. The main difference is the cost of a Mac buys you nice hardware that "just works", and works very well. Mac has of course always been THE system for graphic design and publishing, so the display system is well done.
Same here. I support open source, I helped write a lot of it. I wrote one package from scratch that was distributed with Solaris. I wouldn't BUY their product, but that means I won't USE it. I wouldn't steal it, as these defendants allegedly did.
I wish Oracle released all of their stuff as open source, but they don't. I expect them to respect the license on my software (GPL), and people should respect their license.
If I'm reading that right, Oracle clams that: Oracle provides updated software versions for a yearly fee. Defendants are unlawfully distributing the updated versions to people who haven't paid the fee.
If I'm reading that right, Oracle is being slightly non-generous by having annual payments to get updates. That's understandable, though, it costs them money to keep making new updates.
I see nothing in TFA about Oracle objecting to services the defendants provide, just and objection to them distributing new updates that haven't been paid for. So the headline is a load of bull, right?
Slashdot Mirror
Part of it is in our heads. Also, we eat mammals, not creepy-crawlies, because mammals aren't poisonous. Meat (mammals, birds) is also highly concentrated food.
:)
Insect shells, legs, etc. aren't as good for food, and they are far more likely to be poisonous. Some bugs are poisonous themselves. Others, like flies, hang out in rotting meat which is full of bacteria and toxins. So we evolved to not eat bugs because bugs are likely to make us sick.
Of course, fungus is similar. Mushrooms are an acquired taste, not something that most people enjoy immediately, but with modern practices we can separate the edible fungus from the poisonous. We eat some edible fungus and smoke one of the poisonous ones.
Cats and dogs aren't "all in our heads", we have them for a reason, and that reason isn't food. Evolutionarily speaking, it's better to let your cat keep the rats away than to eat the cat. "Don't eat your friends" is a good idea, not just a cultural convention.
So if our "bank for banks" is largely run by their customers, I guess it's more of a central credit union than a central bank.
Of course, unlike Thailand and some other countries, in the "bank for banks" is separate from the Treasury Department, which is purely governmental. The Bank Of Thailand is both the banking facilitator like the Fed, and also the issuer and regulator of currency, like our Treasury Department. I think I like having them split like we do.
The Bank of Thailand is both the central bank, like the US Federal Reserve, and the issuer of currency, like the US Treasury Department.
It is a government institution.
Here in the US, we've separated the two to some extent. The Treasury Department makes and enforces the rules, the government role.
The Federal Reserve is more like a "central credit union" than a central bank - it's primary role is to serve as "bank for banks", where banks can deposit money or get 24 hour loans. In Thailand, as in many countries, the two functions are combined.
Currently about three billion pounds of KNO3 are made each year. Suppose the researcher's hopes come true and that is cut in half. That would mean only 1,500,000,000 pounds would be on the market each year. Of course, it's not just used for fertilizer, there are many other uses. But if you did replace all those other uses, there would only be enough KNO3 to make ten million bombs per year. Of course, horse stables are full of it, too - stale urine is potassium nitrate.
You know why you can't take liquids on airplanes? Hydrogen peroxide and nail polish remover. If you mix the two correctly, you get a VERY powerful explosive . (If you mix them incorrectly you get dead. Don't try it. It's a great explosive for SUICIDE bombers.)
Another frequently used and powerful explosive is aluminium powder. Yep, ground up tinfoil. Don't try that at home either, it might blow up while you're grinding it. Adding Parlon can help. Parlon is also known as Saran Wrap.
Grind up ping pong balls, that modern gunpowder, called smokeless powder.
So you see, to make any progress by banning stuff you would need to ban half the stuff in the grocery store. Oh, and don't forget to ban livestock, so everyone would have to be vegetarian. ( remember, where animals piss, potassium nitrate crystallizes.)
Every day, I see about 20 CVEs published with vendor fixes. So roughly 7,000 per year on the CVE list alone where the vendor fixes it promptly. Contrast that with the three or four per year that you are calling "time and time again".
When I submitted an issue that could have been used to easily DOS Wikipedia and many other sites, the vendor replied within a few hours. In 24 hours, wiki and a few other major targets were patched. Once those were patched, the vulnerability, with fix, was published on the appropriate lists the next day. So about two days to have the fix widely available, including a Debian package update.
The vendor asked me how I would like to be credited and I ask them to say "Ray Morris of bettercgi.com", adding a plug for my web site.
Another time, our company was the vendor. There wasn't a complete exploit, just a potential risk. We initiated automatic updates within 48 hours for those customers who allowed them. We then contacted the remaining customers, asking them to initiate an update.
For our other scare, we thought customer data may have been leaked. We discovered the problem ourselves, internally. I, as the president of the company, spent two days calling customers on the phone to explain the situation. So yeah, most of the time people who run companies have enough brains to do what is obviously the right course of action. Most of the time.
* it turns out the hacker who could see our customer data was almost certainly me. I logged stuff I shouldn't have.
As the last sentence of TFA mentions, this article is talking about the same temporary injunction that was on Slashdot a few days ago.
The headline is bogus. The ruling is that they have to wait until a full hearing, because you can't unpublish something once you've published it. There has been no ruling on the merits of the case.
How in the world can you spell? Clearly you absolutely refuse to learn anything from anyone.
Some of your thoughts are reasonable guesses. Thing is, you don't have to stick to those guesses when you're presented with facts by people who have actually done it.
Want to see an for yourself that it's possible for apps to ACCIDENTALLY overlay the prompt? Download open roads voyager, set it to overlay buttons, and open a root app.
>. the prompt shows which application
When people open a root app and they get the same prompt they always get, they don't re-read it every time. They also don't get suspicious when the first click on "Ok" doesn't seem to work - the "same" prompt is still there.
> I'd be surprised if su applications don't [control the video memory]
Welcome to surprised.
"some overclocked overheating whitebox frankenmachine full of dust and nicotine" like the Surface they were using at the product launch?
http://youtu.be/N1zxDa3t0fg
Didn't something similar happen at CES 2012?
So much fun:
http://youtu.be/jMToNsCyFQU
Presumably if you root your phone, you'll at least check to see if it works. So at that moment you're expecting the prompt. When sudo is launched, that's when the malware requests root. That's one method. Another method is to use a video overlay to put a benign looking button on top of the prompt. As an overlay, the benign thing isn't clickable, the user is actually clicking on the hidden sudo prompt underneath.
Before assuming I have no experience, Google my name. Note you're also implying Steve Kondrick doesn't know what he's talking about. I guess Steve doesn't have any experience with rooted phone?
It seems there IS one person in this discussion who isn't a security professional. Guess who?
There isn't any law requiring a corporation to maximize profits. The Free Software Foundation is a corporation. Do you think they maximize profit? How about the Red Cross, another corporation? The ACLU?
The closest requirements that actually exist are:
Directors and executives can't give THEMSELVES benefits at the expense of shareholders, aside from agreed salary and benefit packages. So they can't give company money (shareholder's money) to themselves.
They must act in furtherance of the purpose(s) stated in the articles of incorporation. Microsoft's articles, like most corporations, say only that it's purpose is for "any lawful business", so there's no restriction there.
If nobody and NOTHING ever calls sudo, yeah.
Don't assume that all calls to sudo are you doing it on purpose. The risk is that malware could use sudo.
By way of comparison, Windows is somewhat similarly "secure unless you allow something to have elevated privileges". Compare that with a write-once DVD live system, where there is no such thing as altering the system.
That seems to be the #1 item on his list of "things that need APIs before root is unnecessary.
Yet the Apple comment could have been relevant, had he mentioned Apple's tendency to (over)simplify things.
On another note , the bill requiring that USPS catch up on their payments had four sponsors, two Democrats, two Republicans. None of Democrat senators objected to the bill. So the idea that this was a republican thing is just silly. It's a common sense thing.
With the economy sucking ass for the last five years, pension plans haven't received the investment returns they planned on, so some are a little behind what they expected. They invested the money as required, they just couldn't have predicted the worst economy since the great depression. That's a completely different thing than failing to invest at all and falling 40 years behind, as USPS did.
Since 1974, companies have been legally required to make those investments. The law is called ERISA. USPS now has to do the same.
If you Google "pension failure", you'll see about 20 stories about failed government pension plans for every 1 failed company plan. Why? Because companies are required to invest ahead of time and governments aren't. Governments are allowed to engage in the same boondoggle as USPS, so they fail. Just last week, Detroit's city workers found out they aren't getting the pensions they were promised. Should we do the same thing to postal workers?
Generally temporary injunctions like this are just until there is a full hearing. Volkswagen will probably have a fix in place by then, but the main purpose is to avoid doing irreversible damage until there can be a full hearing on the facts.
A temporary injunction is common in many types of cases and in no way indicates the court's opinion on the substantive issues. It's simply a recognition that they can't unpublish the information, so they need to wait until a decision is made before they publish. The same is often done with property disputes such as divorces. A temporary injunction orders both parties not to sell or otherwise dispose of the property until a decision is made as to ownership.
Ps - I don't care for the injunction. I would have preferred that the court hint at whether they think the case has merit, then let the researcher decide whether to release the information immediately, risking a successful suit for damages. The injunction, as a prior restraint on speech, is censorship. Still, it's best not to exaggerate the effect of the or intent of the injunction.
https://www.google.com/search?q=kernel%20changelog%20%22ray%20morris
You can probably fix that H key in a few seconds by cleaning under it.
Also, as the AC said, if your work is sloppy, people will think your work is sloppy.
There IS a problem for them. The problem is they were allowed to get forty years behind. Now they have to get caught up. Private companies generally don't get behind to begin with.
What they were doing is using today's revenue to pay retirement for employees who worked forty years ago. Now they have to switch to investing today's revenue for today's workers. Paying as you go, as they are now required to do, isn't a problem. That's how everyone other than government does it. The problem is the switch - catching up from being forty years behind.
It's a lot like they'd been living on credit cards for forty years. Now they are only allowed to spend what they make - and they have ten years in which to pay off the debt they had racked up.
That's a rumor put out by the union, and false.
They have to ESTIMATE, not pay, what today's employees might collect 75 years from now.
When they hire a 20 year old worker, they are promising to continue paying that worker when he's 80 - which is 60 years from now. They have to make a written estimate of how much today's promises will cost them in the future.
This is standard stuff, what's called Generally Accepted Accounting Practices (GAAP). Every company that issues stock follows the same rules.
Actually private companies DO invest money so the pensions they promised will be paid. Typically, the employer sendd their part to an IRS or 401k account in the employee's name. That way, the money is there 40 years later while the employee is retired.
Occasionally, an employer will get caught screwing around with that and not properly investing that money on behalf of the employees they promised it to. That's called fraud. It's just that federal agencies were allowed to commit this type of fraud. With the internet, USPS may not have the revenue to in 40 years to cover the retirement pay for today's employees. That's why they now have to invest retirement pay for today's employees today, just like private companies do.
My MacBook most certainly does drive three displays. My Mac Pro drives four, is quad-core with 16 GB RAM, and is almost five years old. I bet one a couple years old, like mine, could be bought for a couple hundred bucks.
I used Linux exclusively for fifteen years. I contributed to the kernel. When the boss put me on a Mac, I was surprised to discover how familiar it felt. I can use it just like Linux, with exactly the same workflow. The main difference is the cost of a Mac buys you nice hardware that "just works", and works very well. Mac has of course always been THE system for graphic design and publishing, so the display system is well done.
Same here. I support open source, I helped write a lot of it. I wrote one package from scratch that was distributed with Solaris. I wouldn't BUY their product, but that means I won't USE it. I wouldn't steal it, as these defendants allegedly did.
I wish Oracle released all of their stuff as open source, but they don't. I expect them to respect the license on my software (GPL), and people should respect their license.
If I'm reading that right, Oracle clams that:
Oracle provides updated software versions for a yearly fee.
Defendants are unlawfully distributing the updated versions to people who haven't paid the fee.
If I'm reading that right, Oracle is being slightly non-generous by having annual payments to get updates. That's understandable, though, it costs them money to keep making new updates.
I see nothing in TFA about Oracle objecting to services the defendants provide, just and objection to them distributing new updates that haven't been paid for. So the headline is a load of bull, right?