you, sir, are wrong. That's what BadUSB is, reprogramming a device to behave as another device. Nothing more. Does it enable a variety of attack vectors that were previously impractical? Yes. But it doesn't do so entirely silently. I suggest you familiarize yourself with the USB spec to further your understanding on this matter.
I see where the problem is, BadUSB isn't at all what you think it is. Your hubris is poking you in the eye again. From the Wired story:
That’s the takeaway from findings security researchers Karsten Nohl and Jakob Lell plan to present next week, demonstrating a collection of proof-of-concept malicious software that highlights how the security of USB devices has long been fundamentally broken. The malware they created, called BadUSB, can be installed on a USB device to completely take over a PC, invisibly alter files installed from the memory stick, or even redirect the user’s internet traffic.
It is a demonstration "malware" created by Nohl and Lell to demonstrate the entire collection of attacks I've been discussing, in the original quote way back
Then there's the USB security issues. I love the fact that you can take over a computer by plugging in a storage device, or is it?
which sparked this whole conversation on security. A valid side issue you brought up, DMA, has its admitted security issues. It could be argued that they are quite less severe than these since the DMA memory has been virtualized in recent hardware/OS systems and there is no persistence nor propagation of the threat once the bad hardware has been removed, unlike with the USB issue nor does DMA allow for BIOS/EFI corruption. So the USB issues are worse than I thought while DMA has had additional risk mitigation with recent systems.
+1 on this. That is exactly what I was going to write. Merely copying code from the internet is not reuse, it's a maintenance nightmare waiting to happen. You need to be able to evaluate the code, modify it for what you need, definitely morph it into your own coding conventions, complete with tests, because this is a rather complicated algorithm, right? Otherwise, why bother copying it?
I reviewed them more carefully. I get the following: if the USB bus is active and in use, at least some of the attack vectors work. Perhaps part of the miscommunication is that BadUSB isn't just 1 attack, but many different potential ones. I wrap them all up (perhaps incorrectly for this discussion) as a single attack vector. While being a supported device certainly expands the range of attack possibilities, being unsupported by no means eliminates the threat. The controller on the host can still be reprogrammed, for instance, and the bus communications can be sniffed, depending upon the connected device's capabilities. Nothing anywhere states that these are only done once the OS finally recognizes the device, in fact, several attack vectors occur before the OS is even in play. Finally, most systems will enable the keyboard USB device, so any claims of the original device not being supported are moot, since it can spoof itself as anything at any time, including the keyboard. (This is directly from several of the previous links, including the spec itself)
So I say that your claim,
A USB device without a driver does nothing. Period.
is wholly incorrect in context of BadUSB. I suggest you shed some of that hubris you're carrying around, apparently it is interfering with your reading comprehension.
running multiple connections on a single bus drop performance way way down
Not nearly to the levels you claimed. I have not disputed that there is a performance impact; in fact, I discussed that in one of my posts.
Still are, per your own admission. But moving on.
USB can be compromised with merely plugging in an infected USB device.
It cannot. You need to actually read up on BadUSB. I've pointed you to a few references, and you've pointed out a few, yourself, that you've clearly not read, or at least not understood.
I trust certain people when they say "it is 'x' bad". Bruce is one of those. I briefly reviewed this again, and what I get out of it is if the bus is alive, this works. Obviously, if the bus is disabled, it's not going to be infected. So, is Bruce wrong?
BTW, I did learn that Macs since 2012 are no longer subject to the DMA attacks.
Yes, by way of disabling DMA for the Firewire bus.
Interesting, thought it was to create a virtually mapped 4GB space, thus preventing random reading of the lower 4GB of potentially OS memory which shouldn't have that significant an impact on performance. That's more like daisy-chaining a few drives effect.
Notice how I'm now only pointing out flaws in your arguments, and no longer arguing the points. That is because I have said what I needed to say and provided references where applicable, and you have shown that you are not capable of following the conversation, as you think I've gone off topic when I most certainly have not.
I have noticed how you just assert and occasionally throw a link in as "proof" of your argument. Note how I took out quotes of my references? I also note you didn't dispute a single one of those.
running multiple connections on a single bus drop performance way way down.
USB can be compromised with merely plugging in an infected USB device.
These are all true statements backed by references. I note that you mislead frequently by bringing in unrelated items (Tbolt, DMA, intentional confusion about hubs, etc). Because I keep moving back to these points mean I'm staying on topic, instead of going down whatever rabit hole you want to go. BTW, I did learn that Macs since 2012 are no longer subject to the DMA attacks. Thanks for that.
As you've shown a complete unwillingness to actually consider that you may be wrong, or to even read the posts you're replying to, let alone the linked information (because you're likely sure it'll prove you wrong), I think we're done here. I'm sure anyone reading this will have read everything, leaving you the only one who still thinks you're right.
And yet you completely ignore the reference to the explanation of why USB speeds are far far lower than what you'd expect, and why your sanctimonious statements are nothing more than anecdotal hot air. Take a good look at the following snippets:
From the spec:
At a 5 Gbps signaling rate with 8b/10b encoding, the raw throughput is 500 MBps. When link flow control, packet framing, and protocol overhead are considered, it is realistic for 400 MBps or more to be delivered to an application.
Just 1 Samsung SSD will outperform that speed. It's got a 500+MBps transfer speed.
USB 3.0 devices employing ASMedia controllers deliver the best performance... isn't enough to push past 300 MB/s to the interface's peak potential.
Now we're down to 300 MB/s.
Isochronous transfer is typically used in audio/video devices like capture cards, because it resolves the problem of data loss (such as video frame dropping) when multiple USB devices are in use. Lastly, bulk transfer (bulk-only transport) is the mode that we are focusing on here, since it's used for transferring data to USB mass storage devices.
Well, lookie there, multiple devices cause transfer problems. And bulk only transport, normally used for device drivers don't use the mode that will prevent dropped data, leading to, well, can we say REALLY SLOW transfer rates? I knew you could.
I already knew you were full of it, as USB 3 cannot even feed a single high end SSD properly, much less more than one. Also, no one that really does AV editing would dream of using something as slow as USB 3. eSata or faster, thank you very much. USB 3 is fine for external backup storage, as long as you're only loading 1 at a time.
Which, of course, means the devices have to be identified by the system and a driver has to exist for whatever they identify as.
I was relatively sure that part of the problem was that the system's USB controllers could also be coopted by plugging in a bad USB device, whether the system recognized said device or not. At that point, as long as your system recognizes any USB devices, you're toast. Correct me if I'm oversimplifying the problem.
Firewire is still fairly widely used in media production, and the devices using it include cameras, control boards, and DAT decks, which do get passed around.
Yes it is, although disappearing rapidly, at least from the set of cameras I looked at last year.
And without USB, where do you think you'd plug that thumb drive?
I could see thumb drives going to a ROM only version in the near future. That solves the trust issue with at least thumb drives. I know the arguments against ROMs, but if no one will use your drive because of a virus threat, well, then you have no market.
Drop 2 sets of file transfers through the disks on that one hub, and see what happens.
Okay, so you're doing two copy operations and are surprised when seek times slow them by more than 50%?
I have about 10 disks hooked up and was copying files between 3 sets (3 full speed copy operations, including 2 SSDs) with each disk capable of +100MB/s on large file sequential read/write speeds.
Are you truly that dense? It is 1 pair of drives per copy operation, going through 1 USB controller. Yes, the USB connection will slow down. In your case, I'll also bet your SSDs are on SATA connections, those are 1:1 internal, you mention that yourself.
I'll lay it out specifically:
internal sata SSD 1 (Samsung 840) copy operation to USB hosted disk 1, controller 1.
internal sata WD Caviar Black to external USB hosted disk 2, controller 1.
Internal sata Samsung Spinpoint to external USB hosted disk 2, controller 2.
All externals are newer WD or Samsung disks. 2 of those disks have eSata connectors on them. I've hooked them up as stated, and via eSata to split the data transfers across multiple busses. The throughput increased dramatically in the eSata configuration, leaving only the USB bus as the sucky culprit. Maybe it is the super cheap controllers, but USB has never come close to FW transfer speeds under anything but ideal 1 device per controller scenarios for anyone I know.
meanwhile a USB device must identify itself as a device whose driver required DMA, that driver must be present, and it must emulate that device well enough to fool the driver into actually talking to it; the bar is a fair bit higher with USB than DMA.
I didn't see any of that in the Wired story. It essentially stated: "plug it in, it infects your PC, Antivirus software is useless, and future USB devices plugged into your system can be infected". When Bruce wrote about it along with quite a few others, the evidence seems to point to a rather bad security flaw.
If you're worried about USB, you need to be terrified about the other busses in your system.
The short answer to this one is I only usually have 1 set of devices that are relatively permanent for those other buses. It's not a thumbdrive that gets passed around.
Then why don't I see an issue with it when I connect 2 portable drives (bare enclosures in which I've put a couple of Samsung SSDs) via a USB hub? Also, if not a hub, why did you say:
"Hook 2 devices up to a USB 3 hub, watch yourself get lower than USB 2 speeds"?
I'd figure there'd be no reason to mention a hub if you didn't use one.
All USB controllers on motherboards have multiple ports via a hub, or called a "bus" depending upon what you're using for a reference. I have yet to personally see a 1:1 controller to port system on a motherboard. Drop 2 sets of file transfers through the disks on that one hub, and see what happens. You'll need to have those files coming from 2 separate disk subsystems so that you're not bottlenecked from a single source. I have about 10 disks hooked up and was copying files between 3 sets (3 full speed copy operations, including 2 SSDs) with each disk capable of +100MB/s on large file sequential read/write speeds. The slow down was more than 50%. As an addendum, this problem does not exist with eSata connections. Unfortunately, I do not have enough eSata external ports. It would be interesting to see what happens with a port multiplier though.
Firewire is a bigger security threat than USB in many ways, namely that it is a bus with direct memory access, meaning it can read and write anything in RAM at any time.
There is a DMA component, a quick search reveals they haven't fixed that either yet. Bah.
The USB attack vector has nothing to do with USB itself; it's a flaw in a poor quality devices that allow their firmwares to be reprogrammed, enabling them to act as a different class of device.
This is both wrong and technically right. It has everything to do with the design of USB, and nothing to do with any "flaws" in "poor quality devices". The problem lies in that USB trusts the device to be what it says it is, even if that is more than one thing.
There is no reason Firewire would not be vulnerable in the same way, were a Firewire device's firmware made writable in the same way as the vulnerable subset of USB devices; only the exposure would be worse, given Firewire's DMA. Likewise with Thunderbolt, as it also has DMA.
Might as well add expressCard, PCI, PCIExpress, and anything else with DMA capabilities.
I love the fact that you can take over a computer by plugging in a storage device
Citation? Maybe there's something I missed, but I think you're thinking of this, in which case: Nope. Well, no more than a device with direct memory access. In fact, a little less.
Also, maybe try getting a USB3 hub that isn't a piece of shit. I don't have the speed problems you describe at all.
I wasn't running on a USB3 hub, but directly off the motherboard (which AFAIK share multiple ports per controller and this is a high end Gigabyte motherboard, so not a POS either). The slow down is a direct result of the design of USB serial communications. If you have multiple controllers, you can avoid this issue by running drives on 1 port per controller. I have successfully done this as well, when doing some mass backups among multiple drives. It's how I confirmed the problem in the first place. You will need drives that are capable of relatively high transfer rates to see this problem, but it is still there in USB3.
Sadly, the less capable, less secure, less in just about every way except "cheap" USB won out over Firewire. I'd still rather have FW800 than USB 3. Hook 2 devices up to a USB 3 hub, watch yourself get lower than USB 2 speeds, even when you only access 1 device. What a win that is. Then there's the USB security issues. I love the fact that you can take over a computer by plugging in a storage device, or is it? USB should have been restricted to keyboards and mice only, as an improvement to the PS/2 connector.
Mind you this conversation has been so long (and ultimately our position differ so little) that more than once I've become confused about who wrote what as well. %)
So let's move on. At least my ducks are in a better row now.
For the purposes of understanding his "teachings," he must be approached like any other character whose ideas are to be found exclusively in a literary source and the historicity debate is fruitless.
OK, I believe we agree on this whether or not we agree on the main point of my original assertion or not.
What was rude was the supercillious suggestion that I "begin with" the Wikipedia page for the Bible and "expand [my] research from there." That the fact was so obvious and not particularly pertinent didn't perhaps help, but it was not the problem.
The link wasn't to an article on the bible, but an article on the historicity of Jesus. I believe you would agree that is more than pertinent to the discussion. Note that no non-Christian sources are used, despite the statement contrary in the linked article (Josephus and Tacitus) as detailed in previous posts.
Why do you have trouble with this one and keep trying to change my words?
Two reasons. Firstly the platitude that the bible has been modified over time has never been in contest in this discussion and is, as we have discovered, irrelevant to the quesion of the historicity of Jesus. I cannot even read those words, let alone twist them. Your original reply managed to be impertient in both senses of the word. Had you not been so rude I may have left it there.
1) To the question of of the historicity of Jesus, my first post is 100% relevant, as the main source of writing about him is the bible, and the bible is questionable. Showing that the basis of historicity is unreliable directly implies that any debate about something based on that source to prove authenticity is pointless. Your additional citations went through the same set of groups and processes for at least 1000 years and are therefore no more reliable than the bible regarding this topic.
2) If that first post with an assertion supported by a fact seems rude to you, I suppose all the rest were worse.
Prove that the claim that "There is as much room for debate about the historicty of Jesus as there is about whether water is wet" is a False statement:
We agree on the fact, as you put it that "There/s not much point to debating whether water is wet, since the definition of wet involves "with water" in its oldest sense"
I'm leaving it all in there, because as noted above, and quoted below:
My claim about the "as much room for debate as water is wet" was about the fact that the bible has been modified over time. Nothing more.
Why do you have trouble with this one and keep trying to change my words? Because otherwise there's nothing to debate?
Regarding the "works" of Josephus and Tacitus, neither of these mean squat unless other corroborating proof is added. Note that the oldest extant manuscripts date from the 11th century and...
Here we find you debating the sources regarding the historicity of Jesus (albeit a lower quality version of the scholarly debate you derride as a "billion chimps typing").
You attempted to add references as to why you believe in the historicity of Jesus and change the meaning of the post. I probably should have separated those 2 pieces of the post to clearly delineate the flows, and merely pointed out in a second response that those sources are less than trustworthy, for multiple reasons, My apologies for allowing the confusion to continue.
Clearly there is room for debate about the historicity of Jesus and the above statement is False. Quod est demonstrantum
Which "above" statement? I'd think first you'd have to define exactly what you're trying to (dis)prove.
I think the proper response would be "How do you know he existed and/or said..."
Exactly the same way I know that Gandalf said "You shall not pass!"... I read it in the book. Duh!
Guess that depended upon your ISP. Mine was flat and had issues with their local POTS switches, having to have their telco install a whole new set of hardware because of the amount of lines and data they were pushing through neglected old equipment. The price was the same, no matter what you were using on your end (14.4 through 56K). The price? $14 / month at that time.
... Besides, we don't want "EVERYTHING" different, just some imporant things like better government oversight, holding back the reckless spending of the Obama administration, an actual annual budget again.
Really? Reckless spending of the Obama Administration? We can expect that? Just like the incredibly financially responsible terms under Bush which resulted in wealth for all by the end of his second term? Or is your memory that short?
So we agree... and b) there's no point in debating the historicity of Jesus, since no reliable evidence exists of his existence, unlike, say, Socrates, Plato, or Homer.
Obviously... not on b). There's little point debating the historicity of Jesus
Why? Your references of Josephus and Tacitus are not proof. See below.
In other words, for a non-believer to respond to "Jesus said..." with "but Jesus never existed!" is every bit as clever as responding to "Gandalf told Frodo..." with "wizards and hobbits aren't real!"
I think the proper response would be "How do you know he existed and/or said..."
Quantity has little meaning, much like 1 billion chimps typing away...
Firstly the scholarship we are dealing with is of high quality very much unlike chimps typing away. Secondly, and more importantly, quality is not determinative of debatability. As you point out the very definition of 'wet' involves water, so even low quality debate is precluded.
You may disagree, but my point was that the texts under discussion have no more reliability than selected output of 1 billion chimps regarding the very restricted subject of Jesus. They were likely modified to meet the opinions of those currently writing them. See below. For purposes of scholarship regarding the general life in the 1st century AD, that is an entirely different topic.
Clearly your claim that "There is as much room for debate [about the historicity of Jesus] as water is wet," fails both on logical and empirical grounds. But if you're still not convinced, I'll prove it to you: Jesus' existence is independently testified to by both Josephus and Tacitus!
My claim about the "as much room for debate as water is wet" was about the fact that the bible has been modified over time. Nothing more.
Regarding the "works" of Josephus and Tacitus, neither of these mean squat unless other corroborating proof is added. Note that the oldest extant manuscripts date from the 11th century and were maintained by Christian monks, most likely in a translated version. No way in almost 1000 years would these monks perhaps insert clarifications or slight modifications to such a text. Nope. As a side note, neither of these two were alive at the time of the events in question, and Josephus's purpose in writing his works was to present a more appealing history of the Jews. So facts were already loose there.
While I personally think there probably was someone named Jesus who influenced a strong cult-like following and was summarily executed around the mid 30s AD, I don't accept any written text as conclusive proof that was solely under the control of a group that has a proven and verifiable record of altering even their most highly regarded texts. So even the historical fact of Jesus is in question, much less anything said about his actions. The existence of (Pontius?) Pilate is likely the most factual person related to this immediate discussion with the discovery and dating of the Pilate Stone. Everything else is inferred from questionable texts all having been routed through at least 1000 years of copying by group(s) with vested interests known to alter things to support their current view.
The point is that there is historical evidence that people decided what went in the bible and changed the wording, meaning, etc to whatever suited them.
The fact that the biblical text changes over time hardly proves that there was no historical figure upon whom the text was based, so that observation bears only marginal relevance.
I never made such a claim. What I did claim is that a bible cannot be stated to be the truth. Nothing more, nothing less. Just because there was a flood some estimated 5000-8000 years ago doesn't mean the story of Noah, based on it, has any truth what so ever to it. A story based on historical facts does not automatically become factual.
Remember I'm insisting that we must necessarily treat Jesus as the literary character who emerges out of the text (aware of such changes that occur over time), and since any putative historical Jesus cannot be approached but via the text anyway. Therefore the debate on the historicity of Jesus seems fruitless to me and the question of the veracity of the text (I'm not quite sure in relation to what) doesn't even enter into discussion.
So we agree that a) the bible is a story, perhaps based on some historical facts and b) there's no point in debating the historicity of Jesus, since no reliable evidence exists of his existence, unlike, say, Socrates, Plato, or Homer.
However, if there were a question of veracity, your argument (even without considering its overly binary approach to documents) seems self-defeating. How do we know the text has changed, but by reference to earlier extant versions which presumably approach the more original.
There is as much room for debate there as water is wet.
Find me as many scholarly articles that debate whether water is wet as those which debate whether Jesus was an historical person and I'll agree.
We'll start from the back: Quantity has little meaning, much like 1 billion chimps typing away from the same script. There/s not much point to debating whether water is wet, since the definition of wet involves "with water" in its oldest sense, unless you're advocating changing the definition. Finally, the point of the changing texts to suit the opinions of the current people in control should automatically call into question anything stated in that set of texts. For instance, there are some things that are factual: Jerusalem existed: verified separately and still does today, Romans were occupiers: verified through many other records and physical evidence, etc. There's a group of things that cannot be verified: Garden of Eden, Adam and Eve, the snake, turning water into wine, feeding throngs with inadequate bread, even the crucifixion has little to no corroborating evidence, AFAIK, much less anything less corporeal.
So a couple of different companies didn't make their 20% two years out of the last 20 (Allan and Katrina, IIRC) Also note that insurance skyrocketed in those areas. They made their money back.
The insurance companies are the only ones who don't make money from unnecessary medical procedures and excessive medical costs.
This is incorrect. Insurance companies increase the cost basis, add 20%, and profit soars. Remember that insurance the way it's currently regulated is a skimming game. The more cash flows, the larger the skim.
Doctors who prescribe antibiotics and schedule a couple of visits when you have the sniffles make money from that.
If doctors make money on prescriptions, there's a big big problem. Visits are something you can control.
Hospitals who give you infections then have you stay another two weeks make money from that.
Hospitals that give you infections get sued. I'm pretty sure that's a money losing proposition. The more that happens, the more suits get filed, the more their insurance increases..., wait, who profits again?
Insurance companies who tell doctors and hospitals they won't pay for that nonsense save themselves money, and the patient money as well, not to mention a lot of discomfort, suffering, and death.
Yep, have a baby, you get 24 hours from the first midnight. Unless you're dying. Maybe. Have an operation where they cut you open and swab you out? Yep, insurance says you need to leave the hospital within 24 hours, even though you were near death. That's what insurance companies do when they tell doctors what they should do. In one case I'm personally aware of, that process nearly killed the patient who wound up back in the hospital, and the insurance company wanted them out. The family refused to sign the patient out, so there was no one to take the patient, so they had to stay a few days longer. (The patient was in such condition that they could not leave the hospital on their own, nor really do anything on their own, my personal set of conditions for saying someone should be in a hospital.)
They can - interstate commerce is only regulated by the feds, and there are no restrictions to selling insurance across state lines at the federal level that I'm aware of.
US insurers are in one of the best industries out there, with an incredible position. Name me another business where you're guaranteed 20% profit after costs, and those costs can include building office buildings and the profit excludes renting those office buildings after 2-3 years? Ever wonder why banks and insurance companies buy real estate and build office buildings during recessions?
Yeah, let's just say that insurance companies are not getting a sympathy card from me anytime soon.
Slashdot Mirror
For the record, Wired isn't exactly a first-class source.
No, but I suspect you'll also find some issue with Nohl and Lell's presentation, and also perhaps the BadUSB homepage.
you, sir, are wrong. That's what BadUSB is, reprogramming a device to behave as another device. Nothing more. Does it enable a variety of attack vectors that were previously impractical? Yes. But it doesn't do so entirely silently. I suggest you familiarize yourself with the USB spec to further your understanding on this matter.
I see where the problem is, BadUSB isn't at all what you think it is. Your hubris is poking you in the eye again. From the Wired story:
It is a demonstration "malware" created by Nohl and Lell to demonstrate the entire collection of attacks I've been discussing, in the original quote way back
Then there's the USB security issues. I love the fact that you can take over a computer by plugging in a storage device, or is it?
which sparked this whole conversation on security. A valid side issue you brought up, DMA, has its admitted security issues. It could be argued that they are quite less severe than these since the DMA memory has been virtualized in recent hardware/OS systems and there is no persistence nor propagation of the threat once the bad hardware has been removed, unlike with the USB issue nor does DMA allow for BIOS/EFI corruption. So the USB issues are worse than I thought while DMA has had additional risk mitigation with recent systems.
+1 on this. That is exactly what I was going to write. Merely copying code from the internet is not reuse, it's a maintenance nightmare waiting to happen. You need to be able to evaluate the code, modify it for what you need, definitely morph it into your own coding conventions, complete with tests, because this is a rather complicated algorithm, right? Otherwise, why bother copying it?
I reviewed them more carefully. I get the following: if the USB bus is active and in use, at least some of the attack vectors work. Perhaps part of the miscommunication is that BadUSB isn't just 1 attack, but many different potential ones. I wrap them all up (perhaps incorrectly for this discussion) as a single attack vector. While being a supported device certainly expands the range of attack possibilities, being unsupported by no means eliminates the threat. The controller on the host can still be reprogrammed, for instance, and the bus communications can be sniffed, depending upon the connected device's capabilities. Nothing anywhere states that these are only done once the OS finally recognizes the device, in fact, several attack vectors occur before the OS is even in play. Finally, most systems will enable the keyboard USB device, so any claims of the original device not being supported are moot, since it can spoof itself as anything at any time, including the keyboard. (This is directly from several of the previous links, including the spec itself)
So I say that your claim,
A USB device without a driver does nothing. Period.
is wholly incorrect in context of BadUSB. I suggest you shed some of that hubris you're carrying around, apparently it is interfering with your reading comprehension.
there were performance issues with the USB bus
Were. Moving on.
running multiple connections on a single bus drop performance way way down
Not nearly to the levels you claimed. I have not disputed that there is a performance impact; in fact, I discussed that in one of my posts.
Still are, per your own admission. But moving on.
USB can be compromised with merely plugging in an infected USB device.
It cannot. You need to actually read up on BadUSB. I've pointed you to a few references, and you've pointed out a few, yourself, that you've clearly not read, or at least not understood.
I trust certain people when they say "it is 'x' bad". Bruce is one of those. I briefly reviewed this again, and what I get out of it is if the bus is alive, this works. Obviously, if the bus is disabled, it's not going to be infected. So, is Bruce wrong?
BTW, I did learn that Macs since 2012 are no longer subject to the DMA attacks.
Yes, by way of disabling DMA for the Firewire bus.
Interesting, thought it was to create a virtually mapped 4GB space, thus preventing random reading of the lower 4GB of potentially OS memory which shouldn't have that significant an impact on performance. That's more like daisy-chaining a few drives effect.
Notice how I'm now only pointing out flaws in your arguments, and no longer arguing the points. That is because I have said what I needed to say and provided references where applicable, and you have shown that you are not capable of following the conversation, as you think I've gone off topic when I most certainly have not.
I have noticed how you just assert and occasionally throw a link in as "proof" of your argument. Note how I took out quotes of my references? I also note you didn't dispute a single one of those.
You're still side-stepping. I stated:
These are all true statements backed by references. I note that you mislead frequently by bringing in unrelated items (Tbolt, DMA, intentional confusion about hubs, etc). Because I keep moving back to these points mean I'm staying on topic, instead of going down whatever rabit hole you want to go. BTW, I did learn that Macs since 2012 are no longer subject to the DMA attacks. Thanks for that.
got dropped prior to the line:
"Now we're down to 300 MB/s."
As you've shown a complete unwillingness to actually consider that you may be wrong, or to even read the posts you're replying to, let alone the linked information (because you're likely sure it'll prove you wrong), I think we're done here. I'm sure anyone reading this will have read everything, leaving you the only one who still thinks you're right.
And yet you completely ignore the reference to the explanation of why USB speeds are far far lower than what you'd expect, and why your sanctimonious statements are nothing more than anecdotal hot air. Take a good look at the following snippets: From the spec:
Just 1 Samsung SSD will outperform that speed. It's got a 500+MBps transfer speed. USB 3.0 devices employing ASMedia controllers deliver the best performance... isn't enough to push past 300 MB/s to the interface's peak potential.
Now we're down to 300 MB/s.
Well, lookie there, multiple devices cause transfer problems. And bulk only transport, normally used for device drivers don't use the mode that will prevent dropped data, leading to, well, can we say REALLY SLOW transfer rates? I knew you could.
I already knew you were full of it, as USB 3 cannot even feed a single high end SSD properly, much less more than one. Also, no one that really does AV editing would dream of using something as slow as USB 3. eSata or faster, thank you very much. USB 3 is fine for external backup storage, as long as you're only loading 1 at a time.
Which, of course, means the devices have to be identified by the system and a driver has to exist for whatever they identify as.
I was relatively sure that part of the problem was that the system's USB controllers could also be coopted by plugging in a bad USB device, whether the system recognized said device or not. At that point, as long as your system recognizes any USB devices, you're toast. Correct me if I'm oversimplifying the problem.
Firewire is still fairly widely used in media production, and the devices using it include cameras, control boards, and DAT decks, which do get passed around.
Yes it is, although disappearing rapidly, at least from the set of cameras I looked at last year.
And without USB, where do you think you'd plug that thumb drive?
I could see thumb drives going to a ROM only version in the near future. That solves the trust issue with at least thumb drives. I know the arguments against ROMs, but if no one will use your drive because of a virus threat, well, then you have no market.
Drop 2 sets of file transfers through the disks on that one hub, and see what happens.
Okay, so you're doing two copy operations and are surprised when seek times slow them by more than 50%?
I have about 10 disks hooked up and was copying files between 3 sets (3 full speed copy operations, including 2 SSDs) with each disk capable of +100MB/s on large file sequential read/write speeds.
Are you truly that dense? It is 1 pair of drives per copy operation, going through 1 USB controller. Yes, the USB connection will slow down. In your case, I'll also bet your SSDs are on SATA connections, those are 1:1 internal, you mention that yourself.
I'll lay it out specifically:
All externals are newer WD or Samsung disks. 2 of those disks have eSata connectors on them. I've hooked them up as stated, and via eSata to split the data transfers across multiple busses. The throughput increased dramatically in the eSata configuration, leaving only the USB bus as the sucky culprit. Maybe it is the super cheap controllers, but USB has never come close to FW transfer speeds under anything but ideal 1 device per controller scenarios for anyone I know.
meanwhile a USB device must identify itself as a device whose driver required DMA, that driver must be present, and it must emulate that device well enough to fool the driver into actually talking to it; the bar is a fair bit higher with USB than DMA.
I didn't see any of that in the Wired story. It essentially stated: "plug it in, it infects your PC, Antivirus software is useless, and future USB devices plugged into your system can be infected". When Bruce wrote about it along with quite a few others, the evidence seems to point to a rather bad security flaw.
If you're worried about USB, you need to be terrified about the other busses in your system.
The short answer to this one is I only usually have 1 set of devices that are relatively permanent for those other buses. It's not a thumbdrive that gets passed around.
Then why don't I see an issue with it when I connect 2 portable drives (bare enclosures in which I've put a couple of Samsung SSDs) via a USB hub? Also, if not a hub, why did you say:
"Hook 2 devices up to a USB 3 hub, watch yourself get lower than USB 2 speeds"?
I'd figure there'd be no reason to mention a hub if you didn't use one.
All USB controllers on motherboards have multiple ports via a hub, or called a "bus" depending upon what you're using for a reference. I have yet to personally see a 1:1 controller to port system on a motherboard. Drop 2 sets of file transfers through the disks on that one hub, and see what happens. You'll need to have those files coming from 2 separate disk subsystems so that you're not bottlenecked from a single source. I have about 10 disks hooked up and was copying files between 3 sets (3 full speed copy operations, including 2 SSDs) with each disk capable of +100MB/s on large file sequential read/write speeds. The slow down was more than 50%. As an addendum, this problem does not exist with eSata connections. Unfortunately, I do not have enough eSata external ports. It would be interesting to see what happens with a port multiplier though.
Firewire is a bigger security threat than USB in many ways, namely that it is a bus with direct memory access, meaning it can read and write anything in RAM at any time.
There is a DMA component, a quick search reveals they haven't fixed that either yet. Bah.
The USB attack vector has nothing to do with USB itself; it's a flaw in a poor quality devices that allow their firmwares to be reprogrammed, enabling them to act as a different class of device.
This is both wrong and technically right. It has everything to do with the design of USB, and nothing to do with any "flaws" in "poor quality devices". The problem lies in that USB trusts the device to be what it says it is, even if that is more than one thing.
There is no reason Firewire would not be vulnerable in the same way, were a Firewire device's firmware made writable in the same way as the vulnerable subset of USB devices; only the exposure would be worse, given Firewire's DMA. Likewise with Thunderbolt, as it also has DMA.
Might as well add expressCard, PCI, PCIExpress, and anything else with DMA capabilities.
I love the fact that you can take over a computer by plugging in a storage device
Citation? Maybe there's something I missed, but I think you're thinking of this, in which case: Nope. Well, no more than a device with direct memory access. In fact, a little less.
I was referring to WIred's story
Also, maybe try getting a USB3 hub that isn't a piece of shit. I don't have the speed problems you describe at all.
I wasn't running on a USB3 hub, but directly off the motherboard (which AFAIK share multiple ports per controller and this is a high end Gigabyte motherboard, so not a POS either). The slow down is a direct result of the design of USB serial communications. If you have multiple controllers, you can avoid this issue by running drives on 1 port per controller. I have successfully done this as well, when doing some mass backups among multiple drives. It's how I confirmed the problem in the first place. You will need drives that are capable of relatively high transfer rates to see this problem, but it is still there in USB3.
Sadly, the less capable, less secure, less in just about every way except "cheap" USB won out over Firewire. I'd still rather have FW800 than USB 3. Hook 2 devices up to a USB 3 hub, watch yourself get lower than USB 2 speeds, even when you only access 1 device. What a win that is. Then there's the USB security issues. I love the fact that you can take over a computer by plugging in a storage device, or is it? USB should have been restricted to keyboards and mice only, as an improvement to the PS/2 connector.
Mind you this conversation has been so long (and ultimately our position differ so little) that more than once I've become confused about who wrote what as well. %)
So let's move on. At least my ducks are in a better row now.
For the purposes of understanding his "teachings," he must be approached like any other character whose ideas are to be found exclusively in a literary source and the historicity debate is fruitless.
OK, I believe we agree on this whether or not we agree on the main point of my original assertion or not.
What was rude was the supercillious suggestion that I "begin with" the Wikipedia page for the Bible and "expand [my] research from there." That the fact was so obvious and not particularly pertinent didn't perhaps help, but it was not the problem.
The link wasn't to an article on the bible, but an article on the historicity of Jesus. I believe you would agree that is more than pertinent to the discussion. Note that no non-Christian sources are used, despite the statement contrary in the linked article (Josephus and Tacitus) as detailed in previous posts.
Why do you have trouble with this one and keep trying to change my words?
Two reasons. Firstly the platitude that the bible has been modified over time has never been in contest in this discussion and is, as we have discovered, irrelevant to the quesion of the historicity of Jesus. I cannot even read those words, let alone twist them. Your original reply managed to be impertient in both senses of the word. Had you not been so rude I may have left it there.
1) To the question of of the historicity of Jesus, my first post is 100% relevant, as the main source of writing about him is the bible, and the bible is questionable. Showing that the basis of historicity is unreliable directly implies that any debate about something based on that source to prove authenticity is pointless. Your additional citations went through the same set of groups and processes for at least 1000 years and are therefore no more reliable than the bible regarding this topic.
2) If that first post with an assertion supported by a fact seems rude to you, I suppose all the rest were worse.
How easy was that?
Apparently not easy enough...
Prove that the claim that "There is as much room for debate about the historicty of Jesus as there is about whether water is wet" is a False statement:
We agree on the fact, as you put it that "There/s not much point to debating whether water is wet, since the definition of wet involves "with water" in its oldest sense"
I'm leaving it all in there, because as noted above, and quoted below:
Why do you have trouble with this one and keep trying to change my words? Because otherwise there's nothing to debate?
Regarding the "works" of Josephus and Tacitus, neither of these mean squat unless other corroborating proof is added. Note that the oldest extant manuscripts date from the 11th century and ...
Here we find you debating the sources regarding the historicity of Jesus (albeit a lower quality version of the scholarly debate you derride as a "billion chimps typing").
You attempted to add references as to why you believe in the historicity of Jesus and change the meaning of the post. I probably should have separated those 2 pieces of the post to clearly delineate the flows, and merely pointed out in a second response that those sources are less than trustworthy, for multiple reasons, My apologies for allowing the confusion to continue.
Clearly there is room for debate about the historicity of Jesus and the above statement is False. Quod est demonstrantum
Which "above" statement? I'd think first you'd have to define exactly what you're trying to (dis)prove.
I think the proper response would be "How do you know he existed and/or said..."
Exactly the same way I know that Gandalf said "You shall not pass!" ... I read it in the book. Duh!
But there was no Gandalf....
Guess that depended upon your ISP. Mine was flat and had issues with their local POTS switches, having to have their telco install a whole new set of hardware because of the amount of lines and data they were pushing through neglected old equipment. The price was the same, no matter what you were using on your end (14.4 through 56K). The price? $14 / month at that time.
... Besides, we don't want "EVERYTHING" different, just some imporant things like better government oversight, holding back the reckless spending of the Obama administration, an actual annual budget again.
Really? Reckless spending of the Obama Administration? We can expect that? Just like the incredibly financially responsible terms under Bush which resulted in wealth for all by the end of his second term? Or is your memory that short?
So we agree ... and b) there's no point in debating the historicity of Jesus, since no reliable evidence exists of his existence, unlike, say, Socrates, Plato, or Homer.
Obviously ... not on b). There's little point debating the historicity of Jesus
Why? Your references of Josephus and Tacitus are not proof. See below.
In other words, for a non-believer to respond to "Jesus said ..." with "but Jesus never existed!" is every bit as clever as responding to "Gandalf told Frodo ..." with "wizards and hobbits aren't real!"
I think the proper response would be "How do you know he existed and/or said..."
Quantity has little meaning, much like 1 billion chimps typing away ...
Firstly the scholarship we are dealing with is of high quality very much unlike chimps typing away. Secondly, and more importantly, quality is not determinative of debatability. As you point out the very definition of 'wet' involves water, so even low quality debate is precluded.
You may disagree, but my point was that the texts under discussion have no more reliability than selected output of 1 billion chimps regarding the very restricted subject of Jesus. They were likely modified to meet the opinions of those currently writing them. See below. For purposes of scholarship regarding the general life in the 1st century AD, that is an entirely different topic.
Clearly your claim that "There is as much room for debate [about the historicity of Jesus] as water is wet," fails both on logical and empirical grounds. But if you're still not convinced, I'll prove it to you: Jesus' existence is independently testified to by both Josephus and Tacitus!
My claim about the "as much room for debate as water is wet" was about the fact that the bible has been modified over time. Nothing more.
Regarding the "works" of Josephus and Tacitus, neither of these mean squat unless other corroborating proof is added. Note that the oldest extant manuscripts date from the 11th century and were maintained by Christian monks, most likely in a translated version. No way in almost 1000 years would these monks perhaps insert clarifications or slight modifications to such a text. Nope. As a side note, neither of these two were alive at the time of the events in question, and Josephus's purpose in writing his works was to present a more appealing history of the Jews. So facts were already loose there.
While I personally think there probably was someone named Jesus who influenced a strong cult-like following and was summarily executed around the mid 30s AD, I don't accept any written text as conclusive proof that was solely under the control of a group that has a proven and verifiable record of altering even their most highly regarded texts. So even the historical fact of Jesus is in question, much less anything said about his actions. The existence of (Pontius?) Pilate is likely the most factual person related to this immediate discussion with the discovery and dating of the Pilate Stone. Everything else is inferred from questionable texts all having been routed through at least 1000 years of copying by group(s) with vested interests known to alter things to support their current view.
The point is that there is historical evidence that people decided what went in the bible and changed the wording, meaning, etc to whatever suited them.
The fact that the biblical text changes over time hardly proves that there was no historical figure upon whom the text was based, so that observation bears only marginal relevance.
I never made such a claim. What I did claim is that a bible cannot be stated to be the truth. Nothing more, nothing less. Just because there was a flood some estimated 5000-8000 years ago doesn't mean the story of Noah, based on it, has any truth what so ever to it. A story based on historical facts does not automatically become factual.
Remember I'm insisting that we must necessarily treat Jesus as the literary character who emerges out of the text (aware of such changes that occur over time), and since any putative historical Jesus cannot be approached but via the text anyway. Therefore the debate on the historicity of Jesus seems fruitless to me and the question of the veracity of the text (I'm not quite sure in relation to what) doesn't even enter into discussion.
So we agree that a) the bible is a story, perhaps based on some historical facts and b) there's no point in debating the historicity of Jesus, since no reliable evidence exists of his existence, unlike, say, Socrates, Plato, or Homer.
However, if there were a question of veracity, your argument (even without considering its overly binary approach to documents) seems self-defeating. How do we know the text has changed, but by reference to earlier extant versions which presumably approach the more original.
There is as much room for debate there as water is wet.
Find me as many scholarly articles that debate whether water is wet as those which debate whether Jesus was an historical person and I'll agree.
We'll start from the back: Quantity has little meaning, much like 1 billion chimps typing away from the same script. There/s not much point to debating whether water is wet, since the definition of wet involves "with water" in its oldest sense, unless you're advocating changing the definition. Finally, the point of the changing texts to suit the opinions of the current people in control should automatically call into question anything stated in that set of texts. For instance, there are some things that are factual: Jerusalem existed: verified separately and still does today, Romans were occupiers: verified through many other records and physical evidence, etc. There's a group of things that cannot be verified: Garden of Eden, Adam and Eve, the snake, turning water into wine, feeding throngs with inadequate bread, even the crucifixion has little to no corroborating evidence, AFAIK, much less anything less corporeal.
So a couple of different companies didn't make their 20% two years out of the last 20 (Allan and Katrina, IIRC) Also note that insurance skyrocketed in those areas. They made their money back.
The insurance companies are the only ones who don't make money from unnecessary medical procedures and excessive medical costs.
This is incorrect. Insurance companies increase the cost basis, add 20%, and profit soars. Remember that insurance the way it's currently regulated is a skimming game. The more cash flows, the larger the skim.
Doctors who prescribe antibiotics and schedule a couple of visits when you have the sniffles make money from that.
If doctors make money on prescriptions, there's a big big problem. Visits are something you can control.
Hospitals who give you infections then have you stay another two weeks make money from that.
Hospitals that give you infections get sued. I'm pretty sure that's a money losing proposition. The more that happens, the more suits get filed, the more their insurance increases..., wait, who profits again?
Insurance companies who tell doctors and hospitals they won't pay for that nonsense save themselves money, and the patient money as well, not to mention a lot of discomfort, suffering, and death.
Yep, have a baby, you get 24 hours from the first midnight. Unless you're dying. Maybe. Have an operation where they cut you open and swab you out? Yep, insurance says you need to leave the hospital within 24 hours, even though you were near death. That's what insurance companies do when they tell doctors what they should do. In one case I'm personally aware of, that process nearly killed the patient who wound up back in the hospital, and the insurance company wanted them out. The family refused to sign the patient out, so there was no one to take the patient, so they had to stay a few days longer. (The patient was in such condition that they could not leave the hospital on their own, nor really do anything on their own, my personal set of conditions for saying someone should be in a hospital.)
They can - interstate commerce is only regulated by the feds, and there are no restrictions to selling insurance across state lines at the federal level that I'm aware of.
This would be called "posted rates", something forced on the auto repair industry and auto insurance companies in the 70s. It worked well there.
US insurers are in one of the best industries out there, with an incredible position. Name me another business where you're guaranteed 20% profit after costs, and those costs can include building office buildings and the profit excludes renting those office buildings after 2-3 years? Ever wonder why banks and insurance companies buy real estate and build office buildings during recessions?
Yeah, let's just say that insurance companies are not getting a sympathy card from me anytime soon.