I say, let the punishment fit the crime. Convicted spammers should be locked in a cell where a computer voice reads aloud every single message they sent, in full, once for each person they sent it to. And it should be paused any time they fall asleep, and resume from the beginning of the current message when they awaken. And they should not be let out of the cell for any reason until they listen to every single one.
And they should have Spam for supper every night, the whole time.
A hardcoded authentication string is no good, because anyone who gets their hands on and analyzes one of the infected systems can find out how to forge the commands.
To prevent this, you need public-key cryptography. Which means the communication channel has to have enough bits to accommodate the cryptographic signature.
> The notion that "anybody can make it in > the US if they work hard" is a fairy tale.
That depends on how you define "make it". If you're talking about being a multi-billionaire, yeah, that's probably out of reach for most of us. But if we're talking about having significantly more than your parents had (which is, traditionally, the American dream), that's very much attainable.
> That's why counterfeiting is the way to go. You don't > have to employ violence, you just print your own money.
Counterfeiting has a big disadvantage: it automatically falls under federal jurisdiction and is investigated by the FBI and/or the secret service, as opposed to just local law enforcement.
I would say, for a person with no moral scruples at all, speaking strictly economically, the most advantageous and lucrative form of crime is most likely some form of non-violent white-collar crime, probably involving social engineering, conducted in (a series of) small towns where the local law enforcement is not accustomed to dealing with professionals.
For one thing, in almost all cases, if you get caught, there's not going to be enough evidence to take you to court. Because, if you get caught, it's going to be when the victim realizes something is up, *before* you walk away with the money. The police will speak to you sternly and tell you to be good, and then you leave.
Once you actually have the money, you leave, and nobody knows who you were (you do NOT show anyone ID in this profession, and you leave your car and walk to any place where people are going to see you and connect you with what you're doing), and the amounts of money you're dealing with are too small to bring in the feds. Local law enforcement has nothing on you, cannot identify you, and does not know if you are even still in town, which you're not.
> or I could pull a kitchen knife from my home, > go around to the closest atm, wait for someone > to stick in their pin, and have all of their money!"
Yes, but on average this costs you more than working a regular job. Edwin Windsor lectures one of his clients on some hair-brained criminal scheme very much like this in How to Succeed in Evil, and he hits the nail on the head. I shall attempt to apply his logic to your suggestion...
Assuming you successfully complete your mission and empty the victim's bank account, how much money do you make? No, that's a premature question. How much money do you *take*, gross? How much money is in a typical person's bank account? Perhaps five hundred dollars? And assuming he has a couple of credit cards, how much can you get out of those, on the spot (before he goes and reports them stolen)? A few hundred more? Let's say, for the sake of argument, that you could get as much as a thousand dollars each time. Statistically speaking you wouldn't actually average that much, but let's say you did.
Unfortunately, that's only your gross revenue. To calculate how much you actually *make*, we have to subtract out the expenses. For example, there's the risk of getting caught. How many times can you expect to conduct this operation, on average, before you get caught? Ten times? Twenty? Fifty? Let's suppose you only get caught, on average, once every hundred times. This is very unlikely (forty or so is closer in reality), but stay with me.
So we'll calculate the expense of the *risk* of getting caught, on each occasion, as one-one-hundredth of the cost of *actually* getting caught once. For armed assault and robbery, you're looking at, what, ten years in jail? So the cost of the risk of getting caught, one one occasion when you steal two thousand dollars, is 1/100 times the value of ten years of your life. How much is your life worth?
We'll imagine, for the sake of argument, that the ability to spend your free time wherever you like is worth nothing to you. It's difficult to quantify anyway.
That leaves the matter of what your time at work would be worth, if you were gainfully employed. While in prison, you can't earn any money, so earning money is part of the opportunity cost of spending time in jail.
Suppose the best job you can get pays only eighteen thousand dollars a year. That makes your wages, over the course of ten years, a hundred and eighty thousand dollars. 1/100 of that is $1800. This is part of (not all of, mind you, just part of) the cost you incur each time you mug someone at the ATM, on average. So even though you were hoping to make a thousand dollars gross, your net income is actually some eighteen hundred less than that (and, actually, even less when other expenses we're ignoring are taken into account). So mugging someone at the ATM actually costs you, on average, eight hundred dollars, each time you do it.
As Edwin pointed out (to Lifto the Magnificent IIRC), if a particular crime earns you less money than ordinary legally-kosher employment, perhaps you should find a different law to break.
> Full user privileges is enough for most botnets > to run. The malware can listen on ports
Actually, no. I mean yes, if you only want to listen on 127.0.0.1, but if you want to actually receive incoming traffic from the outside world, you're going to have to use iptables to make the appropriate adjustment. Only the superuser can do that.
(However, a botnet agent doesn't actually need to listen on ports in order to operate. It can make connections as a client and retrieve instructions from a command-and-control server, and Bob is its uncle.)
> most malware authors don't bother with attacking "Desktop > Linux", not because it is more secure than Windows (it's > not that much more secure). It's because there's not much > point having a really tiny botnet.
Actually, it's more like it's not worth having a whole bunch of really tiny botnets, or writing eight times as much code to get the same agent to work on all systems. Desktop Linux is not a monoculture like Windows. Let's just take, for example, one of your statements:
> The malware could also alias stuff like sudo > and su if it needs root privileges.
To cover all the bases, you need to alias, and reproduce the interface of, at *least* the following: su, sudo, gksudo, gksu, kdesudo, kdesu, and that's just the ones I happen to know about.
And it's not just privilege escalation. Everything is like that in the Unix world. Everybody uses slightly different stuff. There's no one target.
> If I wrote malware (I don't), I'd use google, other > search engines and maybe even twitter (but that's > probably covered by search engines nowadays) to search > for new instructions:).
And use public-key cryptography to verify their authenticity, yeah.
Fifteen years ago I was thinking usenet would be the way to go. Kiboze a moderate-traffic newsgroup with a propensity for off-topic randomness (like, say, alt.dreams) for any message containing a given key phrase, look for instructions, and yeah, check that the message is cryptographically signed to ensure authenticity.
But these days, the web is probably a more reliable way to go.
Another possibility would be to (ab)use one or more third-party websites that allow comments from anonymous users. If the site in question allows images (like, say, 4chan), the cryptographic signature could even be embedded, via steganography, in the image, so that ordinary users of the site wouldn't even see it. The instructions, for that matter, could also be hidden like this. All you have to put in the easily-searched text is a trigger phrase (which just serves to limit how many of the messages have to be examined in detail for instructions; if a message doesn't have the trigger phrase, you don't even have to retrieve the associated image).
Someone attacking the botnet, of course, could easily find your instructions, once they analyze one of the infection agents and figure out what to look for. But if the instructions are signed with a private key and verified with a public key, it would be difficult to forge phony instructions.
One problem with abusing an innocent third-party site is that they might view your use as hostile and therefore might be inclined to cooperate with an effort to shut down the botnet. So you wouldn't want to rely on just one.
So yeah, generic web search is probably a good way to go. Program your instruction-gathering code with a list of sixty or eighty search engines in thirty or forty different jurisdictions and watch the people attacking the botnet try to get all of your command-and-control stuff delisted from all of them. That could be quite the challenge.
Someone could flood the web with a bunch of bogus instructions, but the signatures wouldn't check out. The zombies would have to sift through all the haystacks to find the needles, but computers are relentless and fast and could probably cryptographically check tens of thousands of search results per hour, so they WOULD find their actual instructions eventually.
This is kind of scary, actually.
If the infection agent checked the search engines in the same order every time and exhausted all the results on each before moving on to the next, the first search engine on the list could shut the whole thing down by identifying searches for the trigger, showing ONLY results that DON'T contain the "correct" signature, and continuing to show additional pages of results indefinitely so the thing would never move on to the next engine. But that could be easily worked around by making the thing check results from several search engines simultaneously. It could for instance be set up so that any given instance would check, say, the two search engines that you really prefer to use, plus one or two more picked at pseudorandom from the list.
Off the top of my head, I'm not sure how you would go about shutting down something like that, other than by tracking down the actual operator and arresting him.
> Even if the control machines loose DNS resolution, > might not the botnet be configured to fall back to > connecting to well known IP addresses to accept > commands? Seems like the logical thing to do if > you are creating an illegal network...
In the first place, if the control machines loosed DNS resolution, then one supposes the computer would become more useful to its owner, with such an important facility once again available.
Beyond that, one imagines that if the people who were shutting the thing down went to all the trouble to get secret court orders and stuff, one imagines they probably also studied the infection agent in a lab environment to determine its behavior profile before taking action in the wild. They may have even disassembled it and studied the code, but at the very least one supposes they ran a few basic tests, along the lines of "What happens when the nameservers start disavowing all knowledge of the c-and-c sites?" That's pretty basic stuff.
> Most users accept all updates from MS (and pretty > much any software vendor) without even so much as > looking at the titles of the files their downloading.
Yeah. I typically do apt-get dist-upgrade without reading all the individual package names, too. The main exception is when I want to know if there's a kernel update or not, because it's not a convenient time to reboot (in which case if there's a kernel update I'll just wait and do the update later when it's more convenient). (Even then, I don't read through the whole list; I just grep it, or if I'm using the GUI update thingy I quickly scroll the alphabetical list down to the li section and look for linux-image to see if it's there or not. Or I don't bother, and just put the update off until a time when it doesn't matter if I need to reboot or not.)
I don't think it's reasonable to expect every user to examine every update and approve them individually. All of these updates are for software packages that I either deliberately selected, or implicitly selected by installing something that depends on them. I know it's software that I want. Why should I have to approve every *update* to the software as well? Next you're going to say I should read all the source code, but I don't have time for that. I use a *lot* of software. I don't even know all the languages that some of it is written in. At some point, I have to pick out software that I think will do what I want, install it, and just *use* it. You know, so I can get something useful done. That is why I have a computer, after all.
If there were a particular software package that gained a reputation for putting unwanted things in its security updates, I'd probably reconsider whether I really wanted to be using that package.
Sure, before it got to that point, the Debian package maintainer would probably consider repackaging the upstream material in a way that came more in line with Debian's guidelines, and if not then the Debian folks would probably consider getting a different package maintainer. And then there's the matter of the security team, which manages security updates, which is what I'm installing in most cases.
But setting all of that to one side for the moment, let's assume for the sake of argument that this wasn't being done, and so the updates for a given package DID have stuff in that I didn't want on my computer. (I'm not talking here about a few extra features I don't happen to need; I'm talking about stuff that is actively bad and fundamentally not at all in line with the stated purpose of the package.) Do you know what I'd do?
I'd probably go find some other software to use that would do what I want and NOT have undesirable baggage in its updates, and then I'd uninstall the offending package. Because I have other things to do with my time than reading through lists of every single update. Any software that's so badly maintained that it makes me do that isn't worth my time.
By the same token, I don't think it's reasonable to expect Windows users to screen the list of security updates they're getting from Microsoft. These are updates for Windows. Windows is software they have chosen to use. There are other choices, but they've chosen Windows. Clearly they want to use Windows. They need to keep it up to date on its security patches, because failure to do so is a leading cause of problems. (Not THE leading cause, of course. That would be user error. But not applying security updates is also a very common cause of trouble.)
What's to decide? If the updates do become so egregious that they make you question whether you want to keep using Windows, then hey, there ARE other options. Meanwhile, hey, apply the patches. They can *NOT* be as bad as all the malware you get if you don't bother.
Besides, if there IS something bad in one of the updates, almost nobody is sufficiently skeptical and jaded to read through the marketing-speak and figure out what it is just from the name. You'd need a code book or
> even incredibly improbable events may have indeed occurred.
The math doesn't work on that.
I mean, it would, if "incredibly improbable" meant something on the general order of one in a billion, like winning the lottery or being struck by lightning or some other moderately unlikely event that does, in fact, actually happen occasionally.
But when "incredibly improbable" starts meaning stuff like "one in ten to the seven thousand three hundred and eighty-third power", a few billion (or even trillion) years doesn't even scratch the surface. I know, I know, "billions of years" sounds like a lot, but in the face of really large improbabilities, it's nothing. When the numbers start getting big, a trillion can get lost in the underflow real fast. When an event is seriously improbable, it's not really much more likely to have occurred in a hundred billion years than it is to have occurred in the last five minutes.
It is vaguely conceivable that Enceladus could have microbes. Anything I (or anyone other than a microbiologist) would call "life", however, is, for all practical purposes, totally impossible.
IMO, what it actually means is that the so-called image is deliberately designed to be as catastrophically horrible as possible when scaled down. (Actually, it's two images, interleaved line-by-line, both of them horrible in a wide variety of ways.) A flat gray rectangle is arguably the *correct* result. If you get a magenta or green version of the image, your browser is using a very naive scaling algorithm that ignores half of the information in the image. I do not see any reasonable way to construct an algorithm that would reproduce at a smaller scale the same optical illusion contained in the original, since the illusion relies heavily on the precise pixel-by-pixel construction of the image.
> meanwhile, I see a grey rectangle in firefox, > and I still don't get what that signifies.
It mostly signifies that the image in question was carefully designed to be pathologically horrible.
In fact, it's not really one image, but two very different images, interleaved every-other-line. Look closely (or, if your eyes are bad, zoom to 400% or so). The one image is tinted heavily toward green, and the other heavily toward magenta, and the brightness and contrast of each of them are heavily distorted, in a way that causes the average across two lines to always be the same shade of gray. The green image is brighter in the bright areas and darker in the dark areas; the magenta image is not as bright in the bright areas and not as dark in the dark areas. Additionally, the green image uses extra red in the dark areas to compensate for the darkness of the magenta image. And that's just the obvious stuff.
Frankly, the fact that you see the Dalai Llama (when it's not scaled down) if you back up and view it from a distance is *arguably* an optical illusion, or at the very least a testament to the amazing design of your visual cortex, that it's able to make any kind of sense at all out of the distorted mess your eyes are giving it. Designing software to do the same thing when scaling the image down is probably beyond the reach of the current state of the art in computer science, or certainly it would have to draw heavily on AI vision research. Straightforward arithmetic isn't going to produce anything that looks like the Dalai Llama if it takes the whole image into account.
What you *can* do, to work around the interleaved design of the image, is use the most naive scaling algorithm of all, wherein the software just takes every other pixel and ignores the ones in between. That will give you either the green or the magenta version of the image, depending on whether your software takes the first pixel or the second pixel of every pair. The fact that this gives better results than VASTLY superior algorithms is a testament to the pathologically extreme design of the image.
I suspect they probably significantly underestimated the amount of gold mined in ancient times. Part of the reason the amount produced per year is so low now is that most of the easy-to-mine gold, and all of it near the surface, was already mined more than three thousand years ago.
If I had to guess, I'd figure their estimate of the total amount is low by at least an order magnitude, maybe more.
But yeah, almost all of it is still around, scattered throughout the world, probably mostly in the form of jewelry and other small trinkets.
Well, in various contexts you'll get different answers, but in general the golden age is most closely associated with near-eastern empires such as Assyria, Babylonia, and Medo-Persia, in much the same way that the bronze age is associated with Greece.
Sometimes you'll also see references to a silver age in between them.
> You mentioned plastics. They're mostly made > from oil, which has been around for a long > time too. But without the knowledge... no plastics.
I'd argue that plastics are qualitatively different from oil.
Iron and gold are basically the same iron and gold today that they were in Nebuchadnezzar's time, refined to roughly the same extent, and mostly used for the same kinds of purposes. It's not just that they had iron ores and gold ores in the ground. They also had the technology to mine them, refine them into pure form, and make things out of them, more or less exactly the same way we do it today.
Whereas, we couldn't really do that with aluminum until the nineteenth century. Sure, alumina and other aluminum compounds were around, but aluminum metal really wasn't, not until somebody figured out how to use electrolysis to separate it from oxygen. And yes, oil was around, but plastics weren't.
The whole Superman backstory has been rewritten and changed repeatedly over the decades. Are you sure that Superman was already revealed to be an alien in the first comic book he appeared in? I wouldn't be at all surprised if that revelation came later.
> > modern civilisation wouldn't exist without gold. > > I'd say iron's a lot more important.
If I had to name a material that defines modern civilization, I would have said aluminum and/or plastic.
Iron and gold refining have been around since antiquity. If these commodities could have made a civilization modern, it would have happened several thousand years sooner. Even steel has been around for a couple thousand years.
> It's even got an age named after it.
So do gold, bronze, stone, and ice. What's your point?
> If we actually entered a post-apocalyptic world where the > dollar was useless, you'd quickly find gold to be equally useless
No, that doesn't follow.
There have been many situations in history (frequently involving the near-certain imminent collapse of a government) wherein currency rapidly lost all its value. In each and every case, gold was still valuable.
Gold is inherently rare. Nobody knows how to make counterfeit gold. Unless some brilliant physicist discovers an affordable way to do transmutation, that's always going to be the case.
Gold also has a distinctive appearance that makes it easy to tell apart from other metals, even at a glance. ("Fool's gold" may look sort of like it might possibly contain gold ore, but you can't refine it and get anything that looks even vaguely like refined gold.)
These features give gold a durable value that has outlasted innumerable currencies and governments.
Oh, one more thing I forgot to mention: there was no significant precipitation yesterday. It was pretty foggy, but there wasn't really any water actually coming down (apart from the melting stuff dripping off the roofs and trees, of course).
The one consistent feature of all the weather predictions for yesterday was that there was going to be stuff falling from the sky all day. They kept changing their mind about how liquid or solid it was going to be, but they were sure we were going to be getting quite a bit of it.
> The apparent randomness of weather is decreasing over time
Maybe where *you* live it is.
Around here, the two-day weather forecasts are significantly less accurate than the predictions in the farmer's almanac, and often less precise as well. For the entire month of June they say something like "partly sunny, chance of rain". Well, duh.
Heck, the predictions for what weather we were going to have yesterday are a perfect example. Late last week they said we were going to get 6-8 inches of snow on Monday. Then on Saturday they changed their mind and said it was going to be rain Monday. Then at some point on Sunday they said it would be freezing drizzle. Yesterday morning they said no, that was wrong, it would be snow after all, 6-8 inches of snow. You want to guess what we actually got? I'll give you a hint: it was 40 degrees all day.
The weather reports are worthless. The dudes that give them to us are basically just flimflam men. If we got our weather predictions by rolling dice, they'd be just as reliable. I say we stop paying for this nonsense and tell the meteorologists to get a real job.
> The codecen in the late 80's were designed > with processing time in mind, and as such, > the image quality they produced is rubbish > compared to what we have today,
Now, see, I was pretty sure there was such a thing as lossless video by 1990, if not rather earlier. Not everyone was using it, but I was pretty sure it existed. The framerates and resolutions weren't competitive by today's standards, but as you say, computer hardware couldn't do what today's hardware can, either.
> I thought he was referring to using Java as an alternative to ActiveX.
I missed that. I thought he was talking about native Win32 apps.
Yeah, Java didn't really become practical, performance-wise, until the new version came out, about or just shy of a decade ago. I can't remember whether that was Java 2, or the Java 1.x that came out after Java 2 (not to be confused with the Java 1.x that came out earlier, before Java 2). The history of Java version numbers confuses me.
General improvements in available hardware helped it somewhat too, especially when the price of SDRAM fell out of the attic and through the floor. Was that really almost ten years ago now? Time flies.
> Making a video codec patent free is really difficult, > since submarine patents are always a threat.
Which makes me wonder why everyone is always so keen to make new video formats. Why not just use one of the ones that's twenty years old? All the patents would be expired, then. Are the video formats from the late eighties really all deficient in some important way? With all the formats that were floating around back then, competing to cram more video into less space, it's difficult to imagine that NONE of them can meet our needs in this decadent era of cheap storage, extravagant bandwidth, and powerful multi-core CPUs. What am I missing?
You appear to be making pragmatic arguments. Obviously you don't live in the same universe as the FSF. If you did, you'd understand that practical concerns such as backward-compatibility are far less important than abstract ideological purity.
Slashdot Mirror
You're too kind.
I say, let the punishment fit the crime. Convicted spammers should be locked in a cell where a computer voice reads aloud every single message they sent, in full, once for each person they sent it to. And it should be paused any time they fall asleep, and resume from the beginning of the current message when they awaken. And they should not be let out of the cell for any reason until they listen to every single one.
And they should have Spam for supper every night, the whole time.
> I wonder if the spammers follow Slashdot?
Umm, once the botnet was shut down, I suspect they became aware of it more or less immediately anyway.
The "covert" part was not giving them any warning in advance, so that they didn't have time to push out updates to work around what was being done.
A hardcoded authentication string is no good, because anyone who gets their hands on and analyzes one of the infected systems can find out how to forge the commands.
To prevent this, you need public-key cryptography. Which means the communication channel has to have enough bits to accommodate the cryptographic signature.
> The notion that "anybody can make it in
> the US if they work hard" is a fairy tale.
That depends on how you define "make it". If you're talking about being a multi-billionaire, yeah, that's probably out of reach for most of us. But if we're talking about having significantly more than your parents had (which is, traditionally, the American dream), that's very much attainable.
> That's why counterfeiting is the way to go. You don't
> have to employ violence, you just print your own money.
Counterfeiting has a big disadvantage: it automatically falls under federal jurisdiction and is investigated by the FBI and/or the secret service, as opposed to just local law enforcement.
I would say, for a person with no moral scruples at all, speaking strictly economically, the most advantageous and lucrative form of crime is most likely some form of non-violent white-collar crime, probably involving social engineering, conducted in (a series of) small towns where the local law enforcement is not accustomed to dealing with professionals.
For one thing, in almost all cases, if you get caught, there's not going to be enough evidence to take you to court. Because, if you get caught, it's going to be when the victim realizes something is up, *before* you walk away with the money. The police will speak to you sternly and tell you to be good, and then you leave.
Once you actually have the money, you leave, and nobody knows who you were (you do NOT show anyone ID in this profession, and you leave your car and walk to any place where people are going to see you and connect you with what you're doing), and the amounts of money you're dealing with are too small to bring in the feds. Local law enforcement has nothing on you, cannot identify you, and does not know if you are even still in town, which you're not.
> or I could pull a kitchen knife from my home,
> go around to the closest atm, wait for someone
> to stick in their pin, and have all of their money!"
Yes, but on average this costs you more than working a regular job. Edwin Windsor lectures one of his clients on some hair-brained criminal scheme very much like this in How to Succeed in Evil, and he hits the nail on the head. I shall attempt to apply his logic to your suggestion...
Assuming you successfully complete your mission and empty the victim's bank account, how much money do you make? No, that's a premature question. How much money do you *take*, gross? How much money is in a typical person's bank account? Perhaps five hundred dollars? And assuming he has a couple of credit cards, how much can you get out of those, on the spot (before he goes and reports them stolen)? A few hundred more? Let's say, for the sake of argument, that you could get as much as a thousand dollars each time. Statistically speaking you wouldn't actually average that much, but let's say you did.
Unfortunately, that's only your gross revenue. To calculate how much you actually *make*, we have to subtract out the expenses. For example, there's the risk of getting caught. How many times can you expect to conduct this operation, on average, before you get caught? Ten times? Twenty? Fifty? Let's suppose you only get caught, on average, once every hundred times. This is very unlikely (forty or so is closer in reality), but stay with me.
So we'll calculate the expense of the *risk* of getting caught, on each occasion, as one-one-hundredth of the cost of *actually* getting caught once. For armed assault and robbery, you're looking at, what, ten years in jail? So the cost of the risk of getting caught, one one occasion when you steal two thousand dollars, is 1/100 times the value of ten years of your life. How much is your life worth?
We'll imagine, for the sake of argument, that the ability to spend your free time wherever you like is worth nothing to you. It's difficult to quantify anyway.
That leaves the matter of what your time at work would be worth, if you were gainfully employed. While in prison, you can't earn any money, so earning money is part of the opportunity cost of spending time in jail.
Suppose the best job you can get pays only eighteen thousand dollars a year. That makes your wages, over the course of ten years, a hundred and eighty thousand dollars. 1/100 of that is $1800. This is part of (not all of, mind you, just part of) the cost you incur each time you mug someone at the ATM, on average. So even though you were hoping to make a thousand dollars gross, your net income is actually some eighteen hundred less than that (and, actually, even less when other expenses we're ignoring are taken into account). So mugging someone at the ATM actually costs you, on average, eight hundred dollars, each time you do it.
As Edwin pointed out (to Lifto the Magnificent IIRC), if a particular crime earns you less money than ordinary legally-kosher employment, perhaps you should find a different law to break.
> Full user privileges is enough for most botnets
> to run. The malware can listen on ports
Actually, no. I mean yes, if you only want to listen on 127.0.0.1, but if you want to actually receive incoming traffic from the outside world, you're going to have to use iptables to make the appropriate adjustment. Only the superuser can do that.
(However, a botnet agent doesn't actually need to listen on ports in order to operate. It can make connections as a client and retrieve instructions from a command-and-control server, and Bob is its uncle.)
> most malware authors don't bother with attacking "Desktop
> Linux", not because it is more secure than Windows (it's
> not that much more secure). It's because there's not much
> point having a really tiny botnet.
Actually, it's more like it's not worth having a whole bunch of really tiny botnets, or writing eight times as much code to get the same agent to work on all systems. Desktop Linux is not a monoculture like Windows. Let's just take, for example, one of your statements:
> The malware could also alias stuff like sudo
> and su if it needs root privileges.
To cover all the bases, you need to alias, and reproduce the interface of, at *least* the following: su, sudo, gksudo, gksu, kdesudo, kdesu, and that's just the ones I happen to know about.
And it's not just privilege escalation. Everything is like that in the Unix world. Everybody uses slightly different stuff. There's no one target.
> If I wrote malware (I don't), I'd use google, other :).
> search engines and maybe even twitter (but that's
> probably covered by search engines nowadays) to search
> for new instructions
And use public-key cryptography to verify their authenticity, yeah.
Fifteen years ago I was thinking usenet would be the way to go. Kiboze a moderate-traffic newsgroup with a propensity for off-topic randomness (like, say, alt.dreams) for any message containing a given key phrase, look for instructions, and yeah, check that the message is cryptographically signed to ensure authenticity.
But these days, the web is probably a more reliable way to go.
Another possibility would be to (ab)use one or more third-party websites that allow comments from anonymous users. If the site in question allows images (like, say, 4chan), the cryptographic signature could even be embedded, via steganography, in the image, so that ordinary users of the site wouldn't even see it. The instructions, for that matter, could also be hidden like this. All you have to put in the easily-searched text is a trigger phrase (which just serves to limit how many of the messages have to be examined in detail for instructions; if a message doesn't have the trigger phrase, you don't even have to retrieve the associated image).
Someone attacking the botnet, of course, could easily find your instructions, once they analyze one of the infection agents and figure out what to look for. But if the instructions are signed with a private key and verified with a public key, it would be difficult to forge phony instructions.
One problem with abusing an innocent third-party site is that they might view your use as hostile and therefore might be inclined to cooperate with an effort to shut down the botnet. So you wouldn't want to rely on just one.
So yeah, generic web search is probably a good way to go. Program your instruction-gathering code with a list of sixty or eighty search engines in thirty or forty different jurisdictions and watch the people attacking the botnet try to get all of your command-and-control stuff delisted from all of them. That could be quite the challenge.
Someone could flood the web with a bunch of bogus instructions, but the signatures wouldn't check out. The zombies would have to sift through all the haystacks to find the needles, but computers are relentless and fast and could probably cryptographically check tens of thousands of search results per hour, so they WOULD find their actual instructions eventually.
This is kind of scary, actually.
If the infection agent checked the search engines in the same order every time and exhausted all the results on each before moving on to the next, the first search engine on the list could shut the whole thing down by identifying searches for the trigger, showing ONLY results that DON'T contain the "correct" signature, and continuing to show additional pages of results indefinitely so the thing would never move on to the next engine. But that could be easily worked around by making the thing check results from several search engines simultaneously. It could for instance be set up so that any given instance would check, say, the two search engines that you really prefer to use, plus one or two more picked at pseudorandom from the list.
Off the top of my head, I'm not sure how you would go about shutting down something like that, other than by tracking down the actual operator and arresting him.
> Even if the control machines loose DNS resolution,
> might not the botnet be configured to fall back to
> connecting to well known IP addresses to accept
> commands? Seems like the logical thing to do if
> you are creating an illegal network...
In the first place, if the control machines loosed DNS resolution, then one supposes the computer would become more useful to its owner, with such an important facility once again available.
Beyond that, one imagines that if the people who were shutting the thing down went to all the trouble to get secret court orders and stuff, one imagines they probably also studied the infection agent in a lab environment to determine its behavior profile before taking action in the wild. They may have even disassembled it and studied the code, but at the very least one supposes they ran a few basic tests, along the lines of "What happens when the nameservers start disavowing all knowledge of the c-and-c sites?" That's pretty basic stuff.
> Most users accept all updates from MS (and pretty
> much any software vendor) without even so much as
> looking at the titles of the files their downloading.
Yeah. I typically do apt-get dist-upgrade without reading all the individual package names, too. The main exception is when I want to know if there's a kernel update or not, because it's not a convenient time to reboot (in which case if there's a kernel update I'll just wait and do the update later when it's more convenient). (Even then, I don't read through the whole list; I just grep it, or if I'm using the GUI update thingy I quickly scroll the alphabetical list down to the li section and look for linux-image to see if it's there or not. Or I don't bother, and just put the update off until a time when it doesn't matter if I need to reboot or not.)
I don't think it's reasonable to expect every user to examine every update and approve them individually. All of these updates are for software packages that I either deliberately selected, or implicitly selected by installing something that depends on them. I know it's software that I want. Why should I have to approve every *update* to the software as well? Next you're going to say I should read all the source code, but I don't have time for that. I use a *lot* of software. I don't even know all the languages that some of it is written in. At some point, I have to pick out software that I think will do what I want, install it, and just *use* it. You know, so I can get something useful done. That is why I have a computer, after all.
If there were a particular software package that gained a reputation for putting unwanted things in its security updates, I'd probably reconsider whether I really wanted to be using that package.
Sure, before it got to that point, the Debian package maintainer would probably consider repackaging the upstream material in a way that came more in line with Debian's guidelines, and if not then the Debian folks would probably consider getting a different package maintainer. And then there's the matter of the security team, which manages security updates, which is what I'm installing in most cases.
But setting all of that to one side for the moment, let's assume for the sake of argument that this wasn't being done, and so the updates for a given package DID have stuff in that I didn't want on my computer. (I'm not talking here about a few extra features I don't happen to need; I'm talking about stuff that is actively bad and fundamentally not at all in line with the stated purpose of the package.) Do you know what I'd do?
I'd probably go find some other software to use that would do what I want and NOT have undesirable baggage in its updates, and then I'd uninstall the offending package. Because I have other things to do with my time than reading through lists of every single update. Any software that's so badly maintained that it makes me do that isn't worth my time.
By the same token, I don't think it's reasonable to expect Windows users to screen the list of security updates they're getting from Microsoft. These are updates for Windows. Windows is software they have chosen to use. There are other choices, but they've chosen Windows. Clearly they want to use Windows. They need to keep it up to date on its security patches, because failure to do so is a leading cause of problems. (Not THE leading cause, of course. That would be user error. But not applying security updates is also a very common cause of trouble.)
What's to decide? If the updates do become so egregious that they make you question whether you want to keep using Windows, then hey, there ARE other options. Meanwhile, hey, apply the patches. They can *NOT* be as bad as all the malware you get if you don't bother.
Besides, if there IS something bad in one of the updates, almost nobody is sufficiently skeptical and jaded to read through the marketing-speak and figure out what it is just from the name. You'd need a code book or
> even incredibly improbable events may have indeed occurred.
The math doesn't work on that.
I mean, it would, if "incredibly improbable" meant something on the general order of one in a billion, like winning the lottery or being struck by lightning or some other moderately unlikely event that does, in fact, actually happen occasionally.
But when "incredibly improbable" starts meaning stuff like "one in ten to the seven thousand three hundred and eighty-third power", a few billion (or even trillion) years doesn't even scratch the surface. I know, I know, "billions of years" sounds like a lot, but in the face of really large improbabilities, it's nothing. When the numbers start getting big, a trillion can get lost in the underflow real fast. When an event is seriously improbable, it's not really much more likely to have occurred in a hundred billion years than it is to have occurred in the last five minutes.
It is vaguely conceivable that Enceladus could have microbes. Anything I (or anyone other than a microbiologist) would call "life", however, is, for all practical purposes, totally impossible.
IMO, what it actually means is that the so-called image is deliberately designed to be as catastrophically horrible as possible when scaled down. (Actually, it's two images, interleaved line-by-line, both of them horrible in a wide variety of ways.) A flat gray rectangle is arguably the *correct* result. If you get a magenta or green version of the image, your browser is using a very naive scaling algorithm that ignores half of the information in the image. I do not see any reasonable way to construct an algorithm that would reproduce at a smaller scale the same optical illusion contained in the original, since the illusion relies heavily on the precise pixel-by-pixel construction of the image.
> meanwhile, I see a grey rectangle in firefox,
> and I still don't get what that signifies.
It mostly signifies that the image in question was carefully designed to be pathologically horrible.
In fact, it's not really one image, but two very different images, interleaved every-other-line. Look closely (or, if your eyes are bad, zoom to 400% or so). The one image is tinted heavily toward green, and the other heavily toward magenta, and the brightness and contrast of each of them are heavily distorted, in a way that causes the average across two lines to always be the same shade of gray. The green image is brighter in the bright areas and darker in the dark areas; the magenta image is not as bright in the bright areas and not as dark in the dark areas. Additionally, the green image uses extra red in the dark areas to compensate for the darkness of the magenta image. And that's just the obvious stuff.
Frankly, the fact that you see the Dalai Llama (when it's not scaled down) if you back up and view it from a distance is *arguably* an optical illusion, or at the very least a testament to the amazing design of your visual cortex, that it's able to make any kind of sense at all out of the distorted mess your eyes are giving it. Designing software to do the same thing when scaling the image down is probably beyond the reach of the current state of the art in computer science, or certainly it would have to draw heavily on AI vision research. Straightforward arithmetic isn't going to produce anything that looks like the Dalai Llama if it takes the whole image into account.
What you *can* do, to work around the interleaved design of the image, is use the most naive scaling algorithm of all, wherein the software just takes every other pixel and ignores the ones in between. That will give you either the green or the magenta version of the image, depending on whether your software takes the first pixel or the second pixel of every pair. The fact that this gives better results than VASTLY superior algorithms is a testament to the pathologically extreme design of the image.
I suspect they probably significantly underestimated the amount of gold mined in ancient times. Part of the reason the amount produced per year is so low now is that most of the easy-to-mine gold, and all of it near the surface, was already mined more than three thousand years ago.
If I had to guess, I'd figure their estimate of the total amount is low by at least an order magnitude, maybe more.
But yeah, almost all of it is still around, scattered throughout the world, probably mostly in the form of jewelry and other small trinkets.
> Never heard of the gold age.
Is English your first language?
> When was it?
Well, in various contexts you'll get different answers, but in general the golden age is most closely associated with near-eastern empires such as Assyria, Babylonia, and Medo-Persia, in much the same way that the bronze age is associated with Greece.
Sometimes you'll also see references to a silver age in between them.
> You mentioned plastics. They're mostly made
> from oil, which has been around for a long
> time too. But without the knowledge... no plastics.
I'd argue that plastics are qualitatively different from oil.
Iron and gold are basically the same iron and gold today that they were in Nebuchadnezzar's time, refined to roughly the same extent, and mostly used for the same kinds of purposes. It's not just that they had iron ores and gold ores in the ground. They also had the technology to mine them, refine them into pure form, and make things out of them, more or less exactly the same way we do it today.
Whereas, we couldn't really do that with aluminum until the nineteenth century. Sure, alumina and other aluminum compounds were around, but aluminum metal really wasn't, not until somebody figured out how to use electrolysis to separate it from oxygen. And yes, oil was around, but plastics weren't.
The whole Superman backstory has been rewritten and changed repeatedly over the decades. Are you sure that Superman was already revealed to be an alien in the first comic book he appeared in? I wouldn't be at all surprised if that revelation came later.
> > modern civilisation wouldn't exist without gold.
>
> I'd say iron's a lot more important.
If I had to name a material that defines modern civilization, I would have said aluminum and/or plastic.
Iron and gold refining have been around since antiquity. If these commodities could have made a civilization modern, it would have happened several thousand years sooner. Even steel has been around for a couple thousand years.
> It's even got an age named after it.
So do gold, bronze, stone, and ice. What's your point?
> If we actually entered a post-apocalyptic world where the
> dollar was useless, you'd quickly find gold to be equally useless
No, that doesn't follow.
There have been many situations in history (frequently involving the near-certain imminent collapse of a government) wherein currency rapidly lost all its value. In each and every case, gold was still valuable.
Gold is inherently rare. Nobody knows how to make counterfeit gold. Unless some brilliant physicist discovers an affordable way to do transmutation, that's always going to be the case.
Gold also has a distinctive appearance that makes it easy to tell apart from other metals, even at a glance. ("Fool's gold" may look sort of like it might possibly contain gold ore, but you can't refine it and get anything that looks even vaguely like refined gold.)
These features give gold a durable value that has outlasted innumerable currencies and governments.
Oh, one more thing I forgot to mention: there was no significant precipitation yesterday. It was pretty foggy, but there wasn't really any water actually coming down (apart from the melting stuff dripping off the roofs and trees, of course).
The one consistent feature of all the weather predictions for yesterday was that there was going to be stuff falling from the sky all day. They kept changing their mind about how liquid or solid it was going to be, but they were sure we were going to be getting quite a bit of it.
Yeah, tell us another story, Mr. Weatherman.
> The apparent randomness of weather is decreasing over time
Maybe where *you* live it is.
Around here, the two-day weather forecasts are significantly less accurate than the predictions in the farmer's almanac, and often less precise as well. For the entire month of June they say something like "partly sunny, chance of rain". Well, duh.
Heck, the predictions for what weather we were going to have yesterday are a perfect example. Late last week they said we were going to get 6-8 inches of snow on Monday. Then on Saturday they changed their mind and said it was going to be rain Monday. Then at some point on Sunday they said it would be freezing drizzle. Yesterday morning they said no, that was wrong, it would be snow after all, 6-8 inches of snow. You want to guess what we actually got? I'll give you a hint: it was 40 degrees all day.
The weather reports are worthless. The dudes that give them to us are basically just flimflam men. If we got our weather predictions by rolling dice, they'd be just as reliable. I say we stop paying for this nonsense and tell the meteorologists to get a real job.
> The codecen in the late 80's were designed
> with processing time in mind, and as such,
> the image quality they produced is rubbish
> compared to what we have today,
Now, see, I was pretty sure there was such a thing as lossless video by 1990, if not rather earlier. Not everyone was using it, but I was pretty sure it existed. The framerates and resolutions weren't competitive by today's standards, but as you say, computer hardware couldn't do what today's hardware can, either.
> I thought he was referring to using Java as an alternative to ActiveX.
I missed that. I thought he was talking about native Win32 apps.
Yeah, Java didn't really become practical, performance-wise, until the new version came out, about or just shy of a decade ago. I can't remember whether that was Java 2, or the Java 1.x that came out after Java 2 (not to be confused with the Java 1.x that came out earlier, before Java 2). The history of Java version numbers confuses me.
General improvements in available hardware helped it somewhat too, especially when the price of SDRAM fell out of the attic and through the floor. Was that really almost ten years ago now? Time flies.
> Making a video codec patent free is really difficult,
> since submarine patents are always a threat.
Which makes me wonder why everyone is always so keen to make new video formats. Why not just use one of the ones that's twenty years old? All the patents would be expired, then. Are the video formats from the late eighties really all deficient in some important way? With all the formats that were floating around back then, competing to cram more video into less space, it's difficult to imagine that NONE of them can meet our needs in this decadent era of cheap storage, extravagant bandwidth, and powerful multi-core CPUs. What am I missing?
You appear to be making pragmatic arguments. Obviously you don't live in the same universe as the FSF. If you did, you'd understand that practical concerns such as backward-compatibility are far less important than abstract ideological purity.