$33,500? He probably could have gotten WAY more on the black market. This is ultimately the problem with stingy bug bounties.
How is it a problem?
Its a fact of life that we are daily confronted between the choice to do the right thing and the choice to screw someone over for money.
My neighbor went on vacation, they gave me the keys to the house to water the plants, and bring in her mail. I could turn a tidy profit passing the information that the house is empty to a ring of thieves, steal her identity, and strip her car.
Or I can just water the plants and usually receive a bottle of wine or other small thank you gift.
I had the 'keys to her kingdom', and she repaid my responsible behaviour with a token. Should I complain she's being stingy, and call it a huge problem too?
Giving you the 'keys to her kingdom' sounds like a pretty generous repayment for watching over her house, assuming she's at least somewhat attractive.
In addition to its brevity, it also implies the 4 times as many "flags" were taken simply from searches of Google, Linkedin, and others (2x as many points scored, with flags being worth 0.5x those taken via social engineering). Sounds like the corporate website and employees' social networking accounts are the real threat...
Since the article doesn't bother listing what the flags were, one cannot assign a weight to each of them. If all the flags were of equal importance than I would agree with you. But if some are more critical than others, e.g. if flag 1 is "What is the CEO's name?", and flag 2 is "What is the CEO's login and password?", then comparing raw counts as the article is doing is both pointless and misleading.
Being part of IT does not require different thinking. Vulnerability testing is a good thing in the physical world too. And it's also very often illegal without the prior consent of the owner. This is partially because it's pretty much impossible to know with 100% certainty what someone's true intentions are. But also partially because the tester might cost the owner lots of time and money that could have been avoided had the tester simply informed the owner beforehand.
I don't think he should have been expelled; his expulsion was obviously political. But he really should have contacted the company and gotten their permission in writing first.
Remember, people can do bad things even with good intentions.
I wonder if this guy hates his job/Nokia/Microsoft. I meant if he loves his company, he should have contacted Microsoft, and get fixed, then perhaps gets some street cred by publishing some news report.
I am not sure if this kind of activity would sour the relationship between Microsoft and Nokia. Perhaps that's actually his goal.
Maybe he did contact Microsoft and they ignored him. Maybe he felt whistle-blowing was the only way to get this fixed.
And if you're on the cellphone doing whatever, you should be shot.
FTFY.
And by the way, the laws in some (probably many) states do state that you HAVE to go the speed limit, with a few exceptions. For example, here is the text from Arizona law:
"A person shall not drive a motor vehicle at a speed that is less than the speed that is reasonable and prudent under existing conditions unless the speed that is reasonable and prudent exceeds the maximum safe operating speed of the lawfully operated implement of husbandry."
"The speed that is reasonable and prudent under existing conditions" is defined elsewhere in the law as the speed limit if there's no bad weather, road hazards, etc.
Most people driving below the limit would argue that it exceeds the max safe operating speed of the vehicle, but in reality most newer vehicles can drive the limit just fine. It's the driver who's not comfortable with driving the limit, blaming the car is just a convenient excuse.
Of course, this provision is never, ever enforced. But it should be pretty obvious why it's there. People driving 20 MPH under the speed limit add nearly as much danger to the roads as people driving 20 MPH over the speed limit.
They're going to pack 5-10 Arduinos on one satellite so they can have multiple programs running at once. There are also other things that can be bought: for $150 you can buy 15 images to be taken when the satellite passes over your selected targets, and for $300 you can upload a message to be broadcast for a day.
According to the article, the whole thing is expected to cost $86,500 to launch. As long as they can actually meet their budget, it shouldn't be too difficult to make some money. And if the first one is a success, it should be pretty easy for them to launch more later.
Because that's the only system we have. IANAL, but I don't think they could sue anyone asking for a "permanent cell phone" ban (not that it would be enforceable anyway).
Personally I'd rather see them sue asking for the removal of the driver's thumbs. Because if there's any chance to make the driver believe even for a second that he could actually lose his thumbs, he might finally understand that he shouldn't be playing with his damn phone while driving.
P.S. I completely disagree with them suing the girlfriend, but I can't say that I wouldn't get equally suckered by a slick-talking lawyer in a similar situation. Walk a mile, and all that...
Since we're discussing information storage rather than calculations (certainly the two are related but not the same), then per your example the information storage act would require energy to place the water molecule into the box in the first place. If you ignore that by assuming the molecule is already there, then you haven't stored anything and are simply in the intrinsic state of the box like I discussed originally. A computation with no controlled inputs yields no information, it's just nature running its course.
Perhaps you are thinking of this in a purely theoretical sense. In that case then yes, if you can harvest 100% of the energy stored when changing a value, then no additional energy is required.
But, of course, we do not live in such a perfect world. One can never achieve true 100% efficiency. And because of this, my point continues to be that it is impossible to continuously change states in order to store new information without losing some energy. Note that I never said 100% of the energy used during the original storage has to be lost. I simply said that at least some of it would be lost. In the case of the billiard balls, you only spend energy at the beginning as you mentioned, but the amount of energy required is proportional to the number of gates and, due to the laws of thermodynamics, you can never reclaim 100% of that energy after the computation is complete. Therefore, to perform a new computation and store the subsequent result, you would need to expend additional energy to reset the system and restart the computation.
Changing the state of a bit is not necessarily the same as storing information. To be used for information storage, the system can only move between valid states through external stimuli. If it changes to a different state without external stimuli, then it either doesn't store information or the states are not defined correctly.
The whole point of storing something is to have it maintain its state. If an item is not maintaining a single state, then it's not storing information. And if the item is maintaining the state, then you must apply external stimuli (and therefore energy) to change its state, otherwise it's not maintaining the state, now is it?
To store information, you need the ability to set something into at least two possible states, one of which can be the intrinsic state. No matter what you use for storage, you'll always need energy to reach the non-intrinsic state(s), since the intrinsic state is, essentially by definition, the state achieved with no external energy applied.
If you must add energy to enter a non-intrinsic state, it makes perfect sense that the energy would need to be dissipated to return to the intrinsic state (which equates to erasing the bit). I expect something so obvious wouldn't warrant experiments and articles, so what am I missing that makes this more complicated than it seems to be?
I agree that earlier diagnosis might not have much value beyond consultation, and in fact these brain scans might do more harm than good along that line. But the research might yield clues into what causes autism and, although probably too optimistic, maybe even help lead us to a method of preventing the disorder.
To add to your well-written post, I believe the problem is that some people equate "high auto insurance risk" with "poor driver". As an example for those people, consider a race car driver. I'm quite sure the driver will have insurance on their personal vehicle(s). But does that mean they can just as easily get insurance on their race car? No. Is it because they suddenly become a much worse driver when they get into the race car? No. It's because they are in a much higher risk situation when racing.
To reinforce your final point for those who might not get it, driving ability is only one of many factors used to determine someone's risk. It's not an exact science and insurance companies don't have a magic crystal ball to determine when and who will make a claim and for how much. So they have to estimate it using factors that show a strong correlation with high risk. With all other things equal, being a bad driver correlates to being a higher risk, but the inverse is not necessarily true.
While the driver may not have much control over their employer/house/etc., they certainly have far more control over their own situation than the insurance company or its other customers have.
If the driver is, for any reason, more likely to be involved in an accident, then statistically speaking, the insurance co. will have to pay out more money in claims due to having that driver as a customer. The money has to come from somewhere. So the insurance co. has two choices: "punish" that driver with higher premiums, or "punish" other customers by increasing everyone's premiums slightly. And while spreading claims costs across the populace is essentially the main function of insurance companies, they can't spread it too much because eventually people who don't make any claims will get fed up and leave.
Personally, I'd rather have the insurance co. "punish" the one driver rather than charge me more. After all, it's not like I can force that driver to change jobs or houses.
You're forgetting the most important part. Insurance companies don't have to tell you how much of a risk you are calculated to be. So as long as they can convince some customers to pay more, the companies can afford to let some customers pay less.
Insurance isn't about charging people exactly how much they will have to pay out. It's about spreading loss costs over a wide populace. Risk calculation is important to make sure you're collecting enough premiums to cover everyone and to avoid grossly-overcharging low-risk customers (since they would eventually wise up and leave).
Besides, insurance companies don't make money off the premiums they collect. They invest the premiums and turn profits on the returns. It's the actuaries' jobs to ensure insurance companies don't take on so many high-risk customers that they end up paying out more than they are making on their investments.
Whether or not frequent sharp braking correlates to bad driving is irrelevant. All that matters is whether or not it correlates to a higher accident rate.
If the driver is bad, they'll brake sharply often. But even if the driver is good, if they are regularly surrounded by bad drivers, they'll probably brake sharply often. And guess what? In both cases they're more likely to be involved in an accident.
If you tell the executive branch, "Hey a whole bunch of D-bags in Congress are being bought and paid for," I'd bet they'd be willing to at least take a look.
Nah, the current administration won't care much. Now if you tell them a bunch of R-bags in Congress are being bought and paid for, then they'll go to hell and back trying to prove it.
I'm sure it also has to do with the resolution of the nozzle positioning system as well as the spread of the droplets once they hit the surface. To get true 10 million dpi, I think you would need to be able to create 2 dots 100 nm apart without them shorting together.
Of course, it sounds like the resolution is still much better than existing technology, just not 10 million dpi.
You assume that companies can place anything they wish in license agreements. You always have the right to believe something in an agreement is not legal. Based on that belief, you can then choose to fight it in court up front, or you can take your chances choosing to ignore it first then potentially end up in court anyway (probably having to pay lots of $$ if you lose).
Just because something appears in a license agreement does not automatically mean it must be adhered to. But you better be ready to defend your position and face any possible consequences if you choose to ignore it.
Slashdot Mirror
Gee. You can't believe *anything* you read on the internet anymore. *LOL*
I don't believe you.
$33,500? He probably could have gotten WAY more on the black market. This is ultimately the problem with stingy bug bounties.
How is it a problem?
Its a fact of life that we are daily confronted between the choice to do the right thing and the choice to screw someone over for money.
My neighbor went on vacation, they gave me the keys to the house to water the plants, and bring in her mail. I could turn a tidy profit passing the information that the house is empty to a ring of thieves, steal her identity, and strip her car.
Or I can just water the plants and usually receive a bottle of wine or other small thank you gift.
I had the 'keys to her kingdom', and she repaid my responsible behaviour with a token. Should I complain she's being stingy, and call it a huge problem too?
Giving you the 'keys to her kingdom' sounds like a pretty generous repayment for watching over her house, assuming she's at least somewhat attractive.
In addition to its brevity, it also implies the 4 times as many "flags" were taken simply from searches of Google, Linkedin, and others (2x as many points scored, with flags being worth 0.5x those taken via social engineering). Sounds like the corporate website and employees' social networking accounts are the real threat ...
Since the article doesn't bother listing what the flags were, one cannot assign a weight to each of them. If all the flags were of equal importance than I would agree with you. But if some are more critical than others, e.g. if flag 1 is "What is the CEO's name?", and flag 2 is "What is the CEO's login and password?", then comparing raw counts as the article is doing is both pointless and misleading.
Being part of IT does not require different thinking. Vulnerability testing is a good thing in the physical world too. And it's also very often illegal without the prior consent of the owner. This is partially because it's pretty much impossible to know with 100% certainty what someone's true intentions are. But also partially because the tester might cost the owner lots of time and money that could have been avoided had the tester simply informed the owner beforehand.
I don't think he should have been expelled; his expulsion was obviously political. But he really should have contacted the company and gotten their permission in writing first.
Remember, people can do bad things even with good intentions.
I wonder if this guy hates his job/Nokia/Microsoft. I meant if he loves his company, he should have contacted Microsoft, and get fixed, then perhaps gets some street cred by publishing some news report.
I am not sure if this kind of activity would sour the relationship between Microsoft and Nokia. Perhaps that's actually his goal.
Maybe he did contact Microsoft and they ignored him. Maybe he felt whistle-blowing was the only way to get this fixed.
Hello. My name is Mike Quinn. You leaked my memo. Prepare to die.
And if you're on the cellphone doing whatever, you should be shot.
FTFY.
And by the way, the laws in some (probably many) states do state that you HAVE to go the speed limit, with a few exceptions. For example, here is the text from Arizona law:
"A person shall not drive a motor vehicle at a speed that is less than the speed that is reasonable and prudent under existing conditions unless the speed that is reasonable and prudent exceeds the maximum safe operating speed of the lawfully operated implement of husbandry."
"The speed that is reasonable and prudent under existing conditions" is defined elsewhere in the law as the speed limit if there's no bad weather, road hazards, etc.
Most people driving below the limit would argue that it exceeds the max safe operating speed of the vehicle, but in reality most newer vehicles can drive the limit just fine. It's the driver who's not comfortable with driving the limit, blaming the car is just a convenient excuse.
Of course, this provision is never, ever enforced. But it should be pretty obvious why it's there. People driving 20 MPH under the speed limit add nearly as much danger to the roads as people driving 20 MPH over the speed limit.
We often think of the DNA as the storage medium...
You might, but I'm betting physicists think differently. It all depends on the information to which you're referring.
Agreed. The real question is whether or not Kickstarter backers will get their money back if the thing doesn't work.
They're going to pack 5-10 Arduinos on one satellite so they can have multiple programs running at once. There are also other things that can be bought: for $150 you can buy 15 images to be taken when the satellite passes over your selected targets, and for $300 you can upload a message to be broadcast for a day.
According to the article, the whole thing is expected to cost $86,500 to launch. As long as they can actually meet their budget, it shouldn't be too difficult to make some money. And if the first one is a success, it should be pretty easy for them to launch more later.
I have no idea where you crazy copyright-lobby-sympathizers come up with these absolutely ridiculous analogies, but seriously - no one is buying it!
That's the problem. They're downloading it for free instead.
Then why sue anybody at all?
Because that's the only system we have. IANAL, but I don't think they could sue anyone asking for a "permanent cell phone" ban (not that it would be enforceable anyway).
Personally I'd rather see them sue asking for the removal of the driver's thumbs. Because if there's any chance to make the driver believe even for a second that he could actually lose his thumbs, he might finally understand that he shouldn't be playing with his damn phone while driving.
P.S. I completely disagree with them suing the girlfriend, but I can't say that I wouldn't get equally suckered by a slick-talking lawyer in a similar situation. Walk a mile, and all that...
...in what will be a once-in-a-lifetime experience
Transits occur in pairs...the last transit was in 2004.
So, what you're saying is it could be a twice-in-a-lifetime experience for some?
Since we're discussing information storage rather than calculations (certainly the two are related but not the same), then per your example the information storage act would require energy to place the water molecule into the box in the first place. If you ignore that by assuming the molecule is already there, then you haven't stored anything and are simply in the intrinsic state of the box like I discussed originally. A computation with no controlled inputs yields no information, it's just nature running its course.
Perhaps you are thinking of this in a purely theoretical sense. In that case then yes, if you can harvest 100% of the energy stored when changing a value, then no additional energy is required.
But, of course, we do not live in such a perfect world. One can never achieve true 100% efficiency. And because of this, my point continues to be that it is impossible to continuously change states in order to store new information without losing some energy. Note that I never said 100% of the energy used during the original storage has to be lost. I simply said that at least some of it would be lost. In the case of the billiard balls, you only spend energy at the beginning as you mentioned, but the amount of energy required is proportional to the number of gates and, due to the laws of thermodynamics, you can never reclaim 100% of that energy after the computation is complete. Therefore, to perform a new computation and store the subsequent result, you would need to expend additional energy to reset the system and restart the computation.
Changing the state of a bit is not necessarily the same as storing information. To be used for information storage, the system can only move between valid states through external stimuli. If it changes to a different state without external stimuli, then it either doesn't store information or the states are not defined correctly.
The whole point of storing something is to have it maintain its state. If an item is not maintaining a single state, then it's not storing information. And if the item is maintaining the state, then you must apply external stimuli (and therefore energy) to change its state, otherwise it's not maintaining the state, now is it?
To store information, you need the ability to set something into at least two possible states, one of which can be the intrinsic state. No matter what you use for storage, you'll always need energy to reach the non-intrinsic state(s), since the intrinsic state is, essentially by definition, the state achieved with no external energy applied.
If you must add energy to enter a non-intrinsic state, it makes perfect sense that the energy would need to be dissipated to return to the intrinsic state (which equates to erasing the bit). I expect something so obvious wouldn't warrant experiments and articles, so what am I missing that makes this more complicated than it seems to be?
I agree that earlier diagnosis might not have much value beyond consultation, and in fact these brain scans might do more harm than good along that line. But the research might yield clues into what causes autism and, although probably too optimistic, maybe even help lead us to a method of preventing the disorder.
Well, at least someone gets it.
To add to your well-written post, I believe the problem is that some people equate "high auto insurance risk" with "poor driver". As an example for those people, consider a race car driver. I'm quite sure the driver will have insurance on their personal vehicle(s). But does that mean they can just as easily get insurance on their race car? No. Is it because they suddenly become a much worse driver when they get into the race car? No. It's because they are in a much higher risk situation when racing.
To reinforce your final point for those who might not get it, driving ability is only one of many factors used to determine someone's risk. It's not an exact science and insurance companies don't have a magic crystal ball to determine when and who will make a claim and for how much. So they have to estimate it using factors that show a strong correlation with high risk. With all other things equal, being a bad driver correlates to being a higher risk, but the inverse is not necessarily true.
While the driver may not have much control over their employer/house/etc., they certainly have far more control over their own situation than the insurance company or its other customers have.
If the driver is, for any reason, more likely to be involved in an accident, then statistically speaking, the insurance co. will have to pay out more money in claims due to having that driver as a customer. The money has to come from somewhere. So the insurance co. has two choices: "punish" that driver with higher premiums, or "punish" other customers by increasing everyone's premiums slightly. And while spreading claims costs across the populace is essentially the main function of insurance companies, they can't spread it too much because eventually people who don't make any claims will get fed up and leave.
Personally, I'd rather have the insurance co. "punish" the one driver rather than charge me more. After all, it's not like I can force that driver to change jobs or houses.
You're forgetting the most important part. Insurance companies don't have to tell you how much of a risk you are calculated to be. So as long as they can convince some customers to pay more, the companies can afford to let some customers pay less.
Insurance isn't about charging people exactly how much they will have to pay out. It's about spreading loss costs over a wide populace. Risk calculation is important to make sure you're collecting enough premiums to cover everyone and to avoid grossly-overcharging low-risk customers (since they would eventually wise up and leave).
Besides, insurance companies don't make money off the premiums they collect. They invest the premiums and turn profits on the returns. It's the actuaries' jobs to ensure insurance companies don't take on so many high-risk customers that they end up paying out more than they are making on their investments.
Whether or not frequent sharp braking correlates to bad driving is irrelevant. All that matters is whether or not it correlates to a higher accident rate.
If the driver is bad, they'll brake sharply often. But even if the driver is good, if they are regularly surrounded by bad drivers, they'll probably brake sharply often. And guess what? In both cases they're more likely to be involved in an accident.
If you tell the executive branch, "Hey a whole bunch of D-bags in Congress are being bought and paid for," I'd bet they'd be willing to at least take a look.
Nah, the current administration won't care much. Now if you tell them a bunch of R-bags in Congress are being bought and paid for, then they'll go to hell and back trying to prove it.
I'm sure it also has to do with the resolution of the nozzle positioning system as well as the spread of the droplets once they hit the surface. To get true 10 million dpi, I think you would need to be able to create 2 dots 100 nm apart without them shorting together.
Of course, it sounds like the resolution is still much better than existing technology, just not 10 million dpi.
You assume that companies can place anything they wish in license agreements. You always have the right to believe something in an agreement is not legal. Based on that belief, you can then choose to fight it in court up front, or you can take your chances choosing to ignore it first then potentially end up in court anyway (probably having to pay lots of $$ if you lose).
Just because something appears in a license agreement does not automatically mean it must be adhered to. But you better be ready to defend your position and face any possible consequences if you choose to ignore it.
Who cares? Just think of all the energy you could produce by dropping it on the tiles!