Your reasoning doesn't sound convincing. What about people who pay with credit/debit cards? They don't get change back, only a receipt.
I'm pretty sure the reasoning behind this is that people round down the numbers. If the price of gas at a gas station is $1.49 and 9/10ths of a cent, when asked about the price are you more likely to say it's $1.49 or $1.50? Why? Because $1.49 is less than $1.50, and people subconsciously feel better about spending less (because the less you spend, the more you end up with). Marketers know this. They also know that it doesn't work well for small amounts ($0.99 vs $1.00), but $15.99 vs $16.01 make a difference.
Hmm... Summer on a planet 4.5 billion miles from the Sun... ... The planet's average surface temperature is thought to be about -218 C... Wow... almost as bad as Canadian summers:)
Denying all traffic while allowing only the bare minimum necessary is a good policy to implement on many levels. Here's some of the most important reasons why that are in my head right now (not necessarily in order of importance):
- increased security: not only are outsiders unable to see what you have running inside (obscurity), they simply can't get to it. What can't be reached, cannot be easily (i.e. directly) exploited
- simplifies management of rules: instead of blocking port A for irc, port B for ICQ/AIM, port C for Gnutella, port D for... this IP range for irc, that IP range for Gnutella... just block everything by default. No worries if new nodes, not yet on your list, pop up. Less time spent adding IPs. No worries that a third-party blocking mechanism might block false-positives
- increase productivity (yeah, yeah, I know). But, simple fact is, when people are at work, they should be working, not downloading the latest Britney Spears singles (and yes, I am a hipocrite when I say this, because I am reading / posting to slashdot right now)
- make sure that whatever means of blocking you use (e.g. a firewall) are configured to filter both incoming and outgoing traffic: even if a piece of spyware makes its way inside, it won't do too much harm (except maybe try to spread itself)
- in general use the least-trust principle -- it's simply the way to go, not just about spyware, but in general
All this sex.com "controversy" makes me wanna take a few extra-strength Motrins.../me mutters something and gets back to making amanda load stuff into the proper slot and receiving dumps from clients
I think he's talking about wifi interference (which would cause skips and/or drop the feed altogether). Cheap cables are less immune to radio interference, and remember that when they're connecting your speakers to your amp, or your tv to your video source, the signal is analog by then.
I would second a fanless mobo. Cheaper than a laptop (even an old one), you could build one inside an older VCR enclosure (prolly even fit a power supply in there), stick a cdrom / dvd drive in there (though I'm not sure how good a playback you'd get... then again, if my K6-2/300 can do it, I'd hope these things can, too). This gives you several bonuses:
- equipment appears to be part of the entertainment center - wireless means good enough mp3 / internet radio streaming and not being tethered to one place - tvout + some-software-whose-name-eludes-me gives you the ability to control the box via tv and remote - fanless means it's quiet - a good laptop hard drive means it's still relatively quiet (or you can go solid-state media) - built-in dvd/cdrom allows you to play dvd/vcd(/maybe even divx, but a fanless cpu might be underpowered here) - USB gives you the extra flexibility of hooking up other devices (e.g. cameras for picture shows, multimedia
solid-state cards for audio/images, wireless USB adapters)
This is the approach I'll be taking. So far, I have a USB adapter for 802.11 (have a PCI one, too, in case the USB doesn't wanna work) and an older ATI video card w/ a DVD add-on and tv-out. Unfortunately, I'v exhausted the wife-imposed computer budget for the year, so it'll be a while before I get anything else:)
I don't think that the idea of requiring that all messages are signed with a key verified by a known CA is going to fly.
Why not? We already expect websites that deal with our private, sensitive data to use SSL, and we expect that the chain of certificates begin in a place we trust -- a known CA. If we can use centrally-issued certificates to give us the peace of mind of protection of sensitive data, why wouldn't we trust those same centrally-issued certificates to shield us from spammers? Is it because we value the former more than clean inboxes? Because so far we haven't put a dollar figure on losing valueable emails due to our inboxes filling up? For some people that's no longer true -- I've heard of people who've missed out on new job opportunities due to email problems. The more email becomes an integral part of our lives like the telephone, the more we will value it.
The problem with self-signed certs is just that. Now, IIRC, PGP works by distributing a public key to others for the purpose of having those "others" encrypt / sign their correspondence to you with that key. So any spammer, willing enough to spam you, could go to the trouble of getting your public key and signing his spam for you with it. How does that protect you? With a centrally-issued certificate your options increase dramatically. Because of the nature of a cert, you can verify whether the sender has the right to use that cert -- if someone stole it, they wouldn't be able to use it unless they forget their IP as well, and the level of difficulty increases. Moreover, if you find that a cert has been compromised, you can block incoming traffic signed with it, and, if you feel like it, alert the owner of the cert of the compromise, much like I wouldn't expect you to continue to purchase something off of the 'net when your browser alerts you that the web server is using a cert it shouldn't be.
Now,if you combined PGP with this "SSL email", you'd get the best of both worlds -- you'd be able to both verify the identity of the sender *and* make sure only those who have your public key (which, if you were really secretive, could be kept semi-private) can email you.
But I still don't think that PGP keys alone would be enough. Instead of CDs for sale that are full of email addresses, they'd be full of email & PGP key combos, and bulk emailers that would incorporate both of these would pop up soon afterwards. Yes, the CPU cost would increase per mailing. Those that want to remain in the business, though, will perservere.
a proposal where e-mail could simply consist of a delivery notice being sent, whereas the actual e-mail itself would be held on the sender's server itself, until the recipient decides to get the message
I think you're referring to Dan Bernstein's project called Internet Mail 2000. Frankly, I don't see how that's any better than just sending the email. I mean, with the current state of things, you have to delete all the messages you don't want, while with Dan's implementation you'll be deleting notices from people you don't want to talk to. It's not about how much disk space they take up, it's about the annoyance factor. It's about the TCP traffic and system resource volume, which at best would equal that of sending a plain ol' email, and at worst (assuming every message would end up retrieved) would be double. So it's gonna cost me at least as much to use his system, while it might cost me more. Well, if the total cost per message is to be higher, I'd much rather have the human intervention portion of the cost minimized and let my CPU pick up the tab. I don't want to be bothered by notices saying that Nguwani Mumbasa has some important information regarding investment opportunities in Nigeria, or that Mrs. N33dl3 D1ck has 5 ways for me to increase the girth of my strategic body parts.
if you create a whole new standard, designed from scratch, to make email 'responsible' that is used in duality with smtp, until such time as it's the most common, and SMTP is taken out....
with the current'philosophies' out there, there's no way the standard could be set without appeasing too many regulatory agencies into having more control/authority than I would be comfortable with.
I can't explain this well with less than 5k words try and create a new communication standard in this paranoid USA, and it will be used as a tool for those in authority..
I know what you mean, but... who said it would have to be done in the USA?:) Regulatory agencies would have very little say in the protocol's design, because if the idea drummed up enough followers from around the world, there wouldn't be a single regulatory agency to talk about. And trying to get more than a handful of governments to agree on anything is... well... Awww, heck, let's start writing this up in Canada, Canadians have more than a handful of bones to pick with the US as of recently:) I'll be the first to volunteer...
And I don't think it would take all that much time to blueprint and engineer, either. We already know what things we hate about email as we see it today (and I don't mean just spam), we could come up with something in a matter of a few weeks, mebbie a couple of months at the most, planning-wise. Then we just need a few good coders who can follow instructions and have some spare time.
By the time the whole project were in version 1.0, a lot of people would be even more fed up with today's email and ready for an alternative. Take-up rate would most likely be fairly high, especially if the end users would be given a plug-n-play kind of product. A few more years, and SMTP would be ready to head to pastures like analog cell-phones and CB radios (yes, I know both are still in use today, in respectable numbers; I also know that with the advent of FSR radios, digital cell phones those numbers are declining quickly).
I dunno... I'd be optimistic about something like that, and even willing to donate some resources to the cause.
The problem, as I see it, isn't the protocol per se, but the fact that we trust in every step on the path from the sender to receiver.
I agree with the fact that too much trust is the primary reason why email is plagued with problems. The Verisign way you describe sounds like what I'm talking about, although I don't know about the specific implementation details (could you provide me with a link or two where I could read up more?)
However, I do not agree with the very last sentence. While for you the cost of maintaining your email systems might be practically nothing, it's different for people like me, who have millions of emails (a lot of them spam) flowing through their networks. If you add up the cost of maintaining hardware, providing network bandwidth, and all the man-hours spent (essentially wasted) on trying to combat spam, the cost is nowhere near nothing. I'm pretty sure that the total cost of that plus "making what we have" work (excuse my paraphrase) would be much higher (in my case) than development of a parallel, more secure architecture, which not only would not incur the email tax (after all, it would be a different, incompatible protocol that just happens to be duplicating SMTP), but one that would quickly pay for itself once resold to customers, current and future. So (in my case) the new and better way would most likely be cheaper, easier and more lucrative to follow than stitching holes and maintaining a thousand and one patches to SMTP.
Don't you ever get so tired of the old and broken things that you just start anew?li
I've played Tetris off-and-on for about 6 months with my sister, taking turns at our beloved 386sx16. While I haven't had nightmares afterwards, the experience paid back several times over, in a good way -- never again have I had a problem packing a U-haul truck.
IMHO, a better idea, compared to imposing taxes on email, would be to create a new infrastructure for exchanging of "email", where things like forged headers, open relays and spammers would be a thing of the past. What I'm thinking of is essentially a new TCP port, a new service, a new daemon, designed from scratch, one that takes all the concerns of today, does some forecasting for the future, and makes us forget about spam for a few years. Something that uses certificates from a few select (trusted) authorities to verify connecting server's identity (kinda like caller-ID, you only answer the calls you want to allow) -- SSL is an accepted way for us to verify the identity of the website we're trying to connect to, why couldn't it be a way to verify the identity of the server trying to connect to us? And throw in some encryption into the mix so that the traffic can't be \easily\ snooped. Rogue servers would quickly get their act together if they started to have mail queue up because their certs were expired / bad etc.
I think that trying to get an old medium to conform to today's demands might be more expensive (taxes or no taxes) than to simply coming up with a new one. A well-designed (and I don't claim to have one) solution would take less time to implement and I think would be easier to manage.
I understand that SSL, encryption and such would not be music to Dept. of Homeland Security's ears, that they would much rather leave the burden and cost on us, but there would be some upsides from their vantage point, too -- there would be less traffic for them to sift through (though it would be more intensive to process it), and I'm sure they'd get their back-door tentacles into the architecture somehow.
I won't even get into arguments like "how do you tax someone who's out of your jurisdiction", or "how do you get thousands of sysadmins try to add SSL to sendmail/qmail/pick-your-MTA without breaking backward-compatibility" etc. Just like gopher and ftp have/are becoming things of the past, I think SMTP should too.
Disclaimer: I'm not familiar with any military developments in the areas of maglev or hovercraft. I am an engineer, albeit a computer one.
Don't use a fan for propulsion: drag the thing behind drive wheels.
This would defeat one of the ideas of maglev, which was to do away with wheels, tracks, suspension mechanisms etc.
2) reaching speeds of this magnitude (while factoring in the aerodynamics) would require a lot of energy
A lot less than lifting the thing on electromagnets, I'll bet. [...]
OK, I don't have any numbers handy, nor time to research this at the moment... so I won't argue this one here:)
[...] Especially when you can fill the cushion by scooping in air from outside.
a) I think that would create too much turbulence to be worth it b) if you're thinking what I'm thinking, think about all those Nascar race cars which become airborne the moment they scoop up too much air. And that's at below 200mph. Naturally, a T-shaped track and a '[-]'-shaped train undercarriage* would overcome this problem.
It seems like it would be extremely straightforward to me, compared to trying to synch the magnets in the track for a maglev.
The designs I'm thinking of use two sets of magnets: one for propulsion, one for levitation. There would be no sync necessary, as the levitation magnets emit a constant field. Depending on design, we're talking about distances of 10-30 centimeters (4-12 inches) between the track magnets and the train magnets. That's not a whole lot of tolerance there. I don't know whether such precision can be achieved with a hover mechanism.
This is a solved problem: use a third rail. Your drive wheels will have to be in touch with the surface anyway.
Once again, see my first comment in this post.
Someone posted a link to a French design effort [...]
Schade, ich spreche kein Franzoesisch...:)
* the undercarriage would actually look like [ and ] with a bar joining the top ends. Here's some ascii-art of my own. The ### represent magnets in the train's undercarriage, and the %%% represent magnets in the track. The top magnets of the track and the train are usually set to the same polarity, while the bottom ones can be set to opposite polarity (i.e. bottom track magnets would be S and bottom train magnets would be N) to help with lift. Additionally, sensors measuring the distance between the track and the train would alter the strength (and potentially the polarity) of the magnets.
Check out http://24.150.166.93/maglev.txt for some quick ascii-art, since the lameness filter prevents me from posting that here.
If your goal is just to reduce friction, why not simply float the train on an air cushion, like a hovercraft?
Have you ever seen a hovercraft do 300mph?
There are a few things to consider: 1) hovercrafts' design requirements make them very un-aerodynamic 2) reaching speeds of this magnitude (while factoring in the aerodynamics) would require a lot of energy 3) the air cushion is a very imprecise and unstable way of keeping a (moving) vehicle a certain distance from the ground 4) magnetic levitation is quieter (and thus more comfortable for the passengers) 5) the constant magnetic field of the levitation part is the source of on-board electricity (a conductor moving perpendicular(ly?) to the magnetic field has electricity induced in it), which would be hard to compensate for in a hovercraft considering extra weight required
I could prolly think of a few more, but my brain hasn't recovered from the weekend yet.
The same service contract includes prohibitions on running "servers" or electronic publications. Prohibiting electronic publications on a monopoly service ammounts to denial of first amendment rights to free speach [sic].
This, I agree with, and it needs to be pursued. If I'm not exceeding the bandwidth you sold me, then you should have no say over what I do with it.
Well, yes and no. I mean, on one hand your argument is reasonable, but on the other hand you've (presumably) read the contract before signing it, and thus have been aware of the restrictions being imposed on you ahead of time. I don't suppose anyone forced you to sign the contract at gunpoint. So, if you signed it, then don't complain about its terms.
On the other hand, what's a poor soul to do when the Big Cable Company is the only one providing high speed internet service in one's neighborhood? If there's a DSL service provider in the area, see if their terms would give you more bang for teh buck, weigh that against their uptime, installation costs / time / delays, and see if it's worth the hassle. Maybe get DSL installed and working first, then cancel cable. Most DSL providers don't have such draconian rules.
Me, I'm somewhat upset, sure. My cable provider (Cogeco) blocks traffic to ports 25 and 445 on my end, so I can neither host email nor secure web sites ("Hello, McFly, anybody home??" -- shouldn't they be blocking port 80 instead? But, let's not give them ideas here). Why am I still with them? Well, were it solely up to me, I wouldn't be. But, as it stands, signing up for cable internet "magically" enables some level of cable for free, which my wife likes and which we wouldn't have with DSL. Now, am I a thief for hooking up a TV set to a cable splitter and enjoying the "entertainment" which I haven't asked for and didn't want on my cable cable but which has been provided to me anyway? If I am, then we've got a whole 'nother boat of problems here.
From the FAQ: Q : How much weight can it carry? A : Currently with 40 horse power the max. pilot weight is about 190 lbs.
Larger engines are in the works.
"Honey, get off the treadmill, I have 50lbs to lose!" Oh, wait, been there, done that, got a (X-large) T-shirt... Aw, hell, I'll just wait for the bigger engine.
Maybe I could use that GM 3.8L engine from the car... 200hp should do the trick.
Rear Adm. John Poindexter is going to spend a buttload of money to build a supercomputer when a phone call would do - yep, I dig porn. [...] You want a back door to my computer? Just to save you the effort it's full of porn.
In light of your internet activities, I must say, the choice of words here is quite fitting:)
Sometimes public image can go a long way for a company. Sometimes public image / publicity / PR stunts are the only thing companies are after. If they do it frequently enough and/or for important enough issues, and if that wins them a handful more customers who will now think that they're the good guys and will buy their software, that's all that matters.
A simple (not quite fitting) analogy: I was researching tire prices for my car recently, and have stopped by a handful of retailers asking for availability and price of a certain tire. I can tell you that those retailers who went a bit out of their way to help me track it (it's no longer in production, from what I've been told, but some warehouses still stock my size) are more likely to get my business than those who simply told me that they don't have it anymore. Same story with audio equipment -- if I walk into a store and right off the bat I tell the salesperson that I'm not looking to buy anything today and that I'm just there to do research, and if that salesperson still spends some time with me answering my questions (even if other, potentially paying customers are around waiting to be served), that business is more likely to get my money.
Now, with Symantec, I don't use Windows much, let alone IE, but I do use their other products on another platform. If I see that they're working hard to help Windows users, and if my own experience with them has been positive, I'm more likely to buy upgrades or other products from them. Precisely because their public relations (i.e. relations with me) are positive.
If you were confronted by someone who had just lost a bunch of important data because of this exploit, do you really think they'd be impressed if you said "But I was trying to make a very important point to Microsoft!".
Probably not. Neither would you be, once you'd get an answer to "Where was your backup?"
I'm sorry, but things like backups cannot be stressed enough. People should learn that the cost of backup is far smaller than the cost of having to recreate a bazillion documents from scratch. Better they learn now than later. I'm sorry, but I have very little sympathy for people who refuse to make backups.
"Symantec's actions give the impression that they are encouraging people to create and release malicious code. Given that Symantec also sells security and antivirus software, I think there is a terrible conflict of interest here."
I have to admit I wonder about this myself from time to time.
On one hand, I agree. This can be viewed as attempt by Symantec to increase market share / profits by exploiting someone else's mistakes, and can certainly be viewed as inapropriate, a conflict of interest etc.
On the other hand, though... we have a software company with a not-so-stellar track record regarding security in their browsers and/or email clients, not to mention other avenues like operating systems. Moreover, a company that apparently refuses to learn from their mistakes, frequently brushes vulnerability reports aside as "unimportant", "insignificant", and essentially creates a market for companies like Symantec.
Business practices / exploit-with-no-patch-disclosing aside, what's wrong with Symantec developing security / antivirus software while exploring the operating system their software was made for and finding / reporting bugs?
If there was a certain home builder who notoriously installed windows (pun not intended) that could easily be opened from outside by anyone (e.g. a thief), and if I came up with a way to secure such windows (like, custom made-to-fit window bars that go perfectly with your house), why wouldn't you want me to 1) manufacture and advertise my security device, and 2) advertise the fact that the builder refuses to fix / replace the windows with a better model? Would you prefer that your home were insecure and you not know about it? Or would you rather know that there's an easy way into your home that anyone can access with a $5 tool? Wouldn't you rather be protected?
As I said, aside from the way that Symantec approached this particular problem, I don't necessarily think there's a whole lot of a conflict of interest here.
A few years ago I built a new machine. Installed Win98SE on it. The machine crashed constantly. I mean CONSTANTLY. I could boot it up, go to the bathroom, 2 minutes later find it frozen ON THE LOGIN SCREEN. I could open a document in Word, and it would freeze. This was true on a machine with the bare minimum install too, and this same machine was running Linux, NT, and Windows 95 without the same problems, so I don't think you could chalk it up to the hardware. So whose fault was that ?
Have you installed all the latest manufacturer-approved drivers for your hardware? Not only would you have gotten more functionality out of your hardware (since Windows drivers usually provide basic functionality and nothing more), but you probably would have made your system more stable. ATI Rage 128 cards come to mind here...
While I have no comments on either CIBC or TD, my wife could certainly tell you a few hair-raising stories about both. The amount of bad press both of these banks have received in the past year makes me question their business practices. Even if their website were immaculate, I will not trust my money to banks that mismanage funds in accounts, close accounts with no warning, do not monitor accounts for unusual activity or do not punish drives of armored cars who leave bags of money at ATM locations.
If you'd like to learn more, read the archives of Global News (canada.com), The Hamilton Spectator or The Toronto Star.
First Niagara Bank (formerly known as Lockport Savings) is a regional bank in Western New York, although their recent acquisitions and mergers have given them presence in Pennsylvania as well (AFAIK). Their web-based banking system is simple yet powerful, is browser-neutral and does not require Java (for those of us using Unix/Linux and being too lazy to get their JavaVM plugins working). Their online service is free for most types of accounts, but you will have to pay a monthly fee for any month in which you perform online transactions (such as bill payments, money transfers etc.). I find their web service to be a great tool to check up on your account status.
Household / Online Bank's web site used to be browser neutral as well. Then a few months ago they started using "scripts" (as a phone rep told me) which were only IE compatible, and left me out in the cold. I've complained a few times to them, hinting at leaving them (even tho I had no desire to do do). Something changed (maybe a few more people complained) and their website can be viewed with Galeon once again, though some weird artifacts do show up on certain pages. Once again, the website gives me all the information I need about my account and is easy to navigate.
So much for the online experience. Now, the in-person experience.
I've been with First Niagara for a few years now, and I have nothing but praise for them. The clerks are always nice and helpful, staff is friendly and knowledgeable (and when they're not, they admit it and get you an answer at a later time, having consulted with those who know). No hidden fees, full-disclosure, no-hassle banking that's worked like a charm.
My GM Card has been great too. Both their phone support as well as email support are great, and while the experience is less personal, they still get the job done and done well. They are professional, and email responses are rather prompt (usually responses arrive within 24 hours, though I don't recall them actually promising any specific turn-around time anywhere). They stick to what they say, and expect you to do the same -- pretty reasonable, if you ask me.
On the other hand, my vehicle is a 1986 GMC Safari van with bad paint, several dents, and 205,000 miles, so maybe not worth that much effort. Though I'd still be pissed if someone took it.
Wanna know something? Depending on where you live, your van might get stolen anyway -- not for parts, not for a joy ride, but for a drug dealer's use. Drug dealers usually don't meddle in the business of stealing cars, so they hire "professionals" to do their job for them -- meaning they have to pay for the vehicle and the effort. Since a vehicle will be taken away by police if it was used in the process of selling drugs, drug dealers 1) don't want to lose too much money; 2) want a non-descript, inconspicuous vehicle to begin with anyway, so they ask for older, less expensive vehicles.
Depending on where you live, your van may not be as safe as you'd like it to be:)
I've lived just outside of West Philly for several years. I know.
So what is the solution in your case? Keep only one or two most recent versions around? Not have backups altogether?
I agree, some formats will be more cumbersome to implement this for, but most people keep backups around (granted, backups are a beast of a different kind -- most are done on separate media to avoid hardware problems etc.). Maybe the space that normally would've been taken up by backups could be (partially) dedicated for revision control. Or, you could specify in a control panel that you only want 2 most recent versions of a.gif or.tiff kept around, or up to 500MBs worth of.psd's.
All I'm saying is, while transparent revision control may not be feasible for every file type, it would be for most. Since it would be made configurable (maybe in the way I just described), some files could be exempted. But for most people and most filetypes this would be a good thing, and would alleviate the (quite valid) problem that the author of the article pointed out.
Slashdot Mirror
Your reasoning doesn't sound convincing. What about people who pay with credit/debit cards? They don't get change back, only a receipt.
:)
I'm pretty sure the reasoning behind this is that people round down the numbers. If the price of gas at a gas station is $1.49 and 9/10ths of a cent, when asked about the price are you more likely to say it's $1.49 or $1.50? Why? Because $1.49 is less than $1.50, and people subconsciously feel better about spending less (because the less you spend, the more you end up with). Marketers know this. They also know that it doesn't work well for small amounts ($0.99 vs $1.00), but $15.99 vs $16.01 make a difference.
Just my $0.02
Hmm... Summer on a planet 4.5 billion miles from the Sun... ... The planet's average surface temperature is thought to be about -218 C ... Wow... almost as bad as Canadian summers :)
Don't mean to sound like an Internet Nazi, but...
:)
Denying all traffic while allowing only the bare minimum necessary is a good policy to implement on many levels. Here's some of the most important reasons why that are in my head right now (not necessarily in order of importance):
- increased security: not only are outsiders unable to see what you have running inside (obscurity), they simply can't get to it. What can't be reached, cannot be easily (i.e. directly) exploited
- simplifies management of rules: instead of blocking port A for irc, port B for ICQ/AIM, port C for Gnutella, port D for... this IP range for irc, that IP range for Gnutella... just block everything by default. No worries if new nodes, not yet on your list, pop up. Less time spent adding IPs. No worries that a third-party blocking mechanism might block false-positives
- increase productivity (yeah, yeah, I know). But, simple fact is, when people are at work, they should be working, not downloading the latest Britney Spears singles (and yes, I am a hipocrite when I say this, because I am reading / posting to slashdot right now)
- make sure that whatever means of blocking you use (e.g. a firewall) are configured to filter both incoming and outgoing traffic: even if a piece of spyware makes its way inside, it won't do too much harm (except maybe try to spread itself)
- in general use the least-trust principle -- it's simply the way to go, not just about spyware, but in general
Yes, I am biased. I'm an admin
... seen the commercials?
/me mutters something and gets back to making amanda load stuff into the proper slot and receiving dumps from clients
:) ]
All this sex.com "controversy" makes me wanna take a few extra-strength Motrins...
[ you know... amanda
What interference?
I think he's talking about wifi interference (which would cause skips and/or drop the feed altogether). Cheap cables are less immune to radio interference, and remember that when they're connecting your speakers to your amp, or your tv to your video source, the signal is analog by then.
I would second a fanless mobo. Cheaper than a laptop (even an old one), you could build one inside an older VCR enclosure (prolly even fit a power supply in there), stick a cdrom / dvd drive in there (though I'm not sure how good a playback you'd get... then again, if my K6-2/300 can do it, I'd hope these things can, too). This gives you several bonuses:
:)
- equipment appears to be part of the entertainment center
- wireless means good enough mp3 / internet radio streaming and not being tethered to one place
- tvout + some-software-whose-name-eludes-me gives you the ability to control the box via tv and remote
- fanless means it's quiet
- a good laptop hard drive means it's still relatively quiet (or you can go solid-state media)
- built-in dvd/cdrom allows you to play dvd/vcd(/maybe even divx, but a fanless cpu might be underpowered here)
- USB gives you the extra flexibility of hooking up other devices (e.g. cameras for picture shows, multimedia
solid-state cards for audio/images, wireless USB adapters)
This is the approach I'll be taking. So far, I have a USB adapter for 802.11 (have a PCI one, too, in case the USB doesn't wanna work) and an older ATI video card w/ a DVD add-on and tv-out. Unfortunately, I'v exhausted the wife-imposed computer budget for the year, so it'll be a while before I get anything else
Why not? We already expect websites that deal with our private, sensitive data to use SSL, and we expect that the chain of certificates begin in a place we trust -- a known CA. If we can use centrally-issued certificates to give us the peace of mind of protection of sensitive data, why wouldn't we trust those same centrally-issued certificates to shield us from spammers? Is it because we value the former more than clean inboxes? Because so far we haven't put a dollar figure on losing valueable emails due to our inboxes filling up? For some people that's no longer true -- I've heard of people who've missed out on new job opportunities due to email problems. The more email becomes an integral part of our lives like the telephone, the more we will value it.
The problem with self-signed certs is just that. Now, IIRC, PGP works by distributing a public key to others for the purpose of having those "others" encrypt / sign their correspondence to you with that key. So any spammer, willing enough to spam you, could go to the trouble of getting your public key and signing his spam for you with it. How does that protect you? With a centrally-issued certificate your options increase dramatically. Because of the nature of a cert, you can verify whether the sender has the right to use that cert -- if someone stole it, they wouldn't be able to use it unless they forget their IP as well, and the level of difficulty increases. Moreover, if you find that a cert has been compromised, you can block incoming traffic signed with it, and, if you feel like it, alert the owner of the cert of the compromise, much like I wouldn't expect you to continue to purchase something off of the 'net when your browser alerts you that the web server is using a cert it shouldn't be.
Now,if you combined PGP with this "SSL email", you'd get the best of both worlds -- you'd be able to both verify the identity of the sender *and* make sure only those who have your public key (which, if you were really secretive, could be kept semi-private) can email you.
But I still don't think that PGP keys alone would be enough. Instead of CDs for sale that are full of email addresses, they'd be full of email & PGP key combos, and bulk emailers that would incorporate both of these would pop up soon afterwards. Yes, the CPU cost would increase per mailing. Those that want to remain in the business, though, will perservere.
a proposal where e-mail could simply consist of a delivery notice being sent, whereas the actual e-mail itself would be held on the sender's server itself, until the recipient decides to get the message
I think you're referring to Dan Bernstein's project called Internet Mail 2000. Frankly, I don't see how that's any better than just sending the email. I mean, with the current state of things, you have to delete all the messages you don't want, while with Dan's implementation you'll be deleting notices from people you don't want to talk to. It's not about how much disk space they take up, it's about the annoyance factor. It's about the TCP traffic and system resource volume, which at best would equal that of sending a plain ol' email, and at worst (assuming every message would end up retrieved) would be double. So it's gonna cost me at least as much to use his system, while it might cost me more. Well, if the total cost per message is to be higher, I'd much rather have the human intervention portion of the cost minimized and let my CPU pick up the tab. I don't want to be bothered by notices saying that Nguwani Mumbasa has some important information regarding investment opportunities in Nigeria, or that Mrs. N33dl3 D1ck has 5 ways for me to increase the girth of my strategic body parts.
with the current'philosophies' out there, there's no way the standard could be set without appeasing too many regulatory agencies into having more control/authority than I would be comfortable with.
I can't explain this well with less than 5k words
try and create a new communication standard in this paranoid USA, and it will be used as a tool for those in authority..
I know what you mean, but... who said it would have to be done in the USA?
And I don't think it would take all that much time to blueprint and engineer, either. We already know what things we hate about email as we see it today (and I don't mean just spam), we could come up with something in a matter of a few weeks, mebbie a couple of months at the most, planning-wise. Then we just need a few good coders who can follow instructions and have some spare time.
By the time the whole project were in version 1.0, a lot of people would be even more fed up with today's email and ready for an alternative. Take-up rate would most likely be fairly high, especially if the end users would be given a plug-n-play kind of product. A few more years, and SMTP would be ready to head to pastures like analog cell-phones and CB radios (yes, I know both are still in use today, in respectable numbers; I also know that with the advent of FSR radios, digital cell phones those numbers are declining quickly).
I dunno... I'd be optimistic about something like that, and even willing to donate some resources to the cause.
I agree with the fact that too much trust is the primary reason why email is plagued with problems. The Verisign way you describe sounds like what I'm talking about, although I don't know about the specific implementation details (could you provide me with a link or two where I could read up more?)
However, I do not agree with the very last sentence. While for you the cost of maintaining your email systems might be practically nothing, it's different for people like me, who have millions of emails (a lot of them spam) flowing through their networks. If you add up the cost of maintaining hardware, providing network bandwidth, and all the man-hours spent (essentially wasted) on trying to combat spam, the cost is nowhere near nothing. I'm pretty sure that the total cost of that plus "making what we have" work (excuse my paraphrase) would be much higher (in my case) than development of a parallel, more secure architecture, which not only would not incur the email tax (after all, it would be a different, incompatible protocol that just happens to be duplicating SMTP), but one that would quickly pay for itself once resold to customers, current and future. So (in my case) the new and better way would most likely be cheaper, easier and more lucrative to follow than stitching holes and maintaining a thousand and one patches to SMTP.
Don't you ever get so tired of the old and broken things that you just start anew?li
I've played Tetris off-and-on for about 6 months with my sister, taking turns at our beloved 386sx16. While I haven't had nightmares afterwards, the experience paid back several times over, in a good way -- never again have I had a problem packing a U-haul truck.
:)
Oh, and Wolf3d / doom / quake rule
IMHO, a better idea, compared to imposing taxes on email, would be to create a new infrastructure for exchanging of "email", where things like forged headers, open relays and spammers would be a thing of the past. What I'm thinking of is essentially a new TCP port, a new service, a new daemon, designed from scratch, one that takes all the concerns of today, does some forecasting for the future, and makes us forget about spam for a few years. Something that uses certificates from a few select (trusted) authorities to verify connecting server's identity (kinda like caller-ID, you only answer the calls you want to allow) -- SSL is an accepted way for us to verify the identity of the website we're trying to connect to, why couldn't it be a way to verify the identity of the server trying to connect to us? And throw in some encryption into the mix so that the traffic can't be \easily\ snooped. Rogue servers would quickly get their act together if they started to have mail queue up because their certs were expired / bad etc.
I think that trying to get an old medium to conform to today's demands might be more expensive (taxes or no taxes) than to simply coming up with a new one. A well-designed (and I don't claim to have one) solution would take less time to implement and I think would be easier to manage.
I understand that SSL, encryption and such would not be music to Dept. of Homeland Security's ears, that they would much rather leave the burden and cost on us, but there would be some upsides from their vantage point, too -- there would be less traffic for them to sift through (though it would be more intensive to process it), and I'm sure they'd get their back-door tentacles into the architecture somehow.
I won't even get into arguments like "how do you tax someone who's out of your jurisdiction", or "how do you get thousands of sysadmins try to add SSL to sendmail/qmail/pick-your-MTA without breaking backward-compatibility" etc. Just like gopher and ftp have/are becoming things of the past, I think SMTP should too.
Don't use a fan for propulsion: drag the thing behind drive wheels.
This would defeat one of the ideas of maglev, which was to do away with wheels, tracks, suspension mechanisms etc.
A lot less than lifting the thing on electromagnets, I'll bet. [...]
OK, I don't have any numbers handy, nor time to research this at the moment... so I won't argue this one here
[...] Especially when you can fill the cushion by scooping in air from outside.
a) I think that would create too much turbulence to be worth it
b) if you're thinking what I'm thinking, think about all those Nascar race cars which become airborne the moment they scoop up too much air. And that's at below 200mph. Naturally, a T-shaped track and a '[-]'-shaped train undercarriage* would overcome this problem.
It seems like it would be extremely straightforward to me, compared to trying to synch the magnets in the track for a maglev.
The designs I'm thinking of use two sets of magnets: one for propulsion, one for levitation. There would be no sync necessary, as the levitation magnets emit a constant field. Depending on design, we're talking about distances of 10-30 centimeters (4-12 inches) between the track magnets and the train magnets. That's not a whole lot of tolerance there. I don't know whether such precision can be achieved with a hover mechanism.
This is a solved problem: use a third rail. Your drive wheels will have to be in touch with the surface anyway.
Once again, see my first comment in this post.
Someone posted a link to a French design effort [...]
Schade, ich spreche kein Franzoesisch...
* the undercarriage would actually look like [ and ] with a bar joining the top ends.
Here's some ascii-art of my own. The ### represent magnets in the train's undercarriage,
and the %%% represent magnets in the track. The top magnets of the track and the train are
usually set to the same polarity, while the bottom ones can be set to opposite polarity
(i.e. bottom track magnets would be S and bottom train magnets would be N) to help with lift.
Additionally, sensors measuring the distance between the track and the train would alter the
strength (and potentially the polarity) of the magnets.
Check out http://24.150.166.93/maglev.txt for some quick ascii-art, since the lameness filter prevents me from posting that here.
Have you ever seen a hovercraft do 300mph?
There are a few things to consider:
1) hovercrafts' design requirements make them very un-aerodynamic
2) reaching speeds of this magnitude (while factoring in the aerodynamics) would require a lot of energy
3) the air cushion is a very imprecise and unstable way of keeping a (moving) vehicle a certain distance from the ground
4) magnetic levitation is quieter (and thus more comfortable for the passengers)
5) the constant magnetic field of the levitation part is the source of on-board electricity (a conductor moving perpendicular(ly?) to the magnetic field has electricity induced in it), which would be hard to compensate for in a hovercraft considering extra weight required
I could prolly think of a few more, but my brain hasn't recovered from the weekend yet.
This, I agree with, and it needs to be pursued. If I'm not exceeding the bandwidth you sold me, then you should have no say over what I do with it.
Well, yes and no. I mean, on one hand your argument is reasonable, but on the other hand you've (presumably) read the contract before signing it, and thus have been aware of the restrictions being imposed on you ahead of time. I don't suppose anyone forced you to sign the contract at gunpoint. So, if you signed it, then don't complain about its terms.
On the other hand, what's a poor soul to do when the Big Cable Company is the only one providing high speed internet service in one's neighborhood? If there's a DSL service provider in the area, see if their terms would give you more bang for teh buck, weigh that against their uptime, installation costs / time / delays, and see if it's worth the hassle. Maybe get DSL installed and working first, then cancel cable. Most DSL providers don't have such draconian rules.
Me, I'm somewhat upset, sure. My cable provider (Cogeco) blocks traffic to ports 25 and 445 on my end, so I can neither host email nor secure web sites ("Hello, McFly, anybody home??" -- shouldn't they be blocking port 80 instead? But, let's not give them ideas here). Why am I still with them? Well, were it solely up to me, I wouldn't be. But, as it stands, signing up for cable internet "magically" enables some level of cable for free, which my wife likes and which we wouldn't have with DSL. Now, am I a thief for hooking up a TV set to a cable splitter and enjoying the "entertainment" which I haven't asked for and didn't want on my cable cable but which has been provided to me anyway? If I am, then we've got a whole 'nother boat of problems here.
From the FAQ:
Q : How much weight can it carry?
A : Currently with 40 horse power the max. pilot weight is about 190 lbs.
Larger engines are in the works.
"Honey, get off the treadmill, I have 50lbs to lose!"
Oh, wait, been there, done that, got a (X-large) T-shirt...
Aw, hell, I'll just wait for the bigger engine.
Maybe I could use that GM 3.8L engine from the car... 200hp should do the trick.
[...]
You want a back door to my computer? Just to save you the effort it's full of porn.
In light of your internet activities, I must say, the choice of words here is quite fitting
Sometimes public image can go a long way for a company. Sometimes public image / publicity / PR stunts are the only thing companies are after. If they do it frequently enough and/or for important enough issues, and if that wins them a handful more customers who will now think that they're the good guys and will buy their software, that's all that matters.
A simple (not quite fitting) analogy: I was researching tire prices for my car recently, and have stopped by a handful of retailers asking for availability and price of a certain tire. I can tell you that those retailers who went a bit out of their way to help me track it (it's no longer in production, from what I've been told, but some warehouses still stock my size) are more likely to get my business than those who simply told me that they don't have it anymore. Same story with audio equipment -- if I walk into a store and right off the bat I tell the salesperson that I'm not looking to buy anything today and that I'm just there to do research, and if that salesperson still spends some time with me answering my questions (even if other, potentially paying customers are around waiting to be served), that business is more likely to get my money.
Now, with Symantec, I don't use Windows much, let alone IE, but I do use their other products on another platform. If I see that they're working hard to help Windows users, and if my own experience with them has been positive, I'm more likely to buy upgrades or other products from them. Precisely because their public relations (i.e. relations with me) are positive.
If you were confronted by someone who had just lost a bunch of important data because of this exploit, do you really think they'd be impressed if you said "But I was trying to make a very important point to Microsoft!".
Probably not. Neither would you be, once you'd get an answer to "Where was your backup?"
I'm sorry, but things like backups cannot be stressed enough. People should learn that the cost of backup is far smaller than the cost of having to recreate a bazillion documents from scratch. Better they learn now than later. I'm sorry, but I have very little sympathy for people who refuse to make backups.
"Symantec's actions give the impression that they are encouraging people to create and release malicious code. Given that Symantec also sells security and antivirus software, I think there is a terrible conflict of interest here."
I have to admit I wonder about this myself from time to time.
On one hand, I agree. This can be viewed as attempt by Symantec to increase market share / profits by exploiting someone else's mistakes, and can certainly be viewed as inapropriate, a conflict of interest etc.
On the other hand, though... we have a software company with a not-so-stellar track record regarding security in their browsers and/or email clients, not to mention other avenues like operating systems. Moreover, a company that apparently refuses to learn from their mistakes, frequently brushes vulnerability reports aside as "unimportant", "insignificant", and essentially creates a market for companies like Symantec.
Business practices / exploit-with-no-patch-disclosing aside, what's wrong with Symantec developing security / antivirus software while exploring the operating system their software was made for and finding / reporting bugs?
If there was a certain home builder who notoriously installed windows (pun not intended) that could easily be opened from outside by anyone (e.g. a thief), and if I came up with a way to secure such windows (like, custom made-to-fit window bars that go perfectly with your house), why wouldn't you want me to 1) manufacture and advertise my security device, and 2) advertise the fact that the builder refuses to fix / replace the windows with a better model? Would you prefer that your home were insecure and you not know about it? Or would you rather know that there's an easy way into your home that anyone can access with a $5 tool? Wouldn't you rather be protected?
As I said, aside from the way that Symantec approached this particular problem, I don't necessarily think there's a whole lot of a conflict of interest here.
A few years ago I built a new machine. Installed Win98SE on it. The machine crashed constantly. I mean CONSTANTLY. I could boot it up, go to the bathroom, 2 minutes later find it frozen ON THE LOGIN SCREEN. I could open a document in Word, and it would freeze. This was true on a machine with the bare minimum install too, and this same machine was running Linux, NT, and Windows 95 without the same problems, so I don't think you could chalk it up to the hardware. So whose fault was that ?
Have you installed all the latest manufacturer-approved drivers for your hardware? Not only would you have gotten more functionality out of your hardware (since Windows drivers usually provide basic functionality and nothing more), but you probably would have made your system more stable. ATI Rage 128 cards come to mind here...
While I have no comments on either CIBC or TD, my wife could certainly tell you a few hair-raising stories about both. The amount of bad press both of these banks have received in the past year makes me question their business practices. Even if their website were immaculate, I will not trust my money to banks that mismanage funds in accounts, close accounts with no warning, do not monitor accounts for unusual activity or do not punish drives of armored cars who leave bags of money at ATM locations.
If you'd like to learn more, read the archives of Global News (canada.com), The Hamilton Spectator or The Toronto Star.
First Niagara Bank (formerly known as Lockport Savings) is a regional bank in Western New York, although their recent acquisitions and mergers have given them presence in Pennsylvania as well (AFAIK). Their web-based banking system is simple yet powerful, is browser-neutral and does not require Java (for those of us using Unix/Linux and being too lazy to get their JavaVM plugins working). Their online service is free for most types of accounts, but you will have to pay a monthly fee for any month in which you perform online transactions (such as bill payments, money transfers etc.). I find their web service to be a great tool to check up on your account status.
Household / Online Bank's web site used to be browser neutral as well. Then a few months ago they started using "scripts" (as a phone rep told me) which were only IE compatible, and left me out in the cold. I've complained a few times to them, hinting at leaving them (even tho I had no desire to do do). Something changed (maybe a few more people complained) and their website can be viewed with Galeon once again, though some weird artifacts do show up on certain pages. Once again, the website gives me all the information I need about my account and is easy to navigate.
So much for the online experience. Now, the in-person experience.
I've been with First Niagara for a few years now, and I have nothing but praise for them. The clerks are always nice and helpful, staff is friendly and knowledgeable (and when they're not, they admit it and get you an answer at a later time, having consulted with those who know). No hidden fees, full-disclosure, no-hassle banking that's worked like a charm.
My GM Card has been great too. Both their phone support as well as email support are great, and while the experience is less personal, they still get the job done and done well. They are professional, and email responses are rather prompt (usually responses arrive within 24 hours, though I don't recall them actually promising any specific turn-around time anywhere). They stick to what they say, and expect you to do the same -- pretty reasonable, if you ask me.
For more info, check out First Niagara's website and GM Card's home on the web.
On the other hand, my vehicle is a 1986 GMC Safari van with bad paint, several dents, and 205,000 miles, so maybe not worth that much effort. Though I'd still be pissed if someone took it.
:)
Wanna know something? Depending on where you live, your van might get stolen anyway -- not for parts, not for a joy ride, but for a drug dealer's use. Drug dealers usually don't meddle in the business of stealing cars, so they hire "professionals" to do their job for them -- meaning they have to pay for the vehicle and the effort. Since a vehicle will be taken away by police if it was used in the process of selling drugs, drug dealers 1) don't want to lose too much money; 2) want a non-descript, inconspicuous vehicle to begin with anyway, so they ask for older, less expensive vehicles.
Depending on where you live, your van may not be as safe as you'd like it to be
I've lived just outside of West Philly for several years. I know.
So what is the solution in your case? Keep only one or two most recent versions around? Not have backups altogether?
.gif or .tiff kept around, or up to 500MBs worth of .psd's.
I agree, some formats will be more cumbersome to implement this for, but most people keep backups around (granted, backups are a beast of a different kind -- most are done on separate media to avoid hardware problems etc.). Maybe the space that normally would've been taken up by backups could be (partially) dedicated for revision control. Or, you could specify in a control panel that you only want 2 most recent versions of a
All I'm saying is, while transparent revision control may not be feasible for every file type, it would be for most. Since it would be made configurable (maybe in the way I just described), some files could be exempted. But for most people and most filetypes this would be a good thing, and would alleviate the (quite valid) problem that the author of the article pointed out.