Since nobody seems to have mentioned it yet: Reflections on trusting trust. Note that he already mentions planting exploits into microcode, which is already quite close to the hardware. Do you know for sure there's no exploit planted in the microcode of your CPU? Maybe someone manipulated the compiler for the microcode? The compiler on which the compiler for the microcode was compiled?
But even with the actual hardware, that's possible: Just as you can place an exploit in the C compiler, you can also place an exploit in the VHDL compiler. Then the VHDL code will be unsuspicious, and run correctly in the simulator, but the actual chip will still be modified. Again, several levels are possible.
OK, is there anything which can protect us? Well, on one hand it's getting more complicated with each intermediate step. But then, there's also another protection: Exactly the fact that not everything isn't done by the same company! And this even applies for the simple case mentioned in TFA: A company which is asked for a component which, say, adds up a bunch of numbers, doesn't know how it's combined with the other blocks, or what the other blocks actually look like. Therefore he likely cannot tell how you could actually trigger the bad behaviour in the complete chip, or how to do something "useful" on that condition. The same is true on all the other levels: The chip developers will not write their own VHDL compiler, and the VHDL compiler writers have no clue what the chips which will defined with them will look like. The microcode developers likely don't write the microcode compiler, and the microcode compiler people probably don't have access to the microcode source code.
Are you really more worried about warrantless wiretaps than about completely anonymous people on the internet having the ability to take over your computer?
Well, most completely anonymous people on the Internet don't, eg, have access to nuclear weapons and Navy SEALs.
The US government does.
Just sayin'.
On the other hand, the US government (or any other government, for that matter) wouldn't have much use for the amount of money I've got on my bank account (that amount is negligible compared to government budgets).
Most completely anonymous people on the Internet would.
What he probably meant is that the function pair HasSpecialPluralization/DoThatSpecialPluralization isn't formally specified. Especially that it's valid to have in HasSpecialPluralization:
And how exactly do users install updates? I guess using some interface of the iPhone itself. So is there any reason an active root kit cannot interfere with the update process and install itself in the updated version right at installation time?
PostScript files may not render on certain devices, such as non-PostScript printers.
And PDF files may not render on certain devices, such as non-PDF printers. Fortunately in both cases there are programs which can interpret that format and display or print it on printers which don't understand it. For PDF, the best-known such program is Adobe Reader (formerly Acrobat Reader). For PS, the most popular such program is Ghostscipt (with its companion Ghostview for more convenient viewing). Moreover, some operating systems transparently interpret postscript files which are sent to non-postscript printers.
There's definitively a statistical correlation between length of copyright and climate. As copyright duration got longer, the climate got hotter. It's a slow effect, so you don't see clear steps in the pattern. However, if you look at the famous hockey stick curve, you'll notice that the bend of the hockey stick is not too long after the original Berne Convention. That it doesn't match exactly can be attributed to the inherent inertia of the climate. Since then, both duration of copyright successively got longer and the climate got hotter. This is a very clear correlation.
So now we have the proof: Copyright damages our climate!
Assuming that with "BBC" you mean the British Broadcasting Corporation, I don't think American laws matter a lot for them (except for material they sell there). Especially they can show any amount of images which are illegal to show in the U.S., as long as they are not illegal to show in GB.
If all you need to do is to download a manipulated PDF from a web site, then the end user certainly can trigger it by accident, and therefore it's very clearly a hole. That you can use that hole to jailbreak doesn't make it less of a hole. The next PDF you download may use the same hole for something malicious instead.
Claiming it's not a hole because you can use it for jailbreaking is like claiming that a web site's SQL vulnerability isn't a security hole because you could also issue SQL commands for useful things the web page doesn't allow you to do otherwise.
What I don't get is why it is so complicated to just have two browsers installed: IE6 for legacy corporate apps, and a modern browser for the internet (there may be trouble having IE6 and IE8 at the same time, but there should not be any troubles having IE6 and Firefox, or IE8 and Opera). Maybe you can have a proxy which ensures the right browser is used for internet access (i.e. that blocks all IE6 traffic leaving the corporate network). That solution would be simple (no need to update internal ActiveX stuff) and even more secure than using another browser for everything (because any internet site which compromises the browser, but doesn't otherwise compromise the user's account, cannot access any internal stuff because of the lack of ActiveX; moreover non-IE6 access can simply be blocked for internal stuff for additional security). If you use Firefox, you can even make it almost seamless by using IE tab extension.
I wouldn't be surprised if also OS/2 had a larger following to elsewhere (or at least US).
I wouldn't be surprised either. I bought a computer with OS/2 preinstalled in Germany, in 1995. Preinstalled by default, not as special wish. From the (AFAIK) largest German computer seller of that time (Vobis). It also had Star Office preinstalled.
AFAIK it's completely legal to copy old art, even in high quality, as long as there's no chance that the copy may be confused with the original, and you don't claim it to be painted by the original artist (e.g. you shouldn't put the original artist's signature on it).
Slashdot Mirror
At the stock exchange, selling his stock.
You got your driving license without any technical training?
lol@overrated mod... it wasn't even rated in the first place.
Yes it was. It wasn't moderated yet, but it was rated (it had a score).
Since nobody seems to have mentioned it yet: Reflections on trusting trust.
Note that he already mentions planting exploits into microcode, which is already quite close to the hardware. Do you know for sure there's no exploit planted in the microcode of your CPU? Maybe someone manipulated the compiler for the microcode? The compiler on which the compiler for the microcode was compiled?
But even with the actual hardware, that's possible: Just as you can place an exploit in the C compiler, you can also place an exploit in the VHDL compiler. Then the VHDL code will be unsuspicious, and run correctly in the simulator, but the actual chip will still be modified. Again, several levels are possible.
OK, is there anything which can protect us? Well, on one hand it's getting more complicated with each intermediate step. But then, there's also another protection: Exactly the fact that not everything isn't done by the same company! And this even applies for the simple case mentioned in TFA: A company which is asked for a component which, say, adds up a bunch of numbers, doesn't know how it's combined with the other blocks, or what the other blocks actually look like. Therefore he likely cannot tell how you could actually trigger the bad behaviour in the complete chip, or how to do something "useful" on that condition. The same is true on all the other levels: The chip developers will not write their own VHDL compiler, and the VHDL compiler writers have no clue what the chips which will defined with them will look like. The microcode developers likely don't write the microcode compiler, and the microcode compiler people probably don't have access to the microcode source code.
Are you really more worried about warrantless wiretaps than about completely anonymous people on the internet having the ability to take over your computer?
Well, most completely anonymous people on the Internet don't, eg, have access to nuclear weapons and Navy SEALs.
The US government does.
Just sayin'.
On the other hand, the US government (or any other government, for that matter) wouldn't have much use for the amount of money I've got on my bank account (that amount is negligible compared to government budgets).
Most completely anonymous people on the Internet would.
Just sayin'.
What he probably meant is that the function pair HasSpecialPluralization/DoThatSpecialPluralization isn't formally specified. Especially that it's valid to have in HasSpecialPluralization:
if word == "virus"
true
and in DoThatSpecialPluralization:
if word == "virus"
word <- "virii"
And how exactly do users install updates? I guess using some interface of the iPhone itself. So is there any reason an active root kit cannot interfere with the update process and install itself in the updated version right at installation time?
And PDF files may not render on certain devices, such as non-PDF printers. Fortunately in both cases there are programs which can interpret that format and display or print it on printers which don't understand it. For PDF, the best-known such program is Adobe Reader (formerly Acrobat Reader). For PS, the most popular such program is Ghostscipt (with its companion Ghostview for more convenient viewing). Moreover, some operating systems transparently interpret postscript files which are sent to non-postscript printers.
Well, just remember to not bath naked in your pool when the satellite crosses :-)
There's definitively a statistical correlation between length of copyright and climate. As copyright duration got longer, the climate got hotter.
It's a slow effect, so you don't see clear steps in the pattern. However, if you look at the famous hockey stick curve, you'll notice that the bend of the hockey stick is not too long after the original Berne Convention. That it doesn't match exactly can be attributed to the inherent inertia of the climate. Since then, both duration of copyright successively got longer and the climate got hotter. This is a very clear correlation.
So now we have the proof: Copyright damages our climate!
Assuming that with "BBC" you mean the British Broadcasting Corporation, I don't think American laws matter a lot for them (except for material they sell there). Especially they can show any amount of images which are illegal to show in the U.S., as long as they are not illegal to show in GB.
If all you need to do is to download a manipulated PDF from a web site, then the end user certainly can trigger it by accident, and therefore it's very clearly a hole. That you can use that hole to jailbreak doesn't make it less of a hole. The next PDF you download may use the same hole for something malicious instead.
Claiming it's not a hole because you can use it for jailbreaking is like claiming that a web site's SQL vulnerability isn't a security hole because you could also issue SQL commands for useful things the web page doesn't allow you to do otherwise.
Do you want to be the one doing the shafting, or the one getting shafted?
No.
Romanes eunt domus!
And when did the ancestors of the native Americans discover America? I guess that was even earlier.
No, it's not about Sun but about The Sun — look at the title!
Oops, should of course have been Sun and The Sun instead.
Firefox portable anyone?
Are employees generally allowed to run random software from USB sticks?
What I don't get is why it is so complicated to just have two browsers installed: IE6 for legacy corporate apps, and a modern browser for the internet (there may be trouble having IE6 and IE8 at the same time, but there should not be any troubles having IE6 and Firefox, or IE8 and Opera). Maybe you can have a proxy which ensures the right browser is used for internet access (i.e. that blocks all IE6 traffic leaving the corporate network). That solution would be simple (no need to update internal ActiveX stuff) and even more secure than using another browser for everything (because any internet site which compromises the browser, but doesn't otherwise compromise the user's account, cannot access any internal stuff because of the lack of ActiveX; moreover non-IE6 access can simply be blocked for internal stuff for additional security). If you use Firefox, you can even make it almost seamless by using IE tab extension.
Are those metric dollars or imperial dollars?
A hub?
I wouldn't be surprised either. I bought a computer with OS/2 preinstalled in Germany, in 1995. Preinstalled by default, not as special wish. From the (AFAIK) largest German computer seller of that time (Vobis). It also had Star Office preinstalled.
No, it's not about Sun but about The Sun — look at the title!
Don't worry. The world will not end before 2012. :-)
AFAIK it's completely legal to copy old art, even in high quality, as long as there's no chance that the copy may be confused with the original, and you don't claim it to be painted by the original artist (e.g. you shouldn't put the original artist's signature on it).
You are violating the intellectual property rights of the first "first post" poster. Expect a C&D letter soon.