In the end the password had to be sent by email, which as we all know is not the most secure communications medium.
Whilst this was probably a fairly secure method (the password wasn't sent until the package had been received and verified),
Sending a password/key via a different communications channel from the protected data is generally fairly secure. Especially if you are able to verify the identity of the recipient. It probably isn't a bad idea to use some kind of tamper evident packaging if you are sending any physical media though...
If you use adequate encryption the delivery method become irrelevant for security purposes because the value of the data to someone without the key is zero,
Subject to the issue of key management. Thing is that the government department involved is not likely to be one of those which is knowlegable on the subject of encryption. No doubt if they had tried to make any use of encryption they would have brought in commercial consultants, likely to have interests in selling proprietary "solutions" (when if comes to encryption most proprietary software is awful), rather than talking to experts within government. i.e. in the case of the British Government this is GCHQ (in the US it would be the NSA). This is before you even consider that just about all of the private contractors providing government IT in the UK are not remotely competent at anything other than filling out the paper work in order to get the contracts...
If you wanted to send this kind of data without strong encryption you'd need an armoured truck and an armed police escort.
You'd probably want to use several trucks, following different routes, so it wouldn't be obvious which one was carrying the real data. Then you put the real CD in the post labled as somthing boring.
The news on BBC Radio 4 have just confirmed that although the files were "password protected" they were not encrypted.
Given that the people involved appear so incompetent in the most basic matters of data security questions of encryption/password protection/etc may well be of little relevence.
My biggest beef with this is that congress is looking into this at all. It seems in the last few years that congress is doing a lot of stupid publicity-only type inquiries. A few years ago it was steroid use in baseball. They looked into Yahoo's business dealings in China. Now they are looking into the ESRB. I seem to recall other times that congress has gotten into things like this recently but I don't remember any specifics, just that I was thinking at the time "why is congress wasting their time here?"
Whilst failing to do their actual job. e.g. passing bills without reading them. (Though anyone who dosn't realise that they should abstain or vote "no" when they don't understand a proposal, let alone hasn't even read it probably should be excused from voting on the basis of stupidity.)
OTOH, I do think there wasa qualitative difference between GTA and Manhunt. If I had teenage kids over about 13 I'd be happy (not saying everyone would be) for them to play something like GTA. I'd probably give it another couple of years before Manhunt...
What is more useful here though a rating or a synopsis of the game? Another parent may think that Manhunt is ok for the 13 year old, but GTA was not until they were 15... People differ, be they parents or teenagers.
And in 20 years, someone will be advocating the "minimum age of adulthood" be raised to 25.
THe problem is not that there is a hard limit that is too low. The problem is that we're trying to set a hard limit on something that you cannot set a hard limit on. I know 30 year that are completely immature, and I've known people who were rock-solid responsible at 15.
It may even be the case that in some case the problem is that the "hard" limit is actually too low. As well as there should be more of a "soft" limit, a combination of "hard and soft" elements or even something along the lines of "there is an age limit, but if you manage to produce a false proof of age which works then from then on you have all the rights and responsibilities of that age". The latter may well lead to someone losing the right to any "child" concessions. Thus leading to a teenager having to make the choice of if being able to drink, drive, smoke, vote, etc is worth having to pay more to ride on a bus/train, pay more to watch a movie, fill out paperwork related to income tax, be called to serve on a jury, etc. It appears to help the stability of a society if rights go with responsibilities.
That's one of the reasons that I wish rating systems wouldn't use titles like "T for Teen" and "M for mature". It implies that you need to be a certain age to play it and it doesn't really tell you what the content is.
If age was really ment to be the benchmark you'd also expect games and movies to have ratings along the lines of "not recommended for people over age X (unless in the company of (grand)son/daughter/nephew/niece/etc)".
Sure you can guess that if something is "M" it probably has either course language, violence, nudity or all of the above but I, as a parent, will decide how much profanity, course language, violence, sex and drugs is acceptable for my children.
Not only how much, but also of which type. The definition of "course language" can be very subjective. Also whilst some people rate "cartoon" violence worst that "realistic" violence other people have much the opposite opinion. (There are also very subjective issues surrounding if bodies are seen. Which can lead to the apparently strange situation where WMD's are more acceptable to show used than handguns.)
Not some board of strangers who are trying to impose their moral opinions on our other strangers.
It's also ironic that often these groups of people who claim to represent "parents" do not themselves have children (either at all or of relevent ages).
Game makers would be fine with AO ratings except for the fact that they are a kiss of death. For some reason, in everyone's mind, the highest rating = porno. So Walmart and others will sell R rated movies and M rated games, but if you get an NC-17 or AO hung on it all of a sudden nobody wants to distribute it.
Which is ironic considering that one of the ideas behind NC-17 was to distinguish "adult" from "porn".
The problem with "loser pays up to what loser spent" is that there exist entities that can afford to "file in bulk" and who don't really care to win, just to harass enough to force a settlement. The individual defendants don't get the benefit of the economies of scale, and as the defendants can't afford to lose, they have to pay for "higher quality" representation (or at least, they have to pay for a lawyer to handle their case, as opposed to paying a law firm to stamp out 500 cases with little intent to follow through on them all).
AFAIK the RIAA (and similar) arn't actually filing in bulk. So much as sending threats in bulk. Since once a suit is actually filed the parties are on somewhat more equal footing. The defendant can countersue the plaintiff or place the plaintiff in a position they have to either make their case to a court or drop it. Whilst it might be possible to file in bulk it's more difficult to take cases to court in bulk. Even if all the defendents did was have the cases moved to their nearest court.
There has been a court order which is completely different that a ruling. The motion itself is primarily about procedural issues with the RIAA attorneys filing and not about whether any copyright infringement has occurred.
If you (as plaintiff) can't file suit correctly then whatever you allege the defendent has done is irrelevent. Note also that it is generally necessary to establish both that a law has been broken and that the defendent has done this. It is perfectly acceptable for a defendent to claim "no law has actually been broken"/"that law does not apply here". They are not limited to "I/We didn't do that" arguments.
I have seen claims made by the RIAA in reports of cases that they have made that were simply untenable--that an IP address uniquely identifies an individual, that a person that sent a laptop to be repaired and had the hard drive replaced was intentionally destroying evidence, and that a computer screenshot that shows an IP address is conclusive proof that a person was sharing files (I can construct a screenshot that shows any IP address and make any claim I want by those rules of evidence).
Also untenable in the opinion of several judges. Effectivly they have been told "you have no case, go away".
I like the scare quotes on settlement offer. I mean, the vast majority of people are flat out guilty and the settlement is giving them an out relatively cheaply
If these cases came to court it would be up to the plaintiff to prove guilt to the court's satisfaction.
The reason the RIAA's campaign hasn't stopped in the states is that they get what they want most of the time. People cough up the money for the "settlement offer."
Another factor might well be the cost of lawyers and people's reluctance/inability to defend themselves as LIPs.
There's nothing ironic about some guy $NAME being bribed, but, one would expect that an offical designated as a monitor against corruption would be incorruptible. That's the ironic part -- it turns out that a presidential monitor against corruption was indeed corrupt!
Really? Sounds like he refused the bribe whilst documenting the bribary attempt.
A few years ago, I received many stock spams for "XLPI.PK", or Xcel Plus, which sells fuel and lubricant additives. Such additives are referred to in the automotive industry as "mouse milk"; they usually don't do much, and may make things worse. That whole category of products is mostly bogus.
If they actually were any good you'd expect that the oil companies would incorporate them in their products.
Back then, their web site contained endorsements from the FAA and the US Army. The web site reproduced a a letter of endorsement appearing to be from an FAA representative. I thought this was a bit strange, so I sent off a note to the regional FAA office asking if it was legitimate. It would be very strange unless they were advertising their products for aircraft engines. There tends to be a lot more red tape involved with getting anything approved in aviation than with any other kind of vehicle. Given that an engine failure in an aircaft tends to be a lot more serious than one in a car, truck, bus, boat, etc.
never seen gold plated optical wires, but I did have to upgrade to nicely shielded optical wires, and they do serve an important purpose: it is more difficult for my cat to chew through the cable. My first optical cable did look pretty cool after my cat had worked on it for a week or so--little red lights peeking through along the whole length of the cord.
That isn't so much sheilded as armoured. You'd probably have to have various grades for "pet armour" since what might stop a cat probably isn't going to be much use against a rat.
Basically if you're cabable of working with it, use CAT5, otherwise there are a number of cheap solutions.
Except that CAT5 is lacking in conductor area so limited in current capacity and the insulation isn't rated for that high a voltage.
I learned from there that gold has a higher resistance than copper, so the only reason for gold plated connectors is that it sounds expensive.
Actually the usual reason for using gold is that it is more inert than copper. Whilst metals tend to be good conductors metal oxides tend to be good insulators. Silver is actually the best metal when it comes to conductivity, but is fairly reactive.
3. I love to see audiophile setups where the owner doesn't even bother to do a minimal amount of room treatment. No matter how good your sound system is, in a square room with a low flat ceiling and walls at 90 degrees to each other, you're going to have all kinds of reflections, phase interference, and standing waves.
Rarely do rooms have exactly right angles. That's before you even consider doors, windows, furniture, people, etc affecting how sound travels in a room.
4. Spend hundreds of dollars per foot on a cable that you need to be ruggedized, say, for the permanent install of the line array that you've built into a concert hall.
Likeky to be even more of a requirement on a FoH multi for a touring PA system...
It prevents a ground loop. The shield doesn't carry current, it just "shields" (so to speak) the center conductor from EMI.
Rather importantly it won't do this effectivly if it is carrying a current. Thus it is important that a shield is only connected to "ground" at one place. It many cases two "grounds" are not at the same potential. By convention this is the signal source end with a cable.
A good friend is a pilot who has flown pipeline inspection flights, and he says they're easy to follow, even without the little yellow signs. Ground cover and erosion patterns give them away, even under a field that I personally know has been tilled annually for at least 27 years since the pipeline was buried. If you doubt me, go check a google satellite map of any local pipeline you're familiar with -- you will find an unnaturally straight line cutting through fields, passing under roads, disturbing trees, brush, and altering creekbeds.
27 years is nothing much. It is perfectly possible to find the outlines of Roman buildings visible from the air. With the only thing actually being present on the ground are foundation trenches which were filled with earth over a thousand years ago. (Building stone is a valuable commodity and dismantling a building is typically cheaper than quarrying from scratch. Since someone else has already done the job of selecting the decent stone and cutting it into usable size pieces.)
This is about the only way what T-Mobile and Apple are doing would be remotely legal in Germany (or anywhere else in the EU).
You can only buy the phone if you sign up for a 2 year contract in that shop - only after signing the agreement do you get the iPhone.
This is the point at which things become legally questionable. It would be as if a supermarket refused to sell you a glass unless you signed a contract to buy at least 4 litres of milk, per week from them.
You can't buy it from an Apple Store like in the USA.
If Apple tried to sell it at an "Apple Store" in Germany they'd probably have their shops shut down.
That was the original point of the GSM standard. You were supposed to be able to buy a single phone and take it anywhere in the world that supported GSM. Sure, you may or may not have to pop in another SIM card if your provider didn't have roaming in the place where you were at. The whole locking the phones thing breaks that compatibility, as do the different band allocations around the place now.
The latter is addressed by having phones with multiband capability. The more features a phone has the more likely being able to change SIMs is something the user will want to do.
Slashdot Mirror
In the end the password had to be sent by email, which as we all know is not the most secure communications medium.
Whilst this was probably a fairly secure method (the password wasn't sent until the package had been received and verified),
Sending a password/key via a different communications channel from the protected data is generally fairly secure. Especially if you are able to verify the identity of the recipient. It probably isn't a bad idea to use some kind of tamper evident packaging if you are sending any physical media though...
Get your facts straight. HMRC enjoy crown immunity and cannot be prosecuted.
Even if they didn't since they are not a person it's kind of hard to put them in prison.
Personally I think it was honourable of Paul Grey (HMRC's Chairman) to resign.
It's not a good sign when doing the right thing becomes the exception rather than the rule. Wonder if he's taking good care of his P45 and UB40...
If you use adequate encryption the delivery method become irrelevant for security purposes because the value of the data to someone without the key is zero,
Subject to the issue of key management.
Thing is that the government department involved is not likely to be one of those which is knowlegable on the subject of encryption. No doubt if they had tried to make any use of encryption they would have brought in commercial consultants, likely to have interests in selling proprietary "solutions" (when if comes to encryption most proprietary software is awful), rather than talking to experts within government. i.e. in the case of the British Government this is GCHQ (in the US it would be the NSA). This is before you even consider that just about all of the private contractors providing government IT in the UK are not remotely competent at anything other than filling out the paper work in order to get the contracts...
If you wanted to send this kind of data without strong encryption you'd need an armoured truck and an armed police escort.
You'd probably want to use several trucks, following different routes, so it wouldn't be obvious which one was carrying the real data. Then you put the real CD in the post labled as somthing boring.
The news on BBC Radio 4 have just confirmed that although the files were "password protected" they were not encrypted.
Given that the people involved appear so incompetent in the most basic matters of data security questions of encryption/password protection/etc may well be of little relevence.
My biggest beef with this is that congress is looking into this at all. It seems in the last few years that congress is doing a lot of stupid publicity-only type inquiries. A few years ago it was steroid use in baseball. They looked into Yahoo's business dealings in China. Now they are looking into the ESRB. I seem to recall other times that congress has gotten into things like this recently but I don't remember any specifics, just that I was thinking at the time "why is congress wasting their time here?"
:)
Whilst failing to do their actual job. e.g. passing bills without reading them. (Though anyone who dosn't realise that they should abstain or vote "no" when they don't understand a proposal, let alone hasn't even read it probably should be excused from voting on the basis of stupidity.)
Don't they have laws to pass and repeal
Maybe these should be the other way around
OTOH, I do think there wasa qualitative difference between GTA and Manhunt. If I had teenage kids over about 13 I'd be happy (not saying everyone would be) for them to play something like GTA. I'd probably give it another couple of years before Manhunt...
What is more useful here though a rating or a synopsis of the game? Another parent may think that Manhunt is ok for the 13 year old, but GTA was not until they were 15... People differ, be they parents or teenagers.
And in 20 years, someone will be advocating the "minimum age of adulthood" be raised to 25.
THe problem is not that there is a hard limit that is too low. The problem is that we're trying to set a hard limit on something that you cannot set a hard limit on. I know 30 year that are completely immature, and I've known people who were rock-solid responsible at 15.
It may even be the case that in some case the problem is that the "hard" limit is actually too low. As well as there should be more of a "soft" limit, a combination of "hard and soft" elements or even something along the lines of "there is an age limit, but if you manage to produce a false proof of age which works then from then on you have all the rights and responsibilities of that age". The latter may well lead to someone losing the right to any "child" concessions. Thus leading to a teenager having to make the choice of if being able to drink, drive, smoke, vote, etc is worth having to pay more to ride on a bus/train, pay more to watch a movie, fill out paperwork related to income tax, be called to serve on a jury, etc. It appears to help the stability of a society if rights go with responsibilities.
That's one of the reasons that I wish rating systems wouldn't use titles like "T for Teen" and "M for mature". It implies that you need to be a certain age to play it and it doesn't really tell you what the content is.
If age was really ment to be the benchmark you'd also expect games and movies to have ratings along the lines of "not recommended for people over age X (unless in the company of (grand)son/daughter/nephew/niece/etc)".
Sure you can guess that if something is "M" it probably has either course language, violence, nudity or all of the above but I, as a parent, will decide how much profanity, course language, violence, sex and drugs is acceptable for my children.
Not only how much, but also of which type. The definition of "course language" can be very subjective. Also whilst some people rate "cartoon" violence worst that "realistic" violence other people have much the opposite opinion. (There are also very subjective issues surrounding if bodies are seen. Which can lead to the apparently strange situation where WMD's are more acceptable to show used than handguns.)
Not some board of strangers who are trying to impose their moral opinions on our other strangers.
It's also ironic that often these groups of people who claim to represent "parents" do not themselves have children (either at all or of relevent ages).
Game makers would be fine with AO ratings except for the fact that they are a kiss of death. For some reason, in everyone's mind, the highest rating = porno. So Walmart and others will sell R rated movies and M rated games, but if you get an NC-17 or AO hung on it all of a sudden nobody wants to distribute it.
Which is ironic considering that one of the ideas behind NC-17 was to distinguish "adult" from "porn".
The problem with "loser pays up to what loser spent" is that there exist entities that can afford to "file in bulk" and who don't really care to win, just to harass enough to force a settlement. The individual defendants don't get the benefit of the economies of scale, and as the defendants can't afford to lose, they have to pay for "higher quality" representation (or at least, they have to pay for a lawyer to handle their case, as opposed to paying a law firm to stamp out 500 cases with little intent to follow through on them all).
AFAIK the RIAA (and similar) arn't actually filing in bulk. So much as sending threats in bulk. Since once a suit is actually filed the parties are on somewhat more equal footing. The defendant can countersue the plaintiff or place the plaintiff in a position they have to either make their case to a court or drop it. Whilst it might be possible to file in bulk it's more difficult to take cases to court in bulk. Even if all the defendents did was have the cases moved to their nearest court.
There has been a court order which is completely different that a ruling. The motion itself is primarily about procedural issues with the RIAA attorneys filing and not about whether any copyright infringement has occurred.
If you (as plaintiff) can't file suit correctly then whatever you allege the defendent has done is irrelevent.
Note also that it is generally necessary to establish both that a law has been broken and that the defendent has done this. It is perfectly acceptable for a defendent to claim "no law has actually been broken"/"that law does not apply here". They are not limited to "I/We didn't do that" arguments.
I have seen claims made by the RIAA in reports of cases that they have made that were simply untenable--that an IP address uniquely identifies an individual, that a person that sent a laptop to be repaired and had the hard drive replaced was intentionally destroying evidence, and that a computer screenshot that shows an IP address is conclusive proof that a person was sharing files (I can construct a screenshot that shows any IP address and make any claim I want by those rules of evidence).
Also untenable in the opinion of several judges. Effectivly they have been told "you have no case, go away".
I like the scare quotes on settlement offer. I mean, the vast majority of people are flat out guilty and the settlement is giving them an out relatively cheaply
If these cases came to court it would be up to the plaintiff to prove guilt to the court's satisfaction.
The reason the RIAA's campaign hasn't stopped in the states is that they get what they want most of the time. People cough up the money for the "settlement offer."
Another factor might well be the cost of lawyers and people's reluctance/inability to defend themselves as LIPs.
There's nothing ironic about some guy $NAME being bribed, but, one would expect that an offical designated as a monitor against corruption would be incorruptible. That's the ironic part -- it turns out that a presidential monitor against corruption was indeed corrupt!
Really? Sounds like he refused the bribe whilst documenting the bribary attempt.
A few years ago, I received many stock spams for "XLPI.PK", or Xcel Plus, which sells fuel and lubricant additives. Such additives are referred to in the automotive industry as "mouse milk"; they usually don't do much, and may make things worse. That whole category of products is mostly bogus.
If they actually were any good you'd expect that the oil companies would incorporate them in their products.
Back then, their web site contained endorsements from the FAA and the US Army. The web site reproduced a a letter of endorsement appearing to be from an FAA representative. I thought this was a bit strange, so I sent off a note to the regional FAA office asking if it was legitimate.
It would be very strange unless they were advertising their products for aircraft engines. There tends to be a lot more red tape involved with getting anything approved in aviation than with any other kind of vehicle. Given that an engine failure in an aircaft tends to be a lot more serious than one in a car, truck, bus, boat, etc.
never seen gold plated optical wires, but I did have to upgrade to nicely shielded optical wires, and they do serve an important purpose: it is more difficult for my cat to chew through the cable. My first optical cable did look pretty cool after my cat had worked on it for a week or so--little red lights peeking through along the whole length of the cord.
That isn't so much sheilded as armoured. You'd probably have to have various grades for "pet armour" since what might stop a cat probably isn't going to be much use against a rat.
Basically if you're cabable of working with it, use CAT5, otherwise there are a number of cheap solutions.
Except that CAT5 is lacking in conductor area so limited in current capacity and the insulation isn't rated for that high a voltage.
I learned from there that gold has a higher resistance than copper, so the only reason for gold plated connectors is that it sounds expensive.
Actually the usual reason for using gold is that it is more inert than copper. Whilst metals tend to be good conductors metal oxides tend to be good insulators. Silver is actually the best metal when it comes to conductivity, but is fairly reactive.
3. I love to see audiophile setups where the owner doesn't even bother to do a minimal amount of room treatment. No matter how good your sound system is, in a square room with a low flat ceiling and walls at 90 degrees to each other, you're going to have all kinds of reflections, phase interference, and standing waves.
Rarely do rooms have exactly right angles. That's before you even consider doors, windows, furniture, people, etc affecting how sound travels in a room.
4. Spend hundreds of dollars per foot on a cable that you need to be ruggedized, say, for the permanent install of the line array that you've built into a concert hall.
Likeky to be even more of a requirement on a FoH multi for a touring PA system...
It prevents a ground loop. The shield doesn't carry current, it just "shields" (so to speak) the center conductor from EMI.
Rather importantly it won't do this effectivly if it is carrying a current. Thus it is important that a shield is only connected to "ground" at one place. It many cases two "grounds" are not at the same potential. By convention this is the signal source end with a cable.
A good friend is a pilot who has flown pipeline inspection flights, and he says they're easy to follow, even without the little yellow signs. Ground cover and erosion patterns give them away, even under a field that I personally know has been tilled annually for at least 27 years since the pipeline was buried. If you doubt me, go check a google satellite map of any local pipeline you're familiar with -- you will find an unnaturally straight line cutting through fields, passing under roads, disturbing trees, brush, and altering creekbeds.
27 years is nothing much. It is perfectly possible to find the outlines of Roman buildings visible from the air. With the only thing actually being present on the ground are foundation trenches which were filled with earth over a thousand years ago. (Building stone is a valuable commodity and dismantling a building is typically cheaper than quarrying from scratch. Since someone else has already done the job of selecting the decent stone and cutting it into usable size pieces.)
(European law also forbids region-locking of DVD players -- every DVD player sold on the Continent is multi-region
This at least because some EU countries are in R2 and some are in R5.
In Germany you can only buy it in T-Mobile shops.
This is about the only way what T-Mobile and Apple are doing would be remotely legal in Germany (or anywhere else in the EU).
You can only buy the phone if you sign up for a 2 year contract in that shop - only after signing the agreement do you get the iPhone.
This is the point at which things become legally questionable. It would be as if a supermarket refused to sell you a glass unless you signed a contract to buy at least 4 litres of milk, per week from them.
You can't buy it from an Apple Store like in the USA.
If Apple tried to sell it at an "Apple Store" in Germany they'd probably have their shops shut down.
That was the original point of the GSM standard. You were supposed to be able to buy a single phone and take it anywhere in the world that supported GSM. Sure, you may or may not have to pop in another SIM card if your provider didn't have roaming in the place where you were at. The whole locking the phones thing breaks that compatibility, as do the different band allocations around the place now.
The latter is addressed by having phones with multiband capability.
The more features a phone has the more likely being able to change SIMs is something the user will want to do.
What's new is that I don't have the choice to pay a fee to unlock my phone (before or after the contract expires)
Or buy a phone which isn't locked in the first place.