How come bandwidth doesn't split exactly equally between individuals using the network? How does it happen that a bittorrent user slows down all the other users, as opposed to the other users slowing him down until everyone has exactly the same bandwidth? That seems the most equitable solution. Is it technologically unfeasible? why?
I'm not 100% sure on this, but no doubt someone with more clue will chime in if I'm wrong.
I think if you leave things to run their own way, the distribution will be "equal" but weighted by connections, not users.
Now, web pages use one or a handful of connections at most (one for the text and a few others for images - sometimes), and online gaming uses just one from the player to the server, but bittorrent opens hundreds or even thousands of connections per user (one to each peer). Every connection would be given even priority, but in terms of users, the bittorrent user is getting a weight of thousands compared to a weight of 1 for users of other protocols.
There are technological ways to fight this and the most reasonable seems to be QoS shaping, i.e. the network being configured so: "If there is plenty of vacant bandwidth, your bittorrent connections can have it all. But if a more important protocol demands some bandwidth, your bittorrent packets will be put at the end of the queue and they will be served first".
You might even set this up on your home router if you use bittorrent a lot, and also game or use VOIP telephony - so that bittorrent can run at full speed while you're asleep but gets shoved aside if you make a VOIP call, so that you can have enough bandwidth for a good quality conversation. The technology is old and is even supported now in many consumer grade routers.
Many ISPs, including (from TFS) Rogers do exactly this. What they're saying is that if in the future they're not allowed to do this, by law, then they don't know what they'll do instead.
The strongest suggestion here on/. is that one thing they could do, is stop selling a service like "20MBps unlimited" which is not supportable by their network if more than a small fraction of users actually utilise the full advertised features of the product they paid for. Instead, they could offer a service marketed as "sometimes 20MBps not really unlimited, but close enough for web pages and email and gaming" for that price, and keep the bittorrenters well appraised that "because this service isn't unlimited, really, we'll shape your downloads into oblivion - if you don't want that pay the full price for a low contention business grade connection".
The problem as I see it (although I live in Australia and am removed from the broadband situation on the North American continent) is twofold: one, that services are advertised as unlimited and they really aren't (and cannot feasibly be), which leads to all these issues of how much shaping is legal, what disclosure is required, how much overselling, etc.
Two, is that the amount of bandwidth used by plain old ma and pa customers is going up compared to 10 years ago - without bittorrent, people are watching videos on youtube, streaming TV from hulu, doing video phone chats over the net, uploading gigs of photos and videos to picasa, etc - not just downloading web pages at a few kb of text each like they used to. But, the ISPs still have the same network they did then, and even more customers than they did then as broadband becomes more prevalent.
In Australia the first problem is more or less solved, with the ACCC having successfully lobbied government to make it illegal to advertise plans with any kind of limit as "unlimited". So, they are sold as "20gb per month" with peak and off peak times clearly marked. This wasn't always so in Australia - in fact there was even a baseball cap made with the writing "I signed up for an unlimited Internet account with Telstra but all
how, exactly, are you going to get that $10+interest back unless at least enough new money to cover the interest is actually *created* rather than just *loaned out*?
Money doesn't get created, but what gets created is real output that is worth something. You use the $10 you borrowed from me to buy some pumpkin seeds (for simplicity, let's say from me), which you plant and tend.
Your time spent working on tending the pumpkins is worth something to me, because it means that I can eat a pumpkin without myself having to spend any time on growing and tending it.
Because of that, I'm willing to pay you some money for the pumpkin (what I'm actually paying you for is your time spent doing pumpkin work rather than something else). That is money you use to pay me interest on the loan.
So we can use the same money back and forth - it's just a tool for transacting to avoid the double coincidence problem which would occur if we traded by barter instead. What creates the "extra" wealth is that you spend your time on an activity that results in more pumpkins being available than before.
So in case the above explanation wasn't clear - it's all to do with the pumpkin.
This poster is right on the money. If you click through to TFA (*gasp*), at the bottom they have a link to a flash widget allowing you to switch between (digitally recreated versions of) the Nightingale's Rose graphs, and a simple bar chart showing the same data.
The bar chart is ridiculously easier to read and still makes the same point about causes of death just as strongly - even more so, because it's actually understandable.
What percentage of the population supports this, anyway? Anyone have any figures?
Based on an extensive statistically sound survey I have conducted, I would say this percentage is zero, with a 95% confidence interval of between zero and zero.
More seriously, I don't think any non-politicians actively support _this_ plan. I think you can split them into two camps: those who are against, and those who don't have a sufficiently good understanding of the internet to be qualified to comment. Anyone qualified will quickly see that despite your views on child pornography, this is not an achievable goal.
I think the GP meant: Use the aggregator sites to find the cheapest airfare, and if you determine that it's Ryanair, go to their site and book the flight there.
Surely the aggregator won't have a cheaper fare given how much love they seem to be getting from this particular airline...
So it's something to do with the UI - well what? Obviously it fails at basic UI functionality such as copy/paste, so there must be something it does wonderfully better to make up, right? Just tell us what it is, please...
The multitouch screen and the way it's used for zoom/pan is the only thing that makes the browser useable on such a small screen (relative to other handheld devices, maybe the screen is not so small, but it is compared to any real screen that you'd be used to browsing on).
I had an SE M600i that had a functional browser, but pages were either too tiny to read or too zoomed in to see where the text you want is. Changing the zoom level required going though a menu. While it was no doubt _possible_ to get the info you wanted, in terms of ease of use if you could easily call a friend who you knew was at a computer and ask them to look it up, you'd do that instead.
The ease of panning and changing zoom levels on the iPhone, although it seems like a trite toy, is actually the only thing that makes the browsing useable - in fact, it's quite nice to use (of course, no handheld device can ever compare to a full size screen in this regard, but this is as close as it gets). Add to this the fact that Safari on the iPhone renders almost any page well, whereas say Opera Mini on Symbian is quite easy to trip up. For example, the Citibank login screen has some Javascript (for a rubbish on-screen keyboard you have to use) that makes it impossible to log in from the SE, but possible on the iPhone.
I won't lie to you, the lack of copy/paste is quite annoying. The M600i had copy/paste and I did use it a lot. Also I still can't type quite as fast on the iPhone touch screen as I could on the M600i QWERTY keyboard (but close). But it's not a deal breaker - I'll take the lack of copy paste in exchange for a useable browser. It definitely has shortcomings. But hey, you asked what it was that was better so now you know...
No MS RDP client that I could find, but there is a free VNC client on the app store (offical one, no jailbreak needed). Haven't tried it yet so don't know if it's any good.
Citibank Australia (you're forgiven, but only this once;P).
2 or 3 banks here offer an OTP dongle or similar device - HSBC for everyone, and I think 2 of the big 4 for "high value" clients. Citibank know they don't need it to be competitive (they have some other very nice features offered by none of their competitors, like a total lack of account keeping and ATM withdrawal fees, from any ATM, not just their own).
To reply to another poster below - I don't think Blizzard doing this will kick them in the pants at all. They are not competing with WoW (yet..?). If their competitors all did it overnight, then it would be a different story.
Of course it will. If your site is www.exampIe.com, and your certificate is for www.exampIe.com, the browser won't complain. Why should it? The certificate matches the domain you're accessing. If www.example.com is a major bank's website, and you contact Verisign to get a signed cert for www.examp1e.com (a blatant attempt to masquerade for said site), I think you might find they are not as willing to just hand it over as they would be for www.myhobbywebsite.com (which in no way resembles the domain name of any major banks).
In most cases, you wouldn't need to compromise the ISP DNS, only the DHCP server the person is using (generally a consumer router). I could see this attack being feasible with a public wireless point or a cybercafe.
Also he is confusing a bunch of different issues in his post in a poor attempt to make a point. Serving up bullshit DNS is a lot easier than getting your brother's friend's sister to give you Google's cert.
But, CA signing protects from a MiTM attack executed by spoofed DNS - you can make my browser go to the wrong IP address for google.com, but you can't present me a trusted certificate.
What GGP is saying is that despite CA signing, he can still trick my browser by getting root on either (a) my machine, or (b) google's servers.
Either of these, while not impossible, is a significantly higher bar to jump than just setting up a fake DNS using some ARP poisoning on a public wireless lan or some such. Especially in such a way as to not alert either me or google that our respective systems have been hacked.
If google know it's been leaked, they will straight away contact the CA and have the certificate revoked, at which point browsers will start throwing warnings about it again.
So we've changed the requirements for successful deception from a few scripts (attainable with little subject matter knowledge from a web search) on a linux laptop at Starbucks to hacking google's servers well enough they don't realise they've been hacked. In that case, I think CA signing is doing its job pretty well.
And when you do something nefarious with your signed code, the police will subpoena the CA for the details of your transaction, get your info from the credit card company, and send a cop to your door. That's fine, because by then the credit card will have been closed and the address on file vacated.
Part of the security around having the SSL cert verified off site is it helps prevent man in the middle attacks. If you use a self-signed cert it breaks part of the security of SSL. If you're saying that using a self-signed cert is vulnerable to MiTM attacks, while a trusted CA-signed cert is not, that's not true, provided you verify the certificate once (for example, the site could post the fingerprint on many public sites to make it well known), and then tell your browser to trust that certificate for that site.
Then you won't get the certificate warning again, unless the cert changes (as it would in a MiTM attack - it would be self-signed for the same site, but the actual certificate would be different, and your browser would recognise this). The warning then tips you off that something is not as it should be, just as it would if you saw it on a site you expected to have a cert signed by a trusted CA.
Numerous posters above already pointed this out.
Also to reply to vertinox's post (would that be an 'uncle' post?):
A phishing site would have a problem getting a banks cert, but they could even roll their own with something that says "Signed by Verising" and since the person probaly didn't read the address at the top in the first place they most likley wouldn't bother double clicking on the lock on their browser. I think if you tried to get Verisign to sign a cert for "www.commbnak.com.au" (instead of commbank which is a real bank's site), you would not find it easy, because the names are so similar and Verisign would see what you're trying to do. So while it's true some might slip through, I don't think it's as serious a drawback of the system as you imply.
Those 5% are going to employ some means to avoid getting caught (they are, after all, pros).
The customers lost will more likely be the 50th-95th percentile - those who casually download something illegal but lack the expertise to cover it up. Hence, you would lose 45% of your revenue base but only see a 5% reduction in bandwidth utilisation (since the 95% used by those top downloaders will remain).
how easy/hard (compared to magnetic HDDs) is it to permanently blast data off a flash drive if you don't want the data found? Much easier - 10 minutes with a mortar and pestle pretty much guarantees recovery will be impossible. That method would take a lot longer (and require more equipment) for hard drives.
Assuming, of course, that if hiding the data is that important, the cost of a flash drive is a sacrifice you're willing to make.;)
His/her maths is almost correct (i.e. wrong, but not enough to make his point invalid).
The calculation above doesn't take into account the fact that to die in a car crash on your second day (e.g. 5th drive), implies you already didn't die on the first day, so the actual chance of that is p*(1-p)^4, where p = 0.005% or whatever.
A quick spreadsheet exercise projecting this for 9125 drives (10 years @ 2.5 drives per day) shows the probability of death during the 10 years is 36.6%.
Another way to approach the problem that doesn't need either a spreadsheet or a geometric progression trick is to say that the probability of dying in this way during the 10 years is (1 - probability of not dying in that time). The probability of doing all that driving and surviving is (1 - p)^(9125), which = 63.4% when p = 0.005. (1 - 63.4%) = 36.6% giving the same answer as above.
However this doesn't change the fact that piojo's argument is 100% correct that the chance of death per drive must average lower than 0.0005%, as the 36% per 10 years rate is way too high.
Why should I have to figure something like that out to prevent my PC from being made unbootable? Here's what GP wrote, with my emphasis:
The most common version of this issue has to do with when a new kernel update occurs during a NORMAL ubuntu update.
To be fair, it would not happen had the user in question not dived in and edited the menu.lst file manually (and subtly incorrectly) - as an above poster pointed out.
So, my answer to your question is: If you're good enough to be editing menu.lst by hand, you're good enough to figure out how to deal with the problem. If you are not good enough to figure out how to deal with the problem, chances are you have not been making any hand edits to any config files.
The most common version of this issue has to do with when a new kernel update occurs during a NORMAL ubuntu update. You click the orange star, choose update, let it download and install, then reboot and voila...no more access to any hard drive. It happens to my machine every single time.
Why not set the kernel-related packages to 'hold' status? Then, they won't be automatically updated (the updater will say "package X has been held back" or something to that effect).
When you're in the mood to update the kernel and perform all the liveCD booting that entails, you can manually update that package (unhold, install new version, hold again).
Meanwhile, you can still leave automatic update on to get all other updates automatically without fear that you might be in for a surprise dose of liveCD booting and MBR fixing (which I agree is very annoying if you had stuff to get done when it happens).
APIs for useful Explorer customisation? Gone. (That extension, which I found infinitely useful, not only doesn't work but has no hope of ever working thanks to an API change).
I'm sure I would have found more stuff I liked that they took out, but at this point I formatted my laptop and installed XP SP2. I actually didn't mind the UAC and other stuff people complain about (and it all ran quite smoothly despite many people who would convince you otherwise - albeit this was on a pretty decked out laptop). Having said that, XP not only runs faster but actually has the features that I care about and which I've become quite accustomed to. What used to be "upgrade to the latest OS and take the bugs and performance hit to have the latest features" is now "downgrade to the previous OS which is more stable and performs better to keep the *cough* latest features (which are 3 years old)".
While I haven't seen the exact one mentioned a few posts up, this page suggests the cost will not be $200 (although will be a bit more than a regular incandescent bulb - although I don't know where you get them for $0.50). In particular this one claims to have a similar output to a 40w incandescent for under 6USD.
but the data has to be encrypted using a certificate with the hostname in it, and signed by a CA recognized by the client. CAs should only be distributing such tickets to the owner of the hostname, so how can the ISP pretend to be that hostname?
I think the point was that they can modify your browser ("the client") to trust their own (dodgy) CA which signs anything they want, by including that in the "install the internet CD" they give to unsuspecting customers. Then, they just provide a certificate for the hostname signed by their fake CA (which they can) - your browser doesn't throw a warning because it trusts their fake CA. Your client never gets to establish a secure connection with the real site (only their proxy does that), but you don't notice because it throws no warnings and you still get the secure lock icon.
That won't work on you or me (we don't use their CDs, except for preventing drink mugs from leaving rings on the desk), but it will work on 95% of the population.
Well, interesting option for experiment mark 2.
Would be to seed the torrent as a full album bundle.
But include a small payment widget.
Not nagware but friendly like.
What's wrong with "here's a link to the official download torrent", followed by "if you want to send us some money because you like us or our music, use this <paypal/CC/etc> link".
They can still track how many people downloaded it through the tracker stats, and those who were going to pay any non-zero amount (rather than typing 0 in the box) are still going to. They could even require registration to get on the torrent if they wanted (hey - it works for private trackers right?). And, there wouldn't be any queue or high bandwidth costs.
If you've had a power hit at your retail store, once it's back up you don't want to wait half a day for an IT staff guy to drive or fly there and connect the console to type a password into it.
My understanding from reading a lot of the other comments here is that for this feature to work, you have to (at the least) log in while the system is already running and unlocked and enable this feature, so that the passphrase is not asked for at the next reboot.
As such, it's useless in a power failure situation. Either you knew in advance the power failure was going to happen (unlikely), or you haven't logged in prior to it to enable this setting for the next reboot. So the retail store in your example would still be hosed.
Seems like the only place where this would be useful is in a situation where you're saying "OK, I'm going to deliberately remotely reboot this computer now, and then connect back to it, so I don't want it to hang at the passphrase prompt (before any network stuff is loaded) leaving me unable to log in".
Useful for retail stores or anyone else in the case of power failure? No.
Useful for corporate customers needing to reboot a thousand workstations to apply updates? Maybe - assuming there is a central interface where they can enable the feature en-masse (oooh... dangerous). Otherwise they're back to remoting to each one in turn and applying the setting. If there is the ability to enable it en-masse, what if by some accident the affected machines aren't all rebooted afterwards? The ones that weren't are left in an unsecure state. Does the setting wait for "next reboot" indefinitely, or does it apply a sensible/configurable timeout? (e.g. - you haven't rebooted the machine 6 hours after setting the flag, you probably forgot, so just disable it again). I don't know the answer to these questions, because I don't use the software... and more importantly, because the feature is not documented. I think that's the main complaint here, and it's a very legitimate one.
Slashdot Mirror
I just checked and got a 404... is the list working (I'm in Australia)? Or did a malware site just get slashdotted?
How come bandwidth doesn't split exactly equally between individuals using the network? How does it happen that a bittorrent user slows down all the other users, as opposed to the other users slowing him down until everyone has exactly the same bandwidth? That seems the most equitable solution. Is it technologically unfeasible? why?
I'm not 100% sure on this, but no doubt someone with more clue will chime in if I'm wrong.
I think if you leave things to run their own way, the distribution will be "equal" but weighted by connections, not users.
Now, web pages use one or a handful of connections at most (one for the text and a few others for images - sometimes), and online gaming uses just one from the player to the server, but bittorrent opens hundreds or even thousands of connections per user (one to each peer). Every connection would be given even priority, but in terms of users, the bittorrent user is getting a weight of thousands compared to a weight of 1 for users of other protocols.
There are technological ways to fight this and the most reasonable seems to be QoS shaping, i.e. the network being configured so: "If there is plenty of vacant bandwidth, your bittorrent connections can have it all. But if a more important protocol demands some bandwidth, your bittorrent packets will be put at the end of the queue and they will be served first".
You might even set this up on your home router if you use bittorrent a lot, and also game or use VOIP telephony - so that bittorrent can run at full speed while you're asleep but gets shoved aside if you make a VOIP call, so that you can have enough bandwidth for a good quality conversation. The technology is old and is even supported now in many consumer grade routers.
Many ISPs, including (from TFS) Rogers do exactly this. What they're saying is that if in the future they're not allowed to do this, by law, then they don't know what they'll do instead.
The strongest suggestion here on /. is that one thing they could do, is stop selling a service like "20MBps unlimited" which is not supportable by their network if more than a small fraction of users actually utilise the full advertised features of the product they paid for. Instead, they could offer a service marketed as "sometimes 20MBps not really unlimited, but close enough for web pages and email and gaming" for that price, and keep the bittorrenters well appraised that "because this service isn't unlimited, really, we'll shape your downloads into oblivion - if you don't want that pay the full price for a low contention business grade connection".
The problem as I see it (although I live in Australia and am removed from the broadband situation on the North American continent) is twofold: one, that services are advertised as unlimited and they really aren't (and cannot feasibly be), which leads to all these issues of how much shaping is legal, what disclosure is required, how much overselling, etc.
Two, is that the amount of bandwidth used by plain old ma and pa customers is going up compared to 10 years ago - without bittorrent, people are watching videos on youtube, streaming TV from hulu, doing video phone chats over the net, uploading gigs of photos and videos to picasa, etc - not just downloading web pages at a few kb of text each like they used to. But, the ISPs still have the same network they did then, and even more customers than they did then as broadband becomes more prevalent.
In Australia the first problem is more or less solved, with the ACCC having successfully lobbied government to make it illegal to advertise plans with any kind of limit as "unlimited". So, they are sold as "20gb per month" with peak and off peak times clearly marked. This wasn't always so in Australia - in fact there was even a baseball cap made with the writing "I signed up for an unlimited Internet account with Telstra but all
how, exactly, are you going to get that $10+interest back unless at least enough new money to cover the interest is actually *created* rather than just *loaned out*?
Money doesn't get created, but what gets created is real output that is worth something. You use the $10 you borrowed from me to buy some pumpkin seeds (for simplicity, let's say from me), which you plant and tend.
Your time spent working on tending the pumpkins is worth something to me, because it means that I can eat a pumpkin without myself having to spend any time on growing and tending it.
Because of that, I'm willing to pay you some money for the pumpkin (what I'm actually paying you for is your time spent doing pumpkin work rather than something else). That is money you use to pay me interest on the loan.
So we can use the same money back and forth - it's just a tool for transacting to avoid the double coincidence problem which would occur if we traded by barter instead. What creates the "extra" wealth is that you spend your time on an activity that results in more pumpkins being available than before.
So in case the above explanation wasn't clear - it's all to do with the pumpkin.
What do I turn off to make TCP/IP over Firewire work?
What about my favourite XP extension?
I bought a laptop that was pretty high spec with Vista installed and didn't mind the performance so much as the lack of features I use every day.
I put XP on it, but if you can tell me, I may reinstall Vista.
(OK, you got me. That was a lie.)
This poster is right on the money. If you click through to TFA (*gasp*), at the bottom they have a link to a flash widget allowing you to switch between (digitally recreated versions of) the Nightingale's Rose graphs, and a simple bar chart showing the same data.
The bar chart is ridiculously easier to read and still makes the same point about causes of death just as strongly - even more so, because it's actually understandable.
If only I had mod points.
What percentage of the population supports this, anyway? Anyone have any figures?
Based on an extensive statistically sound survey I have conducted, I would say this percentage is zero, with a 95% confidence interval of between zero and zero.
More seriously, I don't think any non-politicians actively support _this_ plan. I think you can split them into two camps: those who are against, and those who don't have a sufficiently good understanding of the internet to be qualified to comment. Anyone qualified will quickly see that despite your views on child pornography, this is not an achievable goal.
I think the GP meant:
Use the aggregator sites to find the cheapest airfare, and if you determine that it's Ryanair, go to their site and book the flight there.
Surely the aggregator won't have a cheaper fare given how much love they seem to be getting from this particular airline...
So it's something to do with the UI - well what? Obviously it fails at basic UI functionality such as copy/paste, so there must be something it does wonderfully better to make up, right? Just tell us what it is, please...
The multitouch screen and the way it's used for zoom/pan is the only thing that makes the browser useable on such a small screen (relative to other handheld devices, maybe the screen is not so small, but it is compared to any real screen that you'd be used to browsing on).
I had an SE M600i that had a functional browser, but pages were either too tiny to read or too zoomed in to see where the text you want is. Changing the zoom level required going though a menu. While it was no doubt _possible_ to get the info you wanted, in terms of ease of use if you could easily call a friend who you knew was at a computer and ask them to look it up, you'd do that instead.
The ease of panning and changing zoom levels on the iPhone, although it seems like a trite toy, is actually the only thing that makes the browsing useable - in fact, it's quite nice to use (of course, no handheld device can ever compare to a full size screen in this regard, but this is as close as it gets). Add to this the fact that Safari on the iPhone renders almost any page well, whereas say Opera Mini on Symbian is quite easy to trip up. For example, the Citibank login screen has some Javascript (for a rubbish on-screen keyboard you have to use) that makes it impossible to log in from the SE, but possible on the iPhone.
I won't lie to you, the lack of copy/paste is quite annoying. The M600i had copy/paste and I did use it a lot. Also I still can't type quite as fast on the iPhone touch screen as I could on the M600i QWERTY keyboard (but close). But it's not a deal breaker - I'll take the lack of copy paste in exchange for a useable browser. It definitely has shortcomings. But hey, you asked what it was that was better so now you know...
No MS RDP client that I could find, but there is a free VNC client on the app store (offical one, no jailbreak needed). Haven't tried it yet so don't know if it's any good.
Citibank Australia (you're forgiven, but only this once ;P).
2 or 3 banks here offer an OTP dongle or similar device - HSBC for everyone, and I think 2 of the big 4 for "high value" clients. Citibank know they don't need it to be competitive (they have some other very nice features offered by none of their competitors, like a total lack of account keeping and ATM withdrawal fees, from any ATM, not just their own).
To reply to another poster below - I don't think Blizzard doing this will kick them in the pants at all. They are not competing with WoW (yet..?). If their competitors all did it overnight, then it would be a different story.
Wowzers, now I can have more security for my account on some computer game than my online banking (I'm looking at you, Citibank).
In most cases, you wouldn't need to compromise the ISP DNS, only the DHCP server the person is using (generally a consumer router). I could see this attack being feasible with a public wireless point or a cybercafe.
Also he is confusing a bunch of different issues in his post in a poor attempt to make a point. Serving up bullshit DNS is a lot easier than getting your brother's friend's sister to give you Google's cert.
But, CA signing protects from a MiTM attack executed by spoofed DNS - you can make my browser go to the wrong IP address for google.com, but you can't present me a trusted certificate.What GGP is saying is that despite CA signing, he can still trick my browser by getting root on either
(a) my machine, or
(b) google's servers.
Either of these, while not impossible, is a significantly higher bar to jump than just setting up a fake DNS using some ARP poisoning on a public wireless lan or some such. Especially in such a way as to not alert either me or google that our respective systems have been hacked.
If google know it's been leaked, they will straight away contact the CA and have the certificate revoked, at which point browsers will start throwing warnings about it again.
So we've changed the requirements for successful deception from a few scripts (attainable with little subject matter knowledge from a web search) on a linux laptop at Starbucks to hacking google's servers well enough they don't realise they've been hacked. In that case, I think CA signing is doing its job pretty well.
Then you won't get the certificate warning again, unless the cert changes (as it would in a MiTM attack - it would be self-signed for the same site, but the actual certificate would be different, and your browser would recognise this). The warning then tips you off that something is not as it should be, just as it would if you saw it on a site you expected to have a cert signed by a trusted CA.
Numerous posters above already pointed this out.
Also to reply to vertinox's post (would that be an 'uncle' post?):
A phishing site would have a problem getting a banks cert, but they could even roll their own with something that says "Signed by Verising" and since the person probaly didn't read the address at the top in the first place they most likley wouldn't bother double clicking on the lock on their browser. I think if you tried to get Verisign to sign a cert for "www.commbnak.com.au" (instead of commbank which is a real bank's site), you would not find it easy, because the names are so similar and Verisign would see what you're trying to do. So while it's true some might slip through, I don't think it's as serious a drawback of the system as you imply.Those 5% are going to employ some means to avoid getting caught (they are, after all, pros).
The customers lost will more likely be the 50th-95th percentile - those who casually download something illegal but lack the expertise to cover it up. Hence, you would lose 45% of your revenue base but only see a 5% reduction in bandwidth utilisation (since the 95% used by those top downloaders will remain).
Assuming, of course, that if hiding the data is that important, the cost of a flash drive is a sacrifice you're willing to make.
His/her maths is almost correct (i.e. wrong, but not enough to make his point invalid).
The calculation above doesn't take into account the fact that to die in a car crash on your second day (e.g. 5th drive), implies you already didn't die on the first day, so the actual chance of that is p*(1-p)^4, where p = 0.005% or whatever.
A quick spreadsheet exercise projecting this for 9125 drives (10 years @ 2.5 drives per day) shows the probability of death during the 10 years is 36.6%.
Another way to approach the problem that doesn't need either a spreadsheet or a geometric progression trick is to say that the probability of dying in this way during the 10 years is (1 - probability of not dying in that time). The probability of doing all that driving and surviving is (1 - p)^(9125), which = 63.4% when p = 0.005. (1 - 63.4%) = 36.6% giving the same answer as above.
However this doesn't change the fact that piojo's argument is 100% correct that the chance of death per drive must average lower than 0.0005%, as the 36% per 10 years rate is way too high.
Why should I have to figure something like that out to prevent my PC from being made unbootable? Here's what GP wrote, with my emphasis:
To be fair, it would not happen had the user in question not dived in and edited the menu.lst file manually (and subtly incorrectly) - as an above poster pointed out. So, my answer to your question is: If you're good enough to be editing menu.lst by hand, you're good enough to figure out how to deal with the problem. If you are not good enough to figure out how to deal with the problem, chances are you have not been making any hand edits to any config files.Why not set the kernel-related packages to 'hold' status? Then, they won't be automatically updated (the updater will say "package X has been held back" or something to that effect).
When you're in the mood to update the kernel and perform all the liveCD booting that entails, you can manually update that package (unhold, install new version, hold again).
Meanwhile, you can still leave automatic update on to get all other updates automatically without fear that you might be in for a surprise dose of liveCD booting and MBR fixing (which I agree is very annoying if you had stuff to get done when it happens).
It's funny you should mention that.
TCP/IP over firewire support? Gone.
APIs for useful Explorer customisation? Gone. (That extension, which I found infinitely useful, not only doesn't work but has no hope of ever working thanks to an API change).
I'm sure I would have found more stuff I liked that they took out, but at this point I formatted my laptop and installed XP SP2. I actually didn't mind the UAC and other stuff people complain about (and it all ran quite smoothly despite many people who would convince you otherwise - albeit this was on a pretty decked out laptop). Having said that, XP not only runs faster but actually has the features that I care about and which I've become quite accustomed to. What used to be "upgrade to the latest OS and take the bugs and performance hit to have the latest features" is now "downgrade to the previous OS which is more stable and performs better to keep the *cough* latest features (which are 3 years old)".
While I haven't seen the exact one mentioned a few posts up, this page suggests the cost will not be $200 (although will be a bit more than a regular incandescent bulb - although I don't know where you get them for $0.50). In particular this one claims to have a similar output to a 40w incandescent for under 6USD.
I think the point was that they can modify your browser ("the client") to trust their own (dodgy) CA which signs anything they want, by including that in the "install the internet CD" they give to unsuspecting customers. Then, they just provide a certificate for the hostname signed by their fake CA (which they can) - your browser doesn't throw a warning because it trusts their fake CA. Your client never gets to establish a secure connection with the real site (only their proxy does that), but you don't notice because it throws no warnings and you still get the secure lock icon.
That won't work on you or me (we don't use their CDs, except for preventing drink mugs from leaving rings on the desk), but it will work on 95% of the population.
Would be to seed the torrent as a full album bundle.
But include a small payment widget.
Not nagware but friendly like.
What's wrong with "here's a link to the official download torrent", followed by "if you want to send us some money because you like us or our music, use this <paypal/CC/etc> link".
They can still track how many people downloaded it through the tracker stats, and those who were going to pay any non-zero amount (rather than typing 0 in the box) are still going to. They could even require registration to get on the torrent if they wanted (hey - it works for private trackers right?). And, there wouldn't be any queue or high bandwidth costs.
If you've had a power hit at your retail store, once it's back up you don't want to wait half a day for an IT staff guy to drive or fly there and connect the console to type a password into it.
My understanding from reading a lot of the other comments here is that for this feature to work, you have to (at the least) log in while the system is already running and unlocked and enable this feature, so that the passphrase is not asked for at the next reboot.
As such, it's useless in a power failure situation. Either you knew in advance the power failure was going to happen (unlikely), or you haven't logged in prior to it to enable this setting for the next reboot. So the retail store in your example would still be hosed.
Seems like the only place where this would be useful is in a situation where you're saying "OK, I'm going to deliberately remotely reboot this computer now, and then connect back to it, so I don't want it to hang at the passphrase prompt (before any network stuff is loaded) leaving me unable to log in".
Useful for retail stores or anyone else in the case of power failure? No.
Useful for corporate customers needing to reboot a thousand workstations to apply updates? Maybe - assuming there is a central interface where they can enable the feature en-masse (oooh ... dangerous). Otherwise they're back to remoting to each one in turn and applying the setting. If there is the ability to enable it en-masse, what if by some accident the affected machines aren't all rebooted afterwards? The ones that weren't are left in an unsecure state. Does the setting wait for "next reboot" indefinitely, or does it apply a sensible/configurable timeout? (e.g. - you haven't rebooted the machine 6 hours after setting the flag, you probably forgot, so just disable it again). I don't know the answer to these questions, because I don't use the software... and more importantly, because the feature is not documented. I think that's the main complaint here, and it's a very legitimate one.