Person 1: Average Joe, mid 20's, wearing t-shirt and jeans. Clean-shaven. Your assessment: Seems OK. Person 2: Guy wearing a cheap cop costume, waving around a gun. Your assessment: ??? ("Hmm, well, he's trying to look like a cop, so it must be ok!")
Two friends send you an invitation and ask you to RSVP: Friend 1: provides a selfaddressed postcard. Oh well, nothing confidential. Friend 2: provides a selfaddressed envelope. Uh oh. How do I know he sent me the invitation? Is the return address really him?
There's value in preventing casual eavesdropping even if you don't prevent MITM.
All most self-signed certificate using sites want is to eliminate plain text conversations, just plain simple encryption, they make no claims about security, they don't want a "green bar", they just don't want to be treated as worse than HTTP.
In that case SSL is a wrong tool for them.
Use the most fit tool for the job. So tell us what tool is more fitted for that purpose. Something around today and that is installed on clients (otherwise it's less fit then SSL).
b) Most experienced users are very happy with self-signed certificates - they are mainly trying to avoid middleman secutiry issues (ISP, employer and other big brother types).
Uh, self-signed certificates are WIDE OPEN to MITM attacks. That's kind of the point here? Maybe you're not as experienced as you think?
I am experienced enough to know the consequences and make an informed decision. I am happy with self-signed certs. Even with a fake user profile and fake email, I'd rather it be encrypted then sent plaintext. Most sites I visit don't need encryption, it's just nice to have it.
I don't need to put my letter to my mom in an envelope (could do a postcard) and she has no way of authenticating my letter as having been sent by me.
The whole point here is to make VERY clear to the user that FF is unable to determine the legitimacy of a "supposedly secure" site because the site owners haven't kept up their end of the bargain!
FF shouldn't treat self-signed as INsecure, it should be treating them as NONsecure. We trust the users to know a NONsecure site from a secure site by the color of the address bar.
If you can't trust the user to treat a webpage that displays as NONsecure properly, then it's already over. The attacker wouldn't even need to bother with SSL.
Encryption without trust and the false impression that encryption is trust gives you the false impression that your data is safe.
The problem is the idea that encryption is the only thing you need for security. Since we don't know who's going to open the mail on the other end, we should just send all our letters on postcards right?
The problem is self-signed certs aren't usually used for providing identity, just encryption to protect against casual snooping. Yes it's still vulnerable to MITM, but so is HTTP.
According to firefox, a selfsigned cert is more dangerous then HTTP. The only reason it could ever be more dangerous is if it's presented in a manner that makes people THINK it's secure when it's not. The people complaining about this want one thing. For self-signed to be placed at same trustworthiness as HTTP, not below it with all sorts of warnings. Don't give it a secure address bar, don't have a lock.
if an e-business can't even put forth that effort, than they don't deserve my business. Heck, if it's only 14 dollars and an email away, the only reason any website uses self-signed certs is philosophical at best.
I agree on a business. But you quickly move over to "any website". I'm of the opinion that all traffic should be encrypted, and I see little reason why a self-signed certificate is unacceptable for someone's personal rant blog. So yes it's wrong to pay someone else for a service you should be able to do better yourself (encryption not authentication).
I like how you write it off as merely philosophical. Morality is defined by philosophy, so I wouldn't be so quick to dismiss philosophy. Some other things that are philosophically wrong: Murder, Rape, Torture.
Really, now? So, you propose that the vast majority of internet servers are reconfigured to accept SSL connections?
There's a big difference between accept and require. Yes I think the vast majority of web servers should accept SSL connections. Do you honestly think that more then a few percent of users would elect to use it. Honestly, if slashdot allowed you to read through https, with it's security conscious (and paranoid) crowd, how many would actually change their bookmarks.
If you're managing 50 routers, you could always set up your own trustchain and add your own root authority to your browser. In fact that's probably the proper way even without firefox's warnings.
In this case, there is a distributed bunch of servers, so when a user requests a file, it's not even reaching the internet backbone, it's reaching a dedicated video server which is local to the ISP. Net neutrality has nothing to do with this, this is just agreements between companies to make highly demanded video available to users without costing the ISPs as much bandwidth.
Yes it does. Because it places a content provider onto a special tier. Why do you think many ISP's cached it locally, because they were getting paid. That's the primary fear of net neutrality. That if you don't pay both your ISP and your customer's ISP the data will be deprioritized. The road to a non-neutral net starts with content providers voluntarily paying for "higher tiers".
The very fact that ISP's choose what goes on their caching servers, means its non-neutral. Even if it was made free and the ISP's used discretion accepting videos, still non-neutral. The only neutral network is one the ISP doesn't make choices for me on what content gets prioritized.
I've played it a few times. It's a good game, a cross between Risk, Settlers of Catan and Diplomacy. You play empires (like risk they're not predefined empires) and can fund terrorism (placing them in your enemies territories). Anyone can trigger terrorist attacks or move them if they have the appropriate cards. Terrorists are much cheaper then directly attacking (allowing the underdog a chance to turn the tides), but they can turn on you. If your empire is destroyed, you start playing as the terrorists themselves (and can even win as terrorists). One empire at anytime can be marked as the Evil Empire.
If all the terrorists are eliminated, all the empires can agree to share victory by declaring peace... psh hippies, that'll never happen.
To be fair, though, the US is prepared to fight without the internet, it will just be an inconvenience. The Future Warrior program was supposed to rely heavily on digital information systems, but it is now mostly canceled. The military is still using the same methods they did in the 80's and 90's (dedicated sat-links and voice channels)before the net got so integrated into daily life. The real problem would be on the civilian front where massive cyber-attacks could blackout good-sized chunks of infrastructure.
It's worse then that, you're thinking only of warfighting elements of military life. How do you think the military would fare if its pay system was shut down? Do you think they have a backup system ready that isn't computerized? Okay they're military, you can compel them to work until the pay issues get sorted... but what about all the elements that moved to contractors, such as gate guards?
And I'm still assuming they're only targeting military. Our whole economy is completely dependent on computers and telecommunications. If a true all out cyber-war was conducted I have no doubt many people will die. Perhaps simply because they were unable to call 911 because the cell system was out of service.
There's just so much time wasted on the road. Link all the cars and let a computer control them and the moment the light goes green all the cars could accelerate at once
If all the cars are linked why have traffic lights? The car will know the route of all cars moving through the intersection, and the server could tell individual cars to speed up and slow down to go through the gaps of traffic (and even to make the gaps). Obviously there'd have to be a significant safety margin, but cars wouldn't necessarily even need to stop in a fully computerized system. As soon as you enter your destination it should have the whole route programmed to within seconds, only making slight modifications as other drivers enter destinations.
Yeah, but you didn't create the IP yet you want to control it by default. You're essentially saying "If you make it I reserve the right to take it and do whatever I want with it". I guess there would be no debate if everyone agreed on this point but I've heard every angle of this issue over the years. I have never seen even one reasonable argument why an entity that creates IP should not be able to control the sale, use and distribution of that IP.
The argument comes in the creation part. You say they created an idea, something that doesn't hold physical form. That the "idea" spans past ordinary space and every physical manifestation is just a part of that idea. That's not logical, that's religion, the belief that the non-material can manifest everywhere at once.
I say its my brain. It's my pen, it's my paper. If I draw a mouse, that's my property. I can claim ownership of the physical manifestation, the piece of paper it's on. Don't worry, the original idea is still in the only place it ever was, in the brain it was thought up in. My "copy" is a shadow of a shadow which has no consequence on the "idea". I get upset when people try to assert that I have no right to my expression because it resembles someone else's.
The point of claiming IP is a natural right is not for the artists sake, they're free to do what they want with it. The point is to control people, to limit their freedoms. When people realize it's not a natural right and start treating it as a way of subsidizing innovation at the expense of natural rights of expression, the sooner we'll get to sane copyright laws (yes I believe copyright should exist just not in it's current form)
But I'm sure you'll throw away my argument and you'll continue with "There is not one reasonable argument"
MMO's *DO* trust their clients for some things. Such as movement, where latency can cause serious problems. The servers do put limitations on this however.
Suppose I have a hacked client and I simulate 2 seconds of packetloss, how far can I travel in one second? I can potentially report to server that during that 2 seconds I was traveling west the whole time or east the whole time. The server realizes 2 second of packetloss is reasonable and trusts the client. Everyone else sees me teleport to the position I reported.
Now suppose I simulate 30 seconds of packetloss (meanwhile my hacked client passively receives data, waiting to see if the Barbarians will invade from the east or west). When I see the alarms coming from the East Gate, I have my client report that it had been traveling east for the last 30 seconds. The server will recognize this as deception and rubberband me back.
So if I recognize that 5 seconds is the threshhold for trust. I could have my client constantly hiccuping packets for 4 seconds (only while I'm standing still) and as soon as I want to move, I can give myself a 4 second teleport in that direction.
And this gets us to how modern MMO's trust the client. They trust the client but they also recognize where the risks are. They make audits built into the system to try to identify suspicious behavior.
He actually took the password. Just because it isn't physical, doesn't mean he can't steal it.
Hey Johnson, you're fired. Fred here will escort you to the first floor medical for your mandatory lobotomy. Hey Fred make sure they dig deep, he knew a lot./sarcasm off
How are you suggesting he not take the password with him?
He stopped providing his services when he was fired. He no longer had an obligation to maintain availability to the systems. He couldn't however do something to cause the system access to be unavailable. Had he refused to provide passwords while an employee, it's a different story.
Otherwise the power company is preventing me "authorized access" to my computer if they turn off my power.
If refusing to provide information to a former employer is a crime, they can save a lot of money firing people and compelling them to continue to work since it would prevent authorized access for them to stop.
Agreed, but it's not that simple, robot cars really are limited by their being to many rude and bad human drivers.
What we need is communicating cars. We could get rid of road signs, signs should appear on the car's HUD. Cars should identify their location to nearby cars, turn signals should inform nearby cars in the HUD and warn you if the lane is not clear (or if a car is approaching to quickly). The speed limit should be printed on the HUD, and automatically adjust to road conditions.
Once more cars are able to communicate, then it becomes easier to automate cars driving functions.
But the BSA is taking the position that they'll be able to squeeze money out of companies that otherwise would not have spent that money -- in other words, a forceful economic stimulus!
Yes squeeze money that wasn't being spent. The company could always sell their assets, lay off workers to pay off the settlements. And hows that's good for the economy?
Stability in companies is valuable. Thats why they need to keep savings for a rainy day. The long term effect of large settlements is that other companies need to keep more savings on hand.
And I think it's perfectly ethical to ignore robots.txt in a case like this.
Not only is it ethical, I think it's absolutely important. In the White House all correspondence is supposed be archived (ya ya Bush email) as part of public record. But I see the campaign as a logical extension of that. They're publishing this publicly for the world to see and its of profound historical value, it SHOULD be archived.
Secondly, what force does REP actually have? It's not a law. It's not even a standard of any standard body. You could argue unauthorized access of the network but I think that'd be hard for someone that's published publicly to the world. Has there been any successful court cases based on violating the REP?
Perhaps 20 years from now, depending on how these next couple of terms turn out, we can expect serious change to our two party system. For now, in my opinion, it's imperative that we keep McCain out of office.
Bullshit. That kind of attitude is exactly why this country is in trouble. You can't just plug your ears and say "We'll fix the system after our problems are resolved". There's always a current issue. But even supposing there isn't a major issue sometime in the future, what motivation would people have to fix the system then, after all life is peachy. All major changes cause instability and a period of worsening, people have to adapt, revisions are made, etc. You have to accept some temporary problems to cause any meaningful change. The current problems are EXACTLY WHY we need to fix the system.
At least with most Cisco devices thats not true. You just boot from flash to skip the startup. Then you can copy the startup-config to running-config, set the password and write. Heck even if you somehow have a bad flash IOS you can boot up off TFTP or ROM.
I haven't worked with anything but Cisco, but I have trouble imagining that most don't have a way to reset password for someone with physical access. Afterall no one should be touching your routers except the admins.
A data forensic specialist will look at all these free blocks, and guess what your SCSI/IDE/FC harddrive tells them in the low level meta data how many seek misses I've had in each area of the disk.
I don't know the details of what metadata hard drives contain but if truecrypt wanted to provide plausible deniability against that specifically then it could do random reads of blocks. It could even do random writes, changing a block to a random value then changing it back to what it was before (journaled in case of interruption). It can't do this very often without lowering drive lifespan, but it doesn't take much to ruin using metadata for forensics.
Also I really doubt they read hard drive meta data on every drive they image. By imaging the drive, they're changing the meta data, thus altering the evidence. You can mount a drive read only, but is there a way to mount it such that it doesn't mess with it's metadata. Forensics isn't just finding the evidence, it's also chain of custody and proving the evidence wasn't altered/contaminated in the process.
2) Law enforcement isn't welcome to just destroy property because they feel like it. They can't burn down your house and say "Well we thought there might be drugs in it, even though we never found any." Likewise they can't just screw up your data for shits and grins. That'd be a great way to get sued. You claim that the truecrypt volume in fact contained important research documents that were worth millions, not illegal data. They can't prove otherwise since they purposefully deleted it.
Not if they kept a clean image and altered the original. If you claimed there was a second volume with valuables, they could compel you to produce key to decrypt it on their unaltered image.
Another thing I find complete asinine is that little form you fill out saying where you are going stay while you are in the US. I've been staying at 1600 Pennsylvania ave. for going on 6 years and no one has so much a blinked.
I'm sure they want you to lie on the form. The laws in the US are setup so everyone is afoul of them in some way. That way we can selectively prosecute the people we don't like. Congratulations, you weren't judged an enemy of the government.
Slashdot Mirror
Person 1: Average Joe, mid 20's, wearing t-shirt and jeans. Clean-shaven. Your assessment: Seems OK.
Person 2: Guy wearing a cheap cop costume, waving around a gun. Your assessment: ??? ("Hmm, well, he's trying to look like a cop, so it must be ok!")
Two friends send you an invitation and ask you to RSVP:
Friend 1: provides a selfaddressed postcard. Oh well, nothing confidential.
Friend 2: provides a selfaddressed envelope. Uh oh. How do I know he sent me the invitation? Is the return address really him?
There's value in preventing casual eavesdropping even if you don't prevent MITM.
All most self-signed certificate using sites want is to eliminate plain text conversations, just plain simple encryption, they make no claims about security, they don't want a "green bar", they just don't want to be treated as worse than HTTP.
In that case SSL is a wrong tool for them.
Use the most fit tool for the job. So tell us what tool is more fitted for that purpose. Something around today and that is installed on clients (otherwise it's less fit then SSL).
b) Most experienced users are very happy with self-signed certificates - they are mainly trying to avoid middleman secutiry issues (ISP, employer and other big brother types).
Uh, self-signed certificates are WIDE OPEN to MITM attacks. That's kind of the point here? Maybe you're not as experienced as you think?
I am experienced enough to know the consequences and make an informed decision. I am happy with self-signed certs. Even with a fake user profile and fake email, I'd rather it be encrypted then sent plaintext. Most sites I visit don't need encryption, it's just nice to have it.
I don't need to put my letter to my mom in an envelope (could do a postcard) and she has no way of authenticating my letter as having been sent by me.
The whole point here is to make VERY clear to the user that FF is unable to determine the legitimacy of a "supposedly secure" site because the site owners haven't kept up their end of the bargain!
FF shouldn't treat self-signed as INsecure, it should be treating them as NONsecure. We trust the users to know a NONsecure site from a secure site by the color of the address bar.
If you can't trust the user to treat a webpage that displays as NONsecure properly, then it's already over. The attacker wouldn't even need to bother with SSL.
Encryption without trust and the false impression that encryption is trust gives you the false impression that your data is safe.
The problem is the idea that encryption is the only thing you need for security. Since we don't know who's going to open the mail on the other end, we should just send all our letters on postcards right?
The problem is self-signed certs aren't usually used for providing identity, just encryption to protect against casual snooping. Yes it's still vulnerable to MITM, but so is HTTP.
According to firefox, a selfsigned cert is more dangerous then HTTP. The only reason it could ever be more dangerous is if it's presented in a manner that makes people THINK it's secure when it's not. The people complaining about this want one thing. For self-signed to be placed at same trustworthiness as HTTP, not below it with all sorts of warnings. Don't give it a secure address bar, don't have a lock.
if an e-business can't even put forth that effort, than they don't deserve my business. Heck, if it's only 14 dollars and an email away, the only reason any website uses self-signed certs is philosophical at best.
I agree on a business. But you quickly move over to "any website". I'm of the opinion that all traffic should be encrypted, and I see little reason why a self-signed certificate is unacceptable for someone's personal rant blog. So yes it's wrong to pay someone else for a service you should be able to do better yourself (encryption not authentication).
I like how you write it off as merely philosophical. Morality is defined by philosophy, so I wouldn't be so quick to dismiss philosophy. Some other things that are philosophically wrong: Murder, Rape, Torture.
Really, now? So, you propose that the vast majority of internet servers are reconfigured to accept SSL connections?
There's a big difference between accept and require. Yes I think the vast majority of web servers should accept SSL connections. Do you honestly think that more then a few percent of users would elect to use it. Honestly, if slashdot allowed you to read through https, with it's security conscious (and paranoid) crowd, how many would actually change their bookmarks.
If you're managing 50 routers, you could always set up your own trustchain and add your own root authority to your browser. In fact that's probably the proper way even without firefox's warnings.
In this case, there is a distributed bunch of servers, so when a user requests a file, it's not even reaching the internet backbone, it's reaching a dedicated video server which is local to the ISP. Net neutrality has nothing to do with this, this is just agreements between companies to make highly demanded video available to users without costing the ISPs as much bandwidth.
Yes it does. Because it places a content provider onto a special tier. Why do you think many ISP's cached it locally, because they were getting paid. That's the primary fear of net neutrality. That if you don't pay both your ISP and your customer's ISP the data will be deprioritized. The road to a non-neutral net starts with content providers voluntarily paying for "higher tiers".
The very fact that ISP's choose what goes on their caching servers, means its non-neutral. Even if it was made free and the ISP's used discretion accepting videos, still non-neutral. The only neutral network is one the ISP doesn't make choices for me on what content gets prioritized.
I've played it a few times. It's a good game, a cross between Risk, Settlers of Catan and Diplomacy. You play empires (like risk they're not predefined empires) and can fund terrorism (placing them in your enemies territories). Anyone can trigger terrorist attacks or move them if they have the appropriate cards. Terrorists are much cheaper then directly attacking (allowing the underdog a chance to turn the tides), but they can turn on you. If your empire is destroyed, you start playing as the terrorists themselves (and can even win as terrorists). One empire at anytime can be marked as the Evil Empire.
If all the terrorists are eliminated, all the empires can agree to share victory by declaring peace... psh hippies, that'll never happen.
To be fair, though, the US is prepared to fight without the internet, it will just be an inconvenience. The Future Warrior program was supposed to rely heavily on digital information systems, but it is now mostly canceled. The military is still using the same methods they did in the 80's and 90's (dedicated sat-links and voice channels)before the net got so integrated into daily life. The real problem would be on the civilian front where massive cyber-attacks could blackout good-sized chunks of infrastructure.
It's worse then that, you're thinking only of warfighting elements of military life. How do you think the military would fare if its pay system was shut down? Do you think they have a backup system ready that isn't computerized? Okay they're military, you can compel them to work until the pay issues get sorted... but what about all the elements that moved to contractors, such as gate guards?
And I'm still assuming they're only targeting military. Our whole economy is completely dependent on computers and telecommunications. If a true all out cyber-war was conducted I have no doubt many people will die. Perhaps simply because they were unable to call 911 because the cell system was out of service.
There's just so much time wasted on the road.
Link all the cars and let a computer control them and the moment the light goes green all the cars could accelerate at once
If all the cars are linked why have traffic lights? The car will know the route of all cars moving through the intersection, and the server could tell individual cars to speed up and slow down to go through the gaps of traffic (and even to make the gaps). Obviously there'd have to be a significant safety margin, but cars wouldn't necessarily even need to stop in a fully computerized system. As soon as you enter your destination it should have the whole route programmed to within seconds, only making slight modifications as other drivers enter destinations.
Yeah, but you didn't create the IP yet you want to control it by default. You're essentially saying "If you make it I reserve the right to take it and do whatever I want with it". I guess there would be no debate if everyone agreed on this point but I've heard every angle of this issue over the years. I have never seen even one reasonable argument why an entity that creates IP should not be able to control the sale, use and distribution of that IP.
The argument comes in the creation part. You say they created an idea, something that doesn't hold physical form. That the "idea" spans past ordinary space and every physical manifestation is just a part of that idea. That's not logical, that's religion, the belief that the non-material can manifest everywhere at once.
I say its my brain. It's my pen, it's my paper. If I draw a mouse, that's my property. I can claim ownership of the physical manifestation, the piece of paper it's on. Don't worry, the original idea is still in the only place it ever was, in the brain it was thought up in. My "copy" is a shadow of a shadow which has no consequence on the "idea". I get upset when people try to assert that I have no right to my expression because it resembles someone else's.
The point of claiming IP is a natural right is not for the artists sake, they're free to do what they want with it. The point is to control people, to limit their freedoms. When people realize it's not a natural right and start treating it as a way of subsidizing innovation at the expense of natural rights of expression, the sooner we'll get to sane copyright laws (yes I believe copyright should exist just not in it's current form)
But I'm sure you'll throw away my argument and you'll continue with "There is not one reasonable argument"
MMO's *DO* trust their clients for some things. Such as movement, where latency can cause serious problems. The servers do put limitations on this however.
Suppose I have a hacked client and I simulate 2 seconds of packetloss, how far can I travel in one second? I can potentially report to server that during that 2 seconds I was traveling west the whole time or east the whole time. The server realizes 2 second of packetloss is reasonable and trusts the client. Everyone else sees me teleport to the position I reported.
Now suppose I simulate 30 seconds of packetloss (meanwhile my hacked client passively receives data, waiting to see if the Barbarians will invade from the east or west). When I see the alarms coming from the East Gate, I have my client report that it had been traveling east for the last 30 seconds. The server will recognize this as deception and rubberband me back.
So if I recognize that 5 seconds is the threshhold for trust. I could have my client constantly hiccuping packets for 4 seconds (only while I'm standing still) and as soon as I want to move, I can give myself a 4 second teleport in that direction.
And this gets us to how modern MMO's trust the client. They trust the client but they also recognize where the risks are. They make audits built into the system to try to identify suspicious behavior.
He actually took the password. Just because it isn't physical, doesn't mean he can't steal it.
Hey Johnson, you're fired. Fred here will escort you to the first floor medical for your mandatory lobotomy. Hey Fred make sure they dig deep, he knew a lot. /sarcasm off
How are you suggesting he not take the password with him?
He stopped providing his services when he was fired. He no longer had an obligation to maintain availability to the systems. He couldn't however do something to cause the system access to be unavailable. Had he refused to provide passwords while an employee, it's a different story.
Otherwise the power company is preventing me "authorized access" to my computer if they turn off my power.
If refusing to provide information to a former employer is a crime, they can save a lot of money firing people and compelling them to continue to work since it would prevent authorized access for them to stop.
Agreed, but it's not that simple, robot cars really are limited by their being to many rude and bad human drivers.
What we need is communicating cars. We could get rid of road signs, signs should appear on the car's HUD. Cars should identify their location to nearby cars, turn signals should inform nearby cars in the HUD and warn you if the lane is not clear (or if a car is approaching to quickly). The speed limit should be printed on the HUD, and automatically adjust to road conditions.
Once more cars are able to communicate, then it becomes easier to automate cars driving functions.
But the BSA is taking the position that they'll be able to squeeze money out of companies that otherwise would not have spent that money -- in other words, a forceful economic stimulus!
Yes squeeze money that wasn't being spent. The company could always sell their assets, lay off workers to pay off the settlements. And hows that's good for the economy?
Stability in companies is valuable. Thats why they need to keep savings for a rainy day. The long term effect of large settlements is that other companies need to keep more savings on hand.
And I think it's perfectly ethical to ignore robots.txt in a case like this.
Not only is it ethical, I think it's absolutely important. In the White House all correspondence is supposed be archived (ya ya Bush email) as part of public record. But I see the campaign as a logical extension of that. They're publishing this publicly for the world to see and its of profound historical value, it SHOULD be archived.
Secondly, what force does REP actually have? It's not a law. It's not even a standard of any standard body. You could argue unauthorized access of the network but I think that'd be hard for someone that's published publicly to the world. Has there been any successful court cases based on violating the REP?
Perhaps 20 years from now, depending on how these next couple of terms turn out, we can expect serious change to our two party system. For now, in my opinion, it's imperative that we keep McCain out of office.
Bullshit. That kind of attitude is exactly why this country is in trouble. You can't just plug your ears and say "We'll fix the system after our problems are resolved". There's always a current issue. But even supposing there isn't a major issue sometime in the future, what motivation would people have to fix the system then, after all life is peachy. All major changes cause instability and a period of worsening, people have to adapt, revisions are made, etc. You have to accept some temporary problems to cause any meaningful change. The current problems are EXACTLY WHY we need to fix the system.
At least with most Cisco devices thats not true. You just boot from flash to skip the startup. Then you can copy the startup-config to running-config, set the password and write. Heck even if you somehow have a bad flash IOS you can boot up off TFTP or ROM.
I haven't worked with anything but Cisco, but I have trouble imagining that most don't have a way to reset password for someone with physical access. Afterall no one should be touching your routers except the admins.
A data forensic specialist will look at all these free blocks, and guess what your SCSI/IDE/FC harddrive tells them in the low level meta data how many seek misses I've had in each area of the disk.
I don't know the details of what metadata hard drives contain but if truecrypt wanted to provide plausible deniability against that specifically then it could do random reads of blocks. It could even do random writes, changing a block to a random value then changing it back to what it was before (journaled in case of interruption). It can't do this very often without lowering drive lifespan, but it doesn't take much to ruin using metadata for forensics.
Also I really doubt they read hard drive meta data on every drive they image. By imaging the drive, they're changing the meta data, thus altering the evidence. You can mount a drive read only, but is there a way to mount it such that it doesn't mess with it's metadata. Forensics isn't just finding the evidence, it's also chain of custody and proving the evidence wasn't altered/contaminated in the process.
2) Law enforcement isn't welcome to just destroy property because they feel like it. They can't burn down your house and say "Well we thought there might be drugs in it, even though we never found any." Likewise they can't just screw up your data for shits and grins. That'd be a great way to get sued. You claim that the truecrypt volume in fact contained important research documents that were worth millions, not illegal data. They can't prove otherwise since they purposefully deleted it.
Not if they kept a clean image and altered the original. If you claimed there was a second volume with valuables, they could compel you to produce key to decrypt it on their unaltered image.
Another thing I find complete asinine is that little form you fill out saying where you are going stay while you are in the US. I've been staying at 1600 Pennsylvania ave. for going on 6 years and no one has so much a blinked.
I'm sure they want you to lie on the form. The laws in the US are setup so everyone is afoul of them in some way. That way we can selectively prosecute the people we don't like. Congratulations, you weren't judged an enemy of the government.