And how do you determine if an app is going to request sensitive permission without umm, vetting it in the first place?
Simple - developer uploads app to market. If app's manifest only requires "safe" permissions then it goes right into the market. If it wants more, then a human looks at it. That is a compromise between the current Google and Apple approaches.
So you have a situation where the app is constantly asking the user for confirmation before doing things, kind of like how MS Vista used to do.
There wouldn't be anything constant about it - this would happen exactly once at the time of install, just like it does now. However, the GUI would change.
Right now the installer just shows you a list of permissions and gives you a choice of OK/Cancel.
My proposal would be a list of permissions, and each has a check-box next to it. "Safe" permissions would be checked by default, and unsafe ones would be unchecked. Anything not in the manifest wouldn't be displayed at all, since the app doesn't need those permissions anyway.
So, if a user just hits OK they get a sandboxed app.
The downside to this approach is that some apps wouldn't be very functional if the user just accepts the defaults. For example, if GPS location is considered unsafe then navigation programs wouldn't work if the user doesn't manually enable GPS location.
The alternative is to check all the boxes by default, similar to the current situation, but let users still uncheck boxes they don't want.
I do agree that no change will completely make it impossible to install malicious software - that is probably an impossible problem to solve. However, we can probably do a lot better than we are doing now.
Keep in mind that Bell Labs was largely the result of utility regulation.
The profit model for Bell was costs+x%. The more cost they had, the more profit they made, courtesy of the utilities commission. So, as long as the research had ANYTHING to do indirectly with the phone system it was paid for. The company didn't really care if it was useful, although obviously they had some incentive to try to get additional value from it.
Companies have learned how to structure regulations so that they can make the profits without having to pay a bunch of engineers.
I don't disagree that the country needs more of an R&D atmosphere, but such a thing only exists when there is a regulatory climate to support it. Rarely does R&D actually pay off from an financial standpoint - at least not at the individual-company level. It tends to be more of a rising-tide-lifts-all-boats thing.
The average person doesn't want to hear that their kids are only average. They want to hear that their kid could be the next astronaut or president of the USA. If you make college free EVERYBODY is going to want access to it, and if your admission standards tick of the majority you're going to end up on the wrong side of democracy, guaranteed.
The problem is that college has been talked up WAY too much. College is a tool, and it is a useful tool for certain problems. The problem is that it has turned into the new high school diploma, so everybody feels like they have to have a degree to amount to anything.
Then, add in the culture aspect - kids like the high-school experience since we've made it fairly fun/social/etc, and they want four more years of it but without dull parents around.
My daughter has started attending a trade school and the contrast with her friends is amazing. She basically acts like a full adult now, and is rapidly losing touch with many of her college-bound friends who tend to just stay up until 4AM and go to parties three times a week. Her friends haven't really changed since high school, and she would fit in with most adults just fine. Her school is designed to foster a professional atmosphere, and she finds herself hanging out more with people with a similar mindset - just like most of the successful adults I know.
I suspect that a year of trade school (pick ANY - from cooking to auto repair) followed by some self-teaching would probably better prepare people for an IT career than 95% of the CS programs out there. The thing kids need to learn isn't what they've being shoveled in class, but rather how to learn on their own and some basic values like making it happen rather than waiting for somebody else to come along and hand you an opportunity.
Teaching everybody to read and do basic math has huge benefits.
Offering classes to everybody to learn Psychology, Calculus, Organic Chemistry, and the History of Western Civilization, and then dumbing down all those courses so that everybody graduates, may not.
I doubt that most college graduates learn much from half of the courses they end up taking. Most college graduates do not go on to become leaders in their fields of study, or doing anything in their field of study. Most college graduates end up being the manager at the local store, or the guy who sells you replacement windows, or whatever.
Think about how free education would actually work - colleges would rapidly become just like a much more expensive version of public school. Whatever government metrics you collect are the ones they'll aim to deliver on. Critical thinking is impossible to measure, so it won't be the focus of teaching. Passing some exam will likely become the focus of the process, but the exam will of course have to be designed such that anybody could learn enough to pass it so exceptional students will get ignored, just as they are in most public schools.
The problem with college education is that the costs have gotten out of hand. Most fields do not teach much in their undergraduate programs that wasn't taught 50 years ago. Heck, I majored in something that was only discovered 60-70 years ago and still 80% of my in-major courses were on foundational topics that did exist 50 years ago, though of course with less modern content. There is no reason that the cost of education needs to go up at the pace that it has.
If a half-decent college education were completed in a year-round 40-hour-per-week program like most trade schools you could get it done in 1-2 years and it could probably be done for a very modest sum. College delivers lots of stuff that you don't really need, in a very inefficient way. The last thing we should do is start tax-funding it in its present state.
And I do believe that most people who currently attend college would be FAR better off in a trade school.
True, but while CM has been a great solution for a while the focus of that distro has moved on to newer phone models. While CM 6.0 runs on the G1 it is VERY slow, and doesn't support apps/data on SD ext3, and official Froyo apps on SD doesn't work well for many apps.
6.1 seems to be a lot better, but I think it is only a matter of time before the G1 stops getting much attention, which then leaves a lot of more experimental mods floating around. CM was nice because it focused more on usability/stability and was less of a POC build.
It is like the 1990s all over again - developers tend to be enthusiasts who buy the latest and greatest, so they always build stuff that doesn't run well on older PCs. We've gotten away from this in the last 10 years since modern PCs (except in the area of graphics) have not really been improving much as they are no longer CPU-bound, and most developers don't own SSDs yet.
Phones, however, are on a very Moore's-law like curve which means that when you donate to your favorite phone modder you're giving him a change to get a newer fancier phone and stop supporting yours.:) Granted, that doesn't mean that the solution isn't to reward them for what they've done for us.
Yeah, I'd like to see that happen. Keep in mind that for another six months there will still be tons of people who bought G1s under contract and they are stuck with them. Can you say class-action-lawsuit?
However, if they just release G1 owners from contract and provide access to non-contract deals then I'd be happy with this approach...:)
I tend to agree. I think the biggest problem is that these are $500 devices being bought by average people for whom $500 is quite a bit of money. Or maybe they're only $200 but only if you sign up for a new account/etc - which you can't do all the time.
And yet, the vendor treats them like a disposable free phone, and they only get updates for six months. Most consumers that buy a $500 device expect it to last years. Now, for devices that don't require updates to function that is one thing. However, smartphones are all about downloading software, and when lots of apps require a newer OS users start to feel that pain.
Plus, users are used to the PC world. If you bought a PC with XP on it in 2003, you could still run the newest software on it today. Sure, games and hardware-intensive apps would be slow or non-functional, but the vast majority of simple apps work on PCs that are ancient by today's standards. I bet a PC running WinME could run half the stuff I use day-to-day.
Granted, phone technology is new and progressing rapidly. However, phone vendors need to consider these devices investments and not abandon them immediately. This is actually one thing Apple does moderately well - their original iPhone was the only iPhone around for much longer than any Android device has stayed on the market, and they only abandoned it for software updates relatively recently. And, I imagine that almost all apps still work on it just fine.
I still think a better solution is to make it impossible to write malicious software in the first place.
Apps should not generally open arbitrary network sockets. Apps should generally not be able to use gobs of bandwidth. Apps should generally not be able to call 911/etc.
Maybe an in-between solution is for Google to vet apps that request more sensitive permissions. So, if your app just displays on-screen, makes connections back to the distributor's website with modest bandwidth use, and maybe plays some music, then no pre-approval is required. If your phone accesses the phone book, the dialer, or sends arbitrary network traffic, then it requires pre-approval. That will of course make app authors think twice about whether those things are necessary.
Perhaps another step is to make it so that by default the app asks for the more sensitive permissions but the user has to confirm them individually and if they just hit the OK button the software gets installed with safer permissions. This would of course require software authors to design their apps so that they work fine with or without GPS location, or phonebook access, or the dialer, or without services, etc.
Well, it remains to be seen if they backport fixes to 1.6, but I agree completely that this is a potential weakness of the platform. Vendors are WAY too quick to abandon old phones. If it isn't still in stores, they don't care about it.
In fact, probably the best way for us poor G1 owners to get some official updates for our phones is to start releasing viruses designed to take down the cell network. THAT would get some updates out quick!:) (Disclaimer - I'm not advocating that anybody actually do this of course!)
Uh, that's exactly how it works right now - only market apps can get onto the phone, unless the user enables the installation of non-market apps. The problem here is that Google left a back-door open. No amount of security design will help if the vendor leaves a back-door open. The iPhone in theory doesn't run anything not signed by Apple, but since lots of users are walking around with jailbroken iPhones they didn't get it right either.
Google just needs to stop leaving back-doors open in their OS. Apps should be installed via the standard interface, and the existing market auto-update feature should be used for deploying updates.
Note also that having multiple repository tiers probably won't help much. The less-vetted tier will undoubtedly have more software in it, so 99.999% of all phones will have it enabled. Thus, virtually all phones will still be vulnerable to malicious apps.
The solution is just to fix the leaks in the sandbox, and not to deliberately engineer them in. As long as the user has to approve all app installs, and apps disclose their permissions, things like this should stay under control.
Oh, on the topic of permissions - Android really needs to let users toggle individual permissions at the time of application install. Right now your only choices are install or don't-install. It would be REALLY nice if I could toggle that "auto-load on start" permission for the 95% of the apps on the phone that I don't want running all the time no matter what the authors think. Right now the only thing I can do is edit the apk manifest, which is a BIG pain and blocks updates.
LTS is good for production environments where you have lots of machines to support.
Suppose you run Ubuntu on 1000 workstations. Each of those runs a variety of programs, not all the same, and some aren't from the PM (they might not be open source, or widely used - they could even be homegrown). Every time there is an upgrade one of these programs could break.
The idea of LTS is that for the most part everything stays put but you still get security updates. For something like a corporate desktop that is exactly what you want. Why do you think that so many computers are still running XP? Simple, it works and as long as it works nobody wants to pay the small fortune it would take to figure out if anything will break and if so fix it when you upgrade 20,000 PCs running it.
From the user's point of view it's completely illogical to upgrade the whole system just because you want a new feature in amaroK 2.4 while your distro only packages 2.3, you expect one application to install or upgrade independently of any other application. That does not happen with Linux.
Sure it does. It just doesn't happen with Ubuntu, or Debian, or RHEL/Fedora/SUSE/etc.
If you use a source-based distro then unless the newer version depends on some API exposed by a newer library then it will build just fine and run against the old one.
It used to be that the preferred upsteam way of distributing packages (outside of a package manager) was as source for exactly this reason. The same tarball worked just fine on sparc/ sgi/ hpux/ linux/ freebsd/ etc.
I do see the utility of something like this tool, but I'd hate to see it used widely. Besides security there is also wasted memory - if 10 programs are linked against the same library it is only loaded in RAM once. If 10 programs are linked against 10 versions of the library, or even the same version built 10 times (and they load those different versions) then the system can't share their memory.
Yup. The problem is that the legal system has gotten way out of hand.
In theory the way it is supposed to work is that two parties with a disagreement go to court, and the court decides who is in the wrong. Maybe the person in the wrong gets punished by the court via damages of some kind depending on the nature of the dispute.
The problem is that today simply going to court is effectively punishment, and the actual damages are just outrageous quite often. Courts do not value the time of participants, and a trial takes many hours of preparation and motion practice let alone showing up in court. The result is that simply being named in a suit is finacially ruinous. Even going pro se doesn't help a great deal, as it takes countless hours that you aren't paid for to go to trial. It might also cost you your job. If you go pro se you could end up messing up and paying sanctions for the other side's legal expenses. Oh, but if the other side messes up they won't pay for your legal bills since you don't have any, and your time is considered worthless since you aren't an attorney. When it comes to scheduling the opposing counsel can point out to the court various conflicts with other litigation that they need to pursue and the court will respect this, but the court will care little for a pro se defendant's other commitments, since they aren't court-related.
They really need to switch to a system where legal costs are balanced. Courts should stipulate a budget for each side, and the court pays the expenses of all counsel. It will be illegal to pay a lawyer, and lawyers cannot parter with other services/etc as a way to get money in the back door. Lawyers will work for the court, and not for parties themselves, essentially. Then, after the trial the entire cost of the trial becomes one of the matters at issue and the loser generally pays. Oh, wealthy plaintiffs will have to put up security in advance.
With such a system neither side can out-lawyer the other as the legal budgets of both sides are fixed and equal. Poor defendants are not subject to death-by-process either.
I'd add generateKey as well - for secure key generation (without any way to distinguish which way the key got there). However, what you suggest seems fine.
I'd also arrange that by law devices come without any key and that they are generated when the consumer first uses the device. The wipekey function would need to be easily accessible by an end-user as well. Again, the purpose for this is to make this very useful for security purposes, and useless for trusted computing purposes.
The grandparent had a good point, actually. The problem is the mentality of security at any cost.
The most secure system is a system that nobody uses. That system of course has absolutely zero utility.
In the real world we have tradeoffs. When you force users to behave in a "secure" manner that is inconvenient, you cause them to engineer around your solution - perhaps resulting in a system that now is less secure than it would have been without the security measure.
Users aren't the enemies - they're just trying to get work done.
Of course there needs to be a balance, but the best security is one where the cost of the security measure in terms of usability is considered in relation to its risk. The question isn't whether a feature increases security, but rather whether it increases it relative to its cost.
It might flood tubes or something like that, but it certainly wouldn't fire.
If at peace the best on-the-scene decision is to remain completely concealed. You don't want to give intel to the enemy on your capabilities.
Now, strategically giving away intel might be good politically, or it might be bad. Giving away that you can negate some of a nations strategic nuclear capability would probably be bad. You don't want them to develop countermeasures, you don't want to get them to build more nukes to keep an advantage, and you don't want them to get twitchier on the trigger out of fear of losing their deterrence. Strategically the US's best option is to have the ability to get rid of every opposing nuclear weapon, but make opponents feel very safe that their nuclear weapons are a potent deterrent.
I suspect the missile probably costs millions to replace, and the warhead(s) cost who knows how much - probably a lot more.
A phoenix missile or tomahawk cost $1M to replace. I think a ballistic missile with a range of 4000 miles and a CEP probably measured in yards would be more expensive.
No - there weren't millions of computers to develop on back then.
However, cobol was the only way to develop anything that mattered on any computers that mattered. I wouldn't be surprised if the NYSE is still running on cobol and cics...
Of course, it is entirely possible that the Chinese launched this, and the USN knew all about the sub being there, and that they directly observed the launch.
They of course wouldn't disclose this, because they wouldn't want to indicate that the sub was tracked, as this is a useful secret to maintain.
And, it isn't like they could have done anything to stop it. The launch was in international waters. They could have randomly torpedoed the sub while it was at sea - not a good diplomatic move. They could have seen the sub get ready to launch, and torpedoed it then, but a sub probably doesn't look like it is launching until it is virtually doing so (just going to periscope depth doesn't constitute a launch - and off the coast they won't be super-deep in any case, and subs go to periscope depth for all kinds of things anyway even in the middle of the ocean). Once they hear doors opening (if they notice) their only options are sink it or don't sink it. Until it actually fires on the US I doubt they'd do anything.
If it was tracked, then no doubt if the sub fired on the US an order would go out to sink it fairly quickly. However, that would be after a considerable delay - probably enough to fire an entire salvo. You can't really stop something like this without having a REALLY twitchy finger and if that happened we'd hear about sub sinkings all the time.
US missiles go over the north pole for targeting and range purposes due to the magnetic fields there.
No, they go over the pole because the shortest distance between two points is a straight line, but we don't put drill bits on missiles to tunnel through the earth, so we settle for a great circle, which is the projection of a straight line onto the surface of Earth. A great circle route from the US to Russia/China/etc goes over the pole. Magnetic fields have nothing to do with it.
Great circle is also your only option for a ballistic flight - any other path requires acceleration during the cruise phase. Unless you're firing at a position on the exact opposite side of the earth you don't get any choice at all - there is only one ballistic ground path between any two points on a globe unless they are opposite each other, or coincident. For opposite points you can fire any direction you want at the right velocity/angle and it ends up in the same place (neglecting rotation of the earth - in reality only some paths work). For the same point you can of course fire straight up, or fire any direction you want with high velocity and the round will land in the same place after one orbit (again, neglecting the rotation of the earth - in reality you probably couldn't ever hit the same point after circling the earth unless you shoot it high enough to allow a full day to pass during the orbit).
Uh, there are probably about 25 steps involved in launching an SLBM. Step one would be maintaining a shallow depth, which ballistic missile subs almost never do otherwise except for maybe a brief stop to get instructions. Somewhere in the series of steps probably includes opening the hatch as well.
I'm sure the launch was deliberate. Now, whether it was planned is a separate matter. Maybe some fault on a missile called for firing it to get rid of it, but that seems unlikely to me. Firing ICBMs is a VERY sensitive matter (if not coordinated with other major powers it certainly would trigger a serious alert and move towards nuclear readiness - not something ANYBODY wants to happen). So, I doubt somebody would write a submarine procedure manual that included firing ballistic missiles except under order. Besides, can you imagine the trouble involved in tracking down the warheads if the thing was armed (which you'd have to assume if it were a standard procedure).
This was almost certainly a test launch. Or, maybe it was smaller than it looked (I didn't see the video so I don't know if it really was an ICBM).
I'm not sure what the point of that is. Does anybody on the planet really doubt that the US has ICBMs? If everybody thinks you can turn any desert on the planet to glass, what is the point of test launches except perhaps to demonstrate that maybe your weapons don't work. What happens if you launch it and miss? In the absence of data everybody fears you, so why risk that by providing evidence one way or the other?
It seems more likely that they were testing some new launch system or something like that. Doing it merely as a demonstration of power seems unlikely.
Slashdot Mirror
And how do you determine if an app is going to request sensitive permission without umm, vetting it in the first place?
Simple - developer uploads app to market. If app's manifest only requires "safe" permissions then it goes right into the market. If it wants more, then a human looks at it. That is a compromise between the current Google and Apple approaches.
So you have a situation where the app is constantly asking the user for confirmation before doing things, kind of like how MS Vista used to do.
There wouldn't be anything constant about it - this would happen exactly once at the time of install, just like it does now. However, the GUI would change.
Right now the installer just shows you a list of permissions and gives you a choice of OK/Cancel.
My proposal would be a list of permissions, and each has a check-box next to it. "Safe" permissions would be checked by default, and unsafe ones would be unchecked. Anything not in the manifest wouldn't be displayed at all, since the app doesn't need those permissions anyway.
So, if a user just hits OK they get a sandboxed app.
The downside to this approach is that some apps wouldn't be very functional if the user just accepts the defaults. For example, if GPS location is considered unsafe then navigation programs wouldn't work if the user doesn't manually enable GPS location.
The alternative is to check all the boxes by default, similar to the current situation, but let users still uncheck boxes they don't want.
I do agree that no change will completely make it impossible to install malicious software - that is probably an impossible problem to solve. However, we can probably do a lot better than we are doing now.
The days of Bell labs, PARC et. al were great...
Keep in mind that Bell Labs was largely the result of utility regulation.
The profit model for Bell was costs+x%. The more cost they had, the more profit they made, courtesy of the utilities commission. So, as long as the research had ANYTHING to do indirectly with the phone system it was paid for. The company didn't really care if it was useful, although obviously they had some incentive to try to get additional value from it.
Companies have learned how to structure regulations so that they can make the profits without having to pay a bunch of engineers.
I don't disagree that the country needs more of an R&D atmosphere, but such a thing only exists when there is a regulatory climate to support it. Rarely does R&D actually pay off from an financial standpoint - at least not at the individual-company level. It tends to be more of a rising-tide-lifts-all-boats thing.
The average person doesn't want to hear that their kids are only average. They want to hear that their kid could be the next astronaut or president of the USA. If you make college free EVERYBODY is going to want access to it, and if your admission standards tick of the majority you're going to end up on the wrong side of democracy, guaranteed.
The problem is that college has been talked up WAY too much. College is a tool, and it is a useful tool for certain problems. The problem is that it has turned into the new high school diploma, so everybody feels like they have to have a degree to amount to anything.
Then, add in the culture aspect - kids like the high-school experience since we've made it fairly fun/social/etc, and they want four more years of it but without dull parents around.
My daughter has started attending a trade school and the contrast with her friends is amazing. She basically acts like a full adult now, and is rapidly losing touch with many of her college-bound friends who tend to just stay up until 4AM and go to parties three times a week. Her friends haven't really changed since high school, and she would fit in with most adults just fine. Her school is designed to foster a professional atmosphere, and she finds herself hanging out more with people with a similar mindset - just like most of the successful adults I know.
I suspect that a year of trade school (pick ANY - from cooking to auto repair) followed by some self-teaching would probably better prepare people for an IT career than 95% of the CS programs out there. The thing kids need to learn isn't what they've being shoveled in class, but rather how to learn on their own and some basic values like making it happen rather than waiting for somebody else to come along and hand you an opportunity.
Teaching everybody to read and do basic math has huge benefits.
Offering classes to everybody to learn Psychology, Calculus, Organic Chemistry, and the History of Western Civilization, and then dumbing down all those courses so that everybody graduates, may not.
I doubt that most college graduates learn much from half of the courses they end up taking. Most college graduates do not go on to become leaders in their fields of study, or doing anything in their field of study. Most college graduates end up being the manager at the local store, or the guy who sells you replacement windows, or whatever.
Think about how free education would actually work - colleges would rapidly become just like a much more expensive version of public school. Whatever government metrics you collect are the ones they'll aim to deliver on. Critical thinking is impossible to measure, so it won't be the focus of teaching. Passing some exam will likely become the focus of the process, but the exam will of course have to be designed such that anybody could learn enough to pass it so exceptional students will get ignored, just as they are in most public schools.
The problem with college education is that the costs have gotten out of hand. Most fields do not teach much in their undergraduate programs that wasn't taught 50 years ago. Heck, I majored in something that was only discovered 60-70 years ago and still 80% of my in-major courses were on foundational topics that did exist 50 years ago, though of course with less modern content. There is no reason that the cost of education needs to go up at the pace that it has.
If a half-decent college education were completed in a year-round 40-hour-per-week program like most trade schools you could get it done in 1-2 years and it could probably be done for a very modest sum. College delivers lots of stuff that you don't really need, in a very inefficient way. The last thing we should do is start tax-funding it in its present state.
And I do believe that most people who currently attend college would be FAR better off in a trade school.
True, but while CM has been a great solution for a while the focus of that distro has moved on to newer phone models. While CM 6.0 runs on the G1 it is VERY slow, and doesn't support apps/data on SD ext3, and official Froyo apps on SD doesn't work well for many apps.
6.1 seems to be a lot better, but I think it is only a matter of time before the G1 stops getting much attention, which then leaves a lot of more experimental mods floating around. CM was nice because it focused more on usability/stability and was less of a POC build.
It is like the 1990s all over again - developers tend to be enthusiasts who buy the latest and greatest, so they always build stuff that doesn't run well on older PCs. We've gotten away from this in the last 10 years since modern PCs (except in the area of graphics) have not really been improving much as they are no longer CPU-bound, and most developers don't own SSDs yet.
Phones, however, are on a very Moore's-law like curve which means that when you donate to your favorite phone modder you're giving him a change to get a newer fancier phone and stop supporting yours. :) Granted, that doesn't mean that the solution isn't to reward them for what they've done for us.
Yeah, I'd like to see that happen. Keep in mind that for another six months there will still be tons of people who bought G1s under contract and they are stuck with them. Can you say class-action-lawsuit?
However, if they just release G1 owners from contract and provide access to non-contract deals then I'd be happy with this approach... :)
Ah, then the fault is not with Google.
Granted, you should note that ALL Android distributions are vendor-specific. They do of course vary in how much the vendors mess with the core OS.
I tend to agree. I think the biggest problem is that these are $500 devices being bought by average people for whom $500 is quite a bit of money. Or maybe they're only $200 but only if you sign up for a new account/etc - which you can't do all the time.
And yet, the vendor treats them like a disposable free phone, and they only get updates for six months. Most consumers that buy a $500 device expect it to last years. Now, for devices that don't require updates to function that is one thing. However, smartphones are all about downloading software, and when lots of apps require a newer OS users start to feel that pain.
Plus, users are used to the PC world. If you bought a PC with XP on it in 2003, you could still run the newest software on it today. Sure, games and hardware-intensive apps would be slow or non-functional, but the vast majority of simple apps work on PCs that are ancient by today's standards. I bet a PC running WinME could run half the stuff I use day-to-day.
Granted, phone technology is new and progressing rapidly. However, phone vendors need to consider these devices investments and not abandon them immediately. This is actually one thing Apple does moderately well - their original iPhone was the only iPhone around for much longer than any Android device has stayed on the market, and they only abandoned it for software updates relatively recently. And, I imagine that almost all apps still work on it just fine.
I still think a better solution is to make it impossible to write malicious software in the first place.
Apps should not generally open arbitrary network sockets. Apps should generally not be able to use gobs of bandwidth. Apps should generally not be able to call 911/etc.
Maybe an in-between solution is for Google to vet apps that request more sensitive permissions. So, if your app just displays on-screen, makes connections back to the distributor's website with modest bandwidth use, and maybe plays some music, then no pre-approval is required. If your phone accesses the phone book, the dialer, or sends arbitrary network traffic, then it requires pre-approval. That will of course make app authors think twice about whether those things are necessary.
Perhaps another step is to make it so that by default the app asks for the more sensitive permissions but the user has to confirm them individually and if they just hit the OK button the software gets installed with safer permissions. This would of course require software authors to design their apps so that they work fine with or without GPS location, or phonebook access, or the dialer, or without services, etc.
Well, it remains to be seen if they backport fixes to 1.6, but I agree completely that this is a potential weakness of the platform. Vendors are WAY too quick to abandon old phones. If it isn't still in stores, they don't care about it.
In fact, probably the best way for us poor G1 owners to get some official updates for our phones is to start releasing viruses designed to take down the cell network. THAT would get some updates out quick! :) (Disclaimer - I'm not advocating that anybody actually do this of course!)
Uh, that's exactly how it works right now - only market apps can get onto the phone, unless the user enables the installation of non-market apps. The problem here is that Google left a back-door open. No amount of security design will help if the vendor leaves a back-door open. The iPhone in theory doesn't run anything not signed by Apple, but since lots of users are walking around with jailbroken iPhones they didn't get it right either.
Google just needs to stop leaving back-doors open in their OS. Apps should be installed via the standard interface, and the existing market auto-update feature should be used for deploying updates.
Note also that having multiple repository tiers probably won't help much. The less-vetted tier will undoubtedly have more software in it, so 99.999% of all phones will have it enabled. Thus, virtually all phones will still be vulnerable to malicious apps.
The solution is just to fix the leaks in the sandbox, and not to deliberately engineer them in. As long as the user has to approve all app installs, and apps disclose their permissions, things like this should stay under control.
Oh, on the topic of permissions - Android really needs to let users toggle individual permissions at the time of application install. Right now your only choices are install or don't-install. It would be REALLY nice if I could toggle that "auto-load on start" permission for the 95% of the apps on the phone that I don't want running all the time no matter what the authors think. Right now the only thing I can do is edit the apk manifest, which is a BIG pain and blocks updates.
LTS is good for production environments where you have lots of machines to support.
Suppose you run Ubuntu on 1000 workstations. Each of those runs a variety of programs, not all the same, and some aren't from the PM (they might not be open source, or widely used - they could even be homegrown). Every time there is an upgrade one of these programs could break.
The idea of LTS is that for the most part everything stays put but you still get security updates. For something like a corporate desktop that is exactly what you want. Why do you think that so many computers are still running XP? Simple, it works and as long as it works nobody wants to pay the small fortune it would take to figure out if anything will break and if so fix it when you upgrade 20,000 PCs running it.
From the user's point of view it's completely illogical to upgrade the whole system just because you want a new feature in amaroK 2.4 while your distro only packages 2.3, you expect one application to install or upgrade independently of any other application. That does not happen with Linux.
Sure it does. It just doesn't happen with Ubuntu, or Debian, or RHEL/Fedora/SUSE/etc.
If you use a source-based distro then unless the newer version depends on some API exposed by a newer library then it will build just fine and run against the old one.
It used to be that the preferred upsteam way of distributing packages (outside of a package manager) was as source for exactly this reason. The same tarball worked just fine on sparc/ sgi/ hpux/ linux/ freebsd/ etc.
I do see the utility of something like this tool, but I'd hate to see it used widely. Besides security there is also wasted memory - if 10 programs are linked against the same library it is only loaded in RAM once. If 10 programs are linked against 10 versions of the library, or even the same version built 10 times (and they load those different versions) then the system can't share their memory.
Yup. The problem is that the legal system has gotten way out of hand.
In theory the way it is supposed to work is that two parties with a disagreement go to court, and the court decides who is in the wrong. Maybe the person in the wrong gets punished by the court via damages of some kind depending on the nature of the dispute.
The problem is that today simply going to court is effectively punishment, and the actual damages are just outrageous quite often. Courts do not value the time of participants, and a trial takes many hours of preparation and motion practice let alone showing up in court. The result is that simply being named in a suit is finacially ruinous. Even going pro se doesn't help a great deal, as it takes countless hours that you aren't paid for to go to trial. It might also cost you your job. If you go pro se you could end up messing up and paying sanctions for the other side's legal expenses. Oh, but if the other side messes up they won't pay for your legal bills since you don't have any, and your time is considered worthless since you aren't an attorney. When it comes to scheduling the opposing counsel can point out to the court various conflicts with other litigation that they need to pursue and the court will respect this, but the court will care little for a pro se defendant's other commitments, since they aren't court-related.
They really need to switch to a system where legal costs are balanced. Courts should stipulate a budget for each side, and the court pays the expenses of all counsel. It will be illegal to pay a lawyer, and lawyers cannot parter with other services/etc as a way to get money in the back door. Lawyers will work for the court, and not for parties themselves, essentially. Then, after the trial the entire cost of the trial becomes one of the matters at issue and the loser generally pays. Oh, wealthy plaintiffs will have to put up security in advance.
With such a system neither side can out-lawyer the other as the legal budgets of both sides are fixed and equal. Poor defendants are not subject to death-by-process either.
I'd add generateKey as well - for secure key generation (without any way to distinguish which way the key got there). However, what you suggest seems fine.
I'd also arrange that by law devices come without any key and that they are generated when the consumer first uses the device. The wipekey function would need to be easily accessible by an end-user as well. Again, the purpose for this is to make this very useful for security purposes, and useless for trusted computing purposes.
Nowhere did he claim that Bruce made these suggestions. They were listed as "recommended password rules" and attributed to "security experts."
Based on my experience, he is right. Security auditors at work push for all of these sorts of things.
Bruce is a breath of fresh air in this field, but his perspective rarely becomes the one that most people have to adhere to.
The grandparent had a good point, actually. The problem is the mentality of security at any cost.
The most secure system is a system that nobody uses. That system of course has absolutely zero utility.
In the real world we have tradeoffs. When you force users to behave in a "secure" manner that is inconvenient, you cause them to engineer around your solution - perhaps resulting in a system that now is less secure than it would have been without the security measure.
Users aren't the enemies - they're just trying to get work done.
Of course there needs to be a balance, but the best security is one where the cost of the security measure in terms of usability is considered in relation to its risk. The question isn't whether a feature increases security, but rather whether it increases it relative to its cost.
Fortunately crazymonkey1, crazymonkey2, crazymonkey3, and crazymonkey4 are all unique passwords.
Oh no, I hacked an account with the password crazymonkey28, and the user changed it due to expiration. Gee, I wonder what the new one might be.
These kinds of aging mechanisms are great for box-checkers, but I don't think they do much to promote real security.
It might flood tubes or something like that, but it certainly wouldn't fire.
If at peace the best on-the-scene decision is to remain completely concealed. You don't want to give intel to the enemy on your capabilities.
Now, strategically giving away intel might be good politically, or it might be bad. Giving away that you can negate some of a nations strategic nuclear capability would probably be bad. You don't want them to develop countermeasures, you don't want to get them to build more nukes to keep an advantage, and you don't want them to get twitchier on the trigger out of fear of losing their deterrence. Strategically the US's best option is to have the ability to get rid of every opposing nuclear weapon, but make opponents feel very safe that their nuclear weapons are a potent deterrent.
I suspect the missile probably costs millions to replace, and the warhead(s) cost who knows how much - probably a lot more.
A phoenix missile or tomahawk cost $1M to replace. I think a ballistic missile with a range of 4000 miles and a CEP probably measured in yards would be more expensive.
No - there weren't millions of computers to develop on back then.
However, cobol was the only way to develop anything that mattered on any computers that mattered. I wouldn't be surprised if the NYSE is still running on cobol and cics...
Of course, it is entirely possible that the Chinese launched this, and the USN knew all about the sub being there, and that they directly observed the launch.
They of course wouldn't disclose this, because they wouldn't want to indicate that the sub was tracked, as this is a useful secret to maintain.
And, it isn't like they could have done anything to stop it. The launch was in international waters. They could have randomly torpedoed the sub while it was at sea - not a good diplomatic move. They could have seen the sub get ready to launch, and torpedoed it then, but a sub probably doesn't look like it is launching until it is virtually doing so (just going to periscope depth doesn't constitute a launch - and off the coast they won't be super-deep in any case, and subs go to periscope depth for all kinds of things anyway even in the middle of the ocean). Once they hear doors opening (if they notice) their only options are sink it or don't sink it. Until it actually fires on the US I doubt they'd do anything.
If it was tracked, then no doubt if the sub fired on the US an order would go out to sink it fairly quickly. However, that would be after a considerable delay - probably enough to fire an entire salvo. You can't really stop something like this without having a REALLY twitchy finger and if that happened we'd hear about sub sinkings all the time.
US missiles go over the north pole for targeting and range purposes due to the magnetic fields there.
No, they go over the pole because the shortest distance between two points is a straight line, but we don't put drill bits on missiles to tunnel through the earth, so we settle for a great circle, which is the projection of a straight line onto the surface of Earth. A great circle route from the US to Russia/China/etc goes over the pole. Magnetic fields have nothing to do with it.
Great circle is also your only option for a ballistic flight - any other path requires acceleration during the cruise phase. Unless you're firing at a position on the exact opposite side of the earth you don't get any choice at all - there is only one ballistic ground path between any two points on a globe unless they are opposite each other, or coincident. For opposite points you can fire any direction you want at the right velocity/angle and it ends up in the same place (neglecting rotation of the earth - in reality only some paths work). For the same point you can of course fire straight up, or fire any direction you want with high velocity and the round will land in the same place after one orbit (again, neglecting the rotation of the earth - in reality you probably couldn't ever hit the same point after circling the earth unless you shoot it high enough to allow a full day to pass during the orbit).
Uh, there are probably about 25 steps involved in launching an SLBM. Step one would be maintaining a shallow depth, which ballistic missile subs almost never do otherwise except for maybe a brief stop to get instructions. Somewhere in the series of steps probably includes opening the hatch as well.
I'm sure the launch was deliberate. Now, whether it was planned is a separate matter. Maybe some fault on a missile called for firing it to get rid of it, but that seems unlikely to me. Firing ICBMs is a VERY sensitive matter (if not coordinated with other major powers it certainly would trigger a serious alert and move towards nuclear readiness - not something ANYBODY wants to happen). So, I doubt somebody would write a submarine procedure manual that included firing ballistic missiles except under order. Besides, can you imagine the trouble involved in tracking down the warheads if the thing was armed (which you'd have to assume if it were a standard procedure).
This was almost certainly a test launch. Or, maybe it was smaller than it looked (I didn't see the video so I don't know if it really was an ICBM).
I'm not sure what the point of that is. Does anybody on the planet really doubt that the US has ICBMs? If everybody thinks you can turn any desert on the planet to glass, what is the point of test launches except perhaps to demonstrate that maybe your weapons don't work. What happens if you launch it and miss? In the absence of data everybody fears you, so why risk that by providing evidence one way or the other?
It seems more likely that they were testing some new launch system or something like that. Doing it merely as a demonstration of power seems unlikely.