Slashdot Mirror


User: ajs318

ajs318's activity in the archive.

Stories
0
Comments
4,821
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 4,821

  1. New voting machine design on Worst Ever Security Flaw in Diebold Voting Machine · · Score: 2, Interesting

    I have designed a Direct Recording Mechanical vote recording, anonymising and counting machine. It uses no electronics. It can be scrutinised right up until it is required for an election. You can see your vote going through.

    The machine is based around mechanical, add-only tally counters. A column of these are mounted in a transparent polycarbonate housing, one for each candidate and an extra counter for total votes. The candidate counters are surrounded by etched plastic which transmits light but prevents anyone seeing exactly what is behind it. Over each counter except the total counter is a shutter, and a large button. Depressing the button retracts the shutter. If the button is released it will return partway, but the shutter will remain retracted and all the other buttons are now locked: the only way to clear the machine is to depress the button fully. This will advance the adjacent counter and, by means of a slotted bar linkage (which is visible through the clear polycarbonate), also advance the total votes counter. After this, the machine must be primed for another vote by the Presiding Officer: this would probably be done remotely by means of a Bowden cable.

    These machines could be made available for scrutiny almost right up to the election. Anyone can observe that the system allows only one vote per priming operation, that the candidate and total vote counters advance together, and that no other counters are advanced. (For this operation, the shutter mechanism can be modified by removing the actual shutter from the moveable supports; thus allowing full observation of all counters. In an election situation we do not really want to give away the number of votes for each candidate so far, so all but the one being voted for are obscured. The etched plastic nonetheless would allow one to see the counter changing even if one could not see what it changed from or to.) At the opening of polling, the numbers on each of the counters are recorded, signed by witnesses, sealed in an envelope and attached to the machine. At the close of polling, all shutters are retracted to read the figures. The original figures are subtracted from the new figures to give the numbers of votes, which can be checked against the total.

    Note there is no possibility of post-election verification; since anonymisation, recording and counting are done in one operation. This also obviates any need for post-election verification, since one can be satisfied from having examined the machine before an election that it functions as intended and only as intended. A number of people working in concert might be able to discern an approximate result, but this IMHO is much less insecure than e.g. issuing voters with a record of their vote.

  2. Re:More like we don't know how to read tech... on Technology And The Decline of Gonzo Journalism · · Score: 5, Funny

    So. I've been a penguin-shagger since before XP came out. Who better than me to test-drive the new Windows? I set off down to the local dealer to get me some supplies. Half an ounce of solid, a big bag of weed. A strip of acid tabs. A gramme of Charlie and another couple of grammes of speed. And to top it all off, a couple of grammes of Gear and a dozen valium. When I heard Kate was coming too I was worried that we might not have enough, so I asked her to bring her own stash. I also bought some more weed, ten tabs of E and some more gear. Next stop the 24 hour Tesco, for some aluminium foil and Ribena. The booze section was still open so I picked up a couple of litres of vodka. Last of all I called at the tobacconist's at the end of my street for king-size Rizla papers.

    First stop was CD time. The Microsoft operating system comes on an even-shinier-than-a-normal-CD CD. I shoved the disc into the drive and skinned up a quick bifter while waiting for my assistant. I mounted it and had a look at the files. Nothing special. I made an ISO. No copy protection. Well, that was handy. I sparked up the dube, then shut down the PC and stripped out its hard drive.

    For a job like this I figured I had better have a decent workstation, so I'd ordered an Athlon 64 4000+, with a top-of-the-range nVidia {at least there are some i-tal drivers for nVidia cards, even if they are slow; beside which, I had plenty of cycles to spare}, two gigabit ethernet ports, serial ATA, old-fashioned parallel ATA and 8 USB ports. A case positively studded with blue diodes and enough fans to change the air in a two-bed semi in an hour. CD-RW and DVD+RW drives. Plenty of DVD+RW discs, that also worked in the TV recorder I had never sent back. A no-nonsense two-channel sound card {no point having more speakers than I have ears} plumbed through several amp and speaker combos. My trusty bipolar NAD 3120 feeding homemade speakers, a Japanese MOSFET amp working into Tannoy Mercurys, and a valve amp I had had rebuilt by a firm in Cambridge, with a response flatter than a witch's tit from DC to long wave radio into some ex-BBC studio monitors. I had a 480mm flat panel LCD, 1600x1200 pixels and not a single dead one among them. All this, you must understand, was absolutely necessary for testing the system. I had already customised Debian the way I wanted it on that machine. Now I was about to abandon the operating system I knew and loved for this Windows thing.

    Kate burst through the door as I was fitting the new hard drive onto which I would install Windows. She was giggling uncontrollably. I hoped she hadn't Made A Scene. These were early days. I had the review to write, and I needed Kate to stay sane so she could keep me sane. I screwed the drive in place and attached the SATA and power cables. Then I powered the machine up.

    "What's it doing now?" asked Kate.
    "Booting."
    "Sounds like a good idea." Kate reached for the aluminium foil. "I brought us some Naughty!"
    "And I brought us some Nice."

    So we had a boot of the heroin and a couple more spliffs while Windows started installing, and between tokes I configured another Linux box with two network cards as a highly-restrictive firewall. I thought we could log every packet going in or out of the Windows box just to see what it was sending where.

  3. not new on Microsoft Adds Risky System-Wide Undelete to Vista · · Score: 2

    I remember VAX/VMS having version control. Filenames were in the form of FILENAME.EXT;nn where nn was a number from 1 to 99 {initially; later versions upped it to 32767} and you could {theoretically at least, though nobody ever did in practice; everyone just ran with the default settings} set on a file-by-file or directory-by-directory basis how many versions to retain. You could PURGE out old versions {essential when we had a disk quota of 5MB, even with a default version_limit of 3} and reset the counter back to 1.

    This definitely has got the potential to bite some unsuspecting person in the arse. But so have most things.

  4. Re:The saddest part. on Big Mother Is Watching · · Score: 1

    This sort of thing is already happening!

  5. The Thin End of the Wedge on Big Mother Is Watching · · Score: 1, Insightful

    There is no obesity problem.

    The truth is, there are skinny six-year-olds who think they are too fat, and Anorexia Nervosa has been diagnosed in boys.

    What there is, however, is a government desperately angling to slap a tax on food.

    This talk of an "obesity epidemic" is a blatant attempt to whip up the Daily Mail readers {none of whom personally know anybody who is over- or underweight, and would not consider it a problem if they did, but they do see images of overweight people, who clearly have less money than they do, on Sky TV} into a frenzy, running around like headless chickens demanding for Something To Be Done. And when the "ordinary" people call for it, the Chancellor will hold up his tatty red briefcase and announce VAT on certain, "unhealthy" foodstuffs. Not, of course, the sort of foodstuffs the Daily Mail readers eat. And the Daily Mail readers will be satisfied. The Sun will be given a new story {most probably involving minor celebrities or paedophiles} to divert attention from the new tax.

    However, once the scope of VAT is broadened, it never, ever narrows. Following a panning by the press after the initial announcement in the March budget, the bad news will have been sufficiently well buried by the November budget for the "VAT on food" experiment to be trumpeted as a success, and an intention will be announced to extend it. Pretty soon, the Daily Mail readers will find 22.5% VAT on their saumon en croûte and mange tout.

    It's all about money. It's not even really about power as an end in its own right; this concept certainly does exist, but often is just a side-effect of the unfortunate human tendency to conflate means with ends. Power is always initially a means to some end, often a noble one, but eventually the means becomes more important than the end.

  6. Re:Reinstall on Options for 'Fixing' A Pirated Copy of Windows · · Score: 1

    In Europe and the UK, a contract cannot take away any rights given to you by the Law of the Land. The Doctrine of Exhaustion of Rights allows you to transfer software to another computer you own, or to sell it {of course, any copy you retain begins infringing copyright immediately after you sell the original}. Even if an EULA formed a legally-binding contract {which it evidently doesn't} it couldn't take away your statutory rights.

  7. no - *distrust* more like on Army to Require Trusted Platform Module in PCs · · Score: 1

    Well, the whole idea is that the person using the device should not have to trust anyone else, least of all the supplier; and the supplier of the device should not have to trust the user. The source code, and any binaries compiled from it, are "safe to lose". The encryption algorithm tells you nothing without the private key {which was put there by the user}.

  8. Re:better one innit on Army to Require Trusted Platform Module in PCs · · Score: 1
    Can you trust that the version of "battlefield map - american edition" was built using the source code the vendor showed to you?
    Yes, because the version you are using is one you built yourself from the source code they shew to you.
    Can you also trust that the signals you send to that device - which contain precise locations of all your soldiers/units - will only be displayed on that device, and not transmitted/relayed to a (potentially insecure) alternate system?
    Yes, because the transmitting device is encrypting against a public key whose corresponding private key is known only to the receiving device. You know that the receiving device is not sending its private key or unencrypted data anywhere, because you read the source code {and it might not even have a transmitter}.
    I'll be honest, I don't know whether TPM will necessarily assist in such matters. I would certainly expect it to..
    Neither of these scenarios require TPM.
  9. Re:What Constitutes Distribution on GPLv3 Second Discussion Draft Released · · Score: 1

    Not necessarily.

    You have to modify the configuration files anyway just for the program to work at all. So you could make a non-working, safe-to-distribute version first; and then modify that for Internal Use Only. The Principle of Equivalence (which states that "all means to the same end are equally valid") applies. You could write your not-safe-to-distribute version first, and only modify it when you were required to distribute it. The final result is the same in either case.

  10. Re:What Constitutes Distribution on GPLv3 Second Discussion Draft Released · · Score: 1

    Do not forget that in many jurisdictions, patent law states that mathematical operations cannot be covered by patents -- and everything that a computer does is a mathematical operation.

    Furthermore, in most jurisdictions a law cannot be applied retroactively {see the UN Universal Declaration on Human Rights, article 11 section 2}. Meaning that in such places, anything that would violate a software patent in the USA {but does not violate any local patent} will be valid Prior Art to block any application for a patent on the technology if and when that place decides to legalise software patents.

    Example: some encryption technique, which for want of a better name we'll call CANDIRU, is patented in the USA. The patent holders attempt to apply for patents across Europe. The Polish patent office tell them where to get off. The UK patent office grant a British patent {which can't actually be enforced, because UK patent law forbids the patenting of computer software} against CANDIRU. Someone smuggles a copy of CANDIRU to Europe, reverse-engineers it and releases an Open Source implementation as OpenCANDIRU. OpenCANDIRU clearly violates the US patent; but it does not violate any patent in Poland, because the patent application was refused outright. If Britain ever decided unilaterally to legalise software patents, the CANDIRU patent would not automatically come into force: that would constitute retroactive application of a new law, which is illegal under the UK Human Rights Act. The CANDIRU patent holders would have to re-apply for their patent, and OpenCANDIRU could be cited as Prior Art to block the application. The same would happen if the EU decided to legalise software patents: EU "federal" law merely obliges member states to pass their own laws, and has no jurisdiction over anyone except the governments of member states. Every EU member state would be required to implement its own law legalising software patents, and the same situation would occur.

  11. Re:Dear Slashdot on GPLv3 Second Discussion Draft Released · · Score: 1

    Not everybody uses a mouse, you insensitive clod!

  12. better one innit on Army to Require Trusted Platform Module in PCs · · Score: 3, Insightful

    A country's armed forces ought to have the power to demand the full source code of every application running on their computers, and the resources to write all their own software wherever necessary. There is no shortage of Open Source applications they could use for starting points .....

  13. Re:You misunderstand on Debian to Run on AMD64 · · Score: 1

    Two reasons, I suspect. (1) The FSF believe that Debian contains non-Free software (although it's kept in a separate repository, and the default is not to include it). Which ought to make a default installation of Debian "free". But (2) Debian believe that the GNU Free Documentation Licence is in violation of the DFSG. The FSF are unhappy enough about this not to cut Original Debian any slack.

    Any GNU/Linux distro is capable of running non-Free software, unless it includes a battery of patches to some popular library and everything else that depends upon it. You could, for example, rename every function in libc; then you could easily modify any source code to use your new patched-to-christ libc, but without the source you'd be SOL.

    Cf. also the dispute between U of W and Debian regarding PINE.

  14. Thinking about stuff on How Google Manages Click Fraud · · Score: 2, Interesting

    I'm writing a piece of ad-blocking software myself, and I was actually thinking of incorporating a few features. Specifically, the option of whether not to download the advert at all; to download the advert without displaying it; or to download the advert without displaying it and download the linked page without displaying it. Is this last option an example of "click fraud"?

  15. 64-bit Debian != 64-bit Fedora on Debian to Run on AMD64 · · Score: 5, Informative

    Many "64-bit" GNU/Linux distributions are actually partly-32-bit. There are directories /lib and /lib64 {with analogues in /usr and /usr/local} for 32- and 64-bit libraries. An application may be compiled as 32-bit and use the 32-bit libraries in /lib, or as 64-bit and use the 64-bit libraries in /lib64. You can tell whether a binary is 32- or 64-bit by doing ldd on it; if the hex numbers are 16 digits long, then it is 64-bit.

    Debian 64-bit is designed from the outset with all 64-bit libraries. /lib64 is just a symbolic link to /lib. This is both Pure and Beautiful. If you want to run 32-bit software, the recommended method is to set up a chroot environment in which to do so. The thinking is simple: software which is "i-tal" can just be recompiled 64-bit native {except OpenOffice, which demonstrates some very dubious programming techniques based around the assumption that the word length and addressing space are exactly 32 bits. OpenOffice of course began life as StarOffice, a closed-source project, and shows just what sort of bad code people will write if they don't expect anyone else ever to see it. Apparently, removal of "embarrassing" code was what delayed OpenSolaris for so long, and look what they left in! How naïve would one have to be to believe that "choosing a suitable licence" is what's really holding up OpenJava?} and software which isn't "i-tal" can go and fuck itself.

    Ubuntu have just added 32-bit libraries, to enable 32-bit applications such as OpenOffice to run. I believe they are also using a 32-bit Firefox, to allow non-free plugins such as Flash to work. It's neither Pure nor Beautiful, but it gets half the job done. Personally, I'd like to see Ubuntu play a bit faster and a bit looser with some of the closed-source stuff: maybe actually reverse-engineer it for the benefit of the whole community, rather than just kowtow to obnoxious licence agreements.

  16. You misunderstand on Debian to Run on AMD64 · · Score: 5, Informative

    What Debian mean by "stable" and "unstable" has about as much to do with how likely the software is to fall over, as what RMS means by "Free software" has to do with how much it costs. Stable or Unstable refer to the distribution, not the packages within it.

    Debian Stable {each release is codenamed after a character from the movie Toy Story} is a release that stays, well, stable. It contains software that has been proven ultra-reliable on a dozen different architectures; and, as far as possible, nothing will adversely affect the operation of anything else. Security patches get backported in, but the main requirement is that nothing should change too much as long as Debian Stable is current. Doing a simple apt-get update && apt-get upgrade will never break anything if you are running Stable. When a new Stable is released, it invariably includes automated migration tools to deal with new configuration file formats &c. These run transparently as part of the upgrade process, ensuring as smooth a transition as possible.

    Debian Unstable {aka SID, for "Still In Development" and also named after the destructive neighbour} is a release that is constantly changing. It is the combination of packages that is unstable, not the software itself: Unstable contains software that is believed to be mostly reliable on at least some of a dozen different architectures. However, due to the fact that the packages in Unstable are updated one-by-one rather than all at a time, there is the possibility of incompatibilities creeping in: one piece of software can affect another. It's also possible that APIs and configuration file formats may change.

    Somewhere between lies Debian Testing. Once a package has proved its worth in Unstable, it moves to Testing -- but not until. If necessary, packages may remain absent altogether from Testing while compatibility issues are resolved (in which case, you will have to get the Stable or Unstable source code and build that; one or the other usually works). Eventually, Testing will be used to create a new Stable.

    Debian Unstable or Testing are the best releases to use for desktops. Stable is really only for servers in co-lo, where you cannot get physical access to the machine to reboot it if it goes Tango Uniform. Thanks to Debian's rigid enforcement of the Free Software Guidelines (which went on to become the Open Source Definition), it's also very easy to keep everything "i-tal" on a Debian system.

  17. Not required on Porting to the Linux Standard Base · · Score: -1, Troll

    GNU Autoconf and Automake, when used properly, allow for packages to build on any almost-POSIX-compliant system {I won't say fully-POSIX-compliant because AFAIK nothing is fully-POSIX-compliant}. That's Linux, BSD, AIX, Solaris, Apple; and even Windows NT4 / 2000 / XP. Windows 98 / Me with Cygwin.

    LSB is merely a way to push closed source software onto Linux through the back door. We have language specifications and POSIX to ensure source compatibility. Binary compatibility is not necessary, and there are valid arguments suggesting it is not even desirable.

  18. Re:In Soviet Union... on Linux-powered Robots From France? Oui! · · Score: 1

    There was a study done recently in which they asked 1000 Frenchmen and 1000 American men to name their most favourite records to listen to while having sex. The most striking conclusion to come out of the survey was that all the Frenchmen's favourite records were LPs, and all the Americans' favourite records were 45s.

  19. Re:HATE SPEECH - MOD PARENT DOWN on Hong Kong Using Children to Hunt for Piracy · · Score: 1
    Are you seriously saying you think it's a good idea that
    • Jews should be allowed to bomb innocent civilians for the crime of not being jewish
    • Muslims should be allowed to blow themselves up on buses because some of the passengers are not muslims
    • Catholics should be allowed to spread AIDS in Africa because condoms are evil
    • Protestants should be allowed to go on "orange order" marches with the sole intent to piss off catholics
    ?

    Simple fact, all these religions have "nasty" sides which are neither separable from the "nice" sides, nor reconcilable with one another (at most, one monotheistic world view can be true). I think the short-term consequences of outlawing monotheism are a small price to pay for the long-term benefits to society.

    I also believe that all means to the same end are equally valid; and if a monotheist can't be persuaded gently to give up their dangerous beliefs, then I think less benign methods are called for. If it later turns out that one of the religions we banned was right all along, well, we can deal with it then.
  20. Re:Interesting... on SQL Injection Attacks Increasing · · Score: 1

    Just unpack the PEAR tarball and scp/ftp the relevant parts up to your web host. Place them in the same directory as the calling script. PHP looks there first for includes.

    Unless your web host has a real BOFH and has not only changed the include order, but also created empty files with the same names as all the wanted includes in some directory which has a higher priority than the working directory .....

  21. Re:Sounds familiar. on Hong Kong Using Children to Hunt for Piracy · · Score: 1

    No, the reproduction was entirely legal under the "fair dealing" provision of the Copyrights, Designs and Patents Act 1988. Meanwhile, by laying a false accusation, you are laying yourself open to a charge of wasting police time. The Met are famous for not liking having their time wasted.

  22. Re:Why are they wasting their time? on Hong Kong Using Children to Hunt for Piracy · · Score: 1

    It's not just muslims ..... christians and jews are every bit as bad. All monotheists are fucking evil cunts who need to be stopped -- by whatever the hell means it takes -- from believing that there is one god. All the evidence points to there being either fewer than one or more than one god, but certainly not exactly one.

    No gods => everyone is responsible for their own actions.
    Many gods => even gods you don't worship can still punish you if you transgress against them.
    One god => any fucking thing is justified because it's in the name of the Law-Giver, you filthy infidel scumbag.

  23. Re:Search != Stumble Upon on Hong Kong Using Children to Hunt for Piracy · · Score: 1

    Software companies lose about as much to "pirates" as the bra industry loses to Charlie Dimmock.

    If it wasn't so easy to pirate software, do you really imagine everybody would suddenly start buying the stuff, or even turn over to using non-pirateable software {Free and Open Source}? Almost nobody would have computers; we'd all go back to using pencils and paper, the way we used to do for years without problems. Even the Free Software movement benefits, however indirectly, from piracy: the presence of pirated software has led to cheaper hardware, which has allowed ordinary people to get onto the scene. Free Software would exist around universities, and other isolated pockets where people can afford to live up to their highest ideals. Rich electronics hobbyists would build their own computers, write their own operating systems, and have their kids chuck the lot in a skip when they died. Ordinary office workers would be making do with log tables and mechanical typewriters -- and dealing out packs of playing cards when they wanted to play patience.

    Even go beyond computer software; look at music and movies. Before there was a recording industry, the only way for a musician to make money was to go out and perform live. The invention of the phonograph created a situation where anyone in a position to invest in the equipment necessary to begin making recordings, could make a lot of money {often at the expense of the performers}. Remember, all this was post-IR1; so anyone with half a brain cell should have been able to foresee that sooner or later, recording equipment would be within the price range of ordinary people and the record companies would lose their supremacy. The only surprise is that it took this long, but the recording industry managed to divert attention around the mid-C20 by creating a format war and so effectively restarting the game. Had the 45rpm record format flopped I think we would have seen, if not home recorders for 78rpm discs by the 1960s, then an independent record label in every city.

    The movie industry is already on the way down, they just can't see it yet. Hollywood films are getting more and more irrelevant as independent films are taking on a life of their own. It's not enough to spend millions of dollars on overpaid, plastic-surgeried-to-fuck actresses and special effects: no amount of money can make up for a plot so dire that the holes are the only thing that keep it together. The CGI thing is losing momentum, too; I confidently predict that either DreamWorks or Pixar will have a box-office flop within the next five years. The studios are haemorrhaging money slowly enough not to notice. Meanwhile, faster turnaround times in news publishing are allowing more people to find out about alternative movies. The kind of films that five years ago wouldn't have made it outside of a university arts centre cinema are now turning up in the big multiplexes.

    If it wasn't possible to pirate music and films, people would listen to less recorded music and watch fewer films. Some of them might even pick up an instrument, or put on a costume, and climb on a stage and perform. I'll tell you something for free. Out of all those people who pirate albums, way fewer would have bought them at the prices you're charging, than the number of people who buy them because they heard a pirate copy at a friend's house. Do the maths: sell 1000 real albums, have 10000 bootlegs made, sell another 50 real ones to people who heard a bootleg and liked it enough to buy it. Or sell 1003 real albums, have 9997 would-have-been bootleggers not giving a fuck, and have 50 would-have-been buyers never hear it.

    If you don't like the fact that what you make gets pirated, then just stop fucking making it.

  24. Re:Search != Stumble Upon [OT] on Hong Kong Using Children to Hunt for Piracy · · Score: 1

    injustice

  25. Re:Search != Stumble Upon on Hong Kong Using Children to Hunt for Piracy · · Score: 1

    Hold the hell on here. You're missing an important point.

    The events that the Hitler Youth were reporting upon were crimes, by Hitler's definition.

    Nowadays we wouldn't tend to regard them as such; but, according to NSDAP standards, crimes they were. What every "law-abiding citizen" should remember is this: you are just one government-imposed ban away from becoming a criminal.