CARP and pfsync can provide a virtual IP address managed by a cluster to act as a frontend to N web servers, but AFAIK (and no I haven't RTFA) they don't have anything else to help like a clustered filesystem, a web server that clusters so sessions can fail over within the cluster or anything fancy like that.
Fuck them and their stupid "you can play by our rules so long as you lose!" mentality. Nevermind their billion dollar profit margins...
Little secret for you - in most reasonably respectable businesses (and yes, I know the gambling industry is frequently far from respectable), a "billion dollar profit margin" requires a trillion dollars of turnover.
In other words, while your gross profit may be huge (which it would be for a casino - the product essentially costs nothing so every penny you get out of your customers is gross profit), your expenses (staff, "complimentary" drinks which aren't because you're hoping to get at least that much money back out of the customer, maintenance of machinery, heating & lighting) quickly bring it right down. You shouldn't be too surprised to find that many businesses make a net profit of around 5%.
It doesn't take a mathematical genius to realise that a few mistakes in the arithmetic and suddenly the net profit of 5% becomes a loss.
Then I'd seriously considering getting better insurance. As long as the vehicle is locked, policies that cover contents are available, and AFAIK, are fairly standard provisions.
Indeed they are, though as others have pointed out it's not just that. You may have a company-owned laptop and a policy which states "must not leave in a vehicle" - hell, you may not have a vehicle. We don't all live in the US.
The staff are are fully aware that the machine will give a certain dose of radiation as part of its normal operation and the safety is there to prevent the dose going above a pre-programmed level. Or at least they would be in the UK.
What I would dearly love to know is how anyone thought that the appropriate thing to do would be to devise a protocol which involved resetting the safety given that it is inconceivable that the person who proposed such a protocol and the people involved with following it were unaware of the risks.
Another story on the lawsuit currently circulating on the wires includes this nugget: "Through a spokesman, Delta denied that it was involved in any hacking. 'Obviously, the idea that Delta would hack into someone’s email is clearly without merit,' spokesman Trebor Banstetter wrote in an email."
He's quite right. There are outside companies you can pay to do that for you.
Eyeballing a map of Europe, I suppose the first half of my trip would be a bit like starting in Birmingham, England, driving to Heathrow (with elk instead of London drivers),
Flights from Birmingham to Budapest only cover about 1,000 miles.
Though to be fair, Yellowstone Park to Sacramento, CA is only about 800 miles and Google Maps reckons it's driveable in 15 hours. I've no idea where your "3-4,000 miles of flying" comes from unless it's a typo - Anchorage to New York is only about 4,300 miles.
The machine's software should not be capable of triggering the release of that much radiation; any change in the radiation levels should require some kind of hardware interaction. Even an idiot who did not RTFM should not be able to cause harm with the machine.
RTFA. The machine isn't capable of releasing that much radiation. Unless you reset the machine part-way through and start again.
Alternatively, you have a machine that requires an engineer called out every time you mistype something.
I don't know about the US, but in the UK the qualification you take to give CT scans these days is usually a degree - you'd be a diagnostic radiographer. How much more training do you want?
The problem isn't the qualification, it's the change in protocol. Someone thought it would be a good idea to override the machine's inbuilt safety cutout by resetting it part-way through the scan, proving that being highly qualified is no barrier to making dangerous decisions.
As has already been discussed, though this is damn difficult under normal circumstances it's relatively trivial if you happen to be in control of the end-users PC through malware.
The premise with SSL is that once the host you're connecting to is verified, you trust the hosts on each end of the connection aren't compromised in some way. If this trust is misplaced, all security assumptions are straight out the window.
Example: You could do a fairly crude but effective hack just by fiddling with your victim's hosts file and injecting your own CA certificate into their certificate store.
That would give you a browser window which appears legit - it looks like it's connected to https://secure.bank.com/ there are no warning signs saying "Alert! This may not be bank.com!" and if the bogus CA cert claimed to be from Verisign I daresay that most people would never know the difference.
The likelihood of the blogosphere subverting an individual court case (which can be closed to the general public) is much lower than the likelihood of subverting the machinations of parliament (which most certainly are NOT closed to the general public).
The next step, I guess, would be Windows malware that attempts to compromise any phones that are connected to the PC so that the bad guys can somehow interfere with the bank SMSs at the phone end of the link. That would be significantly more challenging for the bad guys, though.
Significantly more risky, too, seeing as most people (particularly those that are likely to have their PC bogged down with malware) don't regularly connect their phone to their PC.
Why couldn't your anonymous hacking script simply MITM the entire session and only change the recipient's account for any transactions?
Sure, you're trusting that the user will actually carry out a transaction but if you have the script running on enough people's computers then by the laws of probability you'll still make a fortune.
You are assuming, of course, that these ATM cards really do have random digits on the back.
Rumour has it that at one point a major UK bank's PIN generation algorithm only generated three or four different PINs, and this was in the days before you could easily change your PIN at any cash machine.
It took me two years to realise that this was a deliberate boss strategy by a clueless middle manager who was overpromoted, and was using it to freak out his underlings.
BTDTGTTS. Though (in my case at least) the boss in question didn't seem to realise he was doing it.
Having said that, he was known throughout the organisation as being "difficult to work with" (in much the same way as bubonic plague is "a slight case of the sniffles") and when he resigned (having been headhunted in a profession where headhunting simply does not happen) giving significantly less than his contractual notice, not a word was said.
Does teabagging in Halo violate the restraining order?
Either I missed a lot in that game or there is some cultural dissonance going on. I'm at work now so I'm sure as hell not going to give you the UK definition of "teabagging".... google it yourself.
This is Microsoft all over. They advertise their products to high heaven and pay marketing people a fortune in order to keep the general public thinking "PC = Windows = Microsoft".
Yet even when the features exist (and what you describe is by no means unique - the Windows world is chock-full of $15 shareware tools to make a job easy when the functionality is already built into the OS and is already reasonably easy) they never actually market specific features.
It's always "Faster! More reliable! Helps you work better as a team!". Sometimes it's "This common problem we all recognise is solved by our product!"
But it is almost never "This common problem we all recognise is solved by this particular feature within our product. Here, let's show you....".
There's a similar problem in the UK with our tax inspectors not understanding tax law properly - and we also have a pretty complicated system.
Though TBH the problem isn't the tax inspectors - it's that the government decided a few years ago it was cheaper to operate the tax office as a call centre manned by potplants whose only qualification is "Can you speak English (you're allowed three tries to get the answer right)?".
Historically, you would call your local tax office and the phone would be answered by someone who had been on all the training courses and knew what they were talking about - today your call is answered by some spotty teenager who's going off a single sheet of paper headed "Tax law for dummies!" where the law itself is a heck of a lot more complicated and to get to speak to someone who actually understands the regulations and will apply them properly is an exercise in itself.
Google have been very open about their hardware from the off - they don't use servers with however much redundancy and 4-hour response times, they write applications which allow them to make the individual servers disposable. If a part fails, who cares?
It's a bit of a shame that so few applications allow you to do this yourself.
- The FA discusses online auction sites as a "hotbed" of trading illegal software. But it doesn't say whether the BSA distinguish between online auctions offering cracked copies for download, pirated installation media or perfectly legitimate resale of software which the seller has no further use for. - There's no real explanation of how they reached this figure - do they assume a single person using a torrent installs the software once? Twice? Never? Once then decides they don't really need it so uninstalls it? - Even if the BSA did explain how they reached this figure, how do we know that their methodology is sound and gives reasonably accurate answers? AFAIK there is no methodology that is generally known to give accurate answers to the question of "how many PCs have application X installed, where X may or may not phone home and there may or may not be cracked versions of X in the wild which modify any existing phone-home functionality?"
Thing is, the BSA must know that these numbers are not reliable and that they can't get reliable numbers. I think the reason this article exists is the BSA are seeding the news wires. Who wants to bet that the next thing they'll do is lobby representatives in governments around the world using these bullshit figures and that's the only reason the figures exist?
I wouldn't say that, but ZFS is still a little young for my liking. There are plenty of horror stories concerning data loss, and more to the point plenty of recent horror stories.
Slashdot Mirror
CARP and pfsync can provide a virtual IP address managed by a cluster to act as a frontend to N web servers, but AFAIK (and no I haven't RTFA) they don't have anything else to help like a clustered filesystem, a web server that clusters so sessions can fail over within the cluster or anything fancy like that.
Fuck them and their stupid "you can play by our rules so long as you lose!" mentality. Nevermind their billion dollar profit margins...
Little secret for you - in most reasonably respectable businesses (and yes, I know the gambling industry is frequently far from respectable), a "billion dollar profit margin" requires a trillion dollars of turnover.
In other words, while your gross profit may be huge (which it would be for a casino - the product essentially costs nothing so every penny you get out of your customers is gross profit), your expenses (staff, "complimentary" drinks which aren't because you're hoping to get at least that much money back out of the customer, maintenance of machinery, heating & lighting) quickly bring it right down. You shouldn't be too surprised to find that many businesses make a net profit of around 5%.
It doesn't take a mathematical genius to realise that a few mistakes in the arithmetic and suddenly the net profit of 5% becomes a loss.
Then I'd seriously considering getting better insurance. As long as the vehicle is locked, policies that cover contents are available, and AFAIK, are fairly standard provisions.
Indeed they are, though as others have pointed out it's not just that. You may have a company-owned laptop and a policy which states "must not leave in a vehicle" - hell, you may not have a vehicle. We don't all live in the US.
If you didn't have a trunk (motorcycle rider for example) I could see why, but seriously, this should not be much of an issue for most people.
How about because my insurance may not cover me for something left in an unattended vehicle?
The staff are are fully aware that the machine will give a certain dose of radiation as part of its normal operation and the safety is there to prevent the dose going above a pre-programmed level. Or at least they would be in the UK.
What I would dearly love to know is how anyone thought that the appropriate thing to do would be to devise a protocol which involved resetting the safety given that it is inconceivable that the person who proposed such a protocol and the people involved with following it were unaware of the risks.
Another story on the lawsuit currently circulating on the wires includes this nugget: "Through a spokesman, Delta denied that it was involved in any hacking. 'Obviously, the idea that Delta would hack into someone’s email is clearly without merit,' spokesman Trebor Banstetter wrote in an email."
He's quite right. There are outside companies you can pay to do that for you.
Eyeballing a map of Europe, I suppose the first half of my trip would be a bit like starting in Birmingham, England, driving to Heathrow (with elk instead of London drivers),
Flights from Birmingham to Budapest only cover about 1,000 miles.
Though to be fair, Yellowstone Park to Sacramento, CA is only about 800 miles and Google Maps reckons it's driveable in 15 hours. I've no idea where your "3-4,000 miles of flying" comes from unless it's a typo - Anchorage to New York is only about 4,300 miles.
The machine's software should not be capable of triggering the release of that much radiation; any change in the radiation levels should require some kind of hardware interaction. Even an idiot who did not RTFM should not be able to cause harm with the machine.
RTFA. The machine isn't capable of releasing that much radiation. Unless you reset the machine part-way through and start again.
Alternatively, you have a machine that requires an engineer called out every time you mistype something.
I don't know about the US, but in the UK the qualification you take to give CT scans these days is usually a degree - you'd be a diagnostic radiographer. How much more training do you want?
The problem isn't the qualification, it's the change in protocol. Someone thought it would be a good idea to override the machine's inbuilt safety cutout by resetting it part-way through the scan, proving that being highly qualified is no barrier to making dangerous decisions.
As has already been discussed, though this is damn difficult under normal circumstances it's relatively trivial if you happen to be in control of the end-users PC through malware.
The premise with SSL is that once the host you're connecting to is verified, you trust the hosts on each end of the connection aren't compromised in some way. If this trust is misplaced, all security assumptions are straight out the window.
Example: You could do a fairly crude but effective hack just by fiddling with your victim's hosts file and injecting your own CA certificate into their certificate store.
That would give you a browser window which appears legit - it looks like it's connected to https://secure.bank.com/ there are no warning signs saying "Alert! This may not be bank.com!" and if the bogus CA cert claimed to be from Verisign I daresay that most people would never know the difference.
Reminds me of "The Truth" (Pratchett) which I paraphrase here because I don't have the book to hand:
de Worde: "Can I say that you asked me not to say anything about $SUBJECT?"
"No!"
de Worde: "OK, I'll say that when I asked you if I could say anything about about your banning me from discussing $SUBJECT you said No..."
The likelihood of the blogosphere subverting an individual court case (which can be closed to the general public) is much lower than the likelihood of subverting the machinations of parliament (which most certainly are NOT closed to the general public).
The next step, I guess, would be Windows malware that attempts to compromise any phones that are connected to the PC so that the bad guys can somehow interfere with the bank SMSs at the phone end of the link. That would be significantly more challenging for the bad guys, though.
Significantly more risky, too, seeing as most people (particularly those that are likely to have their PC bogged down with malware) don't regularly connect their phone to their PC.
Why couldn't your anonymous hacking script simply MITM the entire session and only change the recipient's account for any transactions?
Sure, you're trusting that the user will actually carry out a transaction but if you have the script running on enough people's computers then by the laws of probability you'll still make a fortune.
Malware doesn't have a boredom threshold. Provided it's undetected, it can sit there forever if necessary.
You are assuming, of course, that these ATM cards really do have random digits on the back.
Rumour has it that at one point a major UK bank's PIN generation algorithm only generated three or four different PINs, and this was in the days before you could easily change your PIN at any cash machine.
Mitchell & Webb put this pretty well:
http://www.youtube.com/watch?v=CS9ptA3Ya9E
It took me two years to realise that this was a deliberate boss strategy by a clueless middle manager who was overpromoted, and was using it to freak out his underlings.
BTDTGTTS. Though (in my case at least) the boss in question didn't seem to realise he was doing it.
Having said that, he was known throughout the organisation as being "difficult to work with" (in much the same way as bubonic plague is "a slight case of the sniffles") and when he resigned (having been headhunted in a profession where headhunting simply does not happen) giving significantly less than his contractual notice, not a word was said.
Does teabagging in Halo violate the restraining order?
Either I missed a lot in that game or there is some cultural dissonance going on. I'm at work now so I'm sure as hell not going to give you the UK definition of "teabagging".... google it yourself.
This is Microsoft all over. They advertise their products to high heaven and pay marketing people a fortune in order to keep the general public thinking "PC = Windows = Microsoft".
Yet even when the features exist (and what you describe is by no means unique - the Windows world is chock-full of $15 shareware tools to make a job easy when the functionality is already built into the OS and is already reasonably easy) they never actually market specific features.
It's always "Faster! More reliable! Helps you work better as a team!". Sometimes it's "This common problem we all recognise is solved by our product!"
But it is almost never "This common problem we all recognise is solved by this particular feature within our product. Here, let's show you....".
There's a similar problem in the UK with our tax inspectors not understanding tax law properly - and we also have a pretty complicated system.
Though TBH the problem isn't the tax inspectors - it's that the government decided a few years ago it was cheaper to operate the tax office as a call centre manned by potplants whose only qualification is "Can you speak English (you're allowed three tries to get the answer right)?".
Historically, you would call your local tax office and the phone would be answered by someone who had been on all the training courses and knew what they were talking about - today your call is answered by some spotty teenager who's going off a single sheet of paper headed "Tax law for dummies!" where the law itself is a heck of a lot more complicated and to get to speak to someone who actually understands the regulations and will apply them properly is an exercise in itself.
Google have been very open about their hardware from the off - they don't use servers with however much redundancy and 4-hour response times, they write applications which allow them to make the individual servers disposable. If a part fails, who cares?
It's a bit of a shame that so few applications allow you to do this yourself.
What a lousy article - all puff and no content:
- The FA discusses online auction sites as a "hotbed" of trading illegal software. But it doesn't say whether the BSA distinguish between online auctions offering cracked copies for download, pirated installation media or perfectly legitimate resale of software which the seller has no further use for.
- There's no real explanation of how they reached this figure - do they assume a single person using a torrent installs the software once? Twice? Never? Once then decides they don't really need it so uninstalls it?
- Even if the BSA did explain how they reached this figure, how do we know that their methodology is sound and gives reasonably accurate answers? AFAIK there is no methodology that is generally known to give accurate answers to the question of "how many PCs have application X installed, where X may or may not phone home and there may or may not be cracked versions of X in the wild which modify any existing phone-home functionality?"
Thing is, the BSA must know that these numbers are not reliable and that they can't get reliable numbers. I think the reason this article exists is the BSA are seeding the news wires. Who wants to bet that the next thing they'll do is lobby representatives in governments around the world using these bullshit figures and that's the only reason the figures exist?
The PDF file linked shows that it generates images in BMP, JPEG and TIFF format.
I wouldn't say that, but ZFS is still a little young for my liking. There are plenty of horror stories concerning data loss, and more to the point plenty of recent horror stories.