Slashdot Mirror


User: deblau

deblau's activity in the archive.

Stories
0
Comments
1,154
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,154

  1. Re:Not entirely new... on Taking On Software Liability - Again · · Score: 1
    First, I wasn't suggesting proof-verification code, I was suggesting proof that any mathematician or computer scientist could verify manually. There are tools that automate such checks, and if you assume that they have been proved to work correctly (bootstrapping anyone?), then you're fine. Second, I don't need to prove anything about compilers, since that's an implementation detail, and doesn't go to the correctness of the algorithm. If you want to be concrete and use C as your implementation language, that's fine, but you don't have to prove that C is correct. Third, the CPU is again an implementation detail. You only have to prove that your code would run correctly on an "ideal computer". The problem of proving algorithm correctness is different from proving that an algorithm will run correctly on any given hardware. A careful reading of my prior post will show that I only addressed the former problem. The latter is, IMHO, a problem for hardware engineers, and outside my area of expertise.

    Assumptions have no place in program correctness proofs, save those given by the spec. They're useful as hell in implementation, but that doesn't affect whether the code correctly follows the spec. If the spec is wrong, then that's a GIGO problem, not a correctness problem. The parent post demanded correctness, and that what I was talking about.

  2. Re:Mistaken Identity! on You Need Not Be Paranoid To Fear RFID · · Score: 1
    Sorry, I was pretty laconic in my earlier post. In order for police to have probable cause to arrest a person, the 4th Amendment requires a connection between an actual crime and the person to be seized. What's the crime? The rape of a child. What's the connection between you and that crime? The only evidence given is the jacket. The question is, is that enough evidence for the FBI to have probable cause to arrest you?

    Now suppose that RFID hadn't been used at all to ID the jacket, suppose the child said "the rapist was wearing a jacket that looked like so-and-so". You happen to be wearing the same kind of jacket. Is that enough reasonable evidence to arrest you? Hell no, not by a long shot. Unless the person identifying the jacket had some sort of access to the RFID code, the FBI will need more than that to go on (like a particular tear, etc). The use of RFID here isn't the problem (yet).

    How do they tie the RFID to the rapist? Probably by conducting a search through a massive purchase-tracking database, which doesn't yet exist (but conceivably could in the near future). That search, per se, is probably an invasion of privacy, although the law on that point isn't really clear. (Write your Congresscritters!) And what search parameters do they enter in the database? Probably a name. (How else do you identify a person in the database?) Well, if they have the rapist's name, you'd think the FBI would have pictures (or be able to get pictures or composite sketches), and that they'd give them to field agents to avoid mistaken arrests. They might get a name without a picture, if the child knew the rapist, or the rapist was dumb enough to say "Before I rape you, I want you to know my name."

    Suppose they somehow didn't have a picture or sketch of the alleged rapist, but somehow the child (or someone else) was able to produce a name for the database search. OK, the search gives the FBI the knowledge that at a particular point in time, the jacket belonged to the rapist. Is it reasonable for them to believe that he still owns it? Since it's fairly simple (hypothetically speaking) for them to track the RFID tag through this Big Database, your name should have come up too when you bought the jacket. Suppose for the sake of argument that it didn't. All they know is that you were wearing that jacket at the time of the (routine) scan. Is it reasonable for them to believe that you are the rapist? That depends on a whole bunch of things, including how likely it would be that a subsequent sale wouldn't show up in the database, how long it has been since the purchase by the rapist, the location of the original purchase, the location of the alleged rape, the location they arrested you, and how long it has been since the rape (just off the top of my head). Since that info wasn't given, it's hard to say one way or the other.

    There are a huge number of intermediate considerations, any one of which would invalidate the reasonability of the arrest, and which the arresting officer knew or should have known before making the arrest. Any of these would make it less than probable that you committed the crime, and would prevent you being arrested.

  3. Re:Mistaken Identity! on You Need Not Be Paranoid To Fear RFID · · Score: 1
    You're relying on the competence and well-intentionedness of the FBI?
    [Randy Weaver was] still entitled to equal protection under the law.

    Ruby Ridge was an FBI screw up, no doubt about it. But who do you rely on to enforce equal protection, if not the field agents themselves? Do you want a civil libertarian field observer on every field mission with command authority? Do you just want to abolish FBI field missions entirely? Provide me an alternative I can rationally debate. Don't change the subject into an attack on the government.

    RFID tags have the potential to give [the government] a great deal of power.

    So do UPC symbols. One of the biggest arguments against UPC symbols when they were introduced was precisely the argument you make against RFID. The first big privacy concern with RFID is purchase tracking, and by the time you've purchased the item, you're already in the Big Database. Whether you get in through RFID or UPC makes no difference. After the sale, the next big privacy concern is RFID giving away your location. Granted, UPC symbols aren't transmitters, but on that point, I suggest you read two Supreme Court cases: United States v. Knotts, 460 U.S. 276 (1983), then United States v. Karo, 468 U.S. 705 (1984), and draw your own conclusions.

    If you have any other privacy concerns with RFID, please let me know.

  4. Re:Mistaken Identity! on You Need Not Be Paranoid To Fear RFID · · Score: 1
    Believe it or not, the FBI has heard of the 4th Amendment. Your scenario violates it in at least two different ways. Even if they have an arrest warrant, they have to execute it properly, and that means a reasonable belief that you're their man. That won't happen on just an RFID scan, when a photograph would easily show you're not the right person. Frankly, I'm amazed you think the FBI would be that sloppy. Second, without probable cause, they can't take your DNA unless you consent. If you're being interrogated, you generally don't give consent, you submit to authority. Even if you 'agree' to give the sample, it will be thrown out. There may also be some 5th Amendment violations in there too (lack of counsel before DNA extraction, right against self-incrimination).

    In sum, if this ever happened in real life, the guy they got would have a juicy lawsuit against the FBI that would cause them tremendous political damage. At the very least, the agents would lose their jobs, and a department head might too. Everyone involved has an incentive to prevent that.

  5. Re:Not entirely new... on Taking On Software Liability - Again · · Score: 1
    For those readers out there who haven't done this in class: proving correctness is hard. Insanely hard. For a start, see Hoare logic. Take any algorithm over five lines and run through a Hoare proof to see what I mean. Here's a fun one we did in CS, the Euclidean Algorithm: starting with numbers A and B, design and prove correct a program to find G such that G=gcd(A,B). You can use the following predicates: gcd(A,A)=A, gcd(A,B)=gcd(B,A), and gcd(A,B)=gcd(A-B,B) if A > B. If you're familiar with Hoare logic, the design and proof takes under an hour. (You also have to prove that your program terminates.) On the other hand, if you're familiar with the Euclidean Algorithm and any programming language under the sun, writing the code takes under a minute. Difference in coding time: roughly 1.5 orders of magnitude. Your next task: prove Windows correct (or Linux, or any single file in the Linux source for that matter).

    No one writes correct code, EVER, because to guarantee it by design takes orders of magnitude too much work. Take device drivers. Finding loop invariants for driver timing delays would be hellish enough, not to mention the fact that hardware never performs entirely to spec anyway. To prove your driver did exactly what it was supposed to do, you'd have to put provably correct timing bounds on all of your externally called functions. Taking into account interrupts being masked or not. By someone else's code. Not to even get into all the bazillion different exception conditions. Just thinking about how to start laying out a correctness proof gives me a headache.

  6. Re:Resell Windows on Dell's Open PC Costs More Than Windows Box · · Score: 1
    So.. the logical thing to do is buy the PC with Windows and then resell the Windows license. Or is that not allowed?

    To quickly sum up the discussion:

    1. Microsoft owns the copyright to Windows. Microsoft granted you a license (EULA) when you took possession of your computer.
    2. "Subject to sections 107 through 122 [of Title 17, United States Code], the owner of copyright under this title has the exclusive rights to do and to authorize . . . [the] distribut[ing of] copies or phonorecords of the copyrighted work to the public by sale or other transfer of ownership, or by rental, lease, or lending." 17 U.S.C. 106(3).
    3. Section 107 contains the Fair Use Doctrine, but that doctrine doesn't apply to resales. Section 109 contains the Doctrine of First Sale, which applies here, and limits section 106:
      Notwithstanding the provisions of section 106 (3), the owner of a particular copy or phonorecord lawfully made under this title, or any person authorized by such owner, is entitled, without the authority of the copyright owner, to sell or otherwise dispose of the possession of that copy or phonorecord. 17 U.S.C. 109(a).
    4. So if you own your copy of Windows, you are free to resell it. The catch comes when you read further down.
      The privileges prescribed by subsections (a) and (c) do not, unless authorized by the copyright owner, extend to any person who has acquired possession of the copy or phonorecord from the copyright owner, by rental, lease, loan, or otherwise, without acquiring ownership of it. 17 U.S.C. 109(d).
      If you got your copy of Windows bundled with a PC, you don't actually own it. It came with an EULA, a license to use, which is different than ownership. Microsoft is explicit about this:
      "3. RESERVATION OF RIGHTS AND OWNERSHIP. Microsoft reserves all rights not expressly granted to you in this EULA. The Software is protected by copyright and other intellectual property laws and treaties. Microsoft or its suppliers own the title, copyright, and other intellectual property rights in the Software. The Software is licensed, not sold." Windows XP Home Edition EULA.
      Other Microsoft EULAs contain similar provisions.
    5. You still have a license from Microsoft, which you might be able to sell. The only permission you have to do so must come from the terms of the license itself, or outside communication with Microsoft.
      "13. SOFTWARE TRANSFER. . . . Transfer to Third Party. The initial user of the Software may make a one-time permanent transfer of this EULA and Software to another end user, provided the initial user retains no copies of the Software. This transfer must include all of the Software (including all component parts, the media and printed materials, any upgrades, this EULA, and, if applicable, the Certificate of Authenticity). The transfer may not be an indirect transfer, such as a consignment. Prior to the transfer, the end user receiving the Software must agree to all the EULA terms." Windows XP Home Edition EULA.

    In other words, 109(d) says that 109(a) doesn't limit 106(3), and you don't get to sell your copy of Windows because you don't own it. You may be able to sell your license if you (1) are the original owner, (2) give up all the related documentation, certificates, etc. to the purchaser, and (3) get the purchaser to agree to the EULA first. I say "may be able", because even if you satisfy all three conditions, the buyer may not be able to actually use the software once it's transferred, due to technical limitations (such as tying the software to the hardware when it's installed at the factory). Of course, that's his problem, but if he can't use the software, he's not going to pay you for it.

  7. Re:Informative? Plain old wrong. on Dell's Open PC Costs More Than Windows Box · · Score: 1
    Notwithstanding the provisions of section 106 (3), the owner of a particular copy or phonorecord lawfully made under this title, or any person authorized by such owner, is entitled, without the authority of the copyright owner, to sell or otherwise dispose of the possession of that copy or phonorecord.

    Nice try, quoting section 109(a), but you didn't read far enough. "The privileges prescribed by [17 U.S.C. 109] (a) and (c) do not, unless authorized by the copyright owner, extend to any person who has acquired possession of the copy or phonorecord from the copyright owner, by rental, lease, loan, or otherwise, without acquiring ownership of it." 17 U.S.C. 109(d) (emphasis added). If you got permission to take possession of your copy of the bundled software through a license agreement that came with it (which you did, your EULA), you didn't acquire ownership of it, so 109(a) doesn't apply to you.

  8. Re:Stanford racing team has won... on DARPA Grand Challenge Updates · · Score: 1

    Just out of curiosity, but why should they have to pause them at all? I'd want a real autonomous vehicle to be able to dodge moving targets directly in front of it, especially ones going in the same direction and slower than it is. Or was that simply beyond the scope of the challenge?

  9. Re:Stanford racing team has won... on DARPA Grand Challenge Updates · · Score: 2, Informative

    Red Team Too is the closest to the finish line, but they're over Stanley's time. Red Team (One) is at Stanley's time now, and they're up in Beer Bottle Pass, 7 miles from the finish. I don't know about adding penalty time, but it looks like Stanley has won.

  10. Re:And the biggest Irony... on Another Victim Countersues RIAA Under RICO Act · · Score: 1
    Most likely, the RIAA gave Media Sentry a license to copy their works as part of the spying contract. No copyright violation here, unless they copied a song they didn't have the copyright to. Since they know what they own and what they don't, they wouldn't check, for example, J-pop or Euro trance.

    I guess if you want to jerk around the RIAA, make a bunch of mp3s with your computer mic, and share them on Kazaa with names like Metallica_Enter_Sandman(cd-rip).mp3. Then when they download them, they're violating your copyright. Of course, no court in their right mind would find them liable, since you're the one being a jackass. And it would expose you to an expensive lawsuit. Maybe not such a bright idea, now that I think about it.

  11. Re:Some of this is Nonsense on Another Victim Countersues RIAA Under RICO Act · · Score: 1
    This is a civil (as opposed to criminal) case in a United States District Court. That means the Federal Rules of Civil Procedure apply. Fed. R. Civ. P. 8(e)(2) states
    A party may set forth two or more statements of a claim or defense alternately or hypothetically, either in one count or defense or in separate counts or defenses.
    . . .
    A party may also state as many separate claims or defenses as the party has regardless of consistency . . . .
    In English, you can claim "I'm not guilty because I didn't do X", and at the same time claim "Even if I did X, I'm not guilty because Y". Yes, it's logically inconsistent. Yes, it hurts your brain. But lawyers do this all the time, and it's perfectly legal.
  12. Re:Introductory sentence on Another Victim Countersues RIAA Under RICO Act · · Score: 1
    copyright is not a part of criminal law

    Yes, it is. Here is what you do to commit the crime, and here are the penalties.

  13. Probable cause on Federal Agencies To Collect Genetic Info · · Score: 1
    if some agent of the federal government were inclined to violate the rules governing the use of the database, what would be stopping him from following you around and collecting a sample of your saliva from a soda can or blood from a bandage?

    Absolutely nothing, except that it's not cost-effective. They simply don't have the manpower and other resources to do this, but if they did, you can bet it would be done. Technology is making this easier and easier, so it might be possible in the future.

    Society gives each person a reasonable, legitimate, and justifiable expectation of privacy to retain their cells, while still in their body. Anything less, and we've turned into the Borg. To invade that expectation of privacy, there had better be a compelling reason to do so, which is why the Fourth Amendment requires probable cause. I suppose the key to unlocking the puzzle will be whether or not the investigation into the crime of which the suspect is accused would be furthered, in a way deemed legitimate and justifiable in the eyes of society, by the collection of DNA or other bodily samples. If not, then this seizure of cells seems to be plainly unconstitutional. Any other purpose for collecting the DNA not related to the specific crime of which the person is accused, such as for creating a database of criminals, is also plainly unconsitutional.

    Once a person has been convicted of a crime, society deems that person to have lost privacy rights to their DNA. This legislation would push that line back, and I think, hope, and pray society isn't willing to go that far.

  14. In other news... on Yahoo! Mail Superior to Gmail ? · · Score: 0, Offtopic
    vi is superior to emacs.
    Windows is better than Lunix.
    Cats are WAY cooler than dogs.

    YHBT. YHL. HAND.

  15. Wisdom on Some Rights May Have To Be 'Eroded' For Safety · · Score: 4, Insightful
    "The fears of one class of men are not the measure of the rights of another."
    Joanna Baillie, Basil (act III, sc. 1, l. 151)

    "Fear is not the natural state of civilized people."
    Aung San Suu Kyi

    "Be as beneficent as the sun or the sea, but if your rights as a rational being are trenched on, die on the first inch of your territory."
    Ralph Waldo Emerson

  16. Re:RIP on Chief Justice Rehnquist Dies at 80 · · Score: 2, Informative
    I don't know the facts, but how many of the previous justices have died while still being seated?

    Of the 108 Supreme Court Justices, 48 died in office, of whom eight were Chief Justice. Source: Oyez.org.

    1. William H. Rehnquist (CJ)
    2. Fred M. Vinson
    3. Wiley B. Rutledge
    4. Robert H. Jackson
    5. Harlan Fiske Stone (CJ)
    6. Frank Murphy
    7. Benjamin N. Cardozo
    8. Edward T. Sanford
    9. Pierce Butler
    10. Joseph R. Lamar
    11. Edward D. White (CJ)
    12. Horace H. Lurton
    13. Rufus Peckham
    14. Howell E. Jackson
    15. David J. Brewer
    16. Melville W. Fuller (CJ)
    17. Lucius Q.C. Lamar
    18. Samuel Blatchford
    19. Horace Gray
    20. Stanley Matthews
    21. William B. Woods
    22. John M. Harlan
    23. Morrison R. Waite (CJ)
    24. Joseph P. Bradley
    25. Salmon P. Chase (CJ)
    26. Samuel F. Miller
    27. Nathan Clifford
    28. Levi Woodbury
    29. Peter V. Daniel
    30. John McKinley
    31. John Catron
    32. Philip P. Barbour
    33. Roger B. Taney (CJ)
    34. James M. Wayne
    35. Henry Baldwin
    36. John McLean
    37. Robert Trimble
    38. Smith Thompson
    39. Joseph Story
    40. Thomas Todd
    41. Brockholst Livingston
    42. William Johnson
    43. John Marshall (CJ)
    44. Bushrod Washington
    45. William Paterson
    46. James Iredell
    47. William Cushing
    48. James Wilson
    Blah blah blah blah lameness filter sucks.
  17. Re:And yet... on Another Major Spammer Busted · · Score: 1
    For an idea of what has happened to drug suppliers in the past, read Direct Sales Co. v. United States, 319 U.S. 703 (1943). It's not that long (five pages maybe). Executive summary: they nailed the supplier for conspiracy.

    The Harrison Narcotics Act was replaced with the Controlled Substances Act in 1970.

  18. Re:Simple solution on Librarian Suspended over Patrons' Web Access · · Score: 1

    That's too much work. Easier just to pluck out people's eyes the moment they're born. That way we can be sure they won't view inappropriate materials.

  19. Fire a warning shot on ZDNet UK Begs for Google's Forgiveness · · Score: 1
    If Google is being used for illegitimate purposes, that's not Google's fault. Schmidt should have just filed a lawsuit against CNet, not for misuse of Google, but for public invasion of privacy. As some others have already said, it's not Smith & Wesson's fault if someone buys one of their guns and kills a person.

    On the other hand, if there is anything Google can do to prevent this sort of data aggregation, they probably should. Public information should be libre, but making it non-gratis would provide a disincentive to aggregate. Google could try to figure out if the web page they're spidering contains sensitive personal information, and then not indexing it. That still leaves them with the problem of what is and is not sensitive (telephone number? address? mother's maiden name?). It also wouldn't prevent the CNets of the world from doing the aggregation, but it would make it a lot harder for them, and it would prevent embarrassment to the company president.

  20. Re:A transparent society the only consistent appro on Reconciling Information Privacy and Liberty? · · Score: 1

    Equal scrutiny is a good idea. The trick is to set the level of scrutiny. Privacy is psychologically important. People need a space in their lives that they can retreat to, and a place to launch from to experiment and grow. Without privacy, every mistake you ever made while learning could come back to haunt you. Every case of "I thought I wanted X, but I tried it and found out differently" would be public knowledge. People need a private space in their lives. If it disappears, there will be incredible damage to the collective psyche. For that simple reason, the idea that "all information should be libre" is terrible, even for government officials.

  21. Next on his list of things to write about on Successful Strategies for Commenting Your Code · · Score: 2, Funny

    Successful Strategies for Crashing Your Website

  22. Re:Slightly O/T 'non-competition'... on Microsoft Sues Google For Hiring MS Exec · · Score: 2, Insightful
    They signed a previous contract, right? Well then, they're bound by the terms whether they like them or not. You don't have to renegotiate squat if you don't want to. Of course, if your current contract is at-will (like almost all programming contracts these days), you're hosed anyway. If you don't sign, they could just find some unrelated reason to let you go, and since you agreed that was OK when you signed, you're just out of luck.

    Don't believe your boss, he doesn't know what he's talking about. If the contract is "legal speak", how would he know what it means? And if he does know and isn't willing to sit down with you and the company lawyer and explain it to your satisfaction, I wouldn't trust his opinion. Also, last I heard, most managers haven't worked for every other business out there, so how would he know what they'll make you sign?

    Bottom line is, whatever you do, don't sign a contract you're uncomfortable with. Contracts are something that all parties have to agree to, and if you don't agree, don't sign it. Show it to someone you trust, or even a lawyer. For something as important as your primary source of income, a lawyer isn't all that expensive. If you have reasonable requests, your company will work with you if they value you as an employee. It's a lot easier for them to keep you than to hire someone else and bring them up to speed.

  23. Re:oh god, I can see it now on Direct to DVD Futurama Movie · · Score: 1
    [Zap is standing in the shower tent when Kif walks in holding Nixon's head at three feet off the ground.]

    Nixon's head: Brannigan! My God, cover yourself. I didn't live a thousand years and travel a quadrillion miles to look at another man's gizmo.
    Zap Brannigan: Uh, sorry, Mr. President, I... I didn't realize. Kif! Raise him up about nipple high.

  24. Re:Why bother w/this then? on Googling May Break Copyright in Canada · · Score: 1
    Then why even bother to draft it? This seems like an awful waste of time and energy if you know the bill could cripple the search engine industry and that's not what you want.

    Because it scares the hell out of a lot of people, and gives you negotiating leverage. And if you don't care all that much about search engines, even better. It's Politics 101.

  25. Re:Raising the bar on Anatomy of a Hack · · Score: 1
    I'd like to state a fundamental rule of data security: your data is secure against attack from entity A if and only if A's cost in obtaining and using it is greater than its worth to them (and they know it). Note that the cost in obtaining the data (decrypting it, social engineering, whatever) is relatively independent of who A is (depending on how many resources they already own). Its worth and cost to use is different for everyone. (Governments and large organizations might have a lower cost to use illicit information, since they can better cover up how they got it, and maybe avoid jail and fines.)

    For each potential attacker, you have to do a cost-benefit analysis. Your data is totally secure if the analysis comes out in your favor for all potential attackers. That means that you have to defend against the attacker who values your information the most, once you figure out who that is. The phrase "comfort level" is convenient, but it looks inward, not outward. Following my method, you can ask managers simple questions like "How much is this data worth in the hands of a competitor", "How likely is it that they would resort to industrial espionage if they knew you were vulnerable", etc. and get quantitative answers on what kind of security you really need, including how much to spend.

    One upside to this approach, if you could call it that, is that if you discover that your data is really worthless ("public records already available on the Internet" comes to mind), there's no need for biometrics, passwords, and expensive multi-layer security systems. Doing the analysis saves companies money.