The bootloader will refuse to load an unsigned kernel. The kernel can then refuse to load unsigned executables, if it chooses. This will probably not be the default - after all, there are a lot of executables out there that are not signed - but it would be perfectly possible to configure the OS to only load signed code.
This doesn't prevent exploits via kernel API calls, but this would prevent you installing a persistent piece of code with kernel access - you'd have to re-exploit the OS each time it booted. For example, it wouldn't guard you against the recently revealed 0-day kernel exploit in Word, but it would prevent that exploit from permanently rooting your machine by installing kernel drivers (unless you somehow manage to pull off getting your exploit drivers signed).
Everything, eventually, calls kernel APIs, or it wouldn't be able to DO anything. The kernel is the only way you're going to access the file system, the hardware, etc. It would be a pretty sorry-assed word processor that couldn't save files.
The selection of Word as an attack vector was probably influenced by a combination of...
Word is probably the number 1 application that most professionals open after the browser.
Word has the extra advantage that it's not received as much hardening as the browser.
Office may use some of the reputed secret API calls that MS use to give it an advantage... these may be less hardened than public ones, or just less commonly exploited, thus they are a softer target.
The document data structure handling code in Word is likely a total mess, as revealed in the MOO-XML specs, because it contains support for a lot of very old versions of Word, and is probably more vulnerable to exploits than other parts of Office.
Yeah.. I think of that as a bug or missing feature in Calc - it's the one thing I sincerely miss when I'm using Calc instead of Excel. I only use Excel for trivial things, really, and summing columns features prominently.
As a sibling points out, it's probably the most used feature of Excel, so not supporting it is really annoying.
I'm inspired to trudge over to the OpenOffice bug tracker and see if it's ever been logged...
The OS establishes a precedent - that privileged actions like installing apps require a password - and then goes on to breach that precedent in a kids game for actions that spend real money in large gobs, with single clicks.
It's like combining a daycare centre with a nuclear launch control facility. Getting past the door guards requires a security check. But the launch control console has been cunningly disguised as Whack-A-Mole.
Exactly ; they've done studies that prove this - not everyone can program a computer. Every time I see one of those GUI programming environments designed to enable users to program, I sigh. Real programmers detest them (unless they are a mile-high model overview and they fill in the gaps), and people who can't program still can't program, so implementing them is pointless and counter-productive.
If 30-60% of people who self-selected to go on a Computer Science course can't program, what's the percentage in the general population?
For him, it's pragmatic as well. I'm sure that there would be no shortage of parties who'd be happy to stoop to smearing his integrity by claiming that he didn't really believe in what he professed to believe.
Either way, I agree. It must take some serious dedication.
Re:Just seems like a well thought out list
on
The RMS Tour Rider
·
· Score: 1
Aha, thank you for the enlightenment. That's actually not a bad trick.
I should have fallen back on something like Iggy and the Stones who demand that broccoli and cauliflower should be “cut into individual florets and thrown immediately into the garbage”...
Just seems like a well thought out list
on
The RMS Tour Rider
·
· Score: 4, Interesting
It reads like a list of his negative experiences. Especially the bit about parrots.
I found myself identifying with a lot of it - I'm obviously just better socially adjusted than he is when I put up with these things.
It's a lot less ridiculous than some of the riders of celebrities - it actually represents his preferences, mostly his preference to be treated like an independent adult, rather than stupid things that crop up on some peoples riders like a bowl M&Ms with all the green ones picked out.
The only thing we can really do is merge with them. The thought of venal, greedy, selfish humans in charge of an almost unlimited expansion in cognitive and physical ability is a little scary, but then, so is being wiped out as a species.
You only need to sign the bootloader - that then trusts the kernel that it loads.
The OEM need only sign the bootloader, as the first step in the chain of trust. Then that will trust MS signed kernels, that will trust MS signed updates, etc.
I don't think this will continue to be the case ; new tech creates new jobs only because humans are such flexible components of a working system.
Machine systems replace humans in a job when they approach or exceed the capabilities of the human in the same role. (They don't have to exceed the capability of a human to replace them - they just have to be more economic). As machines become capable of more, the number of roles in which a human can outperform a machine becomes smaller and smaller.
By definition, you need fewer workers for an economically viable system of robotic labour. And when you automate away cleaners (Roomba), register workers (self-service registers), and other menial jobs, you're not exactly opening up new working niches for these unskilled labourers.
It's one of those double edged swords - you can indeed, create a trusted platform. The question is, where does the trust reside?
Despite all the the hoo-haa about MS pushing Secure Boot for Windows 8 machines, part of me thinks it's a good thing - it will help to prevent a certain class of rootkit. The downside is that I don't trust MS not to abuse the feature to make it harder to load other operating systems on your machine. A colleague of mine was impressed enough with a certain LiveUSB this week that he intends to try it out on his ageing, ailing, overcrufted Windows machine at home. If Secure Boot was enabled on his machine, this would not have been possible.
Given the amount of software on my Windows machine at work devoted to snooping on what software I run, what files I have on my drive, and what websites I visit, the attitude is that my employer does not trust ME. To be honest, I wouldn't trust the average user not to foul up their computer. I might even welcome a trusted platform, if it meant that all this cruft went away and I could devote the resources to actually doing my job... but as a software developer, I can't run in an completely trusted environment, by definition, I have to be able to run software that has not been approved by our IT department, because I'm writing it.
i) You should dispose of compact fluorescents, just like regular fluorescents. Our local dumps have areas where you can take them.
ii) The CFL bulb contains much less mercury than the coal you would have burned to power the incandescent equivalent.
A quick search through documents, e.g. "Issue 4, dealing with potential fraud... " reveals the "European Electronic Toll Service".
General reading through the documents will reveal this is a scheme for taxing road use via the use of a "black box" with a positioning system and a GSM cellular modem. I've seen other DfT documents which I can no longer locate which are clearer on the matter of integration with a European system.
Of course, any such system also provides the capability of snooping where any vehicle in the target area travels.
Some back-of-napkin costings also reveal that a system like this is an order of magnitude more expensive to both install and run than mandatory active RFID tags in license plates and pickup loops at the ends of target roads (the original justification is that this will reduce congestion at peak times on these roads). On the other hand, RFID systems do not have the advantage of tracking your every movement.
I might be mis-remembering it, but I recall that Galileo specifically mentioned for it's improved performance in urban areas as compared to GPS.
That has to be one of the most ridiculous trolls I've ever seen.
You can't discriminate on any of those grounds in an online game, because none of those characteristics are exposed.
The only things that will be exposed are that which it is acceptable to discriminate on - personality and behaviour.
Granted, the GP is demonstrating a little prejudice by assuming that these people are predominantly children and foreigners. Some of them are probably rich white bankers. Childish behaviour and incoherent English are not limited to any social group.
If anything, F2P games are more discriminatory than normal subscription MMOs, because the affluent player can typically afford advantages that the free player cannot - usually in the form of faster progression (XP boosters, loot boosters) and more bling (higher social status). These are designed right into the game from the start, rather than being a consequence of black market trading (gold for cash) or being added later (like in EVE Online).
So which is worse.. the F2P game which is designed right from the start to be a 2-tier society, or the subscription MMO which is designed to discriminate only on the level of work you put into the game (but has a price for entry)?
If it's the choice of the country club, or the crack den... I'm not sure I want to hang around in either of them, to be honest.
Many of those games were roughly equivalent to indie games these days, in terms of the amount of manpower required to produce them.
So... what has the march of time brought us?
Firstly, inflation. The price of a loaf of bread in 1980 was £0.33, in 1990 £0.50 ; now it's more like £1, so prices have roughly doubled for the essentials of living.
An A-list title in the mid 80s would have been something like Elite ; I remember paying £15 for it (on cassette tape). The package was a robust cardboard box, with the cassette, a manual, a novella, a reference card, etc. I remember getting other games in just the standard plastic cassette box for less.
Elite was originally the product of just two programmers ; although it spawned a large number of conversions and a few unsuccessful sequels.
Right now, I can see Elder Scrolls : Skyrim listed for £29.99 . This is similarly, an A-list title of it's age. The quantity of man effort to produce it has no doubt been enormous. There is no doubt that you are getting a product that contains far, far more content than Elite, which used procedural generation for the bulk of it's content. Being silly ; you are getting around 300,000 times as much game (considering data volumes) - although it's probably more fair to rate it in terms of the hours of gameplay you get before being bored.
So, an A-list PC title seems to be priced about the same as it was in 1985, accounting for inflation, even though it probably cost several orders of magnitude more to produce.
Part of this is accountable in terms of duplication costs - it's cheaper to duplicate optical disks in a standard box than it ever was to duplicate floppy disks and cassettes. Part of it is the expansion of the market ; back then, a computer was a niche item - I had to walk to the next town to buy that copy of Elite. These things really go a long way to compensate for the fact that making games is MUCH more expensive than it used to be. You could knock out a feature-parity copy of Elite pretty quickly these days - modern programming tools would make it a cinch to achieve what you used to have to do manually in assembler or even raw 6502 machine code, and the plentiful resources a modern computer has means you wouldn't have to resort to dirty little tricks like changing screen modes in the middle of a raster frame so you could have a display that was monochrome, but high res at the top, and colour but low res at the bottom.
Even indie developers have to produce a product that is visually and aurally much more polished than anything from the 80s or 90s if they want to succeed. When you look at something beautifully simple like Osmos, you do wonder how they manage to sell that for a price that is, inflation included, around a quarter what you used to pay for a game in the 80s, given the level of artistry involved.
I agree with your observation that with the advent of CD-ROM, publishers went a little mad, and desperately sought ways to get "value for money" out of all that storage space they weren't using - they went from having perhaps 10MB to play with (if your game shipped on 15 floppies, not uncommon), to having 700MB. Hence the "Full Motion Video" crapfests of that period.
They would fold the letter over on itself, and seal it with wax, often with a characteristic indentation from a stamp. Although the Wikipedia page for sealing wax disputes that arrival date for envelopes ; it has them arriving in the 16th century.
And of course, people freely use email with an expectation of privacy but are ignorant that it's akin to sending a postcard via an association of disreputable postmen, not limited to thieves, spies, secret police, and salesmen, and that each of them must read the postcard to be able to pass it onwards. The envelope icon present in the GUI of most modern email programs is pretty misleading from this point of view.
People have been using encryption methods for thousands of years though. But only the elite. It would seem the common man really does believe he has nothing to hide...
I actually found myself wanting this installed in my house the other night. There was a robbery and assault at the end of the street. The police were canvassing for witnesses, and I hadn't seen anything but the aftermath, but he asked if I had CCTV (which I don't). It occurred to me that snooping the IMEI numbers of passing mobile phones was probably a lot more effective and unambiguous. I started having thoughts about combining one of those new open-source GSM stacks with a femtocell.
It's actually quite a reassuring idea, when it's not a corporation in charge of it. It's creepy because they are using it to replace that personal relationship that shopkeepers used to share with their customers.
"Hi there Mr B! How's your daughter E? I got some of these new in today, I thought you might like to try them."
Read this out in the voices of i) Friendly Mom & Pop shopkeep who you've known for years ii) Some kid in a headset you've never seen before.
They don't need to merge with carrier data to associate your IMEI with PII.
Presumably you go to a mall to shop. If you buy things with plastic, they can correlate purchase records with their IMEI snooping records. The more you shop there, the more they can correlate, until it's pretty close to 100% accurate.
If you buy a phone from a store in the mall.... they have an opportunity to really lock that one in.
If you have one of these new phones with Near Field Communications for buying things, I guess that's just an instant bust...
Slashdot Mirror
The bootloader will refuse to load an unsigned kernel. The kernel can then refuse to load unsigned executables, if it chooses. This will probably not be the default - after all, there are a lot of executables out there that are not signed - but it would be perfectly possible to configure the OS to only load signed code.
This doesn't prevent exploits via kernel API calls, but this would prevent you installing a persistent piece of code with kernel access - you'd have to re-exploit the OS each time it booted. For example, it wouldn't guard you against the recently revealed 0-day kernel exploit in Word, but it would prevent that exploit from permanently rooting your machine by installing kernel drivers (unless you somehow manage to pull off getting your exploit drivers signed).
Everything, eventually, calls kernel APIs, or it wouldn't be able to DO anything. The kernel is the only way you're going to access the file system, the hardware, etc. It would be a pretty sorry-assed word processor that couldn't save files.
The selection of Word as an attack vector was probably influenced by a combination of...
Yeah.. I think of that as a bug or missing feature in Calc - it's the one thing I sincerely miss when I'm using Calc instead of Excel. I only use Excel for trivial things, really, and summing columns features prominently.
As a sibling points out, it's probably the most used feature of Excel, so not supporting it is really annoying.
I'm inspired to trudge over to the OpenOffice bug tracker and see if it's ever been logged...
You don't need the password to make in game purchases (in the default configuration of iOS). You need the password to install the game.
The mechanic for in-game purchases is a cynical, well engineered, well researched hook.
The OS establishes a precedent - that privileged actions like installing apps require a password - and then goes on to breach that precedent in a kids game for actions that spend real money in large gobs, with single clicks.
It's like combining a daycare centre with a nuclear launch control facility. Getting past the door guards requires a security check. But the launch control console has been cunningly disguised as Whack-A-Mole.
Exactly ; they've done studies that prove this - not everyone can program a computer. Every time I see one of those GUI programming environments designed to enable users to program, I sigh. Real programmers detest them (unless they are a mile-high model overview and they fill in the gaps), and people who can't program still can't program, so implementing them is pointless and counter-productive.
If 30-60% of people who self-selected to go on a Computer Science course can't program, what's the percentage in the general population?
render rich graphical experiences in native resolution via the Graphic Output Protocol (GOP) driver
No HD content without Secure Boot. Your Blu-Ray will be Blur-Ray because it will be downscaled without Secure Boot enabled.
For him, it's pragmatic as well. I'm sure that there would be no shortage of parties who'd be happy to stoop to smearing his integrity by claiming that he didn't really believe in what he professed to believe.
Either way, I agree. It must take some serious dedication.
Aha, thank you for the enlightenment. That's actually not a bad trick.
I should have fallen back on something like Iggy and the Stones who demand that broccoli and cauliflower should be “cut into individual florets and thrown immediately into the garbage” ...
It reads like a list of his negative experiences. Especially the bit about parrots.
I found myself identifying with a lot of it - I'm obviously just better socially adjusted than he is when I put up with these things.
It's a lot less ridiculous than some of the riders of celebrities - it actually represents his preferences, mostly his preference to be treated like an independent adult, rather than stupid things that crop up on some peoples riders like a bowl M&Ms with all the green ones picked out.
The only thing we can really do is merge with them. The thought of venal, greedy, selfish humans in charge of an almost unlimited expansion in cognitive and physical ability is a little scary, but then, so is being wiped out as a species.
You only need to sign the bootloader - that then trusts the kernel that it loads.
The OEM need only sign the bootloader, as the first step in the chain of trust. Then that will trust MS signed kernels, that will trust MS signed updates, etc.
If it works? Have a party of epic proportions. Or possibly just epic intensity with a few select friends.
Given the history of the man, I don't hold out MUCH hope. But the prize is so great that I can't help but hope a little.
If it works, the future for my daughter will be more likely to be safe and secure. We might even have a stab at world peace.
If it doesn't work... well, it's a shame. It gives the people who are really trying a bad name, and fewer chances at funding.
I don't think this will continue to be the case ; new tech creates new jobs only because humans are such flexible components of a working system.
Machine systems replace humans in a job when they approach or exceed the capabilities of the human in the same role. (They don't have to exceed the capability of a human to replace them - they just have to be more economic). As machines become capable of more, the number of roles in which a human can outperform a machine becomes smaller and smaller.
By definition, you need fewer workers for an economically viable system of robotic labour. And when you automate away cleaners (Roomba), register workers (self-service registers), and other menial jobs, you're not exactly opening up new working niches for these unskilled labourers.
He made a set of wooden walking bipedal mice for my father when he was a boy.
It was less impressive. But gravity powered walking toys have been around for decades.
DYIIIIIVE!!!!!
Linux can use TPM just fine.
It's one of those double edged swords - you can indeed, create a trusted platform. The question is, where does the trust reside?
Despite all the the hoo-haa about MS pushing Secure Boot for Windows 8 machines, part of me thinks it's a good thing - it will help to prevent a certain class of rootkit. The downside is that I don't trust MS not to abuse the feature to make it harder to load other operating systems on your machine. A colleague of mine was impressed enough with a certain LiveUSB this week that he intends to try it out on his ageing, ailing, overcrufted Windows machine at home. If Secure Boot was enabled on his machine, this would not have been possible.
Given the amount of software on my Windows machine at work devoted to snooping on what software I run, what files I have on my drive, and what websites I visit, the attitude is that my employer does not trust ME. To be honest, I wouldn't trust the average user not to foul up their computer. I might even welcome a trusted platform, if it meant that all this cruft went away and I could devote the resources to actually doing my job... but as a software developer, I can't run in an completely trusted environment, by definition, I have to be able to run software that has not been approved by our IT department, because I'm writing it.
I'm sure enviro-hipsters are aware that
i) You should dispose of compact fluorescents, just like regular fluorescents. Our local dumps have areas where you can take them.
ii) The CFL bulb contains much less mercury than the coal you would have burned to power the incandescent equivalent.
The more modern 3 or 2 clause BSD licenses are entirely compatible with the GPL.
See the UK Department for Transport publications on Road Pricing
A quick search through documents, e.g. "Issue 4, dealing with potential fraud ... " reveals the "European Electronic Toll Service".
General reading through the documents will reveal this is a scheme for taxing road use via the use of a "black box" with a positioning system and a GSM cellular modem. I've seen other DfT documents which I can no longer locate which are clearer on the matter of integration with a European system.
Of course, any such system also provides the capability of snooping where any vehicle in the target area travels.
Some back-of-napkin costings also reveal that a system like this is an order of magnitude more expensive to both install and run than mandatory active RFID tags in license plates and pickup loops at the ends of target roads (the original justification is that this will reduce congestion at peak times on these roads). On the other hand, RFID systems do not have the advantage of tracking your every movement.
I might be mis-remembering it, but I recall that Galileo specifically mentioned for it's improved performance in urban areas as compared to GPS.
That has to be one of the most ridiculous trolls I've ever seen.
You can't discriminate on any of those grounds in an online game, because none of those characteristics are exposed.
The only things that will be exposed are that which it is acceptable to discriminate on - personality and behaviour.
Granted, the GP is demonstrating a little prejudice by assuming that these people are predominantly children and foreigners. Some of them are probably rich white bankers. Childish behaviour and incoherent English are not limited to any social group.
If anything, F2P games are more discriminatory than normal subscription MMOs, because the affluent player can typically afford advantages that the free player cannot - usually in the form of faster progression (XP boosters, loot boosters) and more bling (higher social status). These are designed right into the game from the start, rather than being a consequence of black market trading (gold for cash) or being added later (like in EVE Online).
So which is worse.. the F2P game which is designed right from the start to be a 2-tier society, or the subscription MMO which is designed to discriminate only on the level of work you put into the game (but has a price for entry)?
If it's the choice of the country club, or the crack den ... I'm not sure I want to hang around in either of them, to be honest.
Many of those games were roughly equivalent to indie games these days, in terms of the amount of manpower required to produce them.
So ... what has the march of time brought us?
Firstly, inflation. The price of a loaf of bread in 1980 was £0.33, in 1990 £0.50 ; now it's more like £1, so prices have roughly doubled for the essentials of living.
An A-list title in the mid 80s would have been something like Elite ; I remember paying £15 for it (on cassette tape). The package was a robust cardboard box, with the cassette, a manual, a novella, a reference card, etc. I remember getting other games in just the standard plastic cassette box for less.
Elite was originally the product of just two programmers ; although it spawned a large number of conversions and a few unsuccessful sequels.
Right now, I can see Elder Scrolls : Skyrim listed for £29.99 . This is similarly, an A-list title of it's age. The quantity of man effort to produce it has no doubt been enormous. There is no doubt that you are getting a product that contains far, far more content than Elite, which used procedural generation for the bulk of it's content. Being silly ; you are getting around 300,000 times as much game (considering data volumes) - although it's probably more fair to rate it in terms of the hours of gameplay you get before being bored.
So, an A-list PC title seems to be priced about the same as it was in 1985, accounting for inflation, even though it probably cost several orders of magnitude more to produce.
Part of this is accountable in terms of duplication costs - it's cheaper to duplicate optical disks in a standard box than it ever was to duplicate floppy disks and cassettes. Part of it is the expansion of the market ; back then, a computer was a niche item - I had to walk to the next town to buy that copy of Elite. These things really go a long way to compensate for the fact that making games is MUCH more expensive than it used to be. You could knock out a feature-parity copy of Elite pretty quickly these days - modern programming tools would make it a cinch to achieve what you used to have to do manually in assembler or even raw 6502 machine code, and the plentiful resources a modern computer has means you wouldn't have to resort to dirty little tricks like changing screen modes in the middle of a raster frame so you could have a display that was monochrome, but high res at the top, and colour but low res at the bottom.
Even indie developers have to produce a product that is visually and aurally much more polished than anything from the 80s or 90s if they want to succeed. When you look at something beautifully simple like Osmos, you do wonder how they manage to sell that for a price that is, inflation included, around a quarter what you used to pay for a game in the 80s, given the level of artistry involved.
I agree with your observation that with the advent of CD-ROM, publishers went a little mad, and desperately sought ways to get "value for money" out of all that storage space they weren't using - they went from having perhaps 10MB to play with (if your game shipped on 15 floppies, not uncommon), to having 700MB. Hence the "Full Motion Video" crapfests of that period.
They would fold the letter over on itself, and seal it with wax, often with a characteristic indentation from a stamp. Although the Wikipedia page for sealing wax disputes that arrival date for envelopes ; it has them arriving in the 16th century.
And of course, people freely use email with an expectation of privacy but are ignorant that it's akin to sending a postcard via an association of disreputable postmen, not limited to thieves, spies, secret police, and salesmen, and that each of them must read the postcard to be able to pass it onwards. The envelope icon present in the GUI of most modern email programs is pretty misleading from this point of view.
People have been using encryption methods for thousands of years though. But only the elite. It would seem the common man really does believe he has nothing to hide...
I actually found myself wanting this installed in my house the other night. There was a robbery and assault at the end of the street. The police were canvassing for witnesses, and I hadn't seen anything but the aftermath, but he asked if I had CCTV (which I don't). It occurred to me that snooping the IMEI numbers of passing mobile phones was probably a lot more effective and unambiguous. I started having thoughts about combining one of those new open-source GSM stacks with a femtocell.
It's actually quite a reassuring idea, when it's not a corporation in charge of it. It's creepy because they are using it to replace that personal relationship that shopkeepers used to share with their customers.
"Hi there Mr B! How's your daughter E? I got some of these new in today, I thought you might like to try them."
Read this out in the voices of i) Friendly Mom & Pop shopkeep who you've known for years ii) Some kid in a headset you've never seen before.
I think they're shooting themselves in the foot.
They don't need to merge with carrier data to associate your IMEI with PII.
Presumably you go to a mall to shop. If you buy things with plastic, they can correlate purchase records with their IMEI snooping records. The more you shop there, the more they can correlate, until it's pretty close to 100% accurate.
If you buy a phone from a store in the mall.... they have an opportunity to really lock that one in.
If you have one of these new phones with Near Field Communications for buying things, I guess that's just an instant bust...
It's not just smartphones. This can track any phone, presuming it's just snooping for IMEI numbers in GSM communications.