Has it actually been proven that it is mathematically impossible for a quantum algorithm to exist capable of defeating this system? I'm sure you could prove that any particular known algorithm wouldn't work, but the only system resistant to unknown algorithms that I'm aware of is the one-time pad.
If this has been proven I'm genuinely interested. I will confess I'm not a cryptographer.
So as quantum computer registers get larger so will encryption keys. Someone builds a 256 bit quantum computer? Great! So just use a 512 bit key and it'll have to do 2^256 comparisons. ie - it'll be damn slow.
Well, nobody would even use a quantum computer to implement a non-quantum algorithm. Since we don't know how to build a practical quantum computer at all it is hard to tell whether it will be harder for the NSA to add more qubits to their designs than it will be for everybody else to use RSA with a 2 gigabit key and a 32-core system to serve an SSL website to 3 users at a time. Adding bits to an encryption algorithm has its costs as well. Quantum computing is remarkably efficient so the NSA might just need one machine, and if the design is sure to work you can bet they'll have the budget to build it.
Moreover, one also has to keep in mind that there are public key cryptosystems that most likely cannot be cracked even with quantum computers.
The key words you used are "most likely" and at least you're honest enough to use them. There is no mathematical proof that any cipher (other than the one-time pad) is resistant to all as-yet-unknown quantum algorithms. That doesn't mean that they are actually vulnerable - only that we cannot know with certainty whether they are.
People seem to under-estimate the NSA's capabilities here when I talk to them. They employ a lot of really smart people, and they have the benefits of reading all the public literature as well as all the classified stuff that their academic peers cannot read. They obviously don't have high citation rates so the academics tend to look down on them. However, the story of differential cryptanalysis proves that academics aren't always the ones in the lead. Apparently IBM was aware of the technique at least 10 years before it was published, and the NSA was aware of it much longer than that (though nobody knows how long) - this is why DES lasted as long as it did (indeed, the gimped key size is its biggest flaw and 3DES is still reasonably secure though it isn't really future-proof).
For all we know the NSA has a bunch of quantum algorithms just waiting for hardware to run it on. They certainly have a long history of bright cryptographers. Where they might struggle is the physics side, but they certainly could hire promising scientists and give them lots of money. The thing I've found interesting about quantum computing is that there are many different measurement technologies that can be brought to bear that all are fairly well-developed. You have everything from SQUID to NMR, various states of matter for the qubits, nanotechnology, and so on. If the NSA has the budget to pursue many different technologies seriously they could potentially stumble on something that everybody else misses.
In an ideal world the user really needs to associate the token with the merchant they're buying from, and that turns out to be very hard. Just posting a sign that says "Here's a 14 digit merchant number you should enter" proves very little. An attacker could place their own sticker on the sign, or display their own 14 digit number on a hacked web site. A barcode is not much good either, because an ordinary human isn't capable of verifying that the stripes actually say "Friendly Store" instead of "Evil Hackers".
While I agree that it is more complex, these problems at least are solved in my proposed solution. The only thing the user enters is a PIN to confirm the transaction. The device communicates digitally with the POS terminal to get all the transaction details (this could happen in many ways, but would be unidirectional). The POS's merchant identity could be protected by a certificate as well, so if your terminal says that you're paying "Acme Co" then they managed to obtain a certificate for "Acme Co" from the bank. Oh, and the bank stands to lose money if they issue bad certs, so I imagine they'll be more careful than the typical SSL CA.
Well, sure, they can do that, and they can steal wallets, jewelry, or point a gun at you at a stoplight and carjack you.
However, that stuff requires physical presence and is extremely high-profile. You have a decent chance of getting shot at, photographed, or caught by a police officer. Also, your crime is extremely detectable which means that the credit card is only good for maybe an hour unless you are into kidnapping/murder/etc. You could also give people a PIN which the bank treats as valid but triggers a silent alarm.
In contrast, for all you know that kid at the store ringing up your order could be copying down your card number and phoning it to a friend halfway across the country. Your card could be used for days before it is detected, and good luck figuring out who copied the number at that point. Or you can hack into a system from across the globe in a friendly jurisdiction. The theme here is that those who are being robbed don't even realize it until you've stolen a fair bit, and you're not leaving a lot of tracks.
If criminals actually have to steal a physical device to access an account you've won 98% of the battle already. Now we're talking about physical theft and not just information theft.
Anybody with even a minute knowledge of cryptography/security/etc could predict all the problems the payment card industry is having. 95% of the issues are derived from using an account number as a shared secret, and then sharing it with half the planet.
A secure system would not be that difficult to design or operate. Have the POS terminal generate a CSR containing the vendor name, date, amount of transaction, and a unique transaction ID. That gets transmitted to the customer's payment terminal, which they carry with them. The terminal decodes the CSR and displays the amount, etc on the screen in a standard presentation for the customer's approval. They hit approve and enter their PIN, which is typed onto the terminal itself. The device then generates a certificate including the users's account number, timestamp, and another unique ID. The terminal transmits this to the POS terminal, which then transmits it to the bank. The bank verifies the certificate and performs the transaction, and issues a certificate against the whole thing back to the vendor.
Such a system could only be spoofed if the terminal and PIN are stolen and used prior to a report of theft, or if the private key embedded in the terminal were extracted. The latter would be extremely difficult - modern TPMs are very difficult to break into. The PIN and key never leave the device, and the user only interacts with a device whose integrity they have control over. The POS can't display one transaction on the screen and apply the user's signature to another, the POS can't store keys/PINs/etc, and so on. The system is also immune to replay attacks - if you authorize one transaction you'll never be billed for two. The protocol could of course be extended to allow for recurring payments. The payment terminal could have a USB port for easy use with online purchases, and could have a modem for phone purchases (just hold the thing up to the earpiece and then microphone - no need for a 2-way handshake for either transmission).
Sure, that little terminal would cost more than a plastic card, but a single terminal could store credentials for many accounts, and probably would cost less than $100. It doesn't need a fancy color touchscreen - a 1990s LCD display and a 12-key keypad would be plenty.
With IPv6, Coke could get itself a single/48 block and have everything it needs.
Setting aside that this is about MAC, how on earth would you route packets if you have a single/48 with one node on each of 40 bazillion networks? You'd basically need to publish routes that have at most 1-2 IPs in them. That's why IPs are generally assigned by the network, and not to the individual device. IPv6 has enough address space that you could assign everything a unique address, but that doesn't mean that any particular device will persistently use the same address.
Disabled on every machine I own, every machine I've deployed, every machine that I've been given the permission to manage.
All the good stuff you posted aside, you're still just as vulnerable. This isn't just about you leaking info to the NSA about what you have installed, but it is also about everybody else leaking info to the NSA about the bugs in Windows in general. The NSA can use that to create zero-days, which will work perfectly fine against your version of Windows since it contains the same flaws even if you aren't personally reporting them to MS.
I get what you're trying to say, but you're missing my point -- which is, you have to trust that Microsoft's closed source reporting tool is sending the same thing that it displays on the screen for you. Without encryption of the transmission, you can verify what it sends by local traffic snooping, and this keeps them honest. With encryption, you can't verify; the tool could send more than it displays.
Well, they could display on-screen in that report the session key. It wouldn't really be informative, but it would let you decrypt the SSL connection. The parts that use RSA to authenticate and exchange the session key wouldn't be readable, but the payload would be, and you could easily look at the unreadable parts and say, "sure, that looks like an SSL handshake and there isn't room for any hidden data there."
That's a good point and I think the best thing to come out of Obamacare is the preexisting condition coverage. There are some things not fair about it though. One is that someone with preexisting conditions should pay more. Not 100% of the cost of the preexisting condition, but they should pay a bit more. They are sick, they are expensive, they need to pay more.
I'm not sure we're on the same page. Pre-existing conditions means conditions that existed before obtaining insurance, not conditions that presently exist. So, if somebody was insured from birth to the present it is impossible for them to have any pre-existing conditions. If you switch insurance companies they might get into subrogation (a form of arbitration, basically) over which one pays what, but you're covered.
The whole point of insurance, though, is that as long as you're in the risk pool you pay the same regardless of whether you're sick. You don't pay more for your car insurance if you have 12 accidents that aren't your fault, but you do pay more for your car insurance if you get a ticket but have never had an accident. The first is a case of bad luck, and the second is basically a case of negligence. The whole point of insurance is to get rid of the luck factor.
And I'd just as soon get rid of any consideration around pre-existing conditions, because as far as an insurance company beancounter is concerned EVERYBODY has them until they prove otherwise.
The other problem is with preexisting conditions that are due to a "moral fault" of the person, like obesity or alcoholism or drug addiction or smoking.
Controllable risk factors are an entirely different thing from pre-existing condition. It does make sense to control for them regardless, but we do need to use care.
I don't think the right solution is to simply charge people based on their BMI. First, BMI alone isn't really a great number (it is a good starting point for a conversation with a doctor, but chances are Arnold Schwarzenegger has a BMI over 30 which is meaningless). Second, weight is one of those factors that people can sort-of control, but unless you're locked up in a cage and fed rations it isn't really completely controllable. Some people maintain a low weight without effort, and others struggle to be merely obese. Dietary advice parceled out these days tends to depend more on lobbying than medical evidence. Until somebody actually comes up with a practical diet with real clinical outcomes I think it is a bit harsh to penalize people for having a problem that has no scientifically-proven treatment. I say this as somebody who probably wouldn't have to pay any penalties, though in the past I might have, and I've found that weight control at least for me personally has little to do with willpower and a lot more to do with control over diet composition.
But, yes, prevention goes a lot further than treatment and we should be trying to shift the population away from unsafe behaviors/etc.
Prosecutors in recent cases have convinced courts that the intent of the leaker, the value of leaks to the public, and the lack of harm caused by the leaks are irrelevant -- and are therefore inadmissible in court.
So much for Thomas Aquinas. I think half the problem with our justice system is that it is WAY too focused on consequences and not nearly enough on intent, simply because the one is much easier to measure than the other.
As far as I'm concerned Murder shouldn't even be a crime, but Attempted Murder and Reckless Endangerment certainly should be and should carry stiff penalties. If you set out to kill somebody is it really relevant whether you bungled the deed or not? We should be locking up people who are a danger to society and recklessness and antisocial behavior are far bigger indicators of whether somebody will commit a future crime than the consequences of past actions which were unintended and not reckless.
Oh, I don't disagree that the ACA seems like an interim solution at best. The problem is that a majority of the country strongly want the status quo to change, but the majority of the country are also nervous about changing it and are really incapable of (or can't be bothered with) understanding the complexity of the issues. So, we get half-measures and simple solutions to simple problems (it's all the fault of insurers, pharma, whatever).
The whole system really needs an overhaul to be effective. There is no aspect of the current US healthcare system which can be left untouched, and the problem is that all the constituents of the system are fine with reform as long as their part of the system remains untouched. Doctors are happy to see drug price controls, drug companies are happy to see universal coverage, patients don't want their favorite doctor to quit because he will only make $120k/yr, and so on.
I do think that the whole practice of denying pre-existing conditions had to go. It makes a lot of sense for just about any other kind of insurance. It also makes sense in a theoretical sense for medical insurance, but it is extremely open to abuse.
Heck, lots of people were upset that they couldn't keep their previous insurance under the ACA, and yet many of those plans were cheap only because the company intended to screw them if they ever got really sick. People got the comfort of "having insurance" despite the fact that they didn't really have insurance.
What do you mean that X forwarding is not working? It is usually deactivated by default and you have to turn it on with -X or in a config file. If you use '-Y' you turn off security. You have no reason to complain, if you turned security off yourself.
Looked it up. Openssh secure forwarding only works if the X server is compiled with XC-SECURITY enabled, which is disabled by default. Some distros consider it insecure, as does upstream. So, on distros that do not override this and enable XC-SECURITY secure Openssh forwarding is disabled. If you use openssh -X to connect you get the error "Warning: untrusted X11 forwarding setup failed: xauth key data not generated." X11 forwarding does not work in this case. Using -Y works fine.
You'd think so, but from what I've learned Agriculture and DEA are the two agencies where you absolutely have to have your ducks in a row before the box gets onto US soil. For other transgressions you might have it sent back or you might have it held up, but mess up with DEA or Agriculture/Fish-Wildlife and the package could actually be destroyed.
It is amazing how painful customs can be. In some cases if you don't put the right declaration on the outside of a box (such as "not for human use") they might send it back and make you fix it and ship it again. For most issues though the package just sits in limbo until you file the right paperwork.
One tactic I've heard of in the US is to buy a part to a gun (something small and convenient like a grip or a trigger or something). Then get a nice big lockable gun case and place it and everything else you care about inside. Declare your "gun" at the counter (gun parts are treated the same as assembled weapons). They will direct you to someplace to have your luggage screened in your presence, and then you lock it up and keep the key (which doesn't have to be TSA-approved). The case will generally not be opened outside of your presence.
You'll still need to pay any fees you'd pay for other checked bags (by weight/size/number/etc), but you'll avoid having your stuff go missing on you. While the TSA doesn't mind your valuables disappearing they don't like the idea of having guns used in crimes traced to them, so gun cases are exempt from the "we can cut/open any lock" policy. The airline probably feels the same way and will probably give the case extra care - even if just to make sure it is secured/etc.
The reason you use a gun part and not a gun is that while parts get the special treatment from the TSA, they're usually exempt from local gun control laws (though obviously you need to check).
None of this will do you any good for international travel though, which is what the original article pertained to. I'm sure there is lots of paperwork around importing/exporting weapon parts from the US, and that is probably nothing compared to what most other countries would impose.
Personally, I would go the other way, make individual policies tax deductible rather than taxing group policies. This seems more fair to me -- why should people pay taxes on something as essential as healthcare -- and it's actually politically possible
Frankly, they need to make healthcare-related expenses tax-deductible, full stop. Right now there are a bunch of ways to deduct expenses and they basically all suck. There are savings accounts where you guess how much you're going to spend, and if you spend more you end up paying taxes on it, and if you spend less you lose the money you contributed (though not quite as much starting in 2014). There is also a straight-up deduction if you spend something like 2.5% of your income on health-related expenses, but most people don't spend so much and anything you did put in a savings account doesn't count towards it (I'm also not sure if it applies if you take the standard deduction - so it really only counts if you have a mortgage). Then there are breaks like the one you mention.
Seems like they should just have a box that asks how much you spent on health care and let you deduct it, and get rid of all the other nonsense. Sure, make people substantiate it as with charitable donations.
There is a difference between paying taxes things to the government which does unpopular things, and the government forcing someone to buy a particular type of product from a third party. Both are wrong, but the former is a necessary evil and the latter is an unnecessary aspect of fascism.
How is my being forced to pay for Lockheed to build an F22 any different from my having to pick an insurance company and buy insurance from them? The only difference is that I have personally more to show for the latter.
And the insurance mandate is only unnecessary if you allow insurance companies to deny pre-existing conditions. The problem with this is that many unscrupulous (and often less expensive) insurers would issue insurance and then once you get a really expensive condition they'd argue that it was pre-existing and refuse to pay up. Then you have to sue them to obtain the coverage you've been paying for all along. Maybe if you're lucky they'll refund your premiums, though they still happily collect them from healthy people who don't file claims.
The problem with pre-existing conditions is that it is almost impossible to tell when a medical condition actually started. Sure, if you buy insurance for the first time after you're in the hospital it is an easy determination. However, what if you were without insurance for six months two years ago, and then you're diagnosed with cancer. The cancer could conceivably have started when you were uninsured, and that is exactly the line of argument an unscrupulous insurer would take.
So, the ACA required that insurers cover pre-existing conditions, and the necessary tradeoff is that everybody has to buy insurance. Otherwise anybody with half a brain would just sign up on their way to the hospital and cancel the day after they get all their prescriptions filled after being discharged. In fact, that could still be a problem because for as much as people complain about the penalty for not having insurance it really isn't that large which makes incurring it the rational self-interested choice in most cases.
No one is saying the religious institutions don't have to provide insurance coverage. They are saying that they should not have to pay for services that violate their religion.
A religion is whatever its adherents want it to be. There are plenty of religions that don't believe in vaccination or other forms of treatment that didn't exist 200 years ago. Does that mean that a small business owned by such a person doesn't have to provide those either? HPV vaccine has made headlines in recent years as one which might encourage/assume promiscuous behavior, but virtually every major medical association recommends that young women get it.
Couldn't agree more. Frontline had a really good show on some of the healthcare issues in the US and some innovative things being done to try to improve care. Prevention was a big one. They had one case where a poor person had resulted in Medicaid spending something like $60k/yr in ER treatments for acute asthma, but the problem went away completely when a volunteer organization spent $6k fixing his drywall so that the whole house wasn't filled with dust. That is a problem that probably even European countries wouldn't handle well, though obviously they're light-years ahead of the US on the prevention front.
I've heard it explained thusly: if car insurance worked like health insurance, then every time you put gas in your tank, got an oil change, bought tires, etc., you would file a claim.
Well, just one more difference: when you fill up your tank you'd get a bill for $50/gallon which the station would try to get you to pay up front. If you object strongly they'll give in and bill your insurance first. Your insurance would pay $4.50/gallon and ask you to pay $0.50/gallon, and would write off the other $45/gallon as being overpriced. If you didn't have insurance the gas station would tell you that they'd cut you a break and only charge you $25/gallon and you'd thank them for the favor you think they're doing you.
The ACA isn't a tax. it is mandating health insurance with preset coverage minimums and limits. you can't pay $50 a month for benefits that don't actually cover you when you go to use them.
Well, kinda sorta. That's like saying that every April 15th I pay for a set of minimal mandatory government services, like blowing up weddings in Yemen.
However, this is just wrangling over words. If I have to choose between insurance companies denying expensive care and making sick people prove that it wasn't a pre-existing condition from the one day 10 years before that they didn't have insurance between jobs, and requiring everybody to buy insurance at a reasonable rate, I'll take the latter...
X clients tunnelled over X are untrusted X clients and do not have access to everything by default. See X security extension and the -Y option of ssh.
True, but that would apply only to the clients going through the tunnel. Well, assuming it works (on my distro ssh X11 forwarding without -Y doesn't work at all).
Yes, in practice, we find many unix systems where there is effectively only a single user, and the biggest security threat vector against that user is *not other users on the system* but *programs the user decided to run that were not sufficiently vetted to be free of (remotely) explotable bugs and backdoors*
So, I agree with everything you said, but if I only ran software sufficiently vetted to be free of exploitable bugs and backdoors I wouldn't be running just about anything. Certainly I wouldn't be running the Linux kernel, or any web browser. I'm sure there are a few small programs that are sufficiently small that you could completely characterize their behavior if you limited it to a very particular intended use.
Half the stuff on the NSA Christmas list of exploits probably involves zero-days for mainstream FOSS.
I'm not suggesting that we should stop using Linux. I just wouldn't consider it done yet.
Agree 100% that the Android approach is a kludge, but it is a step in the right direction in that it works reasonably well without much fuss. I'm not pointing towards anything in particular as a solution - I think the right solution remains to be found.
However, as we are already starting to see, when everything is captured and recorded for prosterity, no one ever forgets and society is extrodinarily slow to forgive despite the fact that most everyone has been just as guilty at some point in time.
I suspect that this will inevitably change. Today a video of drunken behavior on Facebook can keep somebody from ever getting a job, because such things are rare. However, when there is video footage widely available of every single person on the planet acting like everybody acts at some point in their life, then everybody will learn to ignore it. Sure, everybody's vice is different, but nobody is entirely without vice.
"Let he who is without sin cast the first stone," has the potential to go a long way, once everybody's sins are shouted from the rooftops.
Slashdot Mirror
Has it actually been proven that it is mathematically impossible for a quantum algorithm to exist capable of defeating this system? I'm sure you could prove that any particular known algorithm wouldn't work, but the only system resistant to unknown algorithms that I'm aware of is the one-time pad.
If this has been proven I'm genuinely interested. I will confess I'm not a cryptographer.
So as quantum computer registers get larger so will encryption keys. Someone builds a 256 bit quantum computer? Great! So just use a 512 bit key and it'll have to do 2^256 comparisons. ie - it'll be damn slow.
Well, nobody would even use a quantum computer to implement a non-quantum algorithm. Since we don't know how to build a practical quantum computer at all it is hard to tell whether it will be harder for the NSA to add more qubits to their designs than it will be for everybody else to use RSA with a 2 gigabit key and a 32-core system to serve an SSL website to 3 users at a time. Adding bits to an encryption algorithm has its costs as well. Quantum computing is remarkably efficient so the NSA might just need one machine, and if the design is sure to work you can bet they'll have the budget to build it.
Moreover, one also has to keep in mind that there are public key cryptosystems that most likely cannot be cracked even with quantum computers.
The key words you used are "most likely" and at least you're honest enough to use them. There is no mathematical proof that any cipher (other than the one-time pad) is resistant to all as-yet-unknown quantum algorithms. That doesn't mean that they are actually vulnerable - only that we cannot know with certainty whether they are.
People seem to under-estimate the NSA's capabilities here when I talk to them. They employ a lot of really smart people, and they have the benefits of reading all the public literature as well as all the classified stuff that their academic peers cannot read. They obviously don't have high citation rates so the academics tend to look down on them. However, the story of differential cryptanalysis proves that academics aren't always the ones in the lead. Apparently IBM was aware of the technique at least 10 years before it was published, and the NSA was aware of it much longer than that (though nobody knows how long) - this is why DES lasted as long as it did (indeed, the gimped key size is its biggest flaw and 3DES is still reasonably secure though it isn't really future-proof).
For all we know the NSA has a bunch of quantum algorithms just waiting for hardware to run it on. They certainly have a long history of bright cryptographers. Where they might struggle is the physics side, but they certainly could hire promising scientists and give them lots of money. The thing I've found interesting about quantum computing is that there are many different measurement technologies that can be brought to bear that all are fairly well-developed. You have everything from SQUID to NMR, various states of matter for the qubits, nanotechnology, and so on. If the NSA has the budget to pursue many different technologies seriously they could potentially stumble on something that everybody else misses.
In an ideal world the user really needs to associate the token with the merchant they're buying from, and that turns out to be very hard. Just posting a sign that says "Here's a 14 digit merchant number you should enter" proves very little. An attacker could place their own sticker on the sign, or display their own 14 digit number on a hacked web site. A barcode is not much good either, because an ordinary human isn't capable of verifying that the stripes actually say "Friendly Store" instead of "Evil Hackers".
While I agree that it is more complex, these problems at least are solved in my proposed solution. The only thing the user enters is a PIN to confirm the transaction. The device communicates digitally with the POS terminal to get all the transaction details (this could happen in many ways, but would be unidirectional). The POS's merchant identity could be protected by a certificate as well, so if your terminal says that you're paying "Acme Co" then they managed to obtain a certificate for "Acme Co" from the bank. Oh, and the bank stands to lose money if they issue bad certs, so I imagine they'll be more careful than the typical SSL CA.
Well, sure, they can do that, and they can steal wallets, jewelry, or point a gun at you at a stoplight and carjack you.
However, that stuff requires physical presence and is extremely high-profile. You have a decent chance of getting shot at, photographed, or caught by a police officer. Also, your crime is extremely detectable which means that the credit card is only good for maybe an hour unless you are into kidnapping/murder/etc. You could also give people a PIN which the bank treats as valid but triggers a silent alarm.
In contrast, for all you know that kid at the store ringing up your order could be copying down your card number and phoning it to a friend halfway across the country. Your card could be used for days before it is detected, and good luck figuring out who copied the number at that point. Or you can hack into a system from across the globe in a friendly jurisdiction. The theme here is that those who are being robbed don't even realize it until you've stolen a fair bit, and you're not leaving a lot of tracks.
If criminals actually have to steal a physical device to access an account you've won 98% of the battle already. Now we're talking about physical theft and not just information theft.
Yeah, was a bit frustrating when I finally figured out why it was broken, especially since the error message isn't exactly helpful.
Anybody with even a minute knowledge of cryptography/security/etc could predict all the problems the payment card industry is having. 95% of the issues are derived from using an account number as a shared secret, and then sharing it with half the planet.
A secure system would not be that difficult to design or operate. Have the POS terminal generate a CSR containing the vendor name, date, amount of transaction, and a unique transaction ID. That gets transmitted to the customer's payment terminal, which they carry with them. The terminal decodes the CSR and displays the amount, etc on the screen in a standard presentation for the customer's approval. They hit approve and enter their PIN, which is typed onto the terminal itself. The device then generates a certificate including the users's account number, timestamp, and another unique ID. The terminal transmits this to the POS terminal, which then transmits it to the bank. The bank verifies the certificate and performs the transaction, and issues a certificate against the whole thing back to the vendor.
Such a system could only be spoofed if the terminal and PIN are stolen and used prior to a report of theft, or if the private key embedded in the terminal were extracted. The latter would be extremely difficult - modern TPMs are very difficult to break into. The PIN and key never leave the device, and the user only interacts with a device whose integrity they have control over. The POS can't display one transaction on the screen and apply the user's signature to another, the POS can't store keys/PINs/etc, and so on. The system is also immune to replay attacks - if you authorize one transaction you'll never be billed for two. The protocol could of course be extended to allow for recurring payments. The payment terminal could have a USB port for easy use with online purchases, and could have a modem for phone purchases (just hold the thing up to the earpiece and then microphone - no need for a 2-way handshake for either transmission).
Sure, that little terminal would cost more than a plastic card, but a single terminal could store credentials for many accounts, and probably would cost less than $100. It doesn't need a fancy color touchscreen - a 1990s LCD display and a 12-key keypad would be plenty.
With IPv6, Coke could get itself a single /48 block and have everything it needs.
Setting aside that this is about MAC, how on earth would you route packets if you have a single /48 with one node on each of 40 bazillion networks? You'd basically need to publish routes that have at most 1-2 IPs in them. That's why IPs are generally assigned by the network, and not to the individual device. IPv6 has enough address space that you could assign everything a unique address, but that doesn't mean that any particular device will persistently use the same address.
Disabled on every machine I own, every machine I've deployed, every machine that I've been given the permission to manage.
All the good stuff you posted aside, you're still just as vulnerable. This isn't just about you leaking info to the NSA about what you have installed, but it is also about everybody else leaking info to the NSA about the bugs in Windows in general. The NSA can use that to create zero-days, which will work perfectly fine against your version of Windows since it contains the same flaws even if you aren't personally reporting them to MS.
I get what you're trying to say, but you're missing my point -- which is, you have to trust that Microsoft's closed source reporting tool is sending the same thing that it displays on the screen for you. Without encryption of the transmission, you can verify what it sends by local traffic snooping, and this keeps them honest. With encryption, you can't verify; the tool could send more than it displays.
Well, they could display on-screen in that report the session key. It wouldn't really be informative, but it would let you decrypt the SSL connection. The parts that use RSA to authenticate and exchange the session key wouldn't be readable, but the payload would be, and you could easily look at the unreadable parts and say, "sure, that looks like an SSL handshake and there isn't room for any hidden data there."
That's a good point and I think the best thing to come out of Obamacare is the preexisting condition coverage. There are some things not fair about it though. One is that someone with preexisting conditions should pay more. Not 100% of the cost of the preexisting condition, but they should pay a bit more. They are sick, they are expensive, they need to pay more.
I'm not sure we're on the same page. Pre-existing conditions means conditions that existed before obtaining insurance, not conditions that presently exist. So, if somebody was insured from birth to the present it is impossible for them to have any pre-existing conditions. If you switch insurance companies they might get into subrogation (a form of arbitration, basically) over which one pays what, but you're covered.
The whole point of insurance, though, is that as long as you're in the risk pool you pay the same regardless of whether you're sick. You don't pay more for your car insurance if you have 12 accidents that aren't your fault, but you do pay more for your car insurance if you get a ticket but have never had an accident. The first is a case of bad luck, and the second is basically a case of negligence. The whole point of insurance is to get rid of the luck factor.
And I'd just as soon get rid of any consideration around pre-existing conditions, because as far as an insurance company beancounter is concerned EVERYBODY has them until they prove otherwise.
The other problem is with preexisting conditions that are due to a "moral fault" of the person, like obesity or alcoholism or drug addiction or smoking.
Controllable risk factors are an entirely different thing from pre-existing condition. It does make sense to control for them regardless, but we do need to use care.
I don't think the right solution is to simply charge people based on their BMI. First, BMI alone isn't really a great number (it is a good starting point for a conversation with a doctor, but chances are Arnold Schwarzenegger has a BMI over 30 which is meaningless). Second, weight is one of those factors that people can sort-of control, but unless you're locked up in a cage and fed rations it isn't really completely controllable. Some people maintain a low weight without effort, and others struggle to be merely obese. Dietary advice parceled out these days tends to depend more on lobbying than medical evidence. Until somebody actually comes up with a practical diet with real clinical outcomes I think it is a bit harsh to penalize people for having a problem that has no scientifically-proven treatment. I say this as somebody who probably wouldn't have to pay any penalties, though in the past I might have, and I've found that weight control at least for me personally has little to do with willpower and a lot more to do with control over diet composition.
But, yes, prevention goes a lot further than treatment and we should be trying to shift the population away from unsafe behaviors/etc.
Prosecutors in recent cases have convinced courts that the intent of the leaker, the value of leaks to the public, and the lack of harm caused by the leaks are irrelevant -- and are therefore inadmissible in court.
So much for Thomas Aquinas. I think half the problem with our justice system is that it is WAY too focused on consequences and not nearly enough on intent, simply because the one is much easier to measure than the other.
As far as I'm concerned Murder shouldn't even be a crime, but Attempted Murder and Reckless Endangerment certainly should be and should carry stiff penalties. If you set out to kill somebody is it really relevant whether you bungled the deed or not? We should be locking up people who are a danger to society and recklessness and antisocial behavior are far bigger indicators of whether somebody will commit a future crime than the consequences of past actions which were unintended and not reckless.
Oh, I don't disagree that the ACA seems like an interim solution at best. The problem is that a majority of the country strongly want the status quo to change, but the majority of the country are also nervous about changing it and are really incapable of (or can't be bothered with) understanding the complexity of the issues. So, we get half-measures and simple solutions to simple problems (it's all the fault of insurers, pharma, whatever).
The whole system really needs an overhaul to be effective. There is no aspect of the current US healthcare system which can be left untouched, and the problem is that all the constituents of the system are fine with reform as long as their part of the system remains untouched. Doctors are happy to see drug price controls, drug companies are happy to see universal coverage, patients don't want their favorite doctor to quit because he will only make $120k/yr, and so on.
I do think that the whole practice of denying pre-existing conditions had to go. It makes a lot of sense for just about any other kind of insurance. It also makes sense in a theoretical sense for medical insurance, but it is extremely open to abuse.
Heck, lots of people were upset that they couldn't keep their previous insurance under the ACA, and yet many of those plans were cheap only because the company intended to screw them if they ever got really sick. People got the comfort of "having insurance" despite the fact that they didn't really have insurance.
What do you mean that X forwarding is not working? It is usually deactivated by default and you have to turn it on with -X or in a config file. If you use '-Y' you turn off security. You have no reason to complain, if you turned security off yourself.
Looked it up. Openssh secure forwarding only works if the X server is compiled with XC-SECURITY enabled, which is disabled by default. Some distros consider it insecure, as does upstream. So, on distros that do not override this and enable XC-SECURITY secure Openssh forwarding is disabled. If you use openssh -X to connect you get the error "Warning: untrusted X11 forwarding setup failed: xauth key data not generated." X11 forwarding does not work in this case. Using -Y works fine.
There is some relevant discussion at:
https://bugs.freedesktop.org/show_bug.cgi?id=2606
You'd think so, but from what I've learned Agriculture and DEA are the two agencies where you absolutely have to have your ducks in a row before the box gets onto US soil. For other transgressions you might have it sent back or you might have it held up, but mess up with DEA or Agriculture/Fish-Wildlife and the package could actually be destroyed.
It is amazing how painful customs can be. In some cases if you don't put the right declaration on the outside of a box (such as "not for human use") they might send it back and make you fix it and ship it again. For most issues though the package just sits in limbo until you file the right paperwork.
One tactic I've heard of in the US is to buy a part to a gun (something small and convenient like a grip or a trigger or something). Then get a nice big lockable gun case and place it and everything else you care about inside. Declare your "gun" at the counter (gun parts are treated the same as assembled weapons). They will direct you to someplace to have your luggage screened in your presence, and then you lock it up and keep the key (which doesn't have to be TSA-approved). The case will generally not be opened outside of your presence.
You'll still need to pay any fees you'd pay for other checked bags (by weight/size/number/etc), but you'll avoid having your stuff go missing on you. While the TSA doesn't mind your valuables disappearing they don't like the idea of having guns used in crimes traced to them, so gun cases are exempt from the "we can cut/open any lock" policy. The airline probably feels the same way and will probably give the case extra care - even if just to make sure it is secured/etc.
The reason you use a gun part and not a gun is that while parts get the special treatment from the TSA, they're usually exempt from local gun control laws (though obviously you need to check).
None of this will do you any good for international travel though, which is what the original article pertained to. I'm sure there is lots of paperwork around importing/exporting weapon parts from the US, and that is probably nothing compared to what most other countries would impose.
Personally, I would go the other way, make individual policies tax deductible rather than taxing group policies. This seems more fair to me -- why should people pay taxes on something as essential as healthcare -- and it's actually politically possible
Frankly, they need to make healthcare-related expenses tax-deductible, full stop. Right now there are a bunch of ways to deduct expenses and they basically all suck. There are savings accounts where you guess how much you're going to spend, and if you spend more you end up paying taxes on it, and if you spend less you lose the money you contributed (though not quite as much starting in 2014). There is also a straight-up deduction if you spend something like 2.5% of your income on health-related expenses, but most people don't spend so much and anything you did put in a savings account doesn't count towards it (I'm also not sure if it applies if you take the standard deduction - so it really only counts if you have a mortgage). Then there are breaks like the one you mention.
Seems like they should just have a box that asks how much you spent on health care and let you deduct it, and get rid of all the other nonsense. Sure, make people substantiate it as with charitable donations.
There is a difference between paying taxes things to the government which does unpopular things, and the government forcing someone to buy a particular type of product from a third party. Both are wrong, but the former is a necessary evil and the latter is an unnecessary aspect of fascism.
How is my being forced to pay for Lockheed to build an F22 any different from my having to pick an insurance company and buy insurance from them? The only difference is that I have personally more to show for the latter.
And the insurance mandate is only unnecessary if you allow insurance companies to deny pre-existing conditions. The problem with this is that many unscrupulous (and often less expensive) insurers would issue insurance and then once you get a really expensive condition they'd argue that it was pre-existing and refuse to pay up. Then you have to sue them to obtain the coverage you've been paying for all along. Maybe if you're lucky they'll refund your premiums, though they still happily collect them from healthy people who don't file claims.
The problem with pre-existing conditions is that it is almost impossible to tell when a medical condition actually started. Sure, if you buy insurance for the first time after you're in the hospital it is an easy determination. However, what if you were without insurance for six months two years ago, and then you're diagnosed with cancer. The cancer could conceivably have started when you were uninsured, and that is exactly the line of argument an unscrupulous insurer would take.
So, the ACA required that insurers cover pre-existing conditions, and the necessary tradeoff is that everybody has to buy insurance. Otherwise anybody with half a brain would just sign up on their way to the hospital and cancel the day after they get all their prescriptions filled after being discharged. In fact, that could still be a problem because for as much as people complain about the penalty for not having insurance it really isn't that large which makes incurring it the rational self-interested choice in most cases.
No one is saying the religious institutions don't have to provide insurance coverage. They are saying that they should not have to pay for services that violate their religion.
A religion is whatever its adherents want it to be. There are plenty of religions that don't believe in vaccination or other forms of treatment that didn't exist 200 years ago. Does that mean that a small business owned by such a person doesn't have to provide those either? HPV vaccine has made headlines in recent years as one which might encourage/assume promiscuous behavior, but virtually every major medical association recommends that young women get it.
Couldn't agree more. Frontline had a really good show on some of the healthcare issues in the US and some innovative things being done to try to improve care. Prevention was a big one. They had one case where a poor person had resulted in Medicaid spending something like $60k/yr in ER treatments for acute asthma, but the problem went away completely when a volunteer organization spent $6k fixing his drywall so that the whole house wasn't filled with dust. That is a problem that probably even European countries wouldn't handle well, though obviously they're light-years ahead of the US on the prevention front.
I've heard it explained thusly: if car insurance worked like health insurance, then every time you put gas in your tank, got an oil change, bought tires, etc., you would file a claim.
Well, just one more difference: when you fill up your tank you'd get a bill for $50/gallon which the station would try to get you to pay up front. If you object strongly they'll give in and bill your insurance first. Your insurance would pay $4.50/gallon and ask you to pay $0.50/gallon, and would write off the other $45/gallon as being overpriced. If you didn't have insurance the gas station would tell you that they'd cut you a break and only charge you $25/gallon and you'd thank them for the favor you think they're doing you.
The ACA isn't a tax. it is mandating health insurance with preset coverage minimums and limits. you can't pay $50 a month for benefits that don't actually cover you when you go to use them.
Well, kinda sorta. That's like saying that every April 15th I pay for a set of minimal mandatory government services, like blowing up weddings in Yemen.
However, this is just wrangling over words. If I have to choose between insurance companies denying expensive care and making sick people prove that it wasn't a pre-existing condition from the one day 10 years before that they didn't have insurance between jobs, and requiring everybody to buy insurance at a reasonable rate, I'll take the latter...
X clients tunnelled over X are untrusted X clients and do not have access to everything by default. See X security extension and the -Y option of ssh.
True, but that would apply only to the clients going through the tunnel. Well, assuming it works (on my distro ssh X11 forwarding without -Y doesn't work at all).
Yes, in practice, we find many unix systems where there is effectively only a single user, and the biggest security threat vector against that user is *not other users on the system* but *programs the user decided to run that were not sufficiently vetted to be free of (remotely) explotable bugs and backdoors*
So, I agree with everything you said, but if I only ran software sufficiently vetted to be free of exploitable bugs and backdoors I wouldn't be running just about anything. Certainly I wouldn't be running the Linux kernel, or any web browser. I'm sure there are a few small programs that are sufficiently small that you could completely characterize their behavior if you limited it to a very particular intended use.
Half the stuff on the NSA Christmas list of exploits probably involves zero-days for mainstream FOSS.
I'm not suggesting that we should stop using Linux. I just wouldn't consider it done yet.
Agree 100% that the Android approach is a kludge, but it is a step in the right direction in that it works reasonably well without much fuss. I'm not pointing towards anything in particular as a solution - I think the right solution remains to be found.
However, as we are already starting to see, when everything is captured and recorded for prosterity, no one ever forgets and society is extrodinarily slow to forgive despite the fact that most everyone has been just as guilty at some point in time.
I suspect that this will inevitably change. Today a video of drunken behavior on Facebook can keep somebody from ever getting a job, because such things are rare. However, when there is video footage widely available of every single person on the planet acting like everybody acts at some point in their life, then everybody will learn to ignore it. Sure, everybody's vice is different, but nobody is entirely without vice.
"Let he who is without sin cast the first stone," has the potential to go a long way, once everybody's sins are shouted from the rooftops.