Slashdot Mirror


User: bluefoxlucid

bluefoxlucid's activity in the archive.

Stories
0
Comments
13,737
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 13,737

  1. Re:It's e-mail, it's never going to be 'secure' on Outgoing White House Emails Not Protected by Verification System (axios.com) · · Score: 1

    Grey, for non-signed, no-signature-known.

    Orange is for when you have no way to verify the signature (including no signature but known key), and Red when it's incorrect (e.g. different key than expected); and the e-mail client itself can fetch key and yellow you for an unknown/unsigned key. Green for soft verification (you send your public key encrypted/HMAC, they send back an encrypted/HMAC public key for themselves, and continuous exchange shows no anomalies); blue for hard verification (public CA).

    Initially, everything is grey. Your friends will go green. Corporations will go blue.

    The real user training problem is with the Yellow-to-Green transition and the Blue marker here. Marketing e-mails will all be Blue under the scheme I described. Non-public-CA e-mails from anyone who generates a signature will show up Yellow, and then your client can perform a likely verification to identify that the key is correct and go Green.

    That only means you can trust the sender to be who you think they are.

    It doesn't mean the message is safe.

    In other words: all these Green or Blue e-mails can come from spammers and phishers. You can absolutely verify they're not spoofing your boss, but you can't verify that they're not trying to scam you.

    I'll think up a more-complicated, less-technical scheme later, such as one that reserves the Blue level and a special decoration for long-term trust (i.e. you have a lot of conversations with a person, so they're a valid acquaintance and not just some marketing firm or 401 scammer). That goes beyond "was this message sent by the purported sender?" and into "Do I personally know and trust this person?" It's a different problem.

  2. metal detectors and the "heavily hardened" facility have stopped 100% of the mass shootings.

    So, there was ONE shooting in a populated, soft target several meters from the hard target, ever. These soft targets are directly adjacent to all locations with hard airport targets. Those hardening measures stop all of the mass shootings.

    That being... all zero of them?

    mass shootings require gun(s). Without guns, there are no mass shootings.

    And so the solution is to make sure the guns are around the crowd just outside, not the crowd that has managed to get inside already?

  3. Re:What ever. on Trump Says He Wants Skilled Migrants But Creates New Hurdles (apnews.com) · · Score: 1

    Implicit in the idea of uniform naturalization and control and disposition of federal lands, and in conducting international relations (also a power of Congress) and having a military is the idea that you have a border and you guard it.

    Uh, no. Naturalization is citizenship. You're not "naturalized" if you have a green card; you're authorized to be present. Ask CIS:

    Naturalization is the process by which U.S. citizenship is granted to a foreign citizen or national after he or she fulfills the requirements established by Congress in the Immigration and Nationality Act (INA).

    Emphasis mine. Requirements for naturalization:

    You May Qualify for Naturalization if:

    You have been a permanent resident for at least 5 years and meet all other eligibility requirements, please visit our Path to Citizenship page for more information.

    Permanent resident (green card: you can stay here forever) but you're not naturalized.

    Green Cards are issued as a stepping-stone to naturalization and are part of naturalization laws passed by Congress under Article I, Section 8, Clause 4.

    You mean the Immigration and Naturalization Act?

    If Congress had no authority to make naturalization law, it would not have the authority to make laws about issuing green cards or work visas, nor would it have the authority to pass laws directing the executive to kick people out for not having those documents.

    Actually, the laws prohibit people from giving immigrants jobs and housing (affecting commerce), and give the Executive the authority to remove dangerous unauthorized immigrants.

    Let's ask a lawyer, since I'm just making shit up here and really have nfc what I'm talking about.

    The Supreme Court’s basis for action is clear when the area regulated is naturalization. Article 1, 8, clause 4, of the United States Constitution specifically grants Congress the power to establish a "uniform Rule of Naturalization." By expressly allocating this power to Congress, the Constitution prevents the confusion that would result if individual states could bestow citizenship. The Constitution does not, however, explicitly provide that the power to deny admission or remove non-citizens rests with the federal government as opposed to state governments. Hence, in the early immigration cases the Supreme Court faced the problem of identifying the source of the federal government's exclusive and plenary power over immigration. Later cases found the plenary power to be an inherent sovereign power.

    Inherent sovereign power...makes sense.

    In the earliest cases, the Court looked to the federal power over foreign commerce. The Commerce Clause in Article I, 8, clause 3, of the United States Constitution provides Congress with the power "to regulate Commerce with foreign Nations, and among the several States." The Supreme Court in the Passenger Cases (Sup.Ct.1849) invoked the Commerce Clause to ban the levy of fees upon foreigners wishing to disembark at state ports. The Court invalidated state immigration fees even though Congress had yet to implement any relevant federal regulations.

    Interesting. State fees to control immigration are unconstitutional.

    The Naturalization Clause in Article I, 8, clause 4, has served as an argument for federal control over immigration. The dissent in the Passenger Cases rejected this argument. Passenger Cases (Sup.Ct.1849). As mentioned earlier, the Naturalization Clause's granting of power to "establish an uniform Rule of Naturalization" concerns decisions about citizenship rather than immigration generally.

    Specifically

  4. Is this another invasive anti-privacy act, or does this one have all the correct and proper controls to protect the American people?

  5. All of them?

    On the one hand, there's no evidence that metal detectors have reduced the number of mass shootings in schools that have them.

    On the other, I work in a building where you can kick the all-glass front door in and come through with an AR-15 pretty easily, although there are easier ways in without raising the alarm until you start shooting. Hasn't happened in 40 years, although somebody showed up with a (fake) bomb once. This despite protesters and several crazy people routinely showing up here and a large amount of bad public sentiment.

    You could also shoot up the local super market, college, or 7-11. Those don't have metal detectors and armed guards.

    So all of zero?

    Of course we could say, "Hey, someone gets shot somewhere in America every day! That means every day, we need to be on MAXIMUM ALERT for an active shooter IN OUR OFFICE! We must install magnetometers and hire a paramilitary security force to cavity search our employees every single morning!" That would be stupid, and wouldn't accomplish anything except to annoy people.

    Here's one for you: cars catch fire sometimes. Does your car have a fuel pump kill switch and built-in automatic fire extinguishers?

  6. Re:This seems entirely backwards..... on Online Gaming Could Be Stalled by Net Neutrality Repeal, ESA Tells Court (arstechnica.com) · · Score: 1, Insightful

    Actually, I already have a solution for that. I suggested that we should allow prioritization wherein no party pays (not consumer, not provider), wherein the prioritization is standard (not a "package" added to a service or an enhanced service level or whatnot), and wherein the prioritization does not impact any other service or user (when there's congestion--more demand than resource--prioritization starts falling back to baseline, becoming the first services to be degraded).

    I hadn't considered latency, though; only throughput and data metering. The ESA's argument has brought up an important concern.

  7. The suicide line is bait. US has a larger proportion of homicides than other nations, but a huge amount of suicides. Take the suicides out of the equation and the number is a lot smaller... take it out of the equation for Canada and Switzerland and America's numbers are enormous. Switzerland actually is at parity with the US for firearms deaths per 100,000--a larger portion of theirs come from suicides. Canada has fewer total firearms deaths per 100,000 than either.

    People are trying mostly to not look at the problem, or to look like they're looking at the problem.

  8. Yes, but how often does it happen at a given location? How often does it happen at Google?

    For a given heavily-hardened school or airport or corporate office, how many active shooter attacks do those metal detectors and armed security forces actually stop?

  9. Re:Where? What? on Scientists Harvest First Vegetables in Antarctic Greenhouse (apnews.com) · · Score: 1

    Radish greens are edible. I wonder if they ate them.

  10. Re:How did they pick the vegetables? on Scientists Harvest First Vegetables in Antarctic Greenhouse (apnews.com) · · Score: 1

    They're getting paid a whole lot, so they'll do just about anything.

  11. Re:Who trusts FB as an authentication provider? on Facebook's Privacy Fixes Have Broken Tinder (theverge.com) · · Score: 1

    I should totally make shadow profiles illegal, specifically. If you have a sign-up service and a person doesn't sign up, you can't aggregate data about them to an identity and act on it (transfer, sell, aggregate) except to allow said person to initiate a contact in which they would like to see what data you are able to collect about them from data they are allowed to collect and retain about people who have signed up.

    Yes that's a weird exception. If I have a bunch of stuff about you spread out and I just "don't look at it", I can still whip up a specific profile about you in 30 seconds. If it's data about other people--people keep saying they're hanging out with you, they go to your house a lot, they show up in photos with you--I can't scrub that without censoring those people or not having data about their movements (which means not having data about anyone's movements). If I'm allowed to have data about people at all, I can infer a lot about you, and pretending I can't only damages transparency.

    Thus it should be illegal for me to share the profile, aggregate the profile into data, or use the profile for anything other than to allow you to see what I can figure out about you on a whim (or maybe to fill in your profile if you create one and instruct me to do so).

    Note that this such data should not ever contain data sourced from you--such as an identification of your presence in an area (e.g. your friend posted a picture at a bar with you, sure; we identified your phone there because you browsed a Wordpress site with Facebook comments and were able to correlate the browser with you personally and the IP to the bar, NO. BAD).

  12. Re:LOL ... Jesus, really on Facebook's Privacy Fixes Have Broken Tinder (theverge.com) · · Score: 1

    Wait until Tinder and OKC realize that FOSTA makes them criminally-liable if anyone sets their age to like 20 but is really 14, or is a prostitute being pushed by a pimp.

    Wait until Facebook realizes it, too, is liable.

  13. Re:Day of reckoning on Facebook's Privacy Fixes Have Broken Tinder (theverge.com) · · Score: 1

    Can you tell me if he's likely to donate, or does that cost an extra 6 cents per append?

  14. I don't care for all this; it happens now and then, not every day. Eventually we're going to have to go through metal detectors at every super market and library and other place we enter.

    Why the show of fear? As soon as something happens once, people say, "Something must be done!" You've been a soft target for decades; you can be a soft target for a few decades longer; you're not going to have 15 more active shooters this year by staying a soft target.

  15. Re:Played correctly, the US has an advantage on US' Proposed China Tariffs Would Target Robotics, Satellites (engadget.com) · · Score: 1

    As to trade restrictions hurting the poor, not always since it can have economic benefits. Though as I said, it is totally possible for it to be net negative.

    It is USUALLY net-negative.

    More-expensive products ALWAYS hurt the poor. That's an inarguable fact. The question is whether a trade situation causes economic growth (by population growth, not individual wealth) or not. In other words: are people (per-capita) wealthier, or is the nation (economic power, military might) wealthier?

    the US had a tariff based tax policy prior to WW1. And that period of US economic activity was the most productive and the statistically benefited the poorest in US society more than at any other period of US economic development

    Your parents also got new, higher-paying jobs while your sister was in 7th grade, so having a 7th grader is empirically beneficial to the household income.

    Why has our economy cycled between highly-productive and deep in recession without changes in our trade situation? There are a lot of factors here and it seems you're looking at a giant, complex situation and cherry-picking a factor and data. That's statistical confounding.

    As to "fair trade" this is also a marketing term and has no clearly defined meaning

    Fair Trade is a trade process in which trade agreements include environmental considerations, working conditions, and prices which reflect those of trade between developed nations, even when trading with undeveloped and impoverished nations from whom we could extract a much-lower rate.

  16. Re:What ever. on Trump Says He Wants Skilled Migrants But Creates New Hurdles (apnews.com) · · Score: 1

    Yes, that's the text of the Constitution. It says that Congress has the power to establish a uniform rule determining how people are conferred citizenship. You have to take the impact of migration--simple residence of non-citizens, and their consumption and labor--as a factor in commerce to find authority of Congress to regulate immigration.

    You didn't think a person with a green card was naturalized, did you?

  17. Re:You're a candidate? on US' Proposed China Tariffs Would Target Robotics, Satellites (engadget.com) · · Score: 1

    I've been all over the board with everything from flatly ending poverty to criminal justice reform to a new bill of rights as a guiding principle.

    Good on you, we need more smart people in congress!

    Brute force: I have no friends. No sense of social need, so I don't get lonely or seek relationships. I ended up running for office because I'm tired of seeing beggars everywhere--it's painful to watch. (That's also how I ended up with a cat.)

    Please be aware that most economics is based on measures of corporate profits that ignores the human condition.

    Economics is an odd subject. The root of economics is that people economize: they seek the most ends for the least means. That means greed, financial sense, and rational behaviors are all the same thing. I figured out a while back that things don't have value; instead, people place a valuation on things: value is a property of your imagination. Things have a cost and a price--and the cost is generally abstracted by money, but ultimately must balance to a trade of labor time, so economics is rooted in the laws of physics.

    The measure of economics is, thus, somewhat subjective: we set goals and then attempt to identify if we are objectively supporting those goals. In general, everyone is actually on the right page: the maximization of profits is the maximization of wealth and the minimization of human suffering.

    The problem is in the way people measure profits and approach that maximization. Business profits are only a matter of cash flowing to one place; the total economy has a GDP (production), a GNI (total income--individual and corporate profits), and per-capita measurements of these (how much is produced/earned per person). GDP-per-Capita and GNI-per-Capita are roughly the same thing, but distinct.

    The per-capita GNI and GDP are interesting because every new person is a producer and consumer, and is tax revenue and service cost. The Government has to provide welfare, roads, police, schools, and so forth; the GNI-per-Capita tells you how many dollars you'll get by taxing a percentage of all income, and the GDP-per-Capita attempts to describe how much stuff you're able to produce per person. I generally consider these things "wealth".

    Others like to look at our national economy, our GDP, and our GNI, which describe our strength in the world as an economic superpower. From that perspective, maximizing our national economic production is the goal. That means a maximum population with a lot of poor, struggling workers managed by bare-minimum welfare.

    Calling a nation "wealthy" because it has, as a nation-state, the most total production and global economic clout has obvious flaws. When you hear people talk about trillions of GDP, that's this kind of wealth. When you hear people talk about poor standards of living, that's the effect of low per-capita measures of wealth. Poor nations tend to be small, low-population, or undeveloped--or all of the above--so they have neither national economic power nor high standards-of-living.

    If you want a rough guide to all this, just look from 10 inches and 10 miles: a poor per-capita nation has a median (or wealthy) family clothed in rags, struggling to eat in their grass hut; a wealthy GDP nation has a powerful military and can quite possibly hold its own in the role of Germany in WW3, even if it's full of farmers living in grass huts. High per-capita wealth measures get you Norway.

    please consider that the welfare of the people is paramount to the stability of the country

    And this is the second problem.

    Hayeki

  18. Re:It's e-mail, it's never going to be 'secure' on Outgoing White House Emails Not Protected by Verification System (axios.com) · · Score: 1

    Notice how the mail client above describes that the key isn't even on the device and the end users never even know the key (i.e. the mail client doesn't have the capacity to decrypt; it's on the hardware device)?

    The mail client would tell you if it's signed properly. I also overbuilt the HMAC there: you'd only generate one HMAC, not one per user (because the HMAC will use the session key, and there's only one). So "HMAC", not "HMACs". My bad.

    Just look for the green light on your e-mail.

  19. Re:It's e-mail, it's never going to be 'secure' on Outgoing White House Emails Not Protected by Verification System (axios.com) · · Score: 1

    E-mail could use TLS between client/server and between relay servers. Authentication could use FIDO U2F for client-to-server. We could also rework the FIDO standard--and the hardware devices which use them--to include OpenPGP signing and encryption, and add Curve25519 to FIDO U2F and OpenPGP as the key exchange (i.e. your PGP key is Curve25519, instead of RSA).

    The mail client would send each message to the FIDO device for signing using SHA-256 (if not encrypted) or a key-hashed message authentication code based on SHA-256 (if encrypted). Encryption would also occur to the target parties via the FIDO device, using AES-256 (the pubic key for each party encrypts a separate copy of this key) and CFB mode for the message (semi-parallelizable).

    This scheme would actually never reveal the session key to any party using the FIDO/OpenPGP device. The sender encrypts the message to self, generating the session key on the FIDO device; however, the sender's private key is on the FIDO device, so the sender can't read the session key. Thus, to read the message, the sender must send the message down to the FIDO device for decryption. The device thus would decrypt the session key, read the message, validate the HMAC signature, and return the plaintext of the message and the validation results.

    It is also possible to send the message down with "Also Encrypt To", so the FIDO/OpenPGP device would decrypt the session key, make an encrypted copy with the public key of an additional recipient, re-HMAC the whole thing, and send the result back. Note that because the session keys cannot be part of the symmetric-encrypted body or the signature (the hash is generated by signing, thus its value is unknown during signing), you can actually add recipients by just returning the new block of HMACs and encrypted session keys (you'll generate these encrypted keys before the hash, and they're independent of the hash, so you can include them in the signature), and not return a re-encrypted message.

    This allows each user to use a hardware device paired with a mail client to authenticate themselves (private key, never leaked) and the message sent, as well as to make the message a secret to everybody but intended recipients and malware able to read the decrypted message. Note that you decrypt each message as you open it, so a bulk store of decrypted messages is not available. The security-conscious could individually encrypt each message they receive (automatically), thus avoiding a bulk store of plaintext messages in any case.

    Mail server support is neither required nor useful.

  20. Re:Nope. Linear versus curved on US' Proposed China Tariffs Would Target Robotics, Satellites (engadget.com) · · Score: 2

    The problem is that "one person has to find a new job" isn't free. It puts stress on the job market, driving down salaries, and incrementally increases the chances of someone turning to crime and welfare.

    Actually, the aggregate of making the widget $0.02 cheaper would add up to $40,000 of savings for consumers after 2 million units per year. Essentially, that IS your savings: the cost of the jobs you eliminate.

    Jobs don't come from employer charity; the employer has a need for a unit of labor to keep up with consumer demand. Likewise, price competition sets prices. This means that savings to consumers turn over to become job demand.

    The question in creating a job here versus in China is largely whether you're concentrating consumer spending into fewer American hands. The cost of a widget is its manufacturing, shipping, retail, and all other operations and infrastructure support. Reduce the load on that operations and infrastructure support by selling (and shipping) fewer widgets and you lose those jobs. You can do so by concentrating the wealth of all of those into one hand.

    So, for example, if the aggregate cost of a bunch of widget purchasing is $10,000 of Chinese labor and $20,000 of domestic activity, concentrating that purchase into a $30,000 domestic worker's hands takes away from $20,000 of other domestic activity. That means the retailer, the infrastructure efforts, and the shipping all become one guy's wages.

    When the cost of labor is sufficiently similar (e.g. the Chinese labor costs $28,000 and the domestic labor costs $30,000), you actually might come out ahead by producing domestically: people will be more-poor, but the domestic laborer is doing his local spending at local franchises and small businesses and whatnot, diffusing into local wages and local profits, rather than buying at the Chinese noodle shop in China. When the cost of labor is heavy on your end (e.g. $10,000 Chinese labor vs. $30,000 domestic labor), you have a factory worker who is wealthier than the Chinese factory worker, and everyone else suddenly a lot poorer--and a slowing of your economy, and job loss.

    For each case of producing something cheaper abroad, there's a corresponding *rise* in expenses associated by having an extra person out of work.

    It's a time function, as well.

    The argument that we can have unemployment must necessarily suppose that our workforce can't grow infinitely: we don't have employment capacity to supply infinite jobs. Eventually, our economy hits a carry capacity. This happens because technology scales linearly up to a maximum economy of scale, after which each additional unit produced of a maximally-scaled good costs more than one additional unit of labor.

    The simple example is food. You get an amount of yield with modern farming technology when growing food on good land. Run low on good land and you can still grow; you'll invest more labor and get less yield out of poor soil with bad weather. As you can see, we have the capacity to raise the amount of food produced without increasing the cost per unit of food until we exceed a maximum capacity, and then food starts getting more-expensive.

    That's general across all production: an input becomes scarce, and we can brute force our way around that. The generic case is, of course, that you simply don't have the labor to produce it, so you need more labor, more people, and more food and water--which means going from nice, cheap food and water to expensive vertical farming and desalinization just to support the labor force of computer programmers and pop stars.

    In practice, that never happens. As you suggested, there are wage pressures, and a labor shortage will tend to produce rising wages (wage competition). That produces rising prices as well.

    Okay, who cares?

    We bring nearly 300,000 immigrant workers into this country every year. Aside from the constant

  21. Re:Played correctly, the US has an advantage on US' Proposed China Tariffs Would Target Robotics, Satellites (engadget.com) · · Score: 1

    Making things more-expensive by producing them domestically when it's cheaper to do so abroad always hurts the poor and middle-class by reducing their purchasing power (making them more-poor).

    When the differential is sufficiently large (this is pretty trivial to achieve: it's not even a viable living wage in the US, as of 2006; although better technology is narrowing the gap by reducing the labor-hours invested in manufacturing et al), you also suffer a net-loss in jobs by cutting off imports (yep!). Any losses or gains are temporary, though, and buff themselves out in a few years (if not only several months) to normalize to your nation's population and labor force carry capacity.

    Generally, that means free trade is optimal; however, sudden trade shifts are severely painful, and so it may be wise to create barriers to slow the transition. All trade and technology shifts tend to cause transitional unemployment, so you need a social safety net which adequately protects the worker whose job is lost until such time as they are brought into new employment. That can be months, unless you screw up and put yourself in an economic recession (I'm trying to end all recessions forever).

    There is something to be said for fair trade in its capacity to build up foreign, poor nations. Fair trade accelerates their growth and then transitions to free trade--although the normal process is free trade, some growth, enough power to demand fair trade, and then fair trade. Once your nation is at a level of wealth wherein the provisions of fair trade are just what would happen anyway, it's basically free trade.

  22. Re:Just remember - there is no trade war on US' Proposed China Tariffs Would Target Robotics, Satellites (engadget.com) · · Score: 2

    Remember as well that imports make your citizens wealthier (and, if the differential is large enough, creates a net-increase in domestic jobs); exports draw money in (creates jobs directly, and gets cash for productivity); and your customers can move to another exporter if they find it cheaper elsewhere (e.g. buy from Indonesia instead of China), so exports are lucrative but also put you in the submissive position of the power dynamic and risk propping your economy up on a basis that may vanish at any time.

    Trade deficit doesn't mean "becoming poorer"; it means we're becoming richer by two mechanisms, and one is in greater force than the other. It's like saying you have access to food and shelter, but you have more shelter than food and so you must be losing and you need to cut back on shelter and have less of a house.

  23. We're going to build a wall and Russia is going to crash into it.

  24. Re:What ever. on Trump Says He Wants Skilled Migrants But Creates New Hurdles (apnews.com) · · Score: 1

    Points deducted for identifying the problem to ten decimal places but then asserting the solution lies off in the clouds and "needs research" without actually proposing something resembling a specific solution

    I do that now and then. I don't like taking action when there is data lacking. That means I tend to put the brakes on when people are just flailing about, but also tend to push for real examination of a problem before we bring a solution.

    I'm not about to pretend to have all the answers. An understanding of the meta-problem, yes; a final solution, absolutely not.

    A Republican can't win my district--although I'm worried about the new challenger. I'm taking the General election seriously, even though the common convention is to break open the champagne after the Primary and congratulate ourselves on winning our Congressional seats.

    The new guy claims his political experience includes being a member of Maryland's Continental Congress. Yes, you read that right.

  25. Yep. The whole thing is a risk control; there's no such thing as risk elimination. You can avoid the risk by not having sex, although you still have the risk of transmission by other bodily fluid contact (e.g. blood). You can mitigate it with condoms (these can fail).

    We currently have a sort of voluntary system whereby people give you soft data: "Yes I'm clean, I get tested regularly, I always use condoms". The fact that they're willing to perform oral sex without a condom should be a warning, although it's hard to get HIV on one end of that. If you're concerned about e.g. HSV, though, they're essentially running around unprotected. Then you have the problem that they may have contracted HIV by performing oral on another partner and the condom full of nonoxyl-9 is the only thing protecting you from HIV. You even have serial monogamists who sleep with one partner at a time for a short-term dating span, so churn through lots of partners just like promiscuous folks; and some of those are lax about protection or testing of their partners.

    So you have personal trust and lots of uncontrolled risk, rather than a validated hard metric.

    That means you have the risk of being given faulty or incomplete data among a sea of faulty and incomplete data.