There are perfectly legitimate reasons to maintain user account information in the clear
Personal user information? SS Numbers, addresses? Really?
Sure. Just off the top of my head: an employer would need to keep social security numbers and addresses in the clear for tax purposes, as would pretty much any entity involved with financial transactions.
Yes, the information could be encrypted in the database but the key would need to be accessible if users are able to view and edit their stored information or if the company needs to file tax-related information. This is essentially the same as keeping the information in the clear.
b) Chrome doesn't fucking break everything every upgrade!
While I haven't had issues with Firefox breaking add-ons, Chrome also has another advantage[1]: it installs and runs as a user's account, rather than requiring admin rights to install and update. Updates can occur in the background without annoying the user with UAC popups (or their equivalent).
Firefox installs system-wide and requires admin rights to update. This is somewhat annoying.
[1] Some on Slashdot have complained that this is a disadvantage, particularly on managed systems in a workplace, as users shouldn't be able to install programs without administrator rights. In general, I agree. However, for individual users at home (such as my parents) not requiring admin rights is a huge benefit as it means they get to stay up-to-date and patched (including Chrome's built-in Flash and PDF reader) without being interrupted or bothered.
Having driven on rural roads in Nevada, I would hope you don't need a GPS for help - i.e. take next left turn in 115 miles. First business on left (28 miles).
*shrugs* If I need GPS, I use my cell phone. It has current maps, and doesn't require me to buy a $200 update every few months so I'm up to date.
For what it's worth, there's quite a few consumer-level GPS receivers for car navigation (such as those produced by Garmin, TomTom, etc.) that have "lifetime" updates -- the maps are updated quarterly (or so) from the vendor.
I have one of these devices and it's quite handy. Many of the cell phone navigation applications I've seen require that one have mobile phone service to get maps -- they cache a bit of the maps in case one is outside of coverage for a little while but if you're out of coverage for an extended period of time (such as driving on rural highways in Nevada) the maps and directions quickly become useless.
Having a self-contained navigation system has its advantages in quite a few places.
Much of the abuse I see on the internet (such as spam, port scans, SSH login attempts, etc.) are from bots.
Most of the individual users have no idea their computer is compromised, let alone any idea how to fix the problem. Having ISPs take a more active role in securing their networks and helping users secure their systems is a worthy endeavor.
Being a kid of the 50's, I didn't get a Social Security card until I enlisted in the Army. I was 17. 10 years later, my kids got issued Social Security numbers at birth. When I asked why, I was told 'Oh, that's in case their mom wants to go on welfare or something'.
I was under the impression that having a SSN for your child is necessary for the parent to claim the appropriate "I have successfully reproduced." tax credit. I could be wrong, as I'm not a tax expert.
My renters insurance from when I lived in the US (provided by USAA) coverd damage to insured property due to falling aircraft, spacecraft, satellites, and/or objects falling from space on the condition that the object pass through the ceiling, wall, or window prior to it striking and damaging the insured property (i.e. I can't file a claim for a meteor damaging my computer if there's not a hole in the ceiling from the meteor passing through it.).
Fortunately, I never had to use it./it always seemed odd that anything involving radiation (e.g. ranging from radioactive contamination all the way up to a full-out nuclear explosion) was completely exempted from the policy. I presume that a nuclear explosion would be catastrophic to insurers (not to mention residents) covering that region which is why the exclude it (same thing with floods), but still...
You realize that the Department of Commerce also controls the root DNS zone right? They also allow Verisign to control.com and.net on their behalf (via ICANN)..com and.net are very much under US control.
The Department of Commerce, via their ownership of the root DNS zone, also allow SWITCH to control.ch (the ccTLD for Switzerland) on their behalf (via ICANN). Does that make.ch under US control?.com/.net/.org are not US domains anymore than.ch is a US domain.
The Glock 23 has no metal parts in it (as the most famous - You can actually get at least half-a-dozen polymer frames today, in a variety of poly chambers and actions). Poly casings hit the mainstream within the last few years (though they still cost a bit more); Hand-load with a properly sized ceramic bullet, and you have fully live firearm without a scrap of metal in it.
Say what? The Glock 23 certainly is made of metal, as are all Glock pistols. The barrel, slide, and much of the internal mechanisms are steel and comprise about 80% of the gun's mass. It is certainly detectable by airport metal detectors.
The plastic parts show up clearly on airport x-ray baggage scanners. The plastic parts and magazines have a fair bit of metal in them as well for strengthening (and the metal rails on the frame for the slide to move on) and would set off metal detectors.
There's nothing special about the Glock 23: it's simply the mid-sized model chambered in.40 S&W. I have owned it's 9mm counterpart, the Glock 19, and the subcompact 9mm Glock 26 and can confirm that both the 9mm and.40 S&W models have considerable amounts of metal.
The DNS system as it is now, in the not too distant future, I suspect will be viewed as little more than a Racket. Domain registration should be effectively free. There is no justification for the current registration fees (let alone the BLATANT racketeering fees for xxx and toplevel domains).
Perhaps, but the DNS requires infrastructure to operate. That infrastructure isn't free.
The costs for the gTLDs are pretty reasonable (roughly $10/year for retail pricing; the registry gets what, maybe $6.50/year out of that?). I'm not sure how much of it actually makes it down to the folks who operate the roots, but they should definitely get some of it (assuming they aren't already). It's not easy running a distributed, global system upon which the entire internet relies and that has had 100% uptime for as long as I can remember.
Most ccTLDs are quite reasonably priced. Some are crazy expensive, relatively, but they're still less than $100/year.
Indeed. Cox, a cable ISP in the US, was silently re-writing DNS TTLs from whatever value the authoritative nameserver had set to 30 seconds. It didn't matter if it was a long-lived NS record or a short-lived dynamic DNS entry, everything got changed to 30 seconds. Even the entries for the root nameservers were cached for 30 seconds, increasing their load.
When I had their service and this was affecting me I wrote to their customer support and prefixed the message with a "This is a specialized technical issue about Cox's DNS servers and is not addressable by customer support staff. Please forward this to the systems/network administration folks." The message included a quick summary of the problem, results of dig tests on both Cox's and third-party resolvers, etc.
I got a response two days later saying "We're sorry you're having difficulty setting up your wireless router. You might find the instructions at $URL helpful..."
After that point, I stopped bothering and switched to Google Public DNS. Google's nameservers respected TTLs, didn't do the SiteFinder interception of non-existent domains, and actually had better performance.
GPS receivers (and the filters in their electronics) were built with the assumption that neighboring frequencies would be used by other space-to-ground uses, and thus would have comparable signal strengths (that is, very low).
Having ground-based stations blasting out signals that are brazillions of times more powerful than the weak space-to-ground signals on adjacent frequencies would overwhelm the relatively weak signal from GPS. Filters that can allow the weak GPS signals through while blocking out the immensely more powerful signals on neighboring frequencies would be bulky and expensive. Devices not equipped with those specialized filters (that is, essentially every GPS receiver ever made) would be screwed.
I'm sure that if LightSquared wanted to use the frequencies they acquired for space-to-ground uses, the FCC would have very little trouble with it and the potential for interference with GPS would be essentially nil. Instead, LightSquared purchased (leased? I'm nowhere near an expert on this kind of thing.) these frequencies at a cheap price due to their being intended for space-to-ground use and was trying to change their classification to use them for ground-based transmitters (thus saving LightSquared tons of money acquiring spectrum). They gambled big and (rightfully) lost.
Reliable GPS service is more important than the communication network LightSquared proposed, particularly in regards to safe navigation for aircraft and vessels.
While NameCheap is ICANN-accredited, it looks like nearly all of their domain-related services are handled by eNom, who doesn't seem like the most above-board place around. Sure, eNom has a ton of domains registered with them, but that doesn't mean they're not shady.
Personally, I'd rather go with Gandi or NearlyFreeSpeech.net.
Having been in areas with reasonable (and non-excessive) police patrolling the roads and in areas (say Rome or Cairo) where obediance of common-sense traffic laws is essentially non-existent, I much prefer having the police around to keep things flowing smoothly.
In Cairo, traffic laws technically exist but are widely disregarded (mostly because the police aren't anywhere near sufficient in number to enforce them after the revolution last year). Previously one-way streets now have (unofficial) two-way traffic, which results in massive delays and confusion. People ignore traffic signals, and so a light will cycle through green-yellow-red a dozen times and maybe one car gets through (due to the cross-traffic not bothering to stop). Farmers bring their donkey-pulled carts onto controlled-access highways, causing massive slowdowns. Vendors will set up food carts in the middle of a multi-lane road, blocking a full lane, and sell food. All the drivers are honking and gesturing, but because traffic is so snarled the vendor makes decent business from drivers and pedestrians who take advantage of the stopped traffic to cross the street. If a road has lines painted for three lanes of traffic in one direction, there will be five actual lanes of traffic (nobody pays any attention to the painted lines).
In short: driving in Cairo is pure chaos. Left to their own devices, people drive like maniacs.
Having an oppressive police state on the road (or the speed traps set up by small rural towns) is undesireable and benefits nobody (except the police), certainly, but having clear, well-defined rules that are enforced by the police helps keep things flowing smoothly and safely. The Swiss (I live in Switzerland), for example, have reasonable traffic laws (though they do tend to enforce speed limits quite harshly) and reasonable enforcement, and traffic tends to flow well.
Perhaps not, but the vast majority of users don't care. Many users are not unlike my mother, who constantly clicks "Later" or "Not Now" whenever programs ask to install updates. For this reason, her computer is routinely several months behind the current updates.
Having Chrome auto-update silently and without needing admin rights (as it by default installs itself only for the user that opened the installer, not system-wide) is enormously convienient (and the right choice) for most people.
As an American living in Europe (Switzerland), I concur. I pay about CHF 74 ($80.75 USD, $80.65 CAD) per month for 25Mbps cable internet, landline-phone-over-cable, and a pretty comprehensive cable TV (tons of European channels, lots of English-language stuff including ESPN America [I'm a hockey fan, my wife's an American Football fan], and about 150 radio-over-cable stations). There's no caps or throttling on the internet usage.
We were paying about about the same price in Phoenix, Arizona for 12Mbs cable internet and basic cable (pretty much local channels and some of the big networks like TBS, CBS, ABC, etc.).
Of course, some of the sites my wife and I visit are all in North America and visiting those sites incurs more latency, but it's not a big deal.
I'm an American studying in Switzerland. I bank with PostFinance, the post office-run financial institution.
Any electronic documents or messages from the bank are digitally signed: PDFs are signed and time-stamped using the built-in PDF signature methods. Emails, even the general informative newsletter containing no account-related information at all, are signed with S/MIME. Any account related communications take place using the internal messaging system on their secure website (which requires the user have access to their bank-issued smartcard and offline calculator-like challenge-response device). The instructions that came with the bank card and calculator device make it very clear how to verify that one is actually on the bank's website.
It's trivial to verify that documents and emails are actually issued by the bank, and the login method for the bank's website makes phishing much more difficult.
Compared to USAA, one of the more clueful US banks, this is excellent. Emails from USAA have the last four digits of the account number in the top-right of the message so as to "authenticate" that the message came from the bank. Of course, this is trivial to reproduce and offers no real validation. It's a shame, really.
If more banks (and indeed, more senders in general) signed their messages, that'd be a major improvement. If the big webmail providers (Gmail, Yahoo, and Hotmail) verified S/MIME signatures and displayed a suitable indicator to users, that'd be even better.
Slashdot Mirror
Indeed.
Google Authenticator (which is an implementation of TOTP, and doesn't send anything back to Google itself) can tie in with SSH/PAM quite easily.
There are perfectly legitimate reasons to maintain user account information in the clear
Personal user information? SS Numbers, addresses? Really?
Sure. Just off the top of my head: an employer would need to keep social security numbers and addresses in the clear for tax purposes, as would pretty much any entity involved with financial transactions.
Yes, the information could be encrypted in the database but the key would need to be accessible if users are able to view and edit their stored information or if the company needs to file tax-related information. This is essentially the same as keeping the information in the clear.
a) Chrome have always done it that way.
b) Chrome doesn't fucking break everything every upgrade!
While I haven't had issues with Firefox breaking add-ons, Chrome also has another advantage[1]: it installs and runs as a user's account, rather than requiring admin rights to install and update. Updates can occur in the background without annoying the user with UAC popups (or their equivalent).
Firefox installs system-wide and requires admin rights to update. This is somewhat annoying.
[1] Some on Slashdot have complained that this is a disadvantage, particularly on managed systems in a workplace, as users shouldn't be able to install programs without administrator rights. In general, I agree. However, for individual users at home (such as my parents) not requiring admin rights is a huge benefit as it means they get to stay up-to-date and patched (including Chrome's built-in Flash and PDF reader) without being interrupted or bothered.
I don't know about Norton, but Windows 7's firewall works just fine with IPv6.
Having driven on rural roads in Nevada, I would hope you don't need a GPS for help - i.e. take next left turn in 115 miles. First business on left (28 miles).
Touché.
*shrugs* If I need GPS, I use my cell phone. It has current maps, and doesn't require me to buy a $200 update every few months so I'm up to date.
For what it's worth, there's quite a few consumer-level GPS receivers for car navigation (such as those produced by Garmin, TomTom, etc.) that have "lifetime" updates -- the maps are updated quarterly (or so) from the vendor.
I have one of these devices and it's quite handy. Many of the cell phone navigation applications I've seen require that one have mobile phone service to get maps -- they cache a bit of the maps in case one is outside of coverage for a little while but if you're out of coverage for an extended period of time (such as driving on rural highways in Nevada) the maps and directions quickly become useless.
Having a self-contained navigation system has its advantages in quite a few places.
Much of the abuse I see on the internet (such as spam, port scans, SSH login attempts, etc.) are from bots.
Most of the individual users have no idea their computer is compromised, let alone any idea how to fix the problem. Having ISPs take a more active role in securing their networks and helping users secure their systems is a worthy endeavor.
It was actually a water pump, not an electric utility.
Too many site owners are worried about SEO strategies rather than producing good content.
Being a kid of the 50's, I didn't get a Social Security card until I enlisted in the Army. I was 17. 10 years later, my kids got issued Social Security numbers at birth. When I asked why, I was told 'Oh, that's in case their mom wants to go on welfare or something'.
I was under the impression that having a SSN for your child is necessary for the parent to claim the appropriate "I have successfully reproduced." tax credit. I could be wrong, as I'm not a tax expert.
My renters insurance from when I lived in the US (provided by USAA) coverd damage to insured property due to falling aircraft, spacecraft, satellites, and/or objects falling from space on the condition that the object pass through the ceiling, wall, or window prior to it striking and damaging the insured property (i.e. I can't file a claim for a meteor damaging my computer if there's not a hole in the ceiling from the meteor passing through it.).
Fortunately, I never had to use it. /it always seemed odd that anything involving radiation (e.g. ranging from radioactive contamination all the way up to a full-out nuclear explosion) was completely exempted from the policy. I presume that a nuclear explosion would be catastrophic to insurers (not to mention residents) covering that region which is why the exclude it (same thing with floods), but still...
You realize that the Department of Commerce also controls the root DNS zone right? They also allow Verisign to control .com and .net on their behalf (via ICANN). .com and .net are very much under US control.
The Department of Commerce, via their ownership of the root DNS zone, also allow SWITCH to control .ch (the ccTLD for Switzerland) on their behalf (via ICANN). Does that make .ch under US control? .com/.net/.org are not US domains anymore than .ch is a US domain.
The Glock 23 has no metal parts in it (as the most famous - You can actually get at least half-a-dozen polymer frames today, in a variety of poly chambers and actions). Poly casings hit the mainstream within the last few years (though they still cost a bit more); Hand-load with a properly sized ceramic bullet, and you have fully live firearm without a scrap of metal in it.
Say what? The Glock 23 certainly is made of metal, as are all Glock pistols. The barrel, slide, and much of the internal mechanisms are steel and comprise about 80% of the gun's mass. It is certainly detectable by airport metal detectors.
The plastic parts show up clearly on airport x-ray baggage scanners. The plastic parts and magazines have a fair bit of metal in them as well for strengthening (and the metal rails on the frame for the slide to move on) and would set off metal detectors.
There's nothing special about the Glock 23: it's simply the mid-sized model chambered in .40 S&W. I have owned it's 9mm counterpart, the Glock 19, and the subcompact 9mm Glock 26 and can confirm that both the 9mm and .40 S&W models have considerable amounts of metal.
The DNS system as it is now, in the not too distant future, I suspect will be viewed as little more than a Racket. Domain registration should be effectively free. There is no justification for the current registration fees (let alone the BLATANT racketeering fees for xxx and toplevel domains).
Perhaps, but the DNS requires infrastructure to operate. That infrastructure isn't free.
The costs for the gTLDs are pretty reasonable (roughly $10/year for retail pricing; the registry gets what, maybe $6.50/year out of that?). I'm not sure how much of it actually makes it down to the folks who operate the roots, but they should definitely get some of it (assuming they aren't already). It's not easy running a distributed, global system upon which the entire internet relies and that has had 100% uptime for as long as I can remember.
Most ccTLDs are quite reasonably priced. Some are crazy expensive, relatively, but they're still less than $100/year.
Indeed. Cox, a cable ISP in the US, was silently re-writing DNS TTLs from whatever value the authoritative nameserver had set to 30 seconds. It didn't matter if it was a long-lived NS record or a short-lived dynamic DNS entry, everything got changed to 30 seconds. Even the entries for the root nameservers were cached for 30 seconds, increasing their load.
When I had their service and this was affecting me I wrote to their customer support and prefixed the message with a "This is a specialized technical issue about Cox's DNS servers and is not addressable by customer support staff. Please forward this to the systems/network administration folks." The message included a quick summary of the problem, results of dig tests on both Cox's and third-party resolvers, etc.
I got a response two days later saying "We're sorry you're having difficulty setting up your wireless router. You might find the instructions at $URL helpful..."
After that point, I stopped bothering and switched to Google Public DNS. Google's nameservers respected TTLs, didn't do the SiteFinder interception of non-existent domains, and actually had better performance.
GPS receivers (and the filters in their electronics) were built with the assumption that neighboring frequencies would be used by other space-to-ground uses, and thus would have comparable signal strengths (that is, very low).
Having ground-based stations blasting out signals that are brazillions of times more powerful than the weak space-to-ground signals on adjacent frequencies would overwhelm the relatively weak signal from GPS. Filters that can allow the weak GPS signals through while blocking out the immensely more powerful signals on neighboring frequencies would be bulky and expensive. Devices not equipped with those specialized filters (that is, essentially every GPS receiver ever made) would be screwed.
I'm sure that if LightSquared wanted to use the frequencies they acquired for space-to-ground uses, the FCC would have very little trouble with it and the potential for interference with GPS would be essentially nil. Instead, LightSquared purchased (leased? I'm nowhere near an expert on this kind of thing.) these frequencies at a cheap price due to their being intended for space-to-ground use and was trying to change their classification to use them for ground-based transmitters (thus saving LightSquared tons of money acquiring spectrum). They gambled big and (rightfully) lost.
Reliable GPS service is more important than the communication network LightSquared proposed, particularly in regards to safe navigation for aircraft and vessels.
While NameCheap is ICANN-accredited, it looks like nearly all of their domain-related services are handled by eNom, who doesn't seem like the most above-board place around. Sure, eNom has a ton of domains registered with them, but that doesn't mean they're not shady.
Personally, I'd rather go with Gandi or NearlyFreeSpeech.net.
What do you lose in Xubuntu (by switching from GNOME Ubuntu)?
GNOME.
That stuff claims to only work for cameras that use flashes (e.g. red light cameras). ANPR readers don't use flashes.
It also doesn't work.
A nice sentiment, but unrealistic.
Having been in areas with reasonable (and non-excessive) police patrolling the roads and in areas (say Rome or Cairo) where obediance of common-sense traffic laws is essentially non-existent, I much prefer having the police around to keep things flowing smoothly.
In Cairo, traffic laws technically exist but are widely disregarded (mostly because the police aren't anywhere near sufficient in number to enforce them after the revolution last year). Previously one-way streets now have (unofficial) two-way traffic, which results in massive delays and confusion. People ignore traffic signals, and so a light will cycle through green-yellow-red a dozen times and maybe one car gets through (due to the cross-traffic not bothering to stop). Farmers bring their donkey-pulled carts onto controlled-access highways, causing massive slowdowns. Vendors will set up food carts in the middle of a multi-lane road, blocking a full lane, and sell food. All the drivers are honking and gesturing, but because traffic is so snarled the vendor makes decent business from drivers and pedestrians who take advantage of the stopped traffic to cross the street. If a road has lines painted for three lanes of traffic in one direction, there will be five actual lanes of traffic (nobody pays any attention to the painted lines).
In short: driving in Cairo is pure chaos. Left to their own devices, people drive like maniacs.
Having an oppressive police state on the road (or the speed traps set up by small rural towns) is undesireable and benefits nobody (except the police), certainly, but having clear, well-defined rules that are enforced by the police helps keep things flowing smoothly and safely. The Swiss (I live in Switzerland), for example, have reasonable traffic laws (though they do tend to enforce speed limits quite harshly) and reasonable enforcement, and traffic tends to flow well.
Perhaps not, but the vast majority of users don't care. Many users are not unlike my mother, who constantly clicks "Later" or "Not Now" whenever programs ask to install updates. For this reason, her computer is routinely several months behind the current updates.
Having Chrome auto-update silently and without needing admin rights (as it by default installs itself only for the user that opened the installer, not system-wide) is enormously convienient (and the right choice) for most people.
As an American living in Europe (Switzerland), I concur. I pay about CHF 74 ($80.75 USD, $80.65 CAD) per month for 25Mbps cable internet, landline-phone-over-cable, and a pretty comprehensive cable TV (tons of European channels, lots of English-language stuff including ESPN America [I'm a hockey fan, my wife's an American Football fan], and about 150 radio-over-cable stations). There's no caps or throttling on the internet usage.
We were paying about about the same price in Phoenix, Arizona for 12Mbs cable internet and basic cable (pretty much local channels and some of the big networks like TBS, CBS, ABC, etc.).
Of course, some of the sites my wife and I visit are all in North America and visiting those sites incurs more latency, but it's not a big deal.
That is an excellent analogy. If you don't mind, I'm going to use that description to explain things to others.
I'm an American studying in Switzerland. I bank with PostFinance, the post office-run financial institution.
Any electronic documents or messages from the bank are digitally signed: PDFs are signed and time-stamped using the built-in PDF signature methods. Emails, even the general informative newsletter containing no account-related information at all, are signed with S/MIME. Any account related communications take place using the internal messaging system on their secure website (which requires the user have access to their bank-issued smartcard and offline calculator-like challenge-response device). The instructions that came with the bank card and calculator device make it very clear how to verify that one is actually on the bank's website.
It's trivial to verify that documents and emails are actually issued by the bank, and the login method for the bank's website makes phishing much more difficult.
Compared to USAA, one of the more clueful US banks, this is excellent. Emails from USAA have the last four digits of the account number in the top-right of the message so as to "authenticate" that the message came from the bank. Of course, this is trivial to reproduce and offers no real validation. It's a shame, really.
If more banks (and indeed, more senders in general) signed their messages, that'd be a major improvement. If the big webmail providers (Gmail, Yahoo, and Hotmail) verified S/MIME signatures and displayed a suitable indicator to users, that'd be even better.
They don't need to, so long as DDG does and you don't search for personally-identifying things about yourself.