There are already laws against the criminal things you've suggested. I really don't see why it should also be illegal to break DRM with the intention of doing that -- why should the intention matter at all? Maybe you broke it with the intention of watching it on your Mythbox, and later got the idea (independently) of using the cracked version for something criminal?
No, that's all needlessly vague and complex. If you want to make it hurt more to pirate stuff, change those laws -- which wasn't even a criminal offense until recently, but rather, a civil matter.
Think about that -- it is a federal crime to crack the DRM. It's merely a civil offense to redistribute the music. One goes on your record, the other doesn't. WTF?!
Tag says it all: justrepealit. Or, if you're going to ask for exemptions, don't ask for such pathetically small ones -- are iPhones mentioned specifically? Why can't I crack an iPod Touch, then?
about the only things that come onto the system are anti-virus updates (separate downloads as files)... Windows Update is in itself a risk.
Out of curiosity, why do you trust antivirus updates more than Windows updates?
I have a choice for Windows: forego updates that could possibly make it safer (let's assume that is possible) but could backdoor the system which may very well happen by default, or leave it unpatched and risk some of the earlier gotchas creating a vulnerability.
In other words -- and especially when you're on any network of any kind -- you're trading the paranoid and unsubstantiated possibility of a Microsoft backdoor, for the near certainty of a backdoor/botnet from anyone who happens to read about the latest patched Windows vulnerabilities.
I've considered buying a Mac, but I'm slowly starting to get the feeling that is merely a change of control freak with a clearly better marketing department.
I had a Mac; I use Linux now. And Jobs is far more of a control freak than Microsoft ever was.
Notice how you can install anything you want on a Windows Mobile phone, but you need the blessing of Jobs & Co. to put anything on an iPhone?
That's a clue as to the direction Apple is heading.
It's more than just a better marketing department -- they have better engineers, too, and better products in general -- for a very, very narrow set of use cases. As soon as you want to do something unusual, strangely enough, you may be better off on Windows -- certainly better on Linux.
All sane browsers and OSes that I know of distribute root certificates ahead of time, only to be updated via already-secure channels. The only way to make this work is to subvert that chain somewhere -- either convince an SSL vendor to trust that you are paypal, or somehow convince one of Microsoft, Apple, Mozilla, Opera, etc to distribute your new cert.
The first seems unlikely. You could use RapidSSL, in which case I'd be surprised and concerned to see the green bar go away, and I'd likely check my connection, try from a different location, and get in touch with PayPal to see WTF happened.
All of which assumes you can fool RapidSSL -- not hard, but then, you're trying to impersonate PayPal. It's very likely a human will do a double-take and wonder why you're not getting an EV cert.
The real question is, then, can obtaining an EV cert also prevent RapidSSL from then issuing you another cert? Unless you've thoroughly trained your users to look for that green bar, they could still intercept https://yourbank.com/ using a brand-new RapidSSL cert for that same domain.
if you set up your fake server for hugebank.com, and have it serve up redirects to your newly registered (and certified!) hugebank.secure-banking.dom site, then the user will see a validated site that they got to by typing in their bank's address or following an email link.
There's no reason for a bank to send out a non-https link in an email. I am in the habit of typing https for several sites -- gmail being the main one.
And if it wasn't for the banks (including my current bank) which are Doing It Wrong (sending me to a third-party site for the actual banking), I would be very suspicious seeing anything other than hugebank.com in the URL, validated or not. In fact, the first time this happened, I called them and asked what was going on -- they confirmed that they outsource this stuff.
How many people would blindly type in their password without looking for the nice little lock.
Shouldn't be too hard to write a Firefox extension which does exactly that -- warn you when you seem to be attempting to login to your bank, on a site that isn't the exact same URL as your bank.
For instance, you create your own website and your own certifications and then trick the DNS into thinking your site is from Verisign and was created by them as well (since the source address would be the same according to DNS).
Which would still require you to update Verisign's root certificate, which still requires you to have Verisign's old root certificate key.
If not, well, you're popping up a security notice, which will be very difficult to get past in Firefox.
It's a massive step forward, and practically, if we are willing to infringe on several patents, there is plenty of open support for mpeg4.
However, there are said patents. To be legal, significant royalties must be paid for the use of said patents, even when coding from scratch. (This is why software patents are such poisonous bullshit, by the way -- it doesn't matter how clean your cleanroom implementation is.)
A professional encoding suite is prohibitively expensive -- on the order of several thousand dollars. The royalties are also likely excessive, if you want to write your own encoder (and stay legal).
Which means that the President Elect either does not anticipate anyone actually wanting to use their creative-common rights about these videos, or is asking us to choose between spending a significant amount of money to large, established corporations for that right (hurting main street, helping wall street), or is asking us to break the law.
In short, it's a pretty shitty thing to do, when these free codecs exist, and have plenty of free software to back them up. Even if we accept that there's some reason for the office to prefer creating the initial video with expensive, proprietary software, it should not be difficult to transcode from that to a free codec -- and at least then, any licensing/royalties would be paid once, by change.gov, and not every time, by every single law-abiding citizen who wants to participate.
As a lawyer rather than a technologist, perhaps Professor Lessig doesn't realise that a YouTube video must be downloaded to be viewed, at least in a manner that would have the RIAA sue you if it was one of their copyrighted works.
The RIAA would most likely lose that case. More relevant is the question of the legality and practicality of saving those YouTube videos and sharing them, or of using them in any way other than simply viewing them. For instance, the videos may be licensed under creative commons, but how easy is it to pull a clip from a YouTube video and put it in another video?
Point is, there's nothing wrong with putting it on YouTube to make it easy for most people, who don't care about these things. It might be nice if they didn't give Google/YouTube so much free advertising, but it would get up there anyway, if distributed via some other means.
But there absolutely should be an alternative -- an officially endorsed, easy way to download a better-quality original and remix it into something else.
Video codecs:
- Dirac -- possibly patent-encumbered, but officially free to use
- Theora -- might be untested, but claims to be patent-free.
Audio codecs:
- Vorbis -- sounds as good as AAC on most listening tests; open/free/pantent-free.
- FLAC -- lossless, and as free as Vorbis.
Container formats:
- Ogg/ogm -- same camp as Vorbis and Theora
- Matroska -- uses some binary-xml format for metadata. Seems to support at least as much as Ogg. Not sure what the legal status is, but I suspect it's free. Popular with anime.
Those are the good free ones. Of course, most of us also have high-quality FOSS players for h.264 and AAC delivered as mov, mp4, mkv, even avi (yuck) -- so practically, the biggest change would be to offer it in just about anything other than Flash/Silverlight. (Or the latest version of WMA, for some reason.)
I'd personally prefer vorbis, mkv, and probably Theora, but that's less important than having a reasonable stand-alone (possibly higher-quality) version.
As for your other hypothetical, that's probably how it would go down. Then again, people installed Silverlight to watch the Olympics, so maybe people would install some free codecs to watch the President.
They are measuring "emotional engagement", which, if correct, is still not a measure of "fun".
For instance, the reason engagement may have dropped for Halo 3's cinematic sequences, for me, is that combat up to that point had been intense enough that the cutscene was a chance to relax for a moment. So, less adrenaline, maybe even less emotion at the moment, but I'd still consider them to be some of the best cutscenes -- particularly the random Cortana moments.
Halo 2 even moreso -- I wonder what kind of reading they got from "Return to Sender".
Similarly, while it is nice to have a given boss exist only once, that doesn't necessarily mean that subsequent battles are not fun -- why else replay a game, for instance? Just because the novelty is gone doesn't mean the fun is.
It just goes to show that you cannot provide a single measure as to the quality of a game.
That said, ever since my first Gauntlet kill in Quake 3, I've always felt it extremely unsatisfying when a shooter doesn't provide some sort of meelee weapon. I love Nexuiz for what it is, but I would love it even more if, when I somehow managed to get in close behind someone, I could hit them with something more fun than shotgun alternate fire.
If a website that looks like the bank and has the url of the bank, most users would just buy it and type in their username and password.
Which is why banks should do as PayPal does. If I ever see anything under the URL of http://www.paypal.com, I'll immediately suspect foul play, because PayPal uses https://www.paypal.com for everything.
In fact, it makes me wonder if a whitelist might be better than a blacklist, for phishing -- if a page looks suspiciously like my bank's page, but doesn't have the exact URL I'm expecting (https and all), raise a giant warning. No need to expose private info to Google, just a simple Firefox extension would do the trick...
To answer my own question, It looks like TFA mentions SSL, in a roundabout way:
But not anymore. Kaminsky's exploit would allow an attacker to redirect VeriSign's Web traffic to an exact functioning replica of the VeriSign site. The hacker could then offer his own encryption, which, of course, he could unlock later. Unsuspecting vendors would install the encryption and think themselves safe and ready for business.
In other words, you're telling me that it's worse -- even VeriSign doesn't know how to use SSL properly. You'd think, if you were downloading a new certificate, that you'd get it via SSL?
But thanks to journalists trying to dumb this down, I don't even know whether they're talking about SSL, let alone certificate distribution -- there are just some vague references to "encryption".
And then there is the part about catching return emails -- this problem feels a bit more real to me, mostly because everyone does this "forgot my password" shit, and no one uses PGP for those messages.
If a DNS vulnerability really is this serious, that tells me that the rest of the infrastructure is the problem, not DNS itself. With properly implemented encryption at the protocol level, this wouldn't be a catastrophic security failure, it would just be an irritating DoS, easily circumvented.
If that is true, I am even more terrified than I was for the safety and security of our banks.
You're telling me none of these banks properly implemented SSL? It never occurred to any of them to educate their users, and thus make their uber-expensive SSL certificates have a point?
That is an arms race which doesn't end, though -- how do you know you can trust icc, either? How did you obtain it in the first place -- did you download it and compile it with your own gcc?
Suppose you downloaded a trusted binary -- alright, how do you know you aren't rootkitted, with something which checks a predefined list of compilers, and thus modifies icc again?
Granted, it becomes unlikely. It is, however, impossible to ever truly know. Your method could prove that you are compromised, but it cannot prove that you are not compromised.
The problem is, there's still a nonzero number of people who are most likely not on the NSA's payroll, who are reviewing every line that comes in, and who may help reject a given patch if it can't be understood.
So yes, it's possible, but it's considerably harder -- you not only have to ensure that it's obfuscated, you have to ensure that it looks like it's not, that it appears to do something benign instead.
And you can't simply do that by adding complexity -- after all, the more complex it is, the more scrutiny there will be, and the more attempts at refactoring it down to manageable size.
No, it would be far easier for them to infiltrate a distro, like, say, Ubuntu. But there are countermeasures to that -- you can always download the source and compile it yourself.
Technically, you cannot be sure that everything isn't completely compromised already -- perhaps anything that looks like a compiler is subtly modified to spit out trojan'd code, and anything that looks like a decompiler or a disassembler is similarly rootkitted. However, this would be an enormous amount of work, and the cracks would very likely show eventually.
The scariest way would be to do it in hardware, but I'm not sure how feasible that is.
I have to keep my computer secure because I sometimes have the displeasure of handling sensitive data in Windows and I also can't afford to have the network blacklisted as spam source..
Fixed it for you.
You use anti-virus. I use Firefox, I'm careful where I surf on Windows, I don't download things I don't trust, and I frequently re-image it, just because I think it's a good idea. In my world, there's no such thing as "one of those things that suddenly develops" that can't be fixed by simply blowing away the entire installation, and reverting to the last known good state.
Anti-virus is actually one of the worst methods of keeping a computer secure.
And I am not trying to stop closed code. I write code which is currently closed for a living.
However, I do think they should play by our rules. Just as you would distribute a DMG, MPKG, or a zipfile for OS X -- and not a tarball, or an exe + Wine, or a single statically-linked executable -- you distribute for Linux via package managers.
If you don't want to do that, you're off the beaten path -- like asking Mac users to use MacPorts -- and it is not our fault you chose not to use the perfectly good system we built for you.
Last I checked, no one had quite figured out how to teach computer science -- your first course in college would serve mainly to flunk those who didn't know, or couldn't learn very quickly on their own, because the course itself certainly isn't going to teach you much.
However, the specific things Djikstra is talking about are not problems.
Consider his insistence that "bugs" should be instead called "errors", because this is less metaphorical and closer to the truth -- placing the blame where it belongs (the programmer), and allowing a lower tolerance -- a program cannot be "mostly correct"; it is either correct (with no errors) or it is incorrect (has errors).
This is to ignore one of the most important things to understand about modern computer science: Culture, or, more importantly, communication.
"Error", even in context in computer science, could mean several things. It could be programmer error, it could be an error in the rest of the software, it could be a hardware error, or an error status returned from any of these, even user error.
"Bug" has a very specfic meaning. When you say you've "squashed a bug", there is very little doubt as to what you mean.
Yes, it was initially attached to a metaphor. But as Djikstra so clearly points out, computer science is a radical novelty -- and such radical novelties tend to borrow words from older vocabulary, from other languages, from fiction, and invent some of their own. They do this not because of intellectual laziness, but because they need a vocabulary of their own -- yes, jargon serves a purpose.
And yet, it is not such a radical novelty that old ideas will have no effect. Certainly, some understanding of mathematics will be beneficial -- and although calculus may not be needed most of the time, the way in which it forces you to think will exercise the same parts of your brain that tough programming will.
I would argue, though, that computer science is not only informed by mathematics. It is also informed by softer sciences -- philosophy, creative writing, and languages.
Certainly, parts of it are very much a hard science -- the best sorting algorithm for a given situation, for instance -- but these are often confined to small, easily replaced cases. After all, it should not be difficult to swap sorting algorithms in most programs.
Other parts are very much a creative work -- an attempt to find the clearest possible way to express an idea, both to the computer, and to the next programmer. It is here that we most often talk about elegance.
Both are necessary -- without the creative structuring of a program, and proper communication of that structure to all involved, we would not be able to swap sorting algorithms at will. Without a clear understanding of how the performance of a program is impacted by various choices, that beautiful, creative code may never run.
And that is why it is so challenging to teach. A good programmer is going to be using both halves of his (or her) brain, if not at the same time, then certainly throughout developing a given program.
And that is also why it's not going to be easy to learn.
If Djikstra were alive, he could learn a thing or two from Why The Lucky Stiff.
Is it not possible for there to be ANY story ANYWHERE on-line about games, without people gushing about how they hate DRM, even when the story is NOTHING to do with it?
Is DRM still in use for all AAA titles?
Has even one major publisher rejected DRM? Or even SecuROM?
Then no, it's probably not possible, no matter how offtopic it might be. This is a real, immediate problem which must be dealt with if PC gaming is to continue as an industry. Shoplifting really isn't.
Oh, and it's not clear either from the summary or from TFA -- or, even, from the PDF -- that this is not DRM. It could be what you're describing, or it could also include DRM. It seems like a list of wishful-thinking "would be nice" features, though -- 99.99%?
Unless they put more thought into it than you did.
Since DRM can never work, it doesn't take very much thought to realize that any given DRM system is unlikely to work.
And it only needs to work somewhat better than the current DRM and anti-shoplifting systems. If it prevented 15% of the piracy
It may have a chance at anti-shoplifting, though I doubt they have many problems with shoplifters breaking into the locked glass cases where most games are kept.
It really has no chance at preventing any of the piracy. There may be 15% fewer people who might attempt to crack it -- meaning it still takes exactly one person to successfully crack it, and create a torrent. Once there's a torrent, 100% of the people who would have pirated it anyway will pirate it now.
Making DRM harder to crack will do absolutely nothing to reduce the amount of piracy which happens. The only way it could work is if it were impossible to crack, or more inconvenient to use the cracked version -- neither of which will happen with a single-player PC game.
Indeed they will -- which is exactly why they should stop spending money on stupid shit like this.
With EA, and I know I'm not the only one, but I pirate because of the DRM, not in spite of it. The pirated game I download, with the DRM stripped out, is a better product than the legitimate game I could buy in a store.
In short, Steam provides a DRM scheme, but it also provides enough of a benefit that it's a worthwhile trade. In fact, many of the restrictions imposed by the DRM scheme are things you would have to sacrifice anyway for the network -- for example, the need to be online all the time, the need for constant updates, and the need to run their proprietary software (a given for any game).
Contrast this to SecuROM games, or even moreso, movies -- in these cases, the DRM scheme provides no value. There is no tradeoff to make me want to deal with the DRM -- and worse, the pirated copy is a better product.
That's the essential difference, I think. A pirated Valve game is worth less than a legitimate copy. A pirated EA game is worth more than a legitimate copy.
I don't mind Steam. I do mind some of the other systems -- SecuROM has been getting a lot of attention recently, and it has many things to hate. Becoming part of only one botnet, or acquiring only one virus/trojan, might not do anything that you'd notice immediately, but it's not something I would do deliberately.
This is worse than all of the above, if implemented in software.
If implemented in hardware -- I can imagine a system that might be harmless, where a DVD is "activated" by burning it, for example. In which case, there are still two downsides over Steam -- I can't do digital delivery, and I can't even order it online and have it delivered to my house, unless they expect to pay the UPS guy to do this.
Slashdot Mirror
Make it legal, always, period.
There are already laws against the criminal things you've suggested. I really don't see why it should also be illegal to break DRM with the intention of doing that -- why should the intention matter at all? Maybe you broke it with the intention of watching it on your Mythbox, and later got the idea (independently) of using the cracked version for something criminal?
No, that's all needlessly vague and complex. If you want to make it hurt more to pirate stuff, change those laws -- which wasn't even a criminal offense until recently, but rather, a civil matter.
Think about that -- it is a federal crime to crack the DRM. It's merely a civil offense to redistribute the music. One goes on your record, the other doesn't. WTF?!
Tag says it all: justrepealit. Or, if you're going to ask for exemptions, don't ask for such pathetically small ones -- are iPhones mentioned specifically? Why can't I crack an iPod Touch, then?
about the only things that come onto the system are anti-virus updates (separate downloads as files)... Windows Update is in itself a risk.
Out of curiosity, why do you trust antivirus updates more than Windows updates?
I have a choice for Windows: forego updates that could possibly make it safer (let's assume that is possible) but could backdoor the system which may very well happen by default, or leave it unpatched and risk some of the earlier gotchas creating a vulnerability.
In other words -- and especially when you're on any network of any kind -- you're trading the paranoid and unsubstantiated possibility of a Microsoft backdoor, for the near certainty of a backdoor/botnet from anyone who happens to read about the latest patched Windows vulnerabilities.
I've considered buying a Mac, but I'm slowly starting to get the feeling that is merely a change of control freak with a clearly better marketing department.
I had a Mac; I use Linux now. And Jobs is far more of a control freak than Microsoft ever was.
Notice how you can install anything you want on a Windows Mobile phone, but you need the blessing of Jobs & Co. to put anything on an iPhone?
That's a clue as to the direction Apple is heading.
It's more than just a better marketing department -- they have better engineers, too, and better products in general -- for a very, very narrow set of use cases. As soon as you want to do something unusual, strangely enough, you may be better off on Windows -- certainly better on Linux.
All sane browsers and OSes that I know of distribute root certificates ahead of time, only to be updated via already-secure channels. The only way to make this work is to subvert that chain somewhere -- either convince an SSL vendor to trust that you are paypal, or somehow convince one of Microsoft, Apple, Mozilla, Opera, etc to distribute your new cert.
The first seems unlikely. You could use RapidSSL, in which case I'd be surprised and concerned to see the green bar go away, and I'd likely check my connection, try from a different location, and get in touch with PayPal to see WTF happened.
All of which assumes you can fool RapidSSL -- not hard, but then, you're trying to impersonate PayPal. It's very likely a human will do a double-take and wonder why you're not getting an EV cert.
The latter seems even less likely. Good luck.
This is, supposedly, what EV certificates provide
The real question is, then, can obtaining an EV cert also prevent RapidSSL from then issuing you another cert? Unless you've thoroughly trained your users to look for that green bar, they could still intercept https://yourbank.com/ using a brand-new RapidSSL cert for that same domain.
if you set up your fake server for hugebank.com, and have it serve up redirects to your newly registered (and certified!) hugebank.secure-banking.dom site, then the user will see a validated site that they got to by typing in their bank's address or following an email link.
There's no reason for a bank to send out a non-https link in an email. I am in the habit of typing https for several sites -- gmail being the main one.
And if it wasn't for the banks (including my current bank) which are Doing It Wrong (sending me to a third-party site for the actual banking), I would be very suspicious seeing anything other than hugebank.com in the URL, validated or not. In fact, the first time this happened, I called them and asked what was going on -- they confirmed that they outsource this stuff.
How many people would blindly type in their password without looking for the nice little lock.
Shouldn't be too hard to write a Firefox extension which does exactly that -- warn you when you seem to be attempting to login to your bank, on a site that isn't the exact same URL as your bank.
For instance, you create your own website and your own certifications and then trick the DNS into thinking your site is from Verisign and was created by them as well (since the source address would be the same according to DNS).
Which would still require you to update Verisign's root certificate, which still requires you to have Verisign's old root certificate key.
If not, well, you're popping up a security notice, which will be very difficult to get past in Firefox.
In a word, no.
It's a massive step forward, and practically, if we are willing to infringe on several patents, there is plenty of open support for mpeg4.
However, there are said patents. To be legal, significant royalties must be paid for the use of said patents, even when coding from scratch. (This is why software patents are such poisonous bullshit, by the way -- it doesn't matter how clean your cleanroom implementation is.)
A professional encoding suite is prohibitively expensive -- on the order of several thousand dollars. The royalties are also likely excessive, if you want to write your own encoder (and stay legal).
Which means that the President Elect either does not anticipate anyone actually wanting to use their creative-common rights about these videos, or is asking us to choose between spending a significant amount of money to large, established corporations for that right (hurting main street, helping wall street), or is asking us to break the law.
In short, it's a pretty shitty thing to do, when these free codecs exist, and have plenty of free software to back them up. Even if we accept that there's some reason for the office to prefer creating the initial video with expensive, proprietary software, it should not be difficult to transcode from that to a free codec -- and at least then, any licensing/royalties would be paid once, by change.gov, and not every time, by every single law-abiding citizen who wants to participate.
As a lawyer rather than a technologist, perhaps Professor Lessig doesn't realise that a YouTube video must be downloaded to be viewed, at least in a manner that would have the RIAA sue you if it was one of their copyrighted works.
The RIAA would most likely lose that case. More relevant is the question of the legality and practicality of saving those YouTube videos and sharing them, or of using them in any way other than simply viewing them. For instance, the videos may be licensed under creative commons, but how easy is it to pull a clip from a YouTube video and put it in another video?
Point is, there's nothing wrong with putting it on YouTube to make it easy for most people, who don't care about these things. It might be nice if they didn't give Google/YouTube so much free advertising, but it would get up there anyway, if distributed via some other means.
But there absolutely should be an alternative -- an officially endorsed, easy way to download a better-quality original and remix it into something else.
I know it was rhetorical, but the options are:
Video codecs:
- Dirac -- possibly patent-encumbered, but officially free to use
- Theora -- might be untested, but claims to be patent-free.
Audio codecs:
- Vorbis -- sounds as good as AAC on most listening tests; open/free/pantent-free.
- FLAC -- lossless, and as free as Vorbis.
Container formats:
- Ogg/ogm -- same camp as Vorbis and Theora
- Matroska -- uses some binary-xml format for metadata. Seems to support at least as much as Ogg. Not sure what the legal status is, but I suspect it's free. Popular with anime.
Those are the good free ones. Of course, most of us also have high-quality FOSS players for h.264 and AAC delivered as mov, mp4, mkv, even avi (yuck) -- so practically, the biggest change would be to offer it in just about anything other than Flash/Silverlight. (Or the latest version of WMA, for some reason.)
I'd personally prefer vorbis, mkv, and probably Theora, but that's less important than having a reasonable stand-alone (possibly higher-quality) version.
As for your other hypothetical, that's probably how it would go down. Then again, people installed Silverlight to watch the Olympics, so maybe people would install some free codecs to watch the President.
They are measuring "emotional engagement", which, if correct, is still not a measure of "fun".
For instance, the reason engagement may have dropped for Halo 3's cinematic sequences, for me, is that combat up to that point had been intense enough that the cutscene was a chance to relax for a moment. So, less adrenaline, maybe even less emotion at the moment, but I'd still consider them to be some of the best cutscenes -- particularly the random Cortana moments.
Halo 2 even moreso -- I wonder what kind of reading they got from "Return to Sender".
Similarly, while it is nice to have a given boss exist only once, that doesn't necessarily mean that subsequent battles are not fun -- why else replay a game, for instance? Just because the novelty is gone doesn't mean the fun is.
It just goes to show that you cannot provide a single measure as to the quality of a game.
That said, ever since my first Gauntlet kill in Quake 3, I've always felt it extremely unsatisfying when a shooter doesn't provide some sort of meelee weapon. I love Nexuiz for what it is, but I would love it even more if, when I somehow managed to get in close behind someone, I could hit them with something more fun than shotgun alternate fire.
If a website that looks like the bank and has the url of the bank, most users would just buy it and type in their username and password.
Which is why banks should do as PayPal does. If I ever see anything under the URL of http://www.paypal.com, I'll immediately suspect foul play, because PayPal uses https://www.paypal.com for everything.
In fact, it makes me wonder if a whitelist might be better than a blacklist, for phishing -- if a page looks suspiciously like my bank's page, but doesn't have the exact URL I'm expecting (https and all), raise a giant warning. No need to expose private info to Google, just a simple Firefox extension would do the trick...
To answer my own question, It looks like TFA mentions SSL, in a roundabout way:
But not anymore. Kaminsky's exploit would allow an attacker to redirect VeriSign's Web traffic to an exact functioning replica of the VeriSign site. The hacker could then offer his own encryption, which, of course, he could unlock later. Unsuspecting vendors would install the encryption and think themselves safe and ready for business.
In other words, you're telling me that it's worse -- even VeriSign doesn't know how to use SSL properly. You'd think, if you were downloading a new certificate, that you'd get it via SSL?
But thanks to journalists trying to dumb this down, I don't even know whether they're talking about SSL, let alone certificate distribution -- there are just some vague references to "encryption".
And then there is the part about catching return emails -- this problem feels a bit more real to me, mostly because everyone does this "forgot my password" shit, and no one uses PGP for those messages.
If a DNS vulnerability really is this serious, that tells me that the rest of the infrastructure is the problem, not DNS itself. With properly implemented encryption at the protocol level, this wouldn't be a catastrophic security failure, it would just be an irritating DoS, easily circumvented.
If that is true, I am even more terrified than I was for the safety and security of our banks.
You're telling me none of these banks properly implemented SSL? It never occurred to any of them to educate their users, and thus make their uber-expensive SSL certificates have a point?
That is an arms race which doesn't end, though -- how do you know you can trust icc, either? How did you obtain it in the first place -- did you download it and compile it with your own gcc?
Suppose you downloaded a trusted binary -- alright, how do you know you aren't rootkitted, with something which checks a predefined list of compilers, and thus modifies icc again?
Granted, it becomes unlikely. It is, however, impossible to ever truly know. Your method could prove that you are compromised, but it cannot prove that you are not compromised.
The problem is, there's still a nonzero number of people who are most likely not on the NSA's payroll, who are reviewing every line that comes in, and who may help reject a given patch if it can't be understood.
So yes, it's possible, but it's considerably harder -- you not only have to ensure that it's obfuscated, you have to ensure that it looks like it's not, that it appears to do something benign instead.
And you can't simply do that by adding complexity -- after all, the more complex it is, the more scrutiny there will be, and the more attempts at refactoring it down to manageable size.
No, it would be far easier for them to infiltrate a distro, like, say, Ubuntu. But there are countermeasures to that -- you can always download the source and compile it yourself.
Technically, you cannot be sure that everything isn't completely compromised already -- perhaps anything that looks like a compiler is subtly modified to spit out trojan'd code, and anything that looks like a decompiler or a disassembler is similarly rootkitted. However, this would be an enormous amount of work, and the cracks would very likely show eventually.
The scariest way would be to do it in hardware, but I'm not sure how feasible that is.
I have to keep my computer secure because I sometimes have the displeasure of handling sensitive data in Windows and I also can't afford to have the network blacklisted as spam source..
Fixed it for you.
You use anti-virus. I use Firefox, I'm careful where I surf on Windows, I don't download things I don't trust, and I frequently re-image it, just because I think it's a good idea. In my world, there's no such thing as "one of those things that suddenly develops" that can't be fixed by simply blowing away the entire installation, and reverting to the last known good state.
Anti-virus is actually one of the worst methods of keeping a computer secure.
Skype exists in my repositories...
And I am not trying to stop closed code. I write code which is currently closed for a living.
However, I do think they should play by our rules. Just as you would distribute a DMG, MPKG, or a zipfile for OS X -- and not a tarball, or an exe + Wine, or a single statically-linked executable -- you distribute for Linux via package managers.
If you don't want to do that, you're off the beaten path -- like asking Mac users to use MacPorts -- and it is not our fault you chose not to use the perfectly good system we built for you.
Last I checked, no one had quite figured out how to teach computer science -- your first course in college would serve mainly to flunk those who didn't know, or couldn't learn very quickly on their own, because the course itself certainly isn't going to teach you much.
However, the specific things Djikstra is talking about are not problems.
Consider his insistence that "bugs" should be instead called "errors", because this is less metaphorical and closer to the truth -- placing the blame where it belongs (the programmer), and allowing a lower tolerance -- a program cannot be "mostly correct"; it is either correct (with no errors) or it is incorrect (has errors).
This is to ignore one of the most important things to understand about modern computer science: Culture, or, more importantly, communication.
"Error", even in context in computer science, could mean several things. It could be programmer error, it could be an error in the rest of the software, it could be a hardware error, or an error status returned from any of these, even user error.
"Bug" has a very specfic meaning. When you say you've "squashed a bug", there is very little doubt as to what you mean.
Yes, it was initially attached to a metaphor. But as Djikstra so clearly points out, computer science is a radical novelty -- and such radical novelties tend to borrow words from older vocabulary, from other languages, from fiction, and invent some of their own. They do this not because of intellectual laziness, but because they need a vocabulary of their own -- yes, jargon serves a purpose.
And yet, it is not such a radical novelty that old ideas will have no effect. Certainly, some understanding of mathematics will be beneficial -- and although calculus may not be needed most of the time, the way in which it forces you to think will exercise the same parts of your brain that tough programming will.
I would argue, though, that computer science is not only informed by mathematics. It is also informed by softer sciences -- philosophy, creative writing, and languages.
Certainly, parts of it are very much a hard science -- the best sorting algorithm for a given situation, for instance -- but these are often confined to small, easily replaced cases. After all, it should not be difficult to swap sorting algorithms in most programs.
Other parts are very much a creative work -- an attempt to find the clearest possible way to express an idea, both to the computer, and to the next programmer. It is here that we most often talk about elegance.
Both are necessary -- without the creative structuring of a program, and proper communication of that structure to all involved, we would not be able to swap sorting algorithms at will. Without a clear understanding of how the performance of a program is impacted by various choices, that beautiful, creative code may never run.
And that is why it is so challenging to teach. A good programmer is going to be using both halves of his (or her) brain, if not at the same time, then certainly throughout developing a given program.
And that is also why it's not going to be easy to learn.
If Djikstra were alive, he could learn a thing or two from Why The Lucky Stiff.
Is it not possible for there to be ANY story ANYWHERE on-line about games, without people gushing about how they hate DRM, even when the story is NOTHING to do with it?
Is DRM still in use for all AAA titles?
Has even one major publisher rejected DRM? Or even SecuROM?
Then no, it's probably not possible, no matter how offtopic it might be. This is a real, immediate problem which must be dealt with if PC gaming is to continue as an industry. Shoplifting really isn't.
Oh, and it's not clear either from the summary or from TFA -- or, even, from the PDF -- that this is not DRM. It could be what you're describing, or it could also include DRM. It seems like a list of wishful-thinking "would be nice" features, though -- 99.99%?
Unless they put more thought into it than you did.
Since DRM can never work, it doesn't take very much thought to realize that any given DRM system is unlikely to work.
And it only needs to work somewhat better than the current DRM and anti-shoplifting systems. If it prevented 15% of the piracy
It may have a chance at anti-shoplifting, though I doubt they have many problems with shoplifters breaking into the locked glass cases where most games are kept.
It really has no chance at preventing any of the piracy. There may be 15% fewer people who might attempt to crack it -- meaning it still takes exactly one person to successfully crack it, and create a torrent. Once there's a torrent, 100% of the people who would have pirated it anyway will pirate it now.
Making DRM harder to crack will do absolutely nothing to reduce the amount of piracy which happens. The only way it could work is if it were impossible to crack, or more inconvenient to use the cracked version -- neither of which will happen with a single-player PC game.
Except that the law is, in fact, more enforceable than whatever manager-types know.
If the manager-type doesn't know, or doesn't understand, you threaten to sue, or press charges. If they continue to be difficult, you follow through.
And if that doesn't work, move to a country where the law is enforced.
Indeed they will -- which is exactly why they should stop spending money on stupid shit like this.
With EA, and I know I'm not the only one, but I pirate because of the DRM, not in spite of it. The pirated game I download, with the DRM stripped out, is a better product than the legitimate game I could buy in a store.
In short, Steam provides a DRM scheme, but it also provides enough of a benefit that it's a worthwhile trade. In fact, many of the restrictions imposed by the DRM scheme are things you would have to sacrifice anyway for the network -- for example, the need to be online all the time, the need for constant updates, and the need to run their proprietary software (a given for any game).
Contrast this to SecuROM games, or even moreso, movies -- in these cases, the DRM scheme provides no value. There is no tradeoff to make me want to deal with the DRM -- and worse, the pirated copy is a better product.
That's the essential difference, I think. A pirated Valve game is worth less than a legitimate copy. A pirated EA game is worth more than a legitimate copy.
I don't mind Steam. I do mind some of the other systems -- SecuROM has been getting a lot of attention recently, and it has many things to hate. Becoming part of only one botnet, or acquiring only one virus/trojan, might not do anything that you'd notice immediately, but it's not something I would do deliberately.
This is worse than all of the above, if implemented in software.
If implemented in hardware -- I can imagine a system that might be harmless, where a DVD is "activated" by burning it, for example. In which case, there are still two downsides over Steam -- I can't do digital delivery, and I can't even order it online and have it delivered to my house, unless they expect to pay the UPS guy to do this.
By all rights, we should have a good open source game engine already.
Technically, we do, they're just a generation behind -- but there's still quite a lot of good open source mods for Quake 2 and 3.
But it always frustrated me how pitifully slow CrystalSpace development seemed to be -- and how pitifully slow the results were to run.