Yeah, some AI help in figuring for a faster way to manage the accounting and trading of allocations would probably be very useful. It also sounds like even a good experst system would work well for that.
The reason no one creates an AI to coordinate energy delivery is that we already have a great mechanism for that. It's called prices. That's why prices exist. They enable anyone in any location to make an intelligent decision about how much energy they want to pay to have delivered in order to fulfill their needs. Prices change as supply and demand changes in order to ensure the most efficient distribution of the resource being priced. This method has been refined over thousands of years and is very efficient.
Perhaps you should do some basic economics research to get a longer explanation, but there is no way that a distributed AI with current technology could replace the price mechanism for coordinating energy delivery, because unless you had an AI replacement for every single human energy purchaser and supplier AND those individual AI's were smarter than the people they were replacing, your distributed AI system wouldn't be able to improve on the decisions being made.
An AI replacement for the catallaxy by dedicating massive computing resources in order to make a simple and already solved problem at most a tiny bit more efficient isn't a very rational use of precious resources. Look at the trade-offs. Even if you were successful, you'd spend more energy resources on running the AI's than you would ever possibly make up in a minor increase in efficiency.
They don't care if you're gay. They care if you're gay and hiding it from your wife/family/whatever. The first situation doesn't matter as much, because as long as you're open about it it can't be used for blackmail. The second situation sets up something where you have something to lose if its discovered by a potential blackmailer.
As for druggies, I'd say that while I'd personally respect your right to alter your mind, its perfectly legitimate for an employer (like NASA) to want its employees to be in their right mind while performing sensitive or dangerous tasks.
As for Commies, I could see how if someone actually advocates and acts on an idealogy that includes overthrowing the government (I'm not sure if with the fall of the Soviet Union American Commies still do that nowadays, though), then that government might not want to hire them as an employee in a sensitive position.
As for lefties, that's not political screening. That's just a basic common sense intelligence and maturity test. (Ok, a little flamebait there for ya.:)
Yeah, we had a pipe from a bathroom above break once. Of course it was after hours when no one from that office was around to let someone in to shut it off right away. That accounted for the water coming in from the ceiling, through the lights and right into the top of the racks.
We also had storm water funnelled into the raised floor are where the power was all running. The outside flooded and apparently where some of the data conduits went out of the building, water could come in and then pour down onto the floor. I seem to recall a third incident as well, but it's been long enough that I'm a little fuzzy on the details, which I thus won't try to relate.
I do like someone else's idea to keep a shop vac handy. That'd help for a smaller water incident. Maybe some foam "dams" as well to channel the water away from critical stuff while you try to get it stopped. I imagine some of the packaging servers get shipped in would work well as a dam.
Lots of cheap plastic tarps that are stored out of the way but that you can deploy quickly in the event of a water event.
I know, you think you'll never use them, but if you do (storm leaks, broken pipe above, etc...), they'll be the most valuable tools you could have spent $100 acquiring a whole bunch of.
You just haven't lived if you haven't empirically tested (even accidently) how long it takes for power circuits under six inches of water to blow, or how those drop ceiling flourescent tube lights look when they're full of water and still going, or how long servers and switches stay up with water pouring down the racks into them....:)
The current firmware on the 622 has a nice handful of bugs that stop it from fetching guide data.
Are you sure about this? I've had a 622 since within 10 days of when they were released and have never had any guide data problems. From the message boards I read regularly the only problem I've ever heard of even close to that was that Dishnetwork screwed around with some of the OTA guide data streams, especially the PBS one, that was broken/fixed in a couple releases, but that was a general guide issue for receivers with OTA antennas, not really specific to the 622.
Which specific firmware release are you talking about? There are three that are currently in use for the 622.
Drop your cable company, get Dishnetwork and a VIP 622 or 722 HD DVR.
It's a heck of a lot cheaper than Cable+Tivo and it's actually better than even this new HD Tivo (Faster interface, more recording time, etc...). Plus, allowing for the recent release date of this Tivo box, it's also going to have a lot less bugs than this new box for a while yet.
Oh yeah, and you get many more HD channels than your local cable company is going to have. And you're going to get new HD channels faster as they come out. And external USB hard drive storage is slated for the middle of next month, not as a "replacement" drive, but as portable external storage of recordings that you can use in addition to the internal drive and also take around to your other HD receiver in the house.
And did I mention it will likely cost you way less than local cable+tivo? In terms of upfront and ongoing costs?
The right to drive an SUV is not in the Constitution.
Sure it is. Check the 9th amendment.
Or did you mean the more accurate statement that the power to restrict SUV driving is not granted to the federal government in the constitution?
Unless the federal government is creating a law specifically regarding what can be driven on federally owned property, it hasn't been granted the power to pass laws restricting what you can drive in any copy of the constitution that I've seen. And if it's not a power granted them in the constitution, it would be an unconstitutional law if passed.
IMNSHO, the problem isn't which group is using the government's ever-growing power for their cause, the root of the problem is the government's ever-growing accumulation of power they were never meant to have. I prefer not to live in a totalitarian police state, whether or not I have a preference for whicher set of base idealogy the oligarchy publicly subscribes to.
At least part of the Republican Party (mostly the western more libertarian part) still espouses the idea that the government has taken too much power over our lives, rather than that the solution to every problem is more government power to "fix" it for you.
No, my prediction is based on the idea that processing power will have overtaken processing needs by so much in 10 years that it will be pointless to have a dedicated processing facility. Sure, maybe it'll take 20 years, but it's going to happen.
I did actually RTFA and see that they have several generations of hardware in use as they continually upgrade.
I'm trying to figure out if anyone posting (or the summary writer) actually read the decision?
To summarize:
Prior to this decision, any price floor set by a manufactorer was automatically considered a violation of anti-trust laws designed to increase competition.
Apparently there are some specific situations where a price floor would lead to more competition, not less. The specific cases in question included some of those situations. The argument was that since they led to more competition, not less competition, they didn't violate the relevent anti-trust laws.
Therefore the court took another look and said "You're right, there are some specific situations where a price floor wouldn't violate the law against being anti-competitive, since in those situations it actually leads to more competition". As a result, you may now set a price floor and not have the Feds come after you as long as you are able to show a federal judge that your price floor actually leads to more competition, not less.
If your price floor leads to less competition, then you still can do it as it's still a violations of the relevent anti-trust laws designed to encourage more competition.
So, having read that summary, why the hell does anyone think there is anything wrong with that decision? True, now people who can justify their price floor on more competition grounds might have to defend that in court, but how is that worse than those same people being not able to encourage competition that way in the first place?
For specifics on exactly how a price floor may in rare cases lead to more competition, please read the actual court briefs and decision.
It sounds like the problem is a misallocation of funding, not underfunding.
If you can power X equipment, then why bother to purchase X+Y equipment before you purchase more power capacity first?
Having more equipment than you can power is a symptom of spending too much on equipment and not enough on power capacity. It says nothing about whether your total budget is too low or too high.
Wait, I forgot, we're talking about a government agency. They just assume that any money they mismanage can just be used as justification for an additional funding demand the following year.
Must be nice to be able to get more money because you totally screwed up spending the last round of funding. Too bad it's us giving them the money.
I guess it depends on where you're looking. I'm not as familiar with the job market in Ohio, but I'm guessing that lower-cost-of-living areas have low enough pay that government jobs might look good in comparison. I currently live in a low-cost-of-living area, but that's only because I'm semi-retired enough to just do some consulting over the internet occasionally. I couldn't live here and have a regular job.
If you're on the east or west coast, then the pay is generally higher in the private sector. Silicon Valley and the Washington-Dulles corridor seem to be the hot spots for IT-related jobs since the Internet boom. There is always something in major cities like Chicago, NY, SLC, etc... as well, but I don't think you're as likely to find a job at say, Google, Ebay, Amazon, or similar size players in more rural areas.
So just maybe, if the "models" are accurate with regards to greenhouse gases, if we try really hard to produce more every year, we can reverse part of the eventual global cooling trend. Somehow I doubt that's likely.
However, 15 years from now we'll have the FAA talking about their plan to increase greenhouse gas emissions from planes at the behest of the environmentalists and their allies in big oil who want to regulate people into not using so many alternative energy sources that don't produce enough carbon dioxide.
That's the problem with DHS (and other government departments). Someone like me couldn't possibly manage to get through the civil service bureacracy in order to get a job where I was paid anything comparable to the private sector and was able to actually have an effect on things. It would literally take a presidential appointment of the right group of people to change the IT structure at DHS or another government department. The civil service stands in the way otherwise. Even with support at the top of a department, most career bureacrats will just delay anything they don't like until someone else takes power at the top.
The company I mentioned above actually had our offices located in Reston, VA, in the Washington-Dulles Internet corridor. Our primary data center was across the street from the CIA in McClean. So I knew a lot of guys that worked at various agencies and they're all a mess. Usually the contractors (since they can actually get paid) know what they're doing, but have no ability to change anything that's not an exact part of their contract.
I had a friend who was working on writing a post 9/11 plan to secure some really old in-field unix systems the FAA used for controlling radar installations. He had never used any form of *nix before and came to me for advice on what kinds of security problems they should be looking for. He definitely wasn't qualified for his task. I started with how the systems really couldn't be made secure unless they upgraded the OS to something newer than 12 years old (at the time) and that they really needed to focus on physical security, since these things were literally in a field and accessible by anyone who could hop a fence.
His response was that their contract only covered software, not physical security, that there wasn't anyone going to work on physical security and they also couldn't update the OS since no one was able to mess with the application.
I told him to install Linux or FreeBSD at home to get a feel for some of the basics and pointed him to some documentation, but why even try, after his job was basically impossible to do properly?
extremely lucky
It wasn't luck, it's called the incentive of millions of dollars at risk and the company going out of business if a serious breach were to occur. The senior DHS guys still have a job, their annual COLA and seniority pay-grade raises regardless of whether or not their IT has proper security or not.
A few years ago I was the technical manager for a company that developed and hosted major ecommerce sites. Sites for the largest retail brands in the world. They were very, very, high profile. Any downtime was usually measured in millions of dollars of revenue lost. We went months at a time without any downtime at all, not even scheduled downtime.
We never once had a break-in. We never once had a tripwire report that a single file had been changed by someone without authorization.
We also ran primarily Solaris, Tru64 unix, FreeBSD and Linux (for internal IT stuff like the office mail servers), with windows essentially confined to some desktops on an isolated network.
We also had layered, physically divided networks, with stateful firewalls between layers, switches with ACLs on ports controlling traffic, and all server and workstation OS's hardened before deployment as if they were going to be exposed directly to the internet. Oh yeah, and commercial IDS devices on each network. Users weren't root/administrator on anything, except for the lead developers tracked using sudo on their solaris sandbox and the Sys Admins using sudo elsewhere.
We also did a randomly scheduled once-a-month walkthrough of the work spaces to ensure that no passwords were written down anyplace someone with physical access could get them. We also didn't use stupid change-every-month password policies, but instead instructed staff to create phrases and combinations that mentally translated into their secure personal passwords and also further used ssh keys and keygen dongles where appropriate.
Root passwords were randomly generated and stuck in an envelope in a safe, just in case we ever needed them. If ever used (for example, for console access on a box booting in single user mode due to a hardware problem) they were immediately changed once the use was complete.
We also had multiple QA and staging environments for configuration, content management, security, functional, and performance code testing before deployment. We also had full redundancy and load balancing for every essential server and device.
Oh yeah, we also had a major annual security audit by a good third-party IT security specialist firm. They never once found anything exploitable, despite their best efforts and even given internal network access.
Of course, the previous developer/hoster of the largest brand we supported, when it came time for the transition to our platform, went ahead and decided to physically mail us a dvd with all of their customer's personal and credit card information on it in plain text to use for testing the customer import process. So the above standards aren't exactly universally true of private companies.
But while I've heard lots of bad security stories about government agencies (I knew a network guy contracted to the Department of Agriculture who found out one day that the firewalls for the entire department of agriculture had been set to pass all traffic for 6 months since they were too much trouble to keep configured properly) and about government IT project fiascos (they all take 2-3X as long as expected, cost 2-3X, then never get finished, but instead get rolled into a new project to do the same thing), I've never heard of an actual government IT success story.
The board 15 years ago was elected by the people in the District. Those people made a bad decision when they voted.
So create a special tax district to pay the money off from the people who live in the school district (which is quite wealthy) and tell them it's because they voted the wrong board into office.
Maybe they'll pay a little more attention to their local elections next time.
Yeah, a good rule of thumb for things like credit card agreements, cell phone contracts, Google Adsense contracts, and the like is that they're generally going to say "we can do anything we want to you" in several different ways, but usually with a couple of minor exceptions. Understanding the exceptions can be useful.
But if you can at least verify that you understand what the company is agreeing to, you can also rely on market forces (as in, Sprint can't REALLY screw all of their customers by making their rates 10x what they were overnight without destroying their business) to take care of some of the worst possibilities.
Just don't be one of those people who are 60 days late with a credit card payment and then are shocked that somehow it's written into all their CC terms that all their cards will now raise their rates by 12% because they've suddenly become much higher risk.
Yeah, that was actually part of the point of the sentence, just so I could put "but since you don't read things you probably aren't still reading this anyway." at the end.
I read everything I sign before I sign it. That includes lengthy contracts a home purchase agreement. Of course, I read much faster than the vast majority of people, but that's mostly just practice. It's certainly not "utterly impossible".
Is general society so bad at reading that most people can't be bothered to look at what they're agreeing to? I suppose so, or else the title company person at my first home purchase wouldn't have had to move us to another conference room once she realized that I was actually going to read things before I signed them. She apparently expected it to take 5 minutes instead of half an hour and had scheduled the room accordingly.
In any case, the law regarding contracts is that for a contract to be valid, there must have been a "meeting of the minds" where both parties knew substantially what they were agreeing to. Of course, nowadays some people probably sign the statement that they've read and understand the contract without even reading that statement, but some people are stupid that way.
I have lots of experience with all sorts of times when actually knowing what was in a contract I'd signed was useful, even when simply looking up and reading the VA state law online that pertained to a specific company health insurance provision and pointing it out to HR made their lawyers drop all their demands and sent a letter of profuse apology once they figured out that technically they owed me 3x the amount of a $25K claim they had illegally refused to pay until I signed a subordination agreement that I refused to sign (having read it and recognized it as obligating me to things that they had no right to get out of me), but since you don't read things you probably aren't still reading this anyway.
Heck, you probably don't read documentation either. You still have that extra set of screws left over from when you built that bicycle that rattles kind of funny?
In the nonprofit school that I'm on the board of, our policy is that anything over a certain amount must be approved and signed by multiple officers, up to all four main officers for really large amounts.
What kind of idiot sets up a financial system for a city (that deals with a lot more money that we ever will) in which one user can on their own authority transfer over a quarter of a million dollars to a random bank account? Whoever the controller for the city is should probably be fired at this point.
Even if you have an electronic system, it's WAY more secure to require multiple approvals. For a really large amount, why not pay someone a wage for the five minutes it takes to verify it with authorized individuals?
Think about it. If the guy who installed the keylogger can do this, what would stop the treasurer themselves from doing it at any time, since they apparently have the ability to transfer all the money they want to whomever they want? Or an IT person with even easier access to their computer?
Slashdot Mirror
Of course, the main problem is that to own one as a US citizen, you apparently need to pay more like $400.
And for $400, you can get a nicer laptop online or even at your local walmart.
Wake me up again when I could actually buy them for a non-profit charter public charter school for $100, or even $150 each.
Sorry. Completely misunderstood you.
Yeah, some AI help in figuring for a faster way to manage the accounting and trading of allocations would probably be very useful. It also sounds like even a good experst system would work well for that.
The reason no one creates an AI to coordinate energy delivery is that we already have a great mechanism for that. It's called prices. That's why prices exist. They enable anyone in any location to make an intelligent decision about how much energy they want to pay to have delivered in order to fulfill their needs. Prices change as supply and demand changes in order to ensure the most efficient distribution of the resource being priced. This method has been refined over thousands of years and is very efficient.
Perhaps you should do some basic economics research to get a longer explanation, but there is no way that a distributed AI with current technology could replace the price mechanism for coordinating energy delivery, because unless you had an AI replacement for every single human energy purchaser and supplier AND those individual AI's were smarter than the people they were replacing, your distributed AI system wouldn't be able to improve on the decisions being made.
An AI replacement for the catallaxy by dedicating massive computing resources in order to make a simple and already solved problem at most a tiny bit more efficient isn't a very rational use of precious resources. Look at the trade-offs. Even if you were successful, you'd spend more energy resources on running the AI's than you would ever possibly make up in a minor increase in efficiency.
They don't care if you're gay. They care if you're gay and hiding it from your wife/family/whatever. The first situation doesn't matter as much, because as long as you're open about it it can't be used for blackmail. The second situation sets up something where you have something to lose if its discovered by a potential blackmailer.
:)
As for druggies, I'd say that while I'd personally respect your right to alter your mind, its perfectly legitimate for an employer (like NASA) to want its employees to be in their right mind while performing sensitive or dangerous tasks.
As for Commies, I could see how if someone actually advocates and acts on an idealogy that includes overthrowing the government (I'm not sure if with the fall of the Soviet Union American Commies still do that nowadays, though), then that government might not want to hire them as an employee in a sensitive position.
As for lefties, that's not political screening. That's just a basic common sense intelligence and maturity test. (Ok, a little flamebait there for ya.
I'm sorry, you seem to be confusing the US with the soviets....
(I know, I couldn't resist though.)
Yeah, we had a pipe from a bathroom above break once. Of course it was after hours when no one from that office was around to let someone in to shut it off right away. That accounted for the water coming in from the ceiling, through the lights and right into the top of the racks.
We also had storm water funnelled into the raised floor are where the power was all running. The outside flooded and apparently where some of the data conduits went out of the building, water could come in and then pour down onto the floor. I seem to recall a third incident as well, but it's been long enough that I'm a little fuzzy on the details, which I thus won't try to relate.
I do like someone else's idea to keep a shop vac handy. That'd help for a smaller water incident. Maybe some foam "dams" as well to channel the water away from critical stuff while you try to get it stopped. I imagine some of the packaging servers get shipped in would work well as a dam.
Tarps.
:)
Lots of cheap plastic tarps that are stored out of the way but that you can deploy quickly in the event of a water event.
I know, you think you'll never use them, but if you do (storm leaks, broken pipe above, etc...), they'll be the most valuable tools you could have spent $100 acquiring a whole bunch of.
You just haven't lived if you haven't empirically tested (even accidently) how long it takes for power circuits under six inches of water to blow, or how those drop ceiling flourescent tube lights look when they're full of water and still going, or how long servers and switches stay up with water pouring down the racks into them....
Are you sure about this? I've had a 622 since within 10 days of when they were released and have never had any guide data problems. From the message boards I read regularly the only problem I've ever heard of even close to that was that Dishnetwork screwed around with some of the OTA guide data streams, especially the PBS one, that was broken/fixed in a couple releases, but that was a general guide issue for receivers with OTA antennas, not really specific to the 622.
Which specific firmware release are you talking about? There are three that are currently in use for the 622.
Drop your cable company, get Dishnetwork and a VIP 622 or 722 HD DVR.
It's a heck of a lot cheaper than Cable+Tivo and it's actually better than even this new HD Tivo (Faster interface, more recording time, etc...). Plus, allowing for the recent release date of this Tivo box, it's also going to have a lot less bugs than this new box for a while yet.
Oh yeah, and you get many more HD channels than your local cable company is going to have. And you're going to get new HD channels faster as they come out. And external USB hard drive storage is slated for the middle of next month, not as a "replacement" drive, but as portable external storage of recordings that you can use in addition to the internal drive and also take around to your other HD receiver in the house.
And did I mention it will likely cost you way less than local cable+tivo? In terms of upfront and ongoing costs?
Ah, finally a /. story where the following link makes sense:
DeadSquirrel.com
These guys have already been on top of this kind of stuff for years....
Sure it is. Check the 9th amendment.
Or did you mean the more accurate statement that the power to restrict SUV driving is not granted to the federal government in the constitution?
Unless the federal government is creating a law specifically regarding what can be driven on federally owned property, it hasn't been granted the power to pass laws restricting what you can drive in any copy of the constitution that I've seen. And if it's not a power granted them in the constitution, it would be an unconstitutional law if passed.
IMNSHO, the problem isn't which group is using the government's ever-growing power for their cause, the root of the problem is the government's ever-growing accumulation of power they were never meant to have. I prefer not to live in a totalitarian police state, whether or not I have a preference for whicher set of base idealogy the oligarchy publicly subscribes to.
At least part of the Republican Party (mostly the western more libertarian part) still espouses the idea that the government has taken too much power over our lives, rather than that the solution to every problem is more government power to "fix" it for you.
No, my prediction is based on the idea that processing power will have overtaken processing needs by so much in 10 years that it will be pointless to have a dedicated processing facility. Sure, maybe it'll take 20 years, but it's going to happen.
I did actually RTFA and see that they have several generations of hardware in use as they continually upgrade.
Printable Link - All in one page.
My prediction is that in 10 years the place will be functionally obsolete as a result of processing advancements elsewhere.
Er...
s~then you still can do it~then you still can't do it~
(I always use tildes, since slashes are much more common in things that I like to replace in text)
I'm trying to figure out if anyone posting (or the summary writer) actually read the decision?
To summarize:
Prior to this decision, any price floor set by a manufactorer was automatically considered a violation of anti-trust laws designed to increase competition.
Apparently there are some specific situations where a price floor would lead to more competition, not less. The specific cases in question included some of those situations. The argument was that since they led to more competition, not less competition, they didn't violate the relevent anti-trust laws.
Therefore the court took another look and said "You're right, there are some specific situations where a price floor wouldn't violate the law against being anti-competitive, since in those situations it actually leads to more competition". As a result, you may now set a price floor and not have the Feds come after you as long as you are able to show a federal judge that your price floor actually leads to more competition, not less.
If your price floor leads to less competition, then you still can do it as it's still a violations of the relevent anti-trust laws designed to encourage more competition.
So, having read that summary, why the hell does anyone think there is anything wrong with that decision? True, now people who can justify their price floor on more competition grounds might have to defend that in court, but how is that worse than those same people being not able to encourage competition that way in the first place?
For specifics on exactly how a price floor may in rare cases lead to more competition, please read the actual court briefs and decision.
It sounds like the problem is a misallocation of funding, not underfunding.
If you can power X equipment, then why bother to purchase X+Y equipment before you purchase more power capacity first?
Having more equipment than you can power is a symptom of spending too much on equipment and not enough on power capacity. It says nothing about whether your total budget is too low or too high.
Wait, I forgot, we're talking about a government agency. They just assume that any money they mismanage can just be used as justification for an additional funding demand the following year.
Must be nice to be able to get more money because you totally screwed up spending the last round of funding. Too bad it's us giving them the money.
I guess it depends on where you're looking. I'm not as familiar with the job market in Ohio, but I'm guessing that lower-cost-of-living areas have low enough pay that government jobs might look good in comparison. I currently live in a low-cost-of-living area, but that's only because I'm semi-retired enough to just do some consulting over the internet occasionally. I couldn't live here and have a regular job.
If you're on the east or west coast, then the pay is generally higher in the private sector. Silicon Valley and the Washington-Dulles corridor seem to be the hot spots for IT-related jobs since the Internet boom. There is always something in major cities like Chicago, NY, SLC, etc... as well, but I don't think you're as likely to find a job at say, Google, Ebay, Amazon, or similar size players in more rural areas.
Happily for us, according to a Canadian climate scientist, based on the sunspot cycles, we're due for global cooling to start in 2020, so I wouldn't sweat it.
So just maybe, if the "models" are accurate with regards to greenhouse gases, if we try really hard to produce more every year, we can reverse part of the eventual global cooling trend. Somehow I doubt that's likely.
However, 15 years from now we'll have the FAA talking about their plan to increase greenhouse gas emissions from planes at the behest of the environmentalists and their allies in big oil who want to regulate people into not using so many alternative energy sources that don't produce enough carbon dioxide.
That's the problem with DHS (and other government departments). Someone like me couldn't possibly manage to get through the civil service bureacracy in order to get a job where I was paid anything comparable to the private sector and was able to actually have an effect on things. It would literally take a presidential appointment of the right group of people to change the IT structure at DHS or another government department. The civil service stands in the way otherwise. Even with support at the top of a department, most career bureacrats will just delay anything they don't like until someone else takes power at the top.
The company I mentioned above actually had our offices located in Reston, VA, in the Washington-Dulles Internet corridor. Our primary data center was across the street from the CIA in McClean. So I knew a lot of guys that worked at various agencies and they're all a mess. Usually the contractors (since they can actually get paid) know what they're doing, but have no ability to change anything that's not an exact part of their contract.
I had a friend who was working on writing a post 9/11 plan to secure some really old in-field unix systems the FAA used for controlling radar installations. He had never used any form of *nix before and came to me for advice on what kinds of security problems they should be looking for. He definitely wasn't qualified for his task. I started with how the systems really couldn't be made secure unless they upgraded the OS to something newer than 12 years old (at the time) and that they really needed to focus on physical security, since these things were literally in a field and accessible by anyone who could hop a fence.
His response was that their contract only covered software, not physical security, that there wasn't anyone going to work on physical security and they also couldn't update the OS since no one was able to mess with the application.
I told him to install Linux or FreeBSD at home to get a feel for some of the basics and pointed him to some documentation, but why even try, after his job was basically impossible to do properly?
It wasn't luck, it's called the incentive of millions of dollars at risk and the company going out of business if a serious breach were to occur. The senior DHS guys still have a job, their annual COLA and seniority pay-grade raises regardless of whether or not their IT has proper security or not.
A few years ago I was the technical manager for a company that developed and hosted major ecommerce sites. Sites for the largest retail brands in the world. They were very, very, high profile. Any downtime was usually measured in millions of dollars of revenue lost. We went months at a time without any downtime at all, not even scheduled downtime.
We never once had a break-in. We never once had a tripwire report that a single file had been changed by someone without authorization.
We also ran primarily Solaris, Tru64 unix, FreeBSD and Linux (for internal IT stuff like the office mail servers), with windows essentially confined to some desktops on an isolated network.
We also had layered, physically divided networks, with stateful firewalls between layers, switches with ACLs on ports controlling traffic, and all server and workstation OS's hardened before deployment as if they were going to be exposed directly to the internet. Oh yeah, and commercial IDS devices on each network. Users weren't root/administrator on anything, except for the lead developers tracked using sudo on their solaris sandbox and the Sys Admins using sudo elsewhere.
We also did a randomly scheduled once-a-month walkthrough of the work spaces to ensure that no passwords were written down anyplace someone with physical access could get them. We also didn't use stupid change-every-month password policies, but instead instructed staff to create phrases and combinations that mentally translated into their secure personal passwords and also further used ssh keys and keygen dongles where appropriate.
Root passwords were randomly generated and stuck in an envelope in a safe, just in case we ever needed them. If ever used (for example, for console access on a box booting in single user mode due to a hardware problem) they were immediately changed once the use was complete.
We also had multiple QA and staging environments for configuration, content management, security, functional, and performance code testing before deployment. We also had full redundancy and load balancing for every essential server and device.
Oh yeah, we also had a major annual security audit by a good third-party IT security specialist firm. They never once found anything exploitable, despite their best efforts and even given internal network access.
Of course, the previous developer/hoster of the largest brand we supported, when it came time for the transition to our platform, went ahead and decided to physically mail us a dvd with all of their customer's personal and credit card information on it in plain text to use for testing the customer import process. So the above standards aren't exactly universally true of private companies.
But while I've heard lots of bad security stories about government agencies (I knew a network guy contracted to the Department of Agriculture who found out one day that the firewalls for the entire department of agriculture had been set to pass all traffic for 6 months since they were too much trouble to keep configured properly) and about government IT project fiascos (they all take 2-3X as long as expected, cost 2-3X, then never get finished, but instead get rolled into a new project to do the same thing), I've never heard of an actual government IT success story.
The board 15 years ago was elected by the people in the District. Those people made a bad decision when they voted.
So create a special tax district to pay the money off from the people who live in the school district (which is quite wealthy) and tell them it's because they voted the wrong board into office.
Maybe they'll pay a little more attention to their local elections next time.
Yeah, a good rule of thumb for things like credit card agreements, cell phone contracts, Google Adsense contracts, and the like is that they're generally going to say "we can do anything we want to you" in several different ways, but usually with a couple of minor exceptions. Understanding the exceptions can be useful.
But if you can at least verify that you understand what the company is agreeing to, you can also rely on market forces (as in, Sprint can't REALLY screw all of their customers by making their rates 10x what they were overnight without destroying their business) to take care of some of the worst possibilities.
Just don't be one of those people who are 60 days late with a credit card payment and then are shocked that somehow it's written into all their CC terms that all their cards will now raise their rates by 12% because they've suddenly become much higher risk.
Yeah, that was actually part of the point of the sentence, just so I could put "but since you don't read things you probably aren't still reading this anyway." at the end.
I read everything I sign before I sign it. That includes lengthy contracts a home purchase agreement. Of course, I read much faster than the vast majority of people, but that's mostly just practice. It's certainly not "utterly impossible".
Is general society so bad at reading that most people can't be bothered to look at what they're agreeing to? I suppose so, or else the title company person at my first home purchase wouldn't have had to move us to another conference room once she realized that I was actually going to read things before I signed them. She apparently expected it to take 5 minutes instead of half an hour and had scheduled the room accordingly.
In any case, the law regarding contracts is that for a contract to be valid, there must have been a "meeting of the minds" where both parties knew substantially what they were agreeing to. Of course, nowadays some people probably sign the statement that they've read and understand the contract without even reading that statement, but some people are stupid that way.
I have lots of experience with all sorts of times when actually knowing what was in a contract I'd signed was useful, even when simply looking up and reading the VA state law online that pertained to a specific company health insurance provision and pointing it out to HR made their lawyers drop all their demands and sent a letter of profuse apology once they figured out that technically they owed me 3x the amount of a $25K claim they had illegally refused to pay until I signed a subordination agreement that I refused to sign (having read it and recognized it as obligating me to things that they had no right to get out of me), but since you don't read things you probably aren't still reading this anyway.
Heck, you probably don't read documentation either. You still have that extra set of screws left over from when you built that bicycle that rattles kind of funny?
In the nonprofit school that I'm on the board of, our policy is that anything over a certain amount must be approved and signed by multiple officers, up to all four main officers for really large amounts.
What kind of idiot sets up a financial system for a city (that deals with a lot more money that we ever will) in which one user can on their own authority transfer over a quarter of a million dollars to a random bank account? Whoever the controller for the city is should probably be fired at this point.
Even if you have an electronic system, it's WAY more secure to require multiple approvals. For a really large amount, why not pay someone a wage for the five minutes it takes to verify it with authorized individuals?
Think about it. If the guy who installed the keylogger can do this, what would stop the treasurer themselves from doing it at any time, since they apparently have the ability to transfer all the money they want to whomever they want? Or an IT person with even easier access to their computer?