You try that approaching a toll booth on an unfamiliar road at night. Tell me how it goes.
When you obtain directions through TomTom, Google Maps, or another navigation application, you could have the app notify the banks to authorize payment for tolls along your route. Apps lack this feature now but are likely to add it should banks introduce friction measures against unauthorized use of payment credentials.
Live stream is one.
Attending ball games in person rather than watching some out-of-market game through IPTV would fulfill "Third, favor local content" in Kosslyn's editorial.
Short videos a la Youtube is another. Can't stream hop when it takes awhile to start a new stream.
A counterpart to YouTube on a high-latency network would buffer multiple videos in a playlist. Allow human beings to curate these playlists, and the algorithm won't kick viewers onto an endless loop of "Finger Family", "Surprise Egg", and "Peter Parker and Elsa Agnarrsdaughter Are Roommates" videos.
Video games can be downloaded to a suitable computer in advance of play. Multiplayer video games can run on a split* screen or over a local area network (LAN).
Thus totally killing remote play. Most FPS and MMORPGs are worthless if everyone has to be in the same room or building.
Prior to Xbox Live, split-screen or LAN play was the norm, particularly with iconic shooters such as MIDI Maze, Doom (1993), GoldenEye 007, and the first Halo. Switching the dominant mode of multiplayer from online play back to split-screen or LAN play would fulfill "Third, favor local content" in Kosslyn's editorial.
Latency is exactly the problem with artificial delay. Bandwidth isn't an issue.
Perhaps I wasn't clear about it, in turn because Kosslyn's editorial wasn't clear about what constitutes "urgent content". Perhaps adding QoS would reserve a small fraction of bandwidth for low-latency use and the remainder for high-latency use.
This would be against the First Amendment — do you have citations?
Under the authority of the Communications Act, the U.S. federal government bans the broadcast of profanity. It also issues exclusive nationwide spectrum licenses to carriers that have since formed a cartel. At the local level, cities can require incoming wired service providers to agree to an unreasonably rapid buildout schedule in order to qualify for right-of-way access.
[With a 5-minute delay on payment cards,] Paying a toll booth or a bus ticket or any number of on-the-spot purchases becomes impractical.
Not if the cardholder asked the issuing bank to authorize a particular (merchant, maximum amount) pair more than 5 minutes in advance.
Artificial delays will kill things like media streaming
Unless it's a live stream of a sporting event or whatever, I don't see how a 5-minute delay to buffer up the start of a stream would hurt.
gaming
Video games can be downloaded to a suitable computer in advance of play. Multiplayer video games can run on a split* screen or over a local area network (LAN).
and VOIP
Even if a low-latency channel can provide only 2400 bps each way, Codec 2 squeezes usable voice into such a channel.
* Or otherwise shared, as seen in Konami's Bomberman and Nintendo's Super Smash Bros.
No, I'm advocating some way to either A. help the user determine whether running a particular executable constitutes a mistake, B. mitigate mistakes by limiting what an executable can see or modify to less than an entire user account, or preferably C. both.
Memory unsafety in C and C++ language exists wherever the standards for those languages say "the behavior is undefined". Memory unsafety in Rust exists only in an unsafe block.
if the information available is that important then there is a business model that doesn't require ads to support it, because if someone really needs it then there is a market to be selling it.
Enjoy your paywalls.
The other side of it is that if a company requires their product to be advertised to stay afloat then they have a shitty product
How else should the public learn that a product exists in the first place?
That process must have read and/or write permission to access the files, and it only gets that if the user which owns the process has that permission.
If you run an executable under your user account, then you are "the user which owns the process", and therefore the process has "read and/or write permission" to all files in your home directory. Is there a standard way to contain such a process?
How do you make sure a malicious actor will not serve the old content on purpose
If you're using a signing-only scheme for long-lived bulk data, each version has a different URL. Then the index file, which was transmitted separately using a replay-resistant scheme, indicates that a different URL is the newest version of the file.
Why should he go talk to the UK government (a state in the federated EU) any more than he should go talk to New Jersey or Maryland?
Two reasons:
1. The EU is currently organized more like the United States under the Articles of Confederation than like the US under its present Constitution. The central EU government doesn't have nearly as much power over member states' relationships with non-member states as the US has over the several states. 2. British secession from the European Union is underway.
The British counterpart to the American right to remain silent is weaker. It includes this clause encouraging a defendant to reveal his hand earlier: "But it may harm your defence if you do not mention when questioned something which you later rely on in court." Those under arrest have the right to free legal advice, but unlike the American Miranda warning, the British police caution appears to lack standard phrasing for this (source).
What you are saying is like saying that since you downloaded a piece of software through SSL, you are safe enough and you don't need to check the signature.
Every connection you make to a TLS server is signed by that server. Are you assuming an attack model that involves tampering with the downloadable software before it even reaches the server?
Furthermore, encryption is a weak way to guarantee that content hasn't been altered compared to signing.
A form of signing is implicit in TLS, as it uses a message authentication code (MAC) to detect tampering with a packet's ciphertext. Older cipher suites in TLS separate the MAC and encryption into two steps; newer ones use authenticated encryption with associated data (AEAD), which bakes MAC into the cipher's mode.
I don't see why a self signed certificate gets a warning, but http doesn't it is no less secure.
A self-signed certificate gives a false sense of security, whereas the http: scheme gives a true sense of insecurity. A true sense is better than a false sense.
It is really annoying that you have to pay someone a recurring fee just to add a little security.
Every domain name registrant is entitled to a reasonable number of certificates from Let's Encrypt without charge. Or by "someone" do you refer to Gandi, Namecheap, Amazon Route 53, and other domain name registrars?
Have they fixed this problem? As I recall, the httpd would have to furnish the certificate before the client even sent the Host header.
That's why the client sends the hostname in cleartext as part of the ClientHello message when it opens a connection. Firefox, Edge, Chrome, and Safari all send Server Name Indication (SNI) in the TLS handshake, as does Internet Explorer on all supported Windows operating systems. The last major web browsers not to support SNI were Internet Explorer on Windows XP (whose extended support ended four and a half years ago) and Android Browser on Android 2.x. Does your site get a lot of page views from those ancient, unsupported browsers?
SSL also helps to prevent modification of data in transit.
So would a signing-only cipher suite. Signing-only would also have the advantage, as Strider- points out, of allowing an ISP to run a caching proxy for its subscribers to use.
I was about to complain about local devices, like my NAS, before I discovered that I can set up a self-signed cert for its local domain in a few clicks.
How easy is it to add an exception on your mobile and set-top devices in order to use a self-signed certificate? I seem to remember reading that some game consoles and streaming boxes didn't allow clicking through the unknown issuer exception interstitial.
If [cessation of service of ad-supported websites in response to widespread ad blocking] really bothers you, please help find ways to cultivate non-commercial, unbiased places on the Internet. If you disagree, please get off my lawn. And why are you even on/.?;)
Slashdot Mirror
Thanks for finding Revelation 11:18. Here's Sony's plan to reduce its ecological footprint.
You try that approaching a toll booth on an unfamiliar road at night. Tell me how it goes.
When you obtain directions through TomTom, Google Maps, or another navigation application, you could have the app notify the banks to authorize payment for tolls along your route. Apps lack this feature now but are likely to add it should banks introduce friction measures against unauthorized use of payment credentials.
Live stream is one.
Attending ball games in person rather than watching some out-of-market game through IPTV would fulfill "Third, favor local content" in Kosslyn's editorial.
Short videos a la Youtube is another. Can't stream hop when it takes awhile to start a new stream.
A counterpart to YouTube on a high-latency network would buffer multiple videos in a playlist. Allow human beings to curate these playlists, and the algorithm won't kick viewers onto an endless loop of "Finger Family", "Surprise Egg", and "Peter Parker and Elsa Agnarrsdaughter Are Roommates" videos.
Video games can be downloaded to a suitable computer in advance of play. Multiplayer video games can run on a split* screen or over a local area network (LAN).
Thus totally killing remote play. Most FPS and MMORPGs are worthless if everyone has to be in the same room or building.
Prior to Xbox Live, split-screen or LAN play was the norm, particularly with iconic shooters such as MIDI Maze, Doom (1993), GoldenEye 007, and the first Halo. Switching the dominant mode of multiplayer from online play back to split-screen or LAN play would fulfill "Third, favor local content" in Kosslyn's editorial.
Latency is exactly the problem with artificial delay. Bandwidth isn't an issue.
Perhaps I wasn't clear about it, in turn because Kosslyn's editorial wasn't clear about what constitutes "urgent content". Perhaps adding QoS would reserve a small fraction of bandwidth for low-latency use and the remainder for high-latency use.
I don't think the bible specifically mentions anything about tobacco
You are correct. However, The Bible has plenty of warnings against intentionally harming your body and others' with addictive substances.
Anything using 10/8, 172.16/12, or 192.168/16 is a "private internet" according to RFC 1918 - Address Allocation for Private Internets (1996).
and the state itself
This would be against the First Amendment — do you have citations?
Under the authority of the Communications Act, the U.S. federal government bans the broadcast of profanity. It also issues exclusive nationwide spectrum licenses to carriers that have since formed a cartel. At the local level, cities can require incoming wired service providers to agree to an unreasonably rapid buildout schedule in order to qualify for right-of-way access.
[With a 5-minute delay on payment cards,] Paying a toll booth or a bus ticket or any number of on-the-spot purchases becomes impractical.
Not if the cardholder asked the issuing bank to authorize a particular (merchant, maximum amount) pair more than 5 minutes in advance.
Artificial delays will kill things like media streaming
Unless it's a live stream of a sporting event or whatever, I don't see how a 5-minute delay to buffer up the start of a stream would hurt.
gaming
Video games can be downloaded to a suitable computer in advance of play. Multiplayer video games can run on a split* screen or over a local area network (LAN).
and VOIP
Even if a low-latency channel can provide only 2400 bps each way, Codec 2 squeezes usable voice into such a channel.
* Or otherwise shared, as seen in Konami's Bomberman and Nintendo's Super Smash Bros.
Programming languages and frameworks need to regulated. They need to maintain minimum levels of stability, reliablility and security.
By whom and how would this be measured?
For example, anyone that wants to send email needs to register their server with a central authority.
Under which country's jurisdiction would this "central authority" operate?
And then if outbound email was taxed at even as little as 0.0001% per message, that would be nothing to the average person or company
Unless, say, you operate the volunteer-run mailing list for a popular free software project.
No, I'm advocating some way to either A. help the user determine whether running a particular executable constitutes a mistake, B. mitigate mistakes by limiting what an executable can see or modify to less than an entire user account, or preferably C. both.
if I go to YouTube
Encrypt your traffic
YouTube has been HTTPS for years now. What sort of encryption did you have in mind beyond that?
But keep in mind it's not the operating system's job to protect you from running rm -rf ~.
If not the operating system's job, then whose job is it to protect a non-technical user from himself?
Memory unsafety in C and C++ language exists wherever the standards for those languages say "the behavior is undefined". Memory unsafety in Rust exists only in an unsafe block.
if the information available is that important then there is a business model that doesn't require ads to support it, because if someone really needs it then there is a market to be selling it.
Enjoy your paywalls.
The other side of it is that if a company requires their product to be advertised to stay afloat then they have a shitty product
How else should the public learn that a product exists in the first place?
That process must have read and/or write permission to access the files, and it only gets that if the user which owns the process has that permission.
If you run an executable under your user account, then you are "the user which owns the process", and therefore the process has "read and/or write permission" to all files in your home directory. Is there a standard way to contain such a process?
How do you make sure a malicious actor will not serve the old content on purpose
If you're using a signing-only scheme for long-lived bulk data, each version has a different URL. Then the index file, which was transmitted separately using a replay-resistant scheme, indicates that a different URL is the newest version of the file.
A self signed on an internal private network, is priestly safe and good form.
Provided all clients that will access the server, such as streaming boxes accessing your NAS, even allow use of self-signed certificates.
Why should he go talk to the UK government (a state in the federated EU) any more than he should go talk to New Jersey or Maryland?
Two reasons:
1. The EU is currently organized more like the United States under the Articles of Confederation than like the US under its present Constitution. The central EU government doesn't have nearly as much power over member states' relationships with non-member states as the US has over the several states.
2. British secession from the European Union is underway.
The British counterpart to the American right to remain silent is weaker. It includes this clause encouraging a defendant to reveal his hand earlier: "But it may harm your defence if you do not mention when questioned something which you later rely on in court." Those under arrest have the right to free legal advice, but unlike the American Miranda warning, the British police caution appears to lack standard phrasing for this (source).
no one forced anyone to sign up for a Facebook or Twitter account.
True, even if something is a condition of finding a job (see "Facebook Abstainers Could Be Labeled Suspicious" from July 2012), it isn't "forced". But the alternative might be starvation.
If a proper sysadmin has set up a system, a regular user cant break a Linux/Unix system.
If a particular Linux/Unix system has only one human user, such as a personal laptop or desktop workstation, how should the system be set up properly?
What you are saying is like saying that since you downloaded a piece of software through SSL, you are safe enough and you don't need to check the signature.
Every connection you make to a TLS server is signed by that server. Are you assuming an attack model that involves tampering with the downloadable software before it even reaches the server?
Furthermore, encryption is a weak way to guarantee that content hasn't been altered compared to signing.
A form of signing is implicit in TLS, as it uses a message authentication code (MAC) to detect tampering with a packet's ciphertext. Older cipher suites in TLS separate the MAC and encryption into two steps; newer ones use authenticated encryption with associated data (AEAD), which bakes MAC into the cipher's mode.
I don't see why a self signed certificate gets a warning, but http doesn't it is no less secure.
A self-signed certificate gives a false sense of security, whereas the http: scheme gives a true sense of insecurity. A true sense is better than a false sense.
It is really annoying that you have to pay someone a recurring fee just to add a little security.
Every domain name registrant is entitled to a reasonable number of certificates from Let's Encrypt without charge. Or by "someone" do you refer to Gandi, Namecheap, Amazon Route 53, and other domain name registrars?
Have they fixed this problem? As I recall, the httpd would have to furnish the certificate before the client even sent the Host header.
That's why the client sends the hostname in cleartext as part of the ClientHello message when it opens a connection. Firefox, Edge, Chrome, and Safari all send Server Name Indication (SNI) in the TLS handshake, as does Internet Explorer on all supported Windows operating systems. The last major web browsers not to support SNI were Internet Explorer on Windows XP (whose extended support ended four and a half years ago) and Android Browser on Android 2.x. Does your site get a lot of page views from those ancient, unsupported browsers?
SSL also helps to prevent modification of data in transit.
So would a signing-only cipher suite. Signing-only would also have the advantage, as Strider- points out, of allowing an ISP to run a caching proxy for its subscribers to use.
I was about to complain about local devices, like my NAS, before I discovered that I can set up a self-signed cert for its local domain in a few clicks.
How easy is it to add an exception on your mobile and set-top devices in order to use a self-signed certificate? I seem to remember reading that some game consoles and streaming boxes didn't allow clicking through the unknown issuer exception interstitial.
If [cessation of service of ad-supported websites in response to widespread ad blocking] really bothers you, please help find ways to cultivate non-commercial, unbiased places on the Internet. If you disagree, please get off my lawn. And why are you even on /.? ;)
Slashdot is in theory ad-supported.