But, your forgetting that there still is a paper trail with ATM's - their just inside the ATM where it keeps a record of all of it's transactions
But that paper is not more trustable than the ATM itself. The software in the ATM printed it, after all!
If you suspect that a hacker (or fraudulent banker) has modified the ATM to cheat you, you should be equally worried that he has changed the very software which prints that internal paper.
(Maybe if the paper was visible in a little plexiglass window, before stacking up inside the machine... that might inspire a little more trust)
Secondly, to say that a user-space game program executing which happens to load a global system level DLL is "running as root" is complete nonsense.
If the DLL was included with the game, it is part of the game. (And if the DLL wasn't included, then why's the game need administrator to install again?)
Sure, maybe the DLL in question was written by Microsoft as a redistributable Visual Studio or DirectX component... but maybe not.
For any executable code delivered with a game, you must trust the game publisher as to what it contains. For all security purposes, at least, it is an extension of the game.
A game that is dynamically linked, for example, to the MSVCRT C++ runtime does not run as "root".
I'm not talking about games loading DLLs installed as part of the OS, or some systemwide upgrade patch- but DLLs which the game itself provided.
If it's genuinely IMPOSSIBLE to install a DLL without administrator rights, then that DLL must have some special priviledges when executing. And if it does, and the DLL came with the game, then the game could be using it to do anything; "run as root". On the other hand, if the DLL when executing does not have any special privs, then it should've been possible to install without admin privs, and we've come back to a different flaw of the OS.
Videogames are frivolous. As amusing diversions, they should not demand a security audit before install. From the "sanely paranoid" perspective, if a game needs to be given admin rights at any time, then it's a risk to the other data on your PC.
It is not secure system design to accept games requiring admin privs to install; for all you know, it could be abusing that priv to modify core system DLLs, meaning it will essentially keep those privs forever.
X + fluxbox seemingly takes up more memory than Windows XP does just sitting there.
Hope you're not making the classic error of running "top" to find out how much RAM X uses. The total it prints includes your video card RAM... which could easily be 128 or even 256 greater than the actual usage.
Aside from proposing two radical new ideas, the moon base and manned mars exploration
They're not radical or new. Those ideas have been proposed thousands of times before. There's even a whole society dedicated to promoting manned mars exploration. And the moon base was proposed by China just months before Bush's copycat suggestion.
he has consistently incrased NASA's budget,
No he hasn't. Bush doesn't even have the power to set budgets. The NASA's budgets throughout his term have been increased in total dollars, but at less than the rate of inflation, so they were really minor cutbacks.
crazies like you start to flip out
Flipping out? You're the one using all the extra punctuation. All I said is that Bush hasn't done anything, and is not going to do anything. Both of those things are trivially true, because his proposed Mars plan won't really start up until 2009 at the earliest, when he'll be long gone. At that point the fact that there's simply no funding available (without huge tax increases, which Bush claims to hate) will become undeniably clear.
, I admin the machine, ergo I decide what gets installed and what doesn't:
Do you decide when the user may copy individual *.DOC files to the hard-drive? Those are being "installed"- why, they may even contain executable code...
may elect to install or update system level DLLs which logically requires root level access to the machine
It is a shortcoming of the OS design that the game cannot use the DLLs it needs without installing them in a system-global location. (Alternatively, you could label it a shortcoming of the installer system- but that should be part of the OS)
The fact that games need to run at "root" level is what's being complained about here- but the excuse was made "they don't really need priviledges to run, only to install". Well, that doesn't hold water if the game includes system-level DLLs- effectively, if it's using those DLLs, it is "running as root".
Does that qualify as "installation?"
Yes, by any concievably sane definition of "installation".
I routinely play Starcraft and Unreal Tournament 2004 on my Powerbook G4 at non-native resolutions and they look fine to me
If your laptop is a multiple of 640x480, like 1280x960, then the described blurriness wouldn't actually occur for you.
The effect is worst when you run a program a a resolution close to, but not identitical to, the fixed rez of the LCD. That produces some fairly painful scaling artifacts.
A) Security cameras are invisible. You don't know where they are. (Maybe stores you're familiar with prefer the visible cameras, but they have the option to hide them)
B) Situating yourself to work behind a visibility blocker is itself a suspicious act.
C) So what if you can get away with it a few times? All they really need is to prevent habitual abuse- which can be detected by watching the faces of customers who loitered by the effected items on the day previously. And I have NOT heard of "sleight of head".
If you remap every item in the store, everything everyone buys on that day will be wrong.
That'll be noticed rather quickly, and the store will close up (or go to slower manual checkout) for a few days to sort things out.
All you can accomplish there is a DoS against the store; disrupting their earnings by scrambling with tags. That is a true vulnerability of the system (IF the RFID tags are reprogrammable, and they probably won't be)... but few people would go to all the effort to pull it off, if it's not profitable for the attacker.
(That does not compare with virus-programmers, btw. One single internet worm can infect around the country, for several months. But a single RFID scrambler can only hit one store at a time)
But if I can change the ID number of a $2500 Rolex to that of a $2200 Rolex,
Items of $1000 or more aren't likely to be place out where you can handle them without direct saleman supervision. Even $200 objects are often held in locked cases- not to prevent price-tampering, but simple theft.
RFID is most attractive to POS items between $3 and $100. Below that, the cost of tag starts to be noticable; above, and the volume of merchanise is so low that automated handling saves little.
(Of course, for warehousing & transport, RFID is good for a bigger range of costs)
ut I still think it'd be most useful if each can were uniquely identifiable for individual sales.
Each can needs its own number anyhow, for nightly inventory. The employee must be able to take 10 minutes waving a wand around the shelves to count exactly how many of each product is left.
You can't do this reliably if multiple packages can have the exact same RFID. Otherwise there's the risk of counting the same thing multiple times, depending on the pattern of waving. The wand can't know if you've already scanned this box from the other side of the shelf.
Taking inventory with RFID means not counting the number of each RFID tag found, but listing all RFID tags in the store, looking up the corresponding product number, and only then adding them up.
There is no reason to put an FRID into the cans going into Drink Machines. They serve no purpose that isn't already covered by tried and true technology.
They can serve some new purposes, allowing future drink machines to be designed differently.
RFID-enabled machines can have smaller granularity of product choices. Suppose machines hold 320 drinks. If it's split into 8 columns, you can only put 8 different things in there, limiting marketing opportunities. (Can't have 5 kinds of expensive, rarely purchased fruit drink in addition to the 4 columns of high-volume cola that sells out in a day)
If it's assured that all cans will carry RFID, then the machine no longer must be build with separate columns for separate drinks. Dozens of different choices can all sit in one big holding area, which the machine searches through to match any customer choice. This increases the ability to load it with a maximally-profitable selection.
cuecat = usb if I remember rightly, and dont the majority of pda's have usb?
No and no.
Cuecat would've been cooler as USB, but it had a kinda passthru to a legacy port. And most PDAs don't "have USB". They are capable of being a USB device (usually as part of the cradle), but not having USB gizmos plugged into them (host vs slave)
Your description betrays a misunderstanding of encryption technology, which is irrelevant to the quality of the suggestion.
Digitally signing a checksum is about as silly as compressing a file twice for better storage. You should just sign the whole record and be done with it. Some form of checksum will undoubtably be part in the signing process.
AC says: There's no ISP I know of charging for "international traffic," not in US or Korea.
Ok mediot... just because ISPs don't charge customers for international access doesn't mean they get it for free. They have to pay other ISPs to take their packets out of country. The price is rolled up into your final bill.
Any ISP's businessplan must include an estimate of what percentage of packets can be served on it's own network, which go to neighboring national ISPs, and which need longer-haul routes. Packets from a US user will, on average, need to make many more hops between different ISPs. (I bet Korean packets only need to switch ISPs once, at the master hub in Seoul)
For each of those hops, the ISP needs a payment agreement in place with each other.
The densely populated states still account for the majority of the population
Compared to South Korea, those states aren't "densely populated" at all. Only a few US cities reach that level of density.
All of SK could fit within a day's drive of NYC- and it's population is twice what lives in the NY metropolitan area.
It looks to me like ALL of SK's superiority in broadband can be attributed to compressed geography. (An additional effect of that compression makes broadband more useful to South Koreans: everyone speaking Korean, meaning most servers they'd care to reach, are within a 50ms roundtrip. None of the east-coast/west-coast speed division you get in the USA)
administrator access to _install_, not neccessarily play, which is entirely sensible.
No it isn't. If a person has authority to run programs on a machine, and to place files on the machine, then he should be able to install and run a game off CD. (It should show up only in his own Programs menu, not globally, of course)
This user can undoubtedly install some games, such as a standalone "tetris.exe" or similar, so there's no good reason to prohibit more elaborate installers (unless if that OS doesn't provide a good way to install things in non-global positions, in which case the blame returns to Microsoft)
I specifically was looking for one of the biggest problems with Windows
It also lacks in other areas. For one thing, it ignores the common argument that "Windows only attacked so much because it's the biggest target, not because it's more vulnerable".
And elsewhere it lies, claiming that DOS/Windows has a history of virus-writing that UNIX lacks. That is plainly false, as rtm demonstrated epidemic UNIX infections decades ago.
Why should administrator authority be needed to play a game?
So the game can have "root"-level control over your machine, to ensure that you're not cheating with 3rd-party apps running on the same machine. It must be able to inspect all applications and drivers in memory, comparing them against a list of "cheat signatures" rather like a virus-scanner does.
Seriously. This is exactly what's happening. Evenbalance.com licenses cheat-prevention software modules to several major game publishers, and they've started disallowing players on XP machines unless they're running under the "administrator" account.
Things do happen very quickly here and a delay of even a second can mean the difference between a kill and loss of your platform to hostile fire. Your point about removing humans from harm's way is also well taken.
But the loss of a robotic "platform" can be much less expensive than the loss of a human soldier. A hypothetical remote-controlled infantry-scale robot soldier would have the luxury of waiting for a better evaluation of a target's threat before engaging it... unlike the many current soldiers who gun down unarmed civilians in self-defense.
A robot-controller can err more on the side of caution, where live infantry would behave more aggressively because it's "him or me".
Even Pres Dubya Bush (who is either over-optimistic, or plain stupid, depending who you ask) agrees that his planned Mars trip will cost more than 6 times the intended (past + planned future) ISS spending.
seeing the effort Bush is putting into this at spacedaily.com
He hasn't put in any effort- only the time to give one or two speeches. He's made big promises that won't be blatantly disproved until long after he's out of office.
It was just a way to score points with over-optimistic space-enthusiasts without having to DO anything concrete.
Really, every life is not precious in any general sense.
No, they aren't. But NASA refuses to behave like that. They insist on 99% safety for manned launches, which makes them 10+ times as expensive as a 95% safe unmanned launch.
Because human life is treated as precious by the space program, protecting it uses up the majority of the space budget. Assuming that the USA public's attitude towards dead astronauts can't be changed, he's correct in pointing out manned spaceflight as an expensive distraction.
After fifty years of effort, it's clear that chemically-powered launchers are a dead end.
No, it's not clear at all.
Although I'd like to see an alternative way to escape the gravity well (a space-elevator is less plausible than magnetic rail-launchers, but whatever...), there is no established engineering reason that traditional launches need to cost so much. The reason is only economics, because the price come from the labor of the experts who build the things. Orbital launches are still rare enough to be more like a custom-purchase industry than a mass produced one. The economy-of-scale that would come from launching 50x as frequently would certainly bring on competitive efficiency reducing the prices to $500/lb, or even better.
Read here for a detailed discussion of all the still-unexplored ways that chemical launch motors could be cheapened.
Slashdot Mirror
But, your forgetting that there still is a paper trail with ATM's - their just inside the ATM where it keeps a record of all of it's transactions
But that paper is not more trustable than the ATM itself. The software in the ATM printed it, after all!
If you suspect that a hacker (or fraudulent banker) has modified the ATM to cheat you, you should be equally worried that he has changed the very software which prints that internal paper.
(Maybe if the paper was visible in a little plexiglass window, before stacking up inside the machine... that might inspire a little more trust)
They are in political terms.
You don't believe announcements from the People's Republic of China count as "political"?
Secondly, to say that a user-space game program executing which happens to load a global system level DLL is "running as root" is complete nonsense.
If the DLL was included with the game, it is part of the game. (And if the DLL wasn't included, then why's the game need administrator to install again?)
Sure, maybe the DLL in question was written by Microsoft as a redistributable Visual Studio or DirectX component... but maybe not.
For any executable code delivered with a game, you must trust the game publisher as to what it contains. For all security purposes, at least, it is an extension of the game.
A game that is dynamically linked, for example, to the MSVCRT C++ runtime does not run as "root".
I'm not talking about games loading DLLs installed as part of the OS, or some systemwide upgrade patch- but DLLs which the game itself provided.
If it's genuinely IMPOSSIBLE to install a DLL without administrator rights, then that DLL must have some special priviledges when executing. And if it does, and the DLL came with the game, then the game could be using it to do anything; "run as root". On the other hand, if the DLL when executing does not have any special privs, then it should've been possible to install without admin privs, and we've come back to a different flaw of the OS.
Videogames are frivolous. As amusing diversions, they should not demand a security audit before install. From the "sanely paranoid" perspective, if a game needs to be given admin rights at any time, then it's a risk to the other data on your PC.
It is not secure system design to accept games requiring admin privs to install; for all you know, it could be abusing that priv to modify core system DLLs, meaning it will essentially keep those privs forever.
Any word anywhere on Doom 3 demos?
Get with it! The demo has been out all year.
X + fluxbox seemingly takes up more memory than Windows XP does just sitting there.
Hope you're not making the classic error of running "top" to find out how much RAM X uses. The total it prints includes your video card RAM... which could easily be 128 or even 256 greater than the actual usage.
Aside from proposing two radical new ideas, the moon base and manned mars exploration
They're not radical or new. Those ideas have been proposed thousands of times before. There's even a whole society dedicated to promoting manned mars exploration. And the moon base was proposed by China just months before Bush's copycat suggestion.
he has consistently incrased NASA's budget,
No he hasn't. Bush doesn't even have the power to set budgets. The NASA's budgets throughout his term have been increased in total dollars, but at less than the rate of inflation, so they were really minor cutbacks.
crazies like you start to flip out
Flipping out? You're the one using all the extra punctuation. All I said is that Bush hasn't done anything, and is not going to do anything. Both of those things are trivially true, because his proposed Mars plan won't really start up until 2009 at the earliest, when he'll be long gone. At that point the fact that there's simply no funding available (without huge tax increases, which Bush claims to hate) will become undeniably clear.
, I admin the machine, ergo I decide what gets installed and what doesn't:
Do you decide when the user may copy individual *.DOC files to the hard-drive? Those are being "installed"- why, they may even contain executable code...
may elect to install or update system level DLLs which logically requires root level access to the machine
It is a shortcoming of the OS design that the game cannot use the DLLs it needs without installing them in a system-global location. (Alternatively, you could label it a shortcoming of the installer system- but that should be part of the OS)
The fact that games need to run at "root" level is what's being complained about here- but the excuse was made "they don't really need priviledges to run, only to install". Well, that doesn't hold water if the game includes system-level DLLs- effectively, if it's using those DLLs, it is "running as root".
Does that qualify as "installation?"
Yes, by any concievably sane definition of "installation".
I routinely play Starcraft and Unreal Tournament 2004 on my Powerbook G4 at non-native resolutions and they look fine to me
If your laptop is a multiple of 640x480, like 1280x960, then the described blurriness wouldn't actually occur for you.
The effect is worst when you run a program a a resolution close to, but not identitical to, the fixed rez of the LCD. That produces some fairly painful scaling artifacts.
A) Security cameras are invisible. You don't know where they are. (Maybe stores you're familiar with prefer the visible cameras, but they have the option to hide them)
B) Situating yourself to work behind a visibility blocker is itself a suspicious act.
C) So what if you can get away with it a few times? All they really need is to prevent habitual abuse- which can be detected by watching the faces of customers who loitered by the effected items on the day previously. And I have NOT heard of "sleight of head".
If you remap every item in the store, everything everyone buys on that day will be wrong.
That'll be noticed rather quickly, and the store will close up (or go to slower manual checkout) for a few days to sort things out.
All you can accomplish there is a DoS against the store; disrupting their earnings by scrambling with tags. That is a true vulnerability of the system (IF the RFID tags are reprogrammable, and they probably won't be)... but few people would go to all the effort to pull it off, if it's not profitable for the attacker.
(That does not compare with virus-programmers, btw. One single internet worm can infect around the country, for several months. But a single RFID scrambler can only hit one store at a time)
But if I can change the ID number of a $2500 Rolex to that of a $2200 Rolex,
Items of $1000 or more aren't likely to be place out where you can handle them without direct saleman supervision. Even $200 objects are often held in locked cases- not to prevent price-tampering, but simple theft.
RFID is most attractive to POS items between $3 and $100. Below that, the cost of tag starts to be noticable; above, and the volume of merchanise is so low that automated handling saves little.
(Of course, for warehousing & transport, RFID is good for a bigger range of costs)
ut I still think it'd be most useful if each can were uniquely identifiable for individual sales.
Each can needs its own number anyhow, for nightly inventory. The employee must be able to take 10 minutes waving a wand around the shelves to count exactly how many of each product is left.
You can't do this reliably if multiple packages can have the exact same RFID. Otherwise there's the risk of counting the same thing multiple times, depending on the pattern of waving. The wand can't know if you've already scanned this box from the other side of the shelf.
Taking inventory with RFID means not counting the number of each RFID tag found, but listing all RFID tags in the store, looking up the corresponding product number, and only then adding them up.
There is no reason to put an FRID into the cans going into Drink Machines. They serve no purpose that isn't already covered by tried and true technology.
They can serve some new purposes, allowing future drink machines to be designed differently.
RFID-enabled machines can have smaller granularity of product choices. Suppose machines hold 320 drinks. If it's split into 8 columns, you can only put 8 different things in there, limiting marketing opportunities. (Can't have 5 kinds of expensive, rarely purchased fruit drink in addition to the 4 columns of high-volume cola that sells out in a day)
If it's assured that all cans will carry RFID, then the machine no longer must be build with separate columns for separate drinks. Dozens of different choices can all sit in one big holding area, which the machine searches through to match any customer choice. This increases the ability to load it with a maximally-profitable selection.
cuecat = usb if I remember rightly, and dont the majority of pda's have usb?
No and no.
Cuecat would've been cooler as USB, but it had a kinda passthru to a legacy port. And most PDAs don't "have USB". They are capable of being a USB device (usually as part of the cradle), but not having USB gizmos plugged into them (host vs slave)
digitally signed MD5 checksum
Your description betrays a misunderstanding of encryption technology, which is irrelevant to the quality of the suggestion.
Digitally signing a checksum is about as silly as compressing a file twice for better storage. You should just sign the whole record and be done with it. Some form of checksum will undoubtably be part in the signing process.
AC says: There's no ISP I know of charging for "international traffic," not in US or Korea.
Ok mediot... just because ISPs don't charge customers for international access doesn't mean they get it for free. They have to pay other ISPs to take their packets out of country. The price is rolled up into your final bill.
Any ISP's businessplan must include an estimate of what percentage of packets can be served on it's own network, which go to neighboring national ISPs, and which need longer-haul routes. Packets from a US user will, on average, need to make many more hops between different ISPs. (I bet Korean packets only need to switch ISPs once, at the master hub in Seoul)
For each of those hops, the ISP needs a payment agreement in place with each other.
The densely populated states still account for the majority of the population
Compared to South Korea, those states aren't "densely populated" at all. Only a few US cities reach that level of density.
All of SK could fit within a day's drive of NYC- and it's population is twice what lives in the NY metropolitan area.
It looks to me like ALL of SK's superiority in broadband can be attributed to compressed geography. (An additional effect of that compression makes broadband more useful to South Koreans: everyone speaking Korean, meaning most servers they'd care to reach, are within a 50ms roundtrip. None of the east-coast/west-coast speed division you get in the USA)
administrator access to _install_, not neccessarily play, which is entirely sensible.
No it isn't. If a person has authority to run programs on a machine, and to place files on the machine, then he should be able to install and run a game off CD. (It should show up only in his own Programs menu, not globally, of course)
This user can undoubtedly install some games, such as a standalone "tetris.exe" or similar, so there's no good reason to prohibit more elaborate installers (unless if that OS doesn't provide a good way to install things in non-global positions, in which case the blame returns to Microsoft)
I specifically was looking for one of the biggest problems with Windows
It also lacks in other areas. For one thing, it ignores the common argument that "Windows only attacked so much because it's the biggest target, not because it's more vulnerable".
And elsewhere it lies, claiming that DOS/Windows has a history of virus-writing that UNIX lacks. That is plainly false, as rtm demonstrated epidemic UNIX infections decades ago.
So the game can have "root"-level control over your machine, to ensure that you're not cheating with 3rd-party apps running on the same machine. It must be able to inspect all applications and drivers in memory, comparing them against a list of "cheat signatures" rather like a virus-scanner does.
Seriously. This is exactly what's happening. Evenbalance.com licenses cheat-prevention software modules to several major game publishers, and they've started disallowing players on XP machines unless they're running under the "administrator" account.
Just read the FAQ here:
Because some cheats/hacks cannot be detected otherwise
The reason you give is obselete- mistrust of the end user is the new, upcoming explanation.
Things do happen very quickly here and a delay of even a second can mean the difference between a kill and loss of your platform to hostile fire. Your point about removing humans from harm's way is also well taken.
But the loss of a robotic "platform" can be much less expensive than the loss of a human soldier. A hypothetical remote-controlled infantry-scale robot soldier would have the luxury of waiting for a better evaluation of a target's threat before engaging it... unlike the many current soldiers who gun down unarmed civilians in self-defense.
A robot-controller can err more on the side of caution, where live infantry would behave more aggressively because it's "him or me".
Actually, less than have the cost for ISS.
Even Pres Dubya Bush (who is either over-optimistic, or plain stupid, depending who you ask) agrees that his planned Mars trip will cost more than 6 times the intended (past + planned future) ISS spending.
And that's probably an under-estimate!!
seeing the effort Bush is putting into this at spacedaily.com
He hasn't put in any effort- only the time to give one or two speeches. He's made big promises that won't be blatantly disproved until long after he's out of office.
It was just a way to score points with over-optimistic space-enthusiasts without having to DO anything concrete.
Really, every life is not precious in any general sense.
No, they aren't. But NASA refuses to behave like that. They insist on 99% safety for manned launches, which makes them 10+ times as expensive as a 95% safe unmanned launch.
Because human life is treated as precious by the space program, protecting it uses up the majority of the space budget. Assuming that the USA public's attitude towards dead astronauts can't be changed, he's correct in pointing out manned spaceflight as an expensive distraction.
After fifty years of effort, it's clear that chemically-powered launchers are a dead end.
No, it's not clear at all.
Although I'd like to see an alternative way to escape the gravity well (a space-elevator is less plausible than magnetic rail-launchers, but whatever...), there is no established engineering reason that traditional launches need to cost so much. The reason is only economics, because the price come from the labor of the experts who build the things. Orbital launches are still rare enough to be more like a custom-purchase industry than a mass produced one. The economy-of-scale that would come from launching 50x as frequently would certainly bring on competitive efficiency reducing the prices to $500/lb, or even better.
Read here for a detailed discussion of all the still-unexplored ways that chemical launch motors could be cheapened.