but notice how many times he says "possibly", "could", etc.? It's all speculation.
Indeed! I read both of TFA's, and both were poorly researched sensationalist fluff pieces written by paid shills with agendas. We need to wait for CNET, CNN, and Fox News to chime in to see which side is going to pay the media more to represent them in a positive light.
Every time we let ISIS know that their communications are not private, we lose a potential source of intel and drive them closer to actually using some proper form of communication.
What would you rather have, someone on twitter saying "Come Join ISIS" where it's easy for local/federal authorities to investigate, or something like freenet where there isn't a chance to intercept, let alone trace, the data. Don't you think that a good percent of the Pro-ISIS twitter accounts were honeypots?
I agree the judge should dismiss. I agree that new OS's are going to run slower on older hardware.
I agree with others that Apple needs to fix the downgrade issue. I agree with others that iOS9 performance and stability is unacceptable on my iPad 3.
Hopefully, this suit will at least get Apple to take notice and support their legacy users so that we feel like we're getting a good value.
As most of us have found out when going for PCI compliance, the best way to protect data is often not to possess it. If the keys are generated by the consumer, than it is the consumer that needs to hand over the keys, and not Apple. My understanding is that Apple cannot decrypt customer data, even if they wanted to, as only the customers possess the key(s) to do so.
So instead of a patent taking 4 years to grant, it's now going to take 4 years and 30 days? Oh the humanity! This is a deal breaker and changes everything.
But don't you realize that leaving a port open on her home server makes her history's greatest monster? Clearly, you're not paying attention to the GOP debates.
Yeah, the moment I read the article I checked all of the servers in our enterprise for these nefarious "open ports". I needed to shut down 5000 servers because our tomcat servers have port 8080 wide open! Our web servers have port 443 open! I must have already been hacked because I lost connectivity when I closed down port 22 on all servers.
Why did you even mention "user to authorize the installation" even mentioned? That has not been an acceptable excuse for those platforms, why change now?
The user needs to authorize the installation (of an enterprise certificate into the iOS devices certificate trust store). I mention it because the article mentions it, and it is pretty much counter to what the Slashdot summary implies.
It almost looks like everyone's so hot for a real exploit that these 'rogue certified applications' and their developers are getting overblown.
Ultimately, the solution is al the same. Apple adds the rogue cert(s) to their CRL. Done.
Doesn't matter. If there is a security flaw where a certificate has been compromised then the only correct response it revoke the certificate. Yes this could be highly inconvenient but the danger of not revoking the certificate and disabling the vulnerability is worse. A certificate that isn't revoked when necessary is worse than useless. If the danger does not justify a certificate then what is the point of issuing one in the first place?
Indeed. In this case, it appears that the owner of the certificate (Yingmob Interaction Technology Co) is the author of the malware. Apple will likely revoke the certificate, revoke their developer credentials, blacklist/flag the developers that are on the corporate account, and seek civil penalties.
If the cert belonged to a big enterprise company like HP/IBM, you're still absolutely correct. Apple would revoke the certificate, and HP/IBM would thank them and apologize for their ineptitude at keeping their PrivKey safe.
I wholeheartedly agree with the certificate revocation solution. I would take it a step further and charge penalties to the enterprises whose compromised certificate was used to sign the app. Make Beijing Yingmob Interaction Technology Co., Ltd. Pay for the mess.
Also note that iOS 9 requires the user to authorize the installation.
It's not improbably that the issue (for drivers/owners) will be resolved by a software update that prioritizes emissions compliance at the cost of horsepower.
Does anyone have a link that describes how the testing operation works or some technical details on what is being tested and how?
Like the saying goes....
Fool me once, shame on you. Fool me a dozen times over the course of two decades, shame on me. I fully expect to be nickel'ed and dime'ed over features like clock-speed, GPU, video transcoding, and thermal management until well after the product's lifecycle.
Summary: Joseph Gonzalez, co-founder of Dato, is miffed that his product is unable to exploit Apple's user base an it is hurting their revenue stream. He whines about it to Reuters and they write a sensationalist article. The end.
1: boot a linux live image (CD, Thumbdrive, PXE)
2: mkdir/mnt/backup
3: mount//someserver/someshare/mnt/backup
Copy the raw device to the network share. We'll use ddrescue rather than DD so that it finishes even if the HDD has issues. You'll also get a nice log of the issues.
4: ddrescue/dev/sda/mnt/backup/someName-`date +%Y-%m-%d`.img/mnt/backup/someName-`date +%Y-%m-%d`.log
Wipe the disk
5: dd if=/dev/zero of=/dev/sda bs=1M
If you would like to see the data in the image
6: fdisk -l/mnt/backup/someName-someDate.img --- Note the sector size and start. Multiply these together. Example is 512(size)x2048(start)=1048576
Mount the raw image and take a peek
7: mkdir/mnt/raw
8: mount -o ro,loop,offset=1048576/mnt/backup/someName-someDate.img/mnt/raw
9: ls -l/mnt/raw
Restore the data to the drive
10: dd if=/mnt/backup/someName-someDate.img of=/dev/sda bs=1M
You can then compress the image file to save some space on the server.
Highly skilled personnel are employed in these companies and many have advanced computer science degrees, including PhDs. And because of their complexity, many programs are written using software engineering disciplines.
This gent has obviously never worked in the mobile industry.
Congratulations. You are now wiser than you were prior to accepting the position which you now fill. The next time you interview for a company, which sounds like it may be soon given your current situation, you will now possess an assorted list of queries when the interviewer asks, "Do you have any questions regarding the position or the company?".
I'm sorry, but after reading the article, it appears that they will be charging money for information that should be, and probably already is, available to the general public.
I would be interested to know why people would pay money to change the geography of their Internet servers when they could simply switch to a darknet. I'd recommend trying Freenet for a while and see if you have any complaints besides it being slower than the observable Internet.
I'm genuinely interested in why more people do not take this approach.
The rage comes in when you're already working at 95% capacity, and something simple turns into the mother of all clusterfuck-abortions. For example: You "renew" a Verisign class3 cert, only to find out that the "renewed" cert is in fact an entirely "new" cert because Verisign changed out its intermediate CA. So a drop in file replacement becomes:
Adding the new intermediate and hash symlink to the apache truststore
Adding a FileChain directive to all affected vhosts
Notifying all of your customers that they need to update their truststores in the next 30 days if they wish to continue doing business with you
Realizing that you're going to have to repeat this maintenance for all 400 Verisign certs for the next year (because business partners require yearly renewals)
Having to go through your companies bullshit change-management process, rather than using the rubber stamp renewal template that you spent 2 days creating.
And worst of all, trying to explain all of this to your manager, who has no understanding of the concepts "encryption" and "trust".
5-10 minutes (renew, propagate file, roll apache servers, update asset management) becomes a Full time job for one year.
The majority of which could have been avoided if they had followed your advice "7 years ago" and shelled out for a wildcard cert.
Write people an extremely hefty fine if they are involved in an accident while texting. Make it easier to convict them on involuntary manslaughter charges if they were texting at the time they hit a pedestrian. If people can safely text, great. If not, punish them when they cause problems.
This is the same as any other distraction while driving - you can think about other things than the road while driving legally (work problems, family problems, etc). If you can still safely drive, great. If not, you pay the piper when you hurt someone else.
You've hit several of the nails on the head, but seem to have missed a couple.
We already have laws that charge fines for "Driving while Distracted" and "Dangerous Driving". If an officer sees that you are driving while distracted, and it appears that you are a danger to yourself and/or others, he can issue a ticket.
I want to take a moment to appeal to your sense of justice and remove the word "punishment" from consideration. You can't punish an adult human. It just doesn't work. What does work is restitution (for the victim) and rehabilitation (for the criminal).
When you get caught driving distracted, you get a ticket. Get another, you'll have the insurance increase and defensive driving course. Rack up enough and your public driving privileges get revoked. The existing laws are fully sufficient. No need for additional (unnecessary) bans on tech.
Hi there,
The youtube video contains the qualifier "2: Both cars were moving at 40mph for a combined speed of 80mph". This is not correct. Both cars were moving at 40mph for a combined speed of 40mph. Whether you're hitting an immovable brick wall at 40mph, or an object of equal mass and velocity moving at the opposite direction, you're still accelerating from 40mph to 0mph (a 40mph crash).
Slashdot Mirror
but notice how many times he says "possibly", "could", etc.? It's all speculation.
Indeed! I read both of TFA's, and both were poorly researched sensationalist fluff pieces written by paid shills with agendas. We need to wait for CNET, CNN, and Fox News to chime in to see which side is going to pay the media more to represent them in a positive light.
Every time we let ISIS know that their communications are not private, we lose a potential source of intel and drive them closer to actually using some proper form of communication.
/the sound of me golf clapping
What would you rather have, someone on twitter saying "Come Join ISIS" where it's easy for local/federal authorities to investigate, or something like freenet where there isn't a chance to intercept, let alone trace, the data. Don't you think that a good percent of the Pro-ISIS twitter accounts were honeypots?
I agree the judge should dismiss. I agree that new OS's are going to run slower on older hardware.
I agree with others that Apple needs to fix the downgrade issue. I agree with others that iOS9 performance and stability is unacceptable on my iPad 3.
Hopefully, this suit will at least get Apple to take notice and support their legacy users so that we feel like we're getting a good value.
then Apple will comply with the laws of China.
As most of us have found out when going for PCI compliance, the best way to protect data is often not to possess it. If the keys are generated by the consumer, than it is the consumer that needs to hand over the keys, and not Apple. My understanding is that Apple cannot decrypt customer data, even if they wanted to, as only the customers possess the key(s) to do so.
So instead of a patent taking 4 years to grant, it's now going to take 4 years and 30 days? Oh the humanity! This is a deal breaker and changes everything.
But don't you realize that leaving a port open on her home server makes her history's greatest monster? Clearly, you're not paying attention to the GOP debates.
Yeah, the moment I read the article I checked all of the servers in our enterprise for these nefarious "open ports". I needed to shut down 5000 servers because our tomcat servers have port 8080 wide open! Our web servers have port 443 open! I must have already been hacked because I lost connectivity when I closed down port 22 on all servers.
Common sense, the human brain? Reform of policing so citizens actually trust the police?
Indeed. I was going to say social grace, situational awareness, training, and experience. I also support the notion of a reformation.
Why did you even mention "user to authorize the installation" even mentioned? That has not been an acceptable excuse for those platforms, why change now?
The user needs to authorize the installation (of an enterprise certificate into the iOS devices certificate trust store). I mention it because the article mentions it, and it is pretty much counter to what the Slashdot summary implies.
It almost looks like everyone's so hot for a real exploit that these 'rogue certified applications' and their developers are getting overblown.
Ultimately, the solution is al the same. Apple adds the rogue cert(s) to their CRL. Done.
Doesn't matter. If there is a security flaw where a certificate has been compromised then the only correct response it revoke the certificate. Yes this could be highly inconvenient but the danger of not revoking the certificate and disabling the vulnerability is worse. A certificate that isn't revoked when necessary is worse than useless. If the danger does not justify a certificate then what is the point of issuing one in the first place?
Indeed. In this case, it appears that the owner of the certificate (Yingmob Interaction Technology Co) is the author of the malware. Apple will likely revoke the certificate, revoke their developer credentials, blacklist/flag the developers that are on the corporate account, and seek civil penalties.
If the cert belonged to a big enterprise company like HP/IBM, you're still absolutely correct. Apple would revoke the certificate, and HP/IBM would thank them and apologize for their ineptitude at keeping their PrivKey safe.
I wholeheartedly agree with the certificate revocation solution. I would take it a step further and charge penalties to the enterprises whose compromised certificate was used to sign the app. Make Beijing Yingmob Interaction Technology Co., Ltd. Pay for the mess.
Also note that iOS 9 requires the user to authorize the installation.
The summary mentioned GM, which I believe implied both Pontiac and Saturn brands because they were GM subsidiaries.
It's not improbably that the issue (for drivers/owners) will be resolved by a software update that prioritizes emissions compliance at the cost of horsepower.
Does anyone have a link that describes how the testing operation works or some technical details on what is being tested and how?
Like the saying goes.... Fool me once, shame on you. Fool me a dozen times over the course of two decades, shame on me. I fully expect to be nickel'ed and dime'ed over features like clock-speed, GPU, video transcoding, and thermal management until well after the product's lifecycle.
Do you want to be responsible for that? You better require everyone entering the Library to ask you for the book, so that we can track it.
We had better start requiring registration for callers 911 as well, since the police are now being used as a weapon via swatting attacks.
Summary: Joseph Gonzalez, co-founder of Dato, is miffed that his product is unable to exploit Apple's user base an it is hurting their revenue stream. He whines about it to Reuters and they write a sensationalist article. The end.
Freenet:
https://freenetproject.org/
Freenet freenet, freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet free-net freenet freenet freenet freenet freenet. Freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet. Freenet freenet freenet freenet freenet freenet freenet freenet freenet freenet free-net freenet.
Freenet, Freenet Freenet
Your comment violated the "postercomment" compression filter. Try less whitespace and/or less repetition.
You can script as much of this as you want.
/mnt/backup //someserver/someshare /mnt/backup
/dev/sda /mnt/backup/someName-`date +%Y-%m-%d`.img /mnt/backup/someName-`date +%Y-%m-%d`.log
/mnt/backup/someName-someDate.img --- Note the sector size and start. Multiply these together. Example is 512(size)x2048(start)=1048576
/mnt/raw /mnt/backup/someName-someDate.img /mnt/raw /mnt/raw
1: boot a linux live image (CD, Thumbdrive, PXE)
2: mkdir
3: mount
Copy the raw device to the network share. We'll use ddrescue rather than DD so that it finishes even if the HDD has issues. You'll also get a nice log of the issues.
4: ddrescue
Wipe the disk
5: dd if=/dev/zero of=/dev/sda bs=1M
If you would like to see the data in the image
6: fdisk -l
Mount the raw image and take a peek
7: mkdir
8: mount -o ro,loop,offset=1048576
9: ls -l
Restore the data to the drive
10: dd if=/mnt/backup/someName-someDate.img of=/dev/sda bs=1M
You can then compress the image file to save some space on the server.
Highly skilled personnel are employed in these companies and many have advanced computer science degrees, including PhDs. And because of their complexity, many programs are written using software engineering disciplines.
This gent has obviously never worked in the mobile industry.
Congratulations. You are now wiser than you were prior to accepting the position which you now fill. The next time you interview for a company, which sounds like it may be soon given your current situation, you will now possess an assorted list of queries when the interviewer asks, "Do you have any questions regarding the position or the company?".
I'm sorry, but after reading the article, it appears that they will be charging money for information that should be, and probably already is, available to the general public.
I call shenanigans!
I would be interested to know why people would pay money to change the geography of their Internet servers when they could simply switch to a darknet. I'd recommend trying Freenet for a while and see if you have any complaints besides it being slower than the observable Internet.
I'm genuinely interested in why more people do not take this approach.
The rage comes in when you're already working at 95% capacity, and something simple turns into the mother of all clusterfuck-abortions. For example: You "renew" a Verisign class3 cert, only to find out that the "renewed" cert is in fact an entirely "new" cert because Verisign changed out its intermediate CA. So a drop in file replacement becomes:
Adding the new intermediate and hash symlink to the apache truststore
Adding a FileChain directive to all affected vhosts
Notifying all of your customers that they need to update their truststores in the next 30 days if they wish to continue doing business with you
Realizing that you're going to have to repeat this maintenance for all 400 Verisign certs for the next year (because business partners require yearly renewals)
Having to go through your companies bullshit change-management process, rather than using the rubber stamp renewal template that you spent 2 days creating.
And worst of all, trying to explain all of this to your manager, who has no understanding of the concepts "encryption" and "trust".
5-10 minutes (renew, propagate file, roll apache servers, update asset management) becomes a Full time job for one year.
The majority of which could have been avoided if they had followed your advice "7 years ago" and shelled out for a wildcard cert.
Write people an extremely hefty fine if they are involved in an accident while texting. Make it easier to convict them on involuntary manslaughter charges if they were texting at the time they hit a pedestrian. If people can safely text, great. If not, punish them when they cause problems. This is the same as any other distraction while driving - you can think about other things than the road while driving legally (work problems, family problems, etc). If you can still safely drive, great. If not, you pay the piper when you hurt someone else.
You've hit several of the nails on the head, but seem to have missed a couple.
We already have laws that charge fines for "Driving while Distracted" and "Dangerous Driving". If an officer sees that you are driving while distracted, and it appears that you are a danger to yourself and/or others, he can issue a ticket.
I want to take a moment to appeal to your sense of justice and remove the word "punishment" from consideration. You can't punish an adult human. It just doesn't work. What does work is restitution (for the victim) and rehabilitation (for the criminal).
When you get caught driving distracted, you get a ticket. Get another, you'll have the insurance increase and defensive driving course. Rack up enough and your public driving privileges get revoked. The existing laws are fully sufficient. No need for additional (unnecessary) bans on tech.
Hi there, The youtube video contains the qualifier "2: Both cars were moving at 40mph for a combined speed of 80mph". This is not correct. Both cars were moving at 40mph for a combined speed of 40mph. Whether you're hitting an immovable brick wall at 40mph, or an object of equal mass and velocity moving at the opposite direction, you're still accelerating from 40mph to 0mph (a 40mph crash).
BBH
From TFA:
They also destroyed three decades worth of handwritten research notes by a NASA scientist that had been locked in the safe.
Nasa locked a research scientist in the safe for 30 years?