What the hell makes you think that a child's right to not be abused by a pervert is of equal or lesser importance than a corporation's desire to have a profit margin higher than any traditional industry?
These companies are greedy and want to produce infinite copies of something for virtually no money so that they can sell them at 99% profit, and gouge consumers for multiple copies of the same thing. Do these companies have more "right" to this level of profit than a kid does to not be abused?
Why should companies in markets like this make such massive profit margins when anyone else selling food, physical goods or services etc must make do with a few percent?
More sane copyright laws would massively reduce the level of infringement that occurs... If you make media easier and cheaper to obtain, while removing nasties such as DRM then people will have far less reason to infringe.
People do it because it's easier, substantially cheaper and often yields a superior and more usable product.
Advertising... It's already happening, how many movies have sponsors or product placements these days? Tho most of these movies have their traditional revenue streams as well, adding the advertising is pure greed to get a bit of extra cash. That's one method right there, as requested.
Modern technology makes production costs much cheaper than they used to be.
Anywhere that mass duplicated media is sold for far less than it costs people to duplicate their own, there will be "copyright infringement"...
CDs were not commonly copied when computers didn't have enough disk space to store them, processing power to compress (mp3) them, and writable CDs cost as much as pre pressed ones containing music. Instead, people made lower quality copies onto audio cassette.
If you want to stop copyright infringement, make the originals better value for money such that it isn't viable to obtain a copy. Make them cheaper, make them more easily available and without onerous drm schemes that reduce the value of the product to the consumer.
I bought tons of genuine games for various old machines (amiga, c64, sinclair etc) long after those machines were outdated, because the cost of blank media outweighed the bargain bin games.
Things will even out, again thanks to technology... A few years ago, high quality cameras and equipment for producing special effects cost huge sums of money, as did decent audio sequencing equipment... These days, a lot can be done very cheaply... Powerful computers with complex 3d modeling software are affordable and most special effects are computerized... Same for audio, a lot can and is done in software these days.
Big productions can be good, but they do come at a cost... Big name actors don't come cheap, and aren't necessarily any more talented... There are so many layers of management, corruption and greed that the production actually costs far more than it should.
Singers i think will do just fine, especially those who enjoy doing live shows... Technology is still no substitute for a live show. I guess other forms of live entertainment such as sports will also do very well. The effect it will have tho, is that being a singer will no longer be seen by people as an easy path to riches (as exemplified by all the talent shows on tv these days).. It will be seen as hard work, and only people who have a true passion for art will go for it.
There are also other avenues for actors, big name actors like patrick stewart do live plays, professional wrestling is also a form of acting, and the fame of being the star of popular (not necessarily profitable, most widely viewed is what matters) movies can propel people into other fields such as politics (see arnold schwarzenegger).
Incidentally, movies and music are already heavily used for advertising, not because they need the money to survive but because the producers are often greedy and only care about the money, not about the art.
Absolutely, if the auditors can be proven to be lying or incompetent then they should be held liable.
I was just pointing out that the standards themselves are often flawed, and it's quite possible to be compliant while still being insecure.. As you pointed out, a patching policy is part of the PCI DSS standard, but it doesn't take into account patches which introduce new functionality. Personally i do think that any patches which do anything more than directly fix known vulnerabilities should be re-certified. Also "the same network segment as the cardholder data", but what network segments which have access to the segment holding the card data? All it takes is for one admin workstation to be compromised...
As you point out tho, there are many incompetent companies certifying for PCI among other things... They get away with it because generally nothing bad happens, or isn't discovered, and these companies which cut corners are cheaper... It's also costly to actually do the work required to comply with the standard, so having an incompetent auditor saves you money.
But you point out that an ATM has minimal work to do... Windows is not a minimal OS, it contains a lot of functionality that serves no purpose in the context of an ATM. Any functionality could potentially have bugs, the less complexity you have the lower the risk.
Firewalls are not the ultimate solution, they have vulnerabilities and misconfigurations too... Also as firewalls become more complex, the risk of vulnerabilities increases.
Firewalls should not be relied on as the only facet of security, they should be only a small part of an in depth security policy. If the firewall is taken out of the equation, the system should be able to stand on it's own.
Cheaper because windows coders are ten a penny and very cheap... Cheaper because hardware that will run windows is also extremely cheap and widely available... They can use whatever the cheapest components available are, and be pretty much guaranteed that there will be drivers for it...
And because many of the people making decisions don't realize anything other than windows exists, so it just becomes a default component, you wouldn't build a computer without a processor and many people think windows is as integral to a computer as the processor.
ATMs should be a dumb terminal and a couple of dumb input devices, which talk an encrypted protocol to a backend server... Compromising the display device should not impact the input devices, and the data entered via he reader/pinpad should never go onto the display device in any form.
All it will do, is make future certifications 10 times slower, more invasive and more expensive... This bank is shooting themselves in the foot because they will have to get themselves certified again in the future and will be expected to pay a hefty premium.
Besides, the auditor merely certifies that a particular defined system complies with a given spec at a point in time... They don't assert that the setup is secure, merely that it complies with the letter of the standard, and most of these standards are poorly written with loopholes big enough to drive a truck through.
Not to mention that there are ongoing changes, such as patching and updates to signature files etc, do you need to recertify every time a minor change is made? A minor change could introduce vulnerabilities, for instance a security update could introduce new features and bring with it new exploitable issues while it also fixes an older issue.
How widely do you define the scope? ideally you would include absolutely everything associated with the system, so every workstation used for admin purposes, every inch of cabling etc, this would make the scope very large and costly to deal with.
And how about the age old question of human error? No matter how secure a system is, an error (or intentional attack) by the legitimate users could break things in all manner of ways.
That's the fault of the police for not keeping the evidence secure. You can't expect the suspects to be punished because they could well be innocent, after all there is no proof to the contrary.
Use a Linux partition for all your browsing and general use.. Have a Windows partition that is used for nothing but games (bonus: windows will run the games faster because it gets used less), and let them find that... Just make sure you don't warez the games.
How would a USB device get access to the host system's drives? Surely that would require drivers to be loaded on the host... Not only would this be very OS specific, but it could easily be defeated, you could configure the host to detect the insertion of this particular type of usb device and perform a secure overwrite of all your incriminating files when such a device is inserted.
Having people tied to something they've used for years is one thing... Releasing a new product that's horrible crippled is just ridiculous... The iphone has a good mobile browser, Opera is good and because of this other mobile device makers have been improving their offerings too. If MS just come out with a neutered IE6 hopefully it will fail.
Is there not more than a single broadband provisioning system that does what you need? When i've been looking at web based apps recently, compatibility with standards compliant browsers is a must, as it will work with our varied clients and provide the least hassle when we update clients in the future. If an app required IE6 that would make it unusable for us or otherwise count as a massive black mark against it.
A mountain of HTML code would be relatively easy to fix.. A mountain of proprietary binary applications that you don't have source for and that generate HTML code when executed on the other hand... Or HTML code that becomes "unsupported" if you modify it... I have encountered companies which have a number of apps bought from third parties which depend on IE6 and which they can't modify, or would lose support if they did.
How many windows networks actually implement binary whitelisting? You can download and execute binaries, you cannot "install" because you don't have write access to the install locations or registry keys, but there are versions of firefox which can run without needing to be installed... I have never seen a windows network where you weren't able to execute your own binaries (which in itself is a huge security hole)...
I've seen this implemented on unix based systems, but then you won't be lumbered with IE6 if you're using a unix box... You might be lumbered with something like netscape 4 if you have particularly old machines.
This is why Linux really stands to benefit... Even if windows were ported to arm, all of the applications would still need to be ported by their respective vendors, many of which wouldn't bother, or would release a castrated "mobile" version instead..
Most commercial vendors won't port to a platform unless there is a sufficient market for it, and most customers won't buy a product unless there is already sufficient software availability.. A catch 22 that's already killed Itanium.
Linux on the other hand, is already ported to arm, and most of the applications you would use on a typical linux desktop are also already ported... And any new open source applications being written would be trivially portable between various different processors too.
The problem with windows ce/mobile is that it's advertised as being windows when it really isn't.. This creates the expectation of compatibility with desktop windows. The mobile versions of windows however are not compatible at all, either at the binary or source level (and most apps don't even come with source), such that there are very few available apps... An arm version of linux on the other hand really is linux, and has 99% of the same applications available for it, since in most cases it's just a case of a recompile.
Slashdot Mirror
Your post is clearly flamebait, but...
What the hell makes you think that a child's right to not be abused by a pervert is of equal or lesser importance than a corporation's desire to have a profit margin higher than any traditional industry?
These companies are greedy and want to produce infinite copies of something for virtually no money so that they can sell them at 99% profit, and gouge consumers for multiple copies of the same thing. Do these companies have more "right" to this level of profit than a kid does to not be abused?
Why should companies in markets like this make such massive profit margins when anyone else selling food, physical goods or services etc must make do with a few percent?
More sane copyright laws would massively reduce the level of infringement that occurs... If you make media easier and cheaper to obtain, while removing nasties such as DRM then people will have far less reason to infringe.
People do it because it's easier, substantially cheaper and often yields a superior and more usable product.
Advertising... It's already happening, how many movies have sponsors or product placements these days? Tho most of these movies have their traditional revenue streams as well, adding the advertising is pure greed to get a bit of extra cash. That's one method right there, as requested.
Modern technology makes production costs much cheaper than they used to be.
Live shows.
And many others..
Anywhere that mass duplicated media is sold for far less than it costs people to duplicate their own, there will be "copyright infringement"...
CDs were not commonly copied when computers didn't have enough disk space to store them, processing power to compress (mp3) them, and writable CDs cost as much as pre pressed ones containing music. Instead, people made lower quality copies onto audio cassette.
If you want to stop copyright infringement, make the originals better value for money such that it isn't viable to obtain a copy. Make them cheaper, make them more easily available and without onerous drm schemes that reduce the value of the product to the consumer.
I bought tons of genuine games for various old machines (amiga, c64, sinclair etc) long after those machines were outdated, because the cost of blank media outweighed the bargain bin games.
Things will even out, again thanks to technology...
A few years ago, high quality cameras and equipment for producing special effects cost huge sums of money, as did decent audio sequencing equipment... These days, a lot can be done very cheaply... Powerful computers with complex 3d modeling software are affordable and most special effects are computerized... Same for audio, a lot can and is done in software these days.
Big productions can be good, but they do come at a cost... Big name actors don't come cheap, and aren't necessarily any more talented... There are so many layers of management, corruption and greed that the production actually costs far more than it should.
Singers i think will do just fine, especially those who enjoy doing live shows... Technology is still no substitute for a live show. I guess other forms of live entertainment such as sports will also do very well. The effect it will have tho, is that being a singer will no longer be seen by people as an easy path to riches (as exemplified by all the talent shows on tv these days).. It will be seen as hard work, and only people who have a true passion for art will go for it.
There are also other avenues for actors, big name actors like patrick stewart do live plays, professional wrestling is also a form of acting, and the fame of being the star of popular (not necessarily profitable, most widely viewed is what matters) movies can propel people into other fields such as politics (see arnold schwarzenegger).
Incidentally, movies and music are already heavily used for advertising, not because they need the money to survive but because the producers are often greedy and only care about the money, not about the art.
Keystrokes would be even more OS (and configuration) specific than drivers...
Absolutely, if the auditors can be proven to be lying or incompetent then they should be held liable.
I was just pointing out that the standards themselves are often flawed, and it's quite possible to be compliant while still being insecure.. As you pointed out, a patching policy is part of the PCI DSS standard, but it doesn't take into account patches which introduce new functionality. Personally i do think that any patches which do anything more than directly fix known vulnerabilities should be re-certified.
Also "the same network segment as the cardholder data", but what network segments which have access to the segment holding the card data? All it takes is for one admin workstation to be compromised...
As you point out tho, there are many incompetent companies certifying for PCI among other things... They get away with it because generally nothing bad happens, or isn't discovered, and these companies which cut corners are cheaper... It's also costly to actually do the work required to comply with the standard, so having an incompetent auditor saves you money.
But you point out that an ATM has minimal work to do...
Windows is not a minimal OS, it contains a lot of functionality that serves no purpose in the context of an ATM. Any functionality could potentially have bugs, the less complexity you have the lower the risk.
Firewalls are not the ultimate solution, they have vulnerabilities and misconfigurations too... Also as firewalls become more complex, the risk of vulnerabilities increases.
Firewalls should not be relied on as the only facet of security, they should be only a small part of an in depth security policy. If the firewall is taken out of the equation, the system should be able to stand on it's own.
Because it makes it cheaper...
Cheaper because windows coders are ten a penny and very cheap...
Cheaper because hardware that will run windows is also extremely cheap and widely available... They can use whatever the cheapest components available are, and be pretty much guaranteed that there will be drivers for it...
And because many of the people making decisions don't realize anything other than windows exists, so it just becomes a default component, you wouldn't build a computer without a processor and many people think windows is as integral to a computer as the processor.
ATMs should be a dumb terminal and a couple of dumb input devices, which talk an encrypted protocol to a backend server... Compromising the display device should not impact the input devices, and the data entered via he reader/pinpad should never go onto the display device in any form.
So opera forced other browsers to keep up, and those browsers forced opera to improve too...
No competition = stagnation = IE6...
"fastest network and UI performance and low resource consumption, and lowest reported vulnerabilities"...
That sounds like Lynx..
All it will do, is make future certifications 10 times slower, more invasive and more expensive... This bank is shooting themselves in the foot because they will have to get themselves certified again in the future and will be expected to pay a hefty premium.
Besides, the auditor merely certifies that a particular defined system complies with a given spec at a point in time... They don't assert that the setup is secure, merely that it complies with the letter of the standard, and most of these standards are poorly written with loopholes big enough to drive a truck through.
Not to mention that there are ongoing changes, such as patching and updates to signature files etc, do you need to recertify every time a minor change is made? A minor change could introduce vulnerabilities, for instance a security update could introduce new features and bring with it new exploitable issues while it also fixes an older issue.
How widely do you define the scope? ideally you would include absolutely everything associated with the system, so every workstation used for admin purposes, every inch of cabling etc, this would make the scope very large and costly to deal with.
And how about the age old question of human error? No matter how secure a system is, an error (or intentional attack) by the legitimate users could break things in all manner of ways.
That's the fault of the police for not keeping the evidence secure. You can't expect the suspects to be punished because they could well be innocent, after all there is no proof to the contrary.
Use a Linux partition for all your browsing and general use..
Have a Windows partition that is used for nothing but games (bonus: windows will run the games faster because it gets used less), and let them find that... Just make sure you don't warez the games.
How would a USB device get access to the host system's drives?
Surely that would require drivers to be loaded on the host...
Not only would this be very OS specific, but it could easily be defeated, you could configure the host to detect the insertion of this particular type of usb device and perform a secure overwrite of all your incriminating files when such a device is inserted.
Having people tied to something they've used for years is one thing...
Releasing a new product that's horrible crippled is just ridiculous... The iphone has a good mobile browser, Opera is good and because of this other mobile device makers have been improving their offerings too. If MS just come out with a neutered IE6 hopefully it will fail.
Err, you probably have a proxy...
Is there not more than a single broadband provisioning system that does what you need?
When i've been looking at web based apps recently, compatibility with standards compliant browsers is a must, as it will work with our varied clients and provide the least hassle when we update clients in the future. If an app required IE6 that would make it unusable for us or otherwise count as a massive black mark against it.
If your site is correctly formed HTML, then it will degrade gracefully and be perfectly accessible in lynx.
A mountain of HTML code would be relatively easy to fix..
A mountain of proprietary binary applications that you don't have source for and that generate HTML code when executed on the other hand... Or HTML code that becomes "unsupported" if you modify it...
I have encountered companies which have a number of apps bought from third parties which depend on IE6 and which they can't modify, or would lose support if they did.
How many windows networks actually implement binary whitelisting?
You can download and execute binaries, you cannot "install" because you don't have write access to the install locations or registry keys, but there are versions of firefox which can run without needing to be installed...
I have never seen a windows network where you weren't able to execute your own binaries (which in itself is a huge security hole)...
I've seen this implemented on unix based systems, but then you won't be lumbered with IE6 if you're using a unix box... You might be lumbered with something like netscape 4 if you have particularly old machines.
This is why Linux really stands to benefit...
Even if windows were ported to arm, all of the applications would still need to be ported by their respective vendors, many of which wouldn't bother, or would release a castrated "mobile" version instead..
Most commercial vendors won't port to a platform unless there is a sufficient market for it, and most customers won't buy a product unless there is already sufficient software availability.. A catch 22 that's already killed Itanium.
Linux on the other hand, is already ported to arm, and most of the applications you would use on a typical linux desktop are also already ported... And any new open source applications being written would be trivially portable between various different processors too.
The problem with windows ce/mobile is that it's advertised as being windows when it really isn't.. This creates the expectation of compatibility with desktop windows. The mobile versions of windows however are not compatible at all, either at the binary or source level (and most apps don't even come with source), such that there are very few available apps...
An arm version of linux on the other hand really is linux, and has 99% of the same applications available for it, since in most cases it's just a case of a recompile.