Remember when you were a kid? I bet you'd have loved to go to computer camp. Now that you work in computers, you'd never go to computer camp on your vacation; you'd go to a resort that gives you opportunities to go outside and play.
I've been on a couple of paleontology digs. It's really cool hauling sacks of dirt for a few days, tolerable for a few weeks. Other tasks have different charm half-lives. Hiking through the badlands prospecting for bones that have washed out is probably has the longest appeal; I could spend months doing that. My job required doing this for a couple of weeks, but if I had to spend all summer at it, I'd probably be looking forward to riding the subway and getting a latte at Starbucks when I got back.
If your job was looking at asses all day long, I bet you'd want to spend your vacation in a monastery.
You might or might not be right that this was something they ought not have published, but it's not the same situation. Jailbrekr claimed they'd have published the information if this guy didn't work for them.
Well, one thing that's important to remember is that most non-trivial systems are produced by organizations, not individuals. Doesn't it make sense that the quality of the institution is a factor in code quality? Take a talented individual, put him in a good organization and he will learn to work in a way that the organization rewards.
Computer science is like anything other kind of academic discipline. It is very valuable, but it's not magic.
Consider this thought experiment. Alice likes to read poetry, and tries her hand at writing. She regularly shares her poems with other people interested in reading and writing poetry. Bob likes poetry, so he gets a degree in English and takes as many poetry classes as he can. Then he starts writing poetry and tries submitting it to the New Yorker. It seems to me Alice is more likely to become an accomplished poet than Bob, although you can never know for sure. On the other hand, consider Charlie who like Alice workshops his poems all the time, but who also gets the same formal education as Bob. Again there's no guarantees, but unless something is seriously wrong with the school he's going to he should have the best shot of all.
What I'm saying is that the Computer Science and the craft aspects of programming are complementary precisely because they aren't the same thing.
Without a computer science background, Larry Page and Sergei Brin would never have been able to make Google a success. Google is very much a company founded on algorithms and grown through architecture. Without programming craft, the products would not have been able to be maintained and scaled.to success.
I don't see why not. There's only one official way to use a rotary dial phone. Dialing by fiddling with the receiver "off hook" switch was a pain, and only for those cases where you had to make a call when somebody put one of those locks on the rotary dial.
It's not at all physically obvious why casette tapes should have "sides". The answer is in the physical property of the media. The speed with which the magnetized tape passes the head determines the strength of a signal. One of the trade offs of the technology is that higher speed and overall tape length. Having two sides to the tape allowed the overall tape length to remain manageable while doubling the capacity of the cartridge.
Likewise with the "metal" button. His guess was actually quite clever, and not too far off the mark. "Metal" here is a ridiculous piece of jargon; all tapes use metals or mixtures of different metal compounds bound to a plastic substrate. "Metal" tapes have a mixture with different recording and playback characteristics than the older iron oxide tapes. How the hell is anybody supposed to infer that from a label on a button?
Judging from the picture, they game him a beat up old tape player. It's no wonder it didn't sound so good. He was quite observant to note that some of the sound problems he heard were a result of weak batteries driving the motors, which might be worse on an old device. The quality of the tapes he used could also be an issue. Old, worn out tapes would sound bad, and new tapes that weren't recorded properly in the first place could have problems too.
Back in the day, a really good "walkman" type tape device with a decent set of portable earphones and a good quality tape could actually sound acceptably good. Maybe not audiophile quality, but then again you'd be taking your life in your hands to walk around with anything "audiophile quality" on conspicuous display. Even today people listen to their MP3 players using earbuds. I would say that a portable tape player with everything in tip-top shape and a pair of decent over the ear earphones would give an iPod with stock earbuds a run for its money in terms of sound.
No, I'm arguing for open products over struggling to make closed products act like they're open. I'm for spending my money with vendors who treat me right.
Richard Posner is an interesting guy; the kind of guy who'd be great on a law school faculty but who's a little scary on the bench. He thinks outside the box and is not afraid of taking positions most people think are wrong.
I've come across his name in reading about privacy. Posner is famous for opposing the concept of right of privacy. "Is there a right of privacy?" is the kind of question somebody should ask; having people seriously examine this question is good for society. Having people on the bench who don't believe there is a right to privacy is a different matter.
So he's not the kind of person who would balk from turning things upside down if he had an internally consistent theory that supported it. Not an activist judge, but something much worse: a philosopher judge.
Yes, you can screw around hacking GPS units. The question is, why do that instead of buying an ultramobile PC with GPS and navigation software?
Do you save money? No. Not if your time is worth anything. Also, if you're going to depend on this, say to equip your business or something, you have no guarantee you can do the same hacks when you replace the devices.
Do you learn anything? Well, sure, especially if you're the one who puts the time in to figure out how to do the hack. But less than you'd learn if you spent the same time just building software on a platform where the manufacturers are scheming to make your life miserable.
Are you striking a blow for freedom? Nope. You're sending your money to a manufacturer who's trying to restrict people's freedom. They don't really care if you manage to hack the thing, only that the process makes it worthless to most users. So maybe you should support folks who are marketing and supporting platforms, and save yourself a bundle of time too.
Of course, if the dedicated GPS units are better for their purpose than putting navigation software on an open PC, you can buy both; a GPS unit for navigation, and a UMPC with GPS for hacking. If your time is worth anything, you're still ahead.
I speak from experience, as an inveterate opener of cases and tweaker of things that are not supposed to be tweaked. It's only worth buying something to hack if the act of getting this thing to do something the manufacturer doesn't want it do has some kind of twisted appeal to you. One possible exception is if there is something unique about the hardware, which is certainly not the case for most GPS units. In fact they probably lack things you'll want, like certain interfaces. If there were a device that was amazingly cheap and known to be super hacker friendly, I might be tempted, but probably wouldn't bother. Where the manufacturer is trying tie your hands, why give them money for the privilege of spending your time escaping?
If you've bought one without the intention to hack it, and then you get the itch, sure go for it. That's a different story. But I think you'd be nuts to buy one for hacking if that's a high priority for you.
You have to start by defining "freedom" and evaluating threats to that freedom.
I'll give you an example, the mandatory ID card. Yes, they've been abused in the past. But it's not the ID card itself, it's how it's used. That may seem like a quibbling point, but it matters now because with surveillance cameras, face recognition software and databases, a tyrant can get most of what he gets from the ID card, plus this: you never know for sure when you're being tracked. It's the network and the database you ought to be worrying about. With "papers, please" at least you know when you are being tracked.
Here in the US, we might not have an ID card, and we're way behind the UK in surveillance cameras, but private data miners have practically unlimited ability to track us by our transactions, and the government which by law is not allowed to collect such data is allowed to buy that. Why? Because unlike in the Europe, we don't recognize a right of data privacy; in fact our rights of privacy are not explicitly spelled out anywhere.
Well, if you've ever had to make a business decision (as opposed to armchair quarterback), you'd know that "bad" is sometimes a relative term.
If the choice is (a) sign a deal or (b) compete against the company that owns the platform your software have to work on, the scales are tilted towards signing the deal.
Now you can argue it's Microsoft's right to use its platform control this way. It's a position worth discussing. But you shouldn't sneak that position under the "bad business deal" banner.
Speaking of innovative body construction and drive train technology, here is car which is constructed almost entirely of injection molded parts, and whose biomass powered drive train qualifies it as a zero emissions vehicle.
On top of that, it has that elusive quality that makes a car a hit: style. Within the target market segment, its appeal is undeniable. Best of all, it's not a concept car. You can buy it today.
Well, when I was young, man moons ago, we used to have these things called "consumer protection laws". You could walk over to your phone and call a government hotline for help. Of course, you'd get a massive shock when you picked up the phone because of the electrostatic action of your polyester leisure suit, so I'd have to conclude that on the whole things aren't any better or worse than they used to be.
What you say about power once granted is true, but thing that is missing from this debate is that the executive branch has a duty to defend the constitutionality of laws in court. If it doesn't, it gets a de facto retroactive veto on past legislation. They get somebody to challenge a law they don't like in court, then roll over and play dead.
This doesn't mean that they are necessarily obliged to use powers they see as unconstitutional during an investigation, but once a dispute gets to court they've got to make a good faith effort to defend the law that Congress has passed, even if they don't like it. There's nobody else to do this. It's probably a flaw in our Constitution, but there you have it.
So we can't make many deductions about the administration's own position on this until a year or two has passed and we're wrangling over the administration's own policies. The Doe v. Holder case, IIRC, is part of a series of legal challenges to the Patriot Act that have been going on fr several years. I hope the Obama administration loses on this one.
Well, I'd like to get to know the Earth better before it is reduced to a mere "ball of rock."
That's a good short term (i.e. next million years or so) goal for space exploration.
Every time I hear somebody who insists that the human race should strive to move away from the Earth, I wonder whether that person has ever tried, say, living in a different culture, or among a different economic class. I wonder if he were dropped in a forest whether he could identify the trees, build a shelter, or find food. I wonder if he's ever had a garden of his own.
I'm not against space colonization by any means. By I wonder how many people know how to live on Earth.
Fortunately, space exploration supports both goals: the short term goal of living on Earth more wisely, and the long term goal of living elsewhere.
To a usability expert, expectations are your friends. You trust them. You believe in them.
To a security expert, expectations are your enemies. You distrust them. You try to figure out what they're hiding from you.
Of course, everyone agrees that what is expected and what happens *should* be the same, but I think here the securities guys have the more legitimate concern. Mr. Nielson doesn't even considers the possibility that his expectations might be violated. He assumes they are benign as long as they are "usually" right.
What does "usually" mean? *You the user* may "usually" type the password where you can't be watched (although how Nielson knows this applies to me I have no idea). But the usual case for the *criminal* is the situation where *some* user is being vulnerable. He doesn't care about the legions of users who are not exposed to a problem. He cares about the sufficient number of users to his purpose that are. He *seeks* what we consider negligible and makes his home there.
Suppose I design a web site with ten thousand users a day. Suppose a certain situation comes up only 1/10 of one percent. of the time for any given user on any given day. To a usability expert that's negligible. To a security expert, that means I'll be guaranteeing ten exposures to vulnerabilities per day. That's great for attackers. They don't care that *most* users aren't exposed to this problem *most* of the time. They only care that *some* users will be exposed to this problem nearly *all* of the time.
All engineering is about balancing costs and benefits. But you've got to know the probabilities, and to do that right you've got to determine the right population to calculate them with. Once we've established that the "unusual" user case is the "usual" attacker case, we have to recalculate our cost estimates. Where an attack is extremely unlikely, Mr. Nielson is correct in saying that the increment of security that masking gives is small. We're talking about very, very small probabilities, so the only increment we might rationally care about is dropping the probability to zero. Since some criminals can read keystrokes from a keyboard (although by no means many), we don't achieve that. Therefore masking is useless.
However, from the perspective of the attacker and site owner, a situation where some users are exposed to this kind of attack is quite common. It literally happens all the time for a large site. Therefore if masking repulsed, say, 50% of attacks (being very, very conservative), it's still worth doing if you want to keep your site secure, or care about possible violations of user privacy.
If a poor man is starving, I do not condemn him for stealing a loaf of bread. There might be something noble about starving to death rather than stealing, but I don't expect that from anybody.
If the ship is going down, I do not condemn a man for pushing women or children out of his way so he can get a seat in the lifeboat. It would be admirable for him to wait his turn, or give up his place so a child can take it. But I don't expect that.
If a rich man needs an organ transplant, I don't blame him for working the system to get one. Some people are fortunate to live some place where the queue is short, and the rich man can join multiple queues. I don't see any particular nobility to joining only one list and possibly letting a tissue match go unused. So I certainly wouldn't expect that; in fact I'd expect the opposite. But that is beside the point.
It may be reasonable for a rich man to game the system, but that doesn't mean that the system itself is necessarily reasonable.
You say there is not an infinite supply of livers. That's a ridiculous standard. There isn't an infinite supply of anything. But there are three hundred million people in this country, so there are three hundred million livers. At some point every one of those livers is going to be given up in some way by its owner, and quite a few cases those livers will be in perfectly good order. Probably a lot more usable livers are cremated or thrown out than put into the organ donation system. It's also quite conceivable that better preventive care would preserve more livers in functioning order not so much so that they can be donated, but that the need for donations would be reduced. That would have precisely the same effect on people waiting for transplants as increasing the number of livers, not even counting the benefit of not needing to get a liver transplant in the first place.
There are lots of ways this situation could be made better, except that it's nobody's job to make this situation better. It's not that the rich benefit from this, because they don't. They just suffer less than everyone else.
America is the kind of country that could put a spy satellite capable of taking a crystal clear photo of a menu at an outdoor cafe in Tehran, but find itself unable to locate a Farsi speaker to translate it.
OK, that's a bit of an exaggeration, but the idea that we have the kind of human intelligence capability to create that kind of unrest is a joke. Even in the swashbuckling days when we sent Kermit Roosevelt to Tehran with a suitcases of cash to stage a coup, we did it the old fashioned way, buying off government and military officials. Even if we could manage that sort of thing today, there's no way we could create a popular uprising of this size. Even an indigenous opposition movement couldn't do it.
There's only one agency that could have created these protests: the Iranian regime itself. It started with a miscalculation: they underestimated voter turnout. Then they panicked, over-reacting again and again, until they are in danger of recreating the very conditions of the revolution that brought them to power. It's a mistake old men in power too long frequently make. They become the very thing they fought against and won when they were young men.
The idiot is the person who thinks he can secure liberty for himself alone.
The time to worry about plausible deniability is before the secret police catch you. And make sure everyone knows the drill too. In the face of the secret police "individual liberty" has no practical utility.
Even an oppressive state can't kill everyone. That's the game going on in the streets of Tehran today. The protesters want to nucleate into a crowd so big that it can't be dispersed without killing lots of people. The government doesn't want to do that, because in Iran that means funerals, which are ready made protest rallies. The government wants to keep the crowds isolated and intimidated so that it doesn't end up signing its own death warrant.
The key to effective oppression is intimidation. The key to defeating oppression is to gather so many people together they can't be intimidated.
Well, I'm not entirely sure you are correct about the need to put a man on the Moon. You see, it's not us with the t-shirt, it's us wearing our parents' t-shirt. For a lot of us it's grannie's t-shirt.
When China puts a man on the Moon, they'll be making a statement: America doesn't do this sort of thing anymore. They're coasting. Look to us for leadership and vision.
True, doing something that had never been done before would be even better for that purpose, but still they'll be doing something we don't currently have the capability or will to do. Unless we have something different to answer this with ("look at us, we just found a cure for influenza!"), China's claim will be credible enough to be worth the effort of going there.
Slashdot Mirror
Remember when you were a kid? I bet you'd have loved to go to computer camp. Now that you work in computers, you'd never go to computer camp on your vacation; you'd go to a resort that gives you opportunities to go outside and play.
I've been on a couple of paleontology digs. It's really cool hauling sacks of dirt for a few days, tolerable for a few weeks. Other tasks have different charm half-lives. Hiking through the badlands prospecting for bones that have washed out is probably has the longest appeal; I could spend months doing that. My job required doing this for a couple of weeks, but if I had to spend all summer at it, I'd probably be looking forward to riding the subway and getting a latte at Starbucks when I got back.
If your job was looking at asses all day long, I bet you'd want to spend your vacation in a monastery.
No, still citation needed. Differing circumstances require different actions.
You might or might not be right that this was something they ought not have published, but it's not the same situation. Jailbrekr claimed they'd have published the information if this guy didn't work for them.
Citation please?
If Rohde became a cause celebre, the people holding him might be tempted to do a Daniel Pearl style execution for the publicity.
Well, one thing that's important to remember is that most non-trivial systems are produced by organizations, not individuals. Doesn't it make sense that the quality of the institution is a factor in code quality? Take a talented individual, put him in a good organization and he will learn to work in a way that the organization rewards.
Computer science is like anything other kind of academic discipline. It is very valuable, but it's not magic.
Consider this thought experiment. Alice likes to read poetry, and tries her hand at writing. She regularly shares her poems with other people interested in reading and writing poetry. Bob likes poetry, so he gets a degree in English and takes as many poetry classes as he can. Then he starts writing poetry and tries submitting it to the New Yorker. It seems to me Alice is more likely to become an accomplished poet than Bob, although you can never know for sure. On the other hand, consider Charlie who like Alice workshops his poems all the time, but who also gets the same formal education as Bob. Again there's no guarantees, but unless something is seriously wrong with the school he's going to he should have the best shot of all.
What I'm saying is that the Computer Science and the craft aspects of programming are complementary precisely because they aren't the same thing.
Without a computer science background, Larry Page and Sergei Brin would never have been able to make Google a success. Google is very much a company founded on algorithms and grown through architecture. Without programming craft, the products would not have been able to be maintained and scaled.to success.
I don't see why not. There's only one official way to use a rotary dial phone. Dialing by fiddling with the receiver "off hook" switch was a pain, and only for those cases where you had to make a call when somebody put one of those locks on the rotary dial.
It's not at all physically obvious why casette tapes should have "sides". The answer is in the physical property of the media. The speed with which the magnetized tape passes the head determines the strength of a signal. One of the trade offs of the technology is that higher speed and overall tape length. Having two sides to the tape allowed the overall tape length to remain manageable while doubling the capacity of the cartridge.
Likewise with the "metal" button. His guess was actually quite clever, and not too far off the mark. "Metal" here is a ridiculous piece of jargon; all tapes use metals or mixtures of different metal compounds bound to a plastic substrate. "Metal" tapes have a mixture with different recording and playback characteristics than the older iron oxide tapes. How the hell is anybody supposed to infer that from a label on a button?
Judging from the picture, they game him a beat up old tape player. It's no wonder it didn't sound so good. He was quite observant to note that some of the sound problems he heard were a result of weak batteries driving the motors, which might be worse on an old device. The quality of the tapes he used could also be an issue. Old, worn out tapes would sound bad, and new tapes that weren't recorded properly in the first place could have problems too.
Back in the day, a really good "walkman" type tape device with a decent set of portable earphones and a good quality tape could actually sound acceptably good. Maybe not audiophile quality, but then again you'd be taking your life in your hands to walk around with anything "audiophile quality" on conspicuous display. Even today people listen to their MP3 players using earbuds. I would say that a portable tape player with everything in tip-top shape and a pair of decent over the ear earphones would give an iPod with stock earbuds a run for its money in terms of sound.
No, I'm arguing for open products over struggling to make closed products act like they're open. I'm for spending my money with vendors who treat me right.
Richard Posner is an interesting guy; the kind of guy who'd be great on a law school faculty but who's a little scary on the bench. He thinks outside the box and is not afraid of taking positions most people think are wrong.
I've come across his name in reading about privacy. Posner is famous for opposing the concept of right of privacy. "Is there a right of privacy?" is the kind of question somebody should ask; having people seriously examine this question is good for society. Having people on the bench who don't believe there is a right to privacy is a different matter.
So he's not the kind of person who would balk from turning things upside down if he had an internally consistent theory that supported it. Not an activist judge, but something much worse: a philosopher judge.
How much is your time worth?
Yes, you can screw around hacking GPS units. The question is, why do that instead of buying an ultramobile PC with GPS and navigation software?
Do you save money? No. Not if your time is worth anything. Also, if you're going to depend on this, say to equip your business or something, you have no guarantee you can do the same hacks when you replace the devices.
Do you learn anything? Well, sure, especially if you're the one who puts the time in to figure out how to do the hack. But less than you'd learn if you spent the same time just building software on a platform where the manufacturers are scheming to make your life miserable.
Are you striking a blow for freedom? Nope. You're sending your money to a manufacturer who's trying to restrict people's freedom. They don't really care if you manage to hack the thing, only that the process makes it worthless to most users. So maybe you should support folks who are marketing and supporting platforms, and save yourself a bundle of time too.
Of course, if the dedicated GPS units are better for their purpose than putting navigation software on an open PC, you can buy both; a GPS unit for navigation, and a UMPC with GPS for hacking. If your time is worth anything, you're still ahead.
I speak from experience, as an inveterate opener of cases and tweaker of things that are not supposed to be tweaked. It's only worth buying something to hack if the act of getting this thing to do something the manufacturer doesn't want it do has some kind of twisted appeal to you. One possible exception is if there is something unique about the hardware, which is certainly not the case for most GPS units. In fact they probably lack things you'll want, like certain interfaces. If there were a device that was amazingly cheap and known to be super hacker friendly, I might be tempted, but probably wouldn't bother. Where the manufacturer is trying tie your hands, why give them money for the privilege of spending your time escaping?
If you've bought one without the intention to hack it, and then you get the itch, sure go for it. That's a different story. But I think you'd be nuts to buy one for hacking if that's a high priority for you.
You have to start by defining "freedom" and evaluating threats to that freedom.
I'll give you an example, the mandatory ID card. Yes, they've been abused in the past. But it's not the ID card itself, it's how it's used. That may seem like a quibbling point, but it matters now because with surveillance cameras, face recognition software and databases, a tyrant can get most of what he gets from the ID card, plus this: you never know for sure when you're being tracked. It's the network and the database you ought to be worrying about. With "papers, please" at least you know when you are being tracked.
Here in the US, we might not have an ID card, and we're way behind the UK in surveillance cameras, but private data miners have practically unlimited ability to track us by our transactions, and the government which by law is not allowed to collect such data is allowed to buy that. Why? Because unlike in the Europe, we don't recognize a right of data privacy; in fact our rights of privacy are not explicitly spelled out anywhere.
Well, if you've ever had to make a business decision (as opposed to armchair quarterback), you'd know that "bad" is sometimes a relative term.
If the choice is (a) sign a deal or (b) compete against the company that owns the platform your software have to work on, the scales are tilted towards signing the deal.
Now you can argue it's Microsoft's right to use its platform control this way. It's a position worth discussing. But you shouldn't sneak that position under the "bad business deal" banner.
That's true for water droplets as well. You don't get a perfect picture, but you can see that the phenomenon is periodic.
I have seven words to say to you: no we will not let you go!
Haven't they heard of strobe lights?
Speaking of innovative body construction and drive train technology, here is car which is constructed almost entirely of injection molded parts, and whose biomass powered drive train qualifies it as a zero emissions vehicle.
On top of that, it has that elusive quality that makes a car a hit: style. Within the target market segment, its appeal is undeniable. Best of all, it's not a concept car. You can buy it today.
Well, when I was young, man moons ago, we used to have these things called "consumer protection laws". You could walk over to your phone and call a government hotline for help. Of course, you'd get a massive shock when you picked up the phone because of the electrostatic action of your polyester leisure suit, so I'd have to conclude that on the whole things aren't any better or worse than they used to be.
What you say about power once granted is true, but thing that is missing from this debate is that the executive branch has a duty to defend the constitutionality of laws in court. If it doesn't, it gets a de facto retroactive veto on past legislation. They get somebody to challenge a law they don't like in court, then roll over and play dead.
This doesn't mean that they are necessarily obliged to use powers they see as unconstitutional during an investigation, but once a dispute gets to court they've got to make a good faith effort to defend the law that Congress has passed, even if they don't like it. There's nobody else to do this. It's probably a flaw in our Constitution, but there you have it.
So we can't make many deductions about the administration's own position on this until a year or two has passed and we're wrangling over the administration's own policies. The Doe v. Holder case, IIRC, is part of a series of legal challenges to the Patriot Act that have been going on fr several years. I hope the Obama administration loses on this one.
Well, I'd like to get to know the Earth better before it is reduced to a mere "ball of rock."
That's a good short term (i.e. next million years or so) goal for space exploration.
Every time I hear somebody who insists that the human race should strive to move away from the Earth, I wonder whether that person has ever tried, say, living in a different culture, or among a different economic class. I wonder if he were dropped in a forest whether he could identify the trees, build a shelter, or find food. I wonder if he's ever had a garden of his own.
I'm not against space colonization by any means. By I wonder how many people know how to live on Earth.
Fortunately, space exploration supports both goals: the short term goal of living on Earth more wisely, and the long term goal of living elsewhere.
Well, that's the crux isn't it?
To a usability expert, expectations are your friends. You trust them. You believe in them.
To a security expert, expectations are your enemies. You distrust them. You try to figure out what they're hiding from you.
Of course, everyone agrees that what is expected and what happens *should* be the same, but I think here the securities guys have the more legitimate concern. Mr. Nielson doesn't even considers the possibility that his expectations might be violated. He assumes they are benign as long as they are "usually" right.
What does "usually" mean? *You the user* may "usually" type the password where you can't be watched (although how Nielson knows this applies to me I have no idea). But the usual case for the *criminal* is the situation where *some* user is being vulnerable. He doesn't care about the legions of users who are not exposed to a problem. He cares about the sufficient number of users to his purpose that are. He *seeks* what we consider negligible and makes his home there.
Suppose I design a web site with ten thousand users a day. Suppose a certain situation comes up only 1/10 of one percent. of the time for any given user on any given day. To a usability expert that's negligible. To a security expert, that means I'll be guaranteeing ten exposures to vulnerabilities per day. That's great for attackers. They don't care that *most* users aren't exposed to this problem *most* of the time. They only care that *some* users will be exposed to this problem nearly *all* of the time.
All engineering is about balancing costs and benefits. But you've got to know the probabilities, and to do that right you've got to determine the right population to calculate them with. Once we've established that the "unusual" user case is the "usual" attacker case, we have to recalculate our cost estimates. Where an attack is extremely unlikely, Mr. Nielson is correct in saying that the increment of security that masking gives is small. We're talking about very, very small probabilities, so the only increment we might rationally care about is dropping the probability to zero. Since some criminals can read keystrokes from a keyboard (although by no means many), we don't achieve that. Therefore masking is useless.
However, from the perspective of the attacker and site owner, a situation where some users are exposed to this kind of attack is quite common. It literally happens all the time for a large site. Therefore if masking repulsed, say, 50% of attacks (being very, very conservative), it's still worth doing if you want to keep your site secure, or care about possible violations of user privacy.
I suppose if you start a fork, and the other tine dies, then you end up with a skewer.
I think this debate is somewhat confused.
If a poor man is starving, I do not condemn him for stealing a loaf of bread. There might be something noble about starving to death rather than stealing, but I don't expect that from anybody.
If the ship is going down, I do not condemn a man for pushing women or children out of his way so he can get a seat in the lifeboat. It would be admirable for him to wait his turn, or give up his place so a child can take it. But I don't expect that.
If a rich man needs an organ transplant, I don't blame him for working the system to get one. Some people are fortunate to live some place where the queue is short, and the rich man can join multiple queues. I don't see any particular nobility to joining only one list and possibly letting a tissue match go unused. So I certainly wouldn't expect that; in fact I'd expect the opposite. But that is beside the point.
It may be reasonable for a rich man to game the system, but that doesn't mean that the system itself is necessarily reasonable.
You say there is not an infinite supply of livers. That's a ridiculous standard. There isn't an infinite supply of anything. But there are three hundred million people in this country, so there are three hundred million livers. At some point every one of those livers is going to be given up in some way by its owner, and quite a few cases those livers will be in perfectly good order. Probably a lot more usable livers are cremated or thrown out than put into the organ donation system. It's also quite conceivable that better preventive care would preserve more livers in functioning order not so much so that they can be donated, but that the need for donations would be reduced. That would have precisely the same effect on people waiting for transplants as increasing the number of livers, not even counting the benefit of not needing to get a liver transplant in the first place.
There are lots of ways this situation could be made better, except that it's nobody's job to make this situation better. It's not that the rich benefit from this, because they don't. They just suffer less than everyone else.
Those demonstrators, puppets of Western regimes?
Ha. If only.
America is the kind of country that could put a spy satellite capable of taking a crystal clear photo of a menu at an outdoor cafe in Tehran, but find itself unable to locate a Farsi speaker to translate it.
OK, that's a bit of an exaggeration, but the idea that we have the kind of human intelligence capability to create that kind of unrest is a joke. Even in the swashbuckling days when we sent Kermit Roosevelt to Tehran with a suitcases of cash to stage a coup, we did it the old fashioned way, buying off government and military officials. Even if we could manage that sort of thing today, there's no way we could create a popular uprising of this size. Even an indigenous opposition movement couldn't do it.
There's only one agency that could have created these protests: the Iranian regime itself. It started with a miscalculation: they underestimated voter turnout. Then they panicked, over-reacting again and again, until they are in danger of recreating the very conditions of the revolution that brought them to power. It's a mistake old men in power too long frequently make. They become the very thing they fought against and won when they were young men.
The idiot is the person who thinks he can secure liberty for himself alone.
The time to worry about plausible deniability is before the secret police catch you. And make sure everyone knows the drill too. In the face of the secret police "individual liberty" has no practical utility.
Even an oppressive state can't kill everyone. That's the game going on in the streets of Tehran today. The protesters want to nucleate into a crowd so big that it can't be dispersed without killing lots of people. The government doesn't want to do that, because in Iran that means funerals, which are ready made protest rallies. The government wants to keep the crowds isolated and intimidated so that it doesn't end up signing its own death warrant.
The key to effective oppression is intimidation. The key to defeating oppression is to gather so many people together they can't be intimidated.
Well, I'm not entirely sure you are correct about the need to put a man on the Moon. You see, it's not us with the t-shirt, it's us wearing our parents' t-shirt. For a lot of us it's grannie's t-shirt.
When China puts a man on the Moon, they'll be making a statement: America doesn't do this sort of thing anymore. They're coasting. Look to us for leadership and vision.
True, doing something that had never been done before would be even better for that purpose, but still they'll be doing something we don't currently have the capability or will to do. Unless we have something different to answer this with ("look at us, we just found a cure for influenza!"), China's claim will be credible enough to be worth the effort of going there.