The amount of abuse this database would be open to... urgh. Off the top of my head:
1. Government departments hire a lot of people who have write access to these databases. 2. It is SOP that a record added to the database is not automatically brought to the attention of someone else to check. 3. It is also common for the procedures to get off the database are substantially more complicated than the procedures to get on it. 4. The people mentioned in 1. above are humans. They're corruptible, they have emotions. 5. So, all I need to do to really screw you over is bribe such a person to add your name to the "do not work" list. It may not affect you now, but in 6 months/a year/5 years time...
At least when you're issued papers, they generally suffice and it's pretty hard for someone to take them off you.
I'm sure others can come up with more imaginative abuses of the system.
Several years ago, I had a theory about technology development. I think I'm going to have to update it.
Theory:
In order to form a successful company, you have a number of options:
1. Build a good quality product, sell it at a competitive price and look after your customers. 2. Build garbage, send out flyers to every school you can think of saying "We are specialists in education!" 3. New! Threaten, cajole, scream at and otherwise make life difficult for your competitors' customers. This option is in trial in a number of companies around the world following great success in Microsoft.
That really is stretching the definition of a legitimate business.
Granted, there may be no specific law, but it's not as if there's a single respectable university in the land which will knowingly accept work prepared in this way.
FWIW, I agree that Unix, like any desktop computer system, is only as secure as the user who's sat in front of it.
IMO, all these people saying "Unix can't suffer from viruses therefore it's secure!" are living in a fools paradise where they don't appear to have realised that the "executable file infector which spreads when the infected file is executed"-type virus is all but dead, and most things described as viruses today would be more accurately described as trojans.
I don't think anything much will change in terms of that perception unless and until there's a major worm attack.
In any company, there's a whole bunch of departments other than IT.
Those departments don't always fancy calling the IT department when they have an IT requirement - particularly if it doesn't seem that complicated. There is always someone in the department who knows their way around Excel (and possibly Access) better than any of their colleagues. So they cobble something together in some 'orrible mess of VB macros linking who knows what files, referential integrity or scalable design be damned.
Were you to audit any sizeable business for spreadsheets made somehow interactive with scripts and badly designed databases thrown together in Access, I guarantee you'd be amazed and disturbed in equal measure. And you really don't want to start trying to figure out which ones have somehow become critical to the business.
This has been going on for years. Try taking that functionality away today, you might as well suggest replacing their computers with slide rules.
1. Microsoft was planning to sue everyone and his dog until someone pointed out the various Open Patent movements, and it might be a bad idea to wake up such a sleeping giant.
I doubt it. I don't think it's a sleeping giant as much as a sleeping leprechaun, and Microsoft is pretty careful about what they publicly announce these days.
2. The whole "we've got patents" thing was intended to stir up some nice headlines in magazines like Forbes, with a view to getting some nice op-ed FUD. Basically, a means of encouraging Microsoft-friendly top level CTOs to kill any Linux projects they hear about. It's not like there's going to be anywhere near so many editorials printed next week saying "Further to Microsoft announcing their patents, they've now announced they don't intend to sue" as there were editorials announcing the patents in the first place.
Much more likely. Unlike Microsoft to admit to spreading FUD quite so flagrantly, though.
Be honest now, how many people in the real world can you see voluntarily buying a Dell in the knowledge that if they want to run Windows, the first thing they're going to have to do is buy a license and install it separately?
Software itself violates the free market. For an item to have value, it must have utility and scarcity. As the marginal cost of production of a unit of software is damn near 0 (its fractions of a penny of electricity), software does not have scarcity. Thus it has no value.
There's still an R&D cost. The same thing is true in the pharmaceutical industry - most of the products cost a remarkably small fraction of their retail price to produce, but the R&D is crucifyingly expensive.
As with pharma, the R&D is substantially more expensive for a product which attempts to solve a "difficult" problem, or one which hasn't already been solved. I don't think we'll see the death of proprietary software any time soon for exactly this reason - though I wouldn't be too surprised to see the majority of proprietary software become custom-produced, either from scratch or on the back of Free software with suitable licenses.
This shouldn't be too concerning because a large number of the world's developers don't work on commercial software which is likely to be commoditized by the Free/Open Source movement for one reason or another. If you don't, well, there's never any harm in having a few months expenses tucked away in a savings account.
As I said, it matters not in the slightest what GMail allows you to do right now. That's exactly the kind of feature Google could restrict so ISPs can then offer a tiered mail service.
In other words, "Pay us extra to get the functionality you already had until recently".
Tell me about it... my g/f's Irish, but we live together in the UK. When her mother had a recent health scare, our phone bill went through the roof. It may only be 45 minutes flight away but it is another country so as far as the telco's concerned, that's international rates. And international rates to mobile phones are even worse.
We're now on a flat fee and get 200 minutes/month to almost any number on the planet, including cellphones but excluding premium rate sex lines. Much better - I just wish the telco offered this years ago.
1. Google announces that ISP's will be able to release a google-apps branded for their users. This includes domain management, docs, spreadsheets, calendar, web page creator, gmail, and 24 hour phone support.
Doesn't say anything about making domain management available to users. It only says "manage your domain and user accounts online" for ISPs.
And I am pretty sure Google will allow ISPs to decide exactly what subset of those options they make available.
Want domain management as a customer (or even to just be able to send your email with the "From" address being something in your domain rather than the ISPs)? Pay for the premium package.
Sometimes, yes. Some of them have some logic built into their website so if it looks like the part before the @ symbol is specific to them, it automatically rejects the email address as "invalid". ("Where Are You Now?", a site trying to cash in on the success of FriendsReunited, does this).
Seldom is the logic that good. There's almost always a way to come up with an email address which easily identifies the culprit without tripping such a filter.
Not necessarily. I use my own domain for email, which forwards everything to my ISP so I can download it through POP3.
My ISPs SMTP relay is set up to allow customers coming from their IP blocks to set up any "from" address they like. Therefore, it's more or less transparent to anyone I exchange email with.
If my ISP drops their POP3 service in favour of a webmail-based interface on Google, I may lose this flexibility. I don't know if Google allows you to set your own from: address now, but it's not really important. They'll brand the product for ISPs and add/remove features as requested - if one of those features is "don't allow users to set their own email address" - then I guess I'll have to find someone else to host my email. I'm buggered if I'm running my own SMTP relay for the sake of what is little more than a vanity domain, which only exists so I can change ISP at will.
Not really, I can buy a single first-class stamp from my local shop which is only a couple of hundred yards from where I live.
Perhaps I'm lucky, living in the UK rather than certain parts of the US where you seem to get funny looks if you cross the street on foot rather than driving.
My computer science course, for instance, did spend some time in the first year emphasising that getting user requirements was absolutely crucial, and if you didn't have a good idea what they wanted you may as well go home now.
But most of the marks came from designing and producing code. There was only one project which required us to go out and find user requirements before implementing them, and that was in the final year. Everything else, the requirements were given to you in plain language right at the start. Even developing some sort of sane user interface was of minimal importance.
This might work OK if you're a developer in a huge organisation and all you ever do is churn out code to requirements which have already been given to you - but you'll have to put in a lot of work to advance beyond that point.
On the one side, you've got the stereotypical salesperson who "doesn't care about the tool or if something's wrong with it - they just want to get the job done".
On the other, you've got the stereotypical techie who "doesn't care about the salesperson - he's got the requirements in front of him and as far as he's concerned, that's it".
Both of these people (and real examples of these stereotypes do exist) need to get off their high horse for a minute. The salesman's right, it is a tool. But it's not like a spanner where it either works or it doesn't and it would pretty clear to a small child if there were something wrong with it. The person who creates the tool has no idea what the tool should do or how it should work without speaking to the salesman, and the salesman needs to understand that either he or someone in his department is going to have to spend a long time talking with IT to ensure that they understand his needs.
Similarly, the techie is well aware that he's got a bunch of complex tools at his disposal. However, it's all too common to find that his familiarity with those tools has led him to expect a similar level of familiarity in others, and he has disdain for those who don't. It doesn't take much scrutiny to realise that this simply isn't how the real world works - my mechanic doesn't expect me to know that there's an oxygen sensor built into my exhaust or what it's there for. All I know is petrol goes in one hole, oil in another, water in a third - and that all need to be present. Turn the key, put it in gear, hit the accelerator and you've got forward motion.
I'd argue that the problem here is one of interfaces - not just the human-computer one, but also the human-human one. With cars, all cars are fairly similar in terms of how you drive them. Sure, the more you spend the more refined things become, but that's as far as it goes. That's certainly not true of either computer interfaces or of people.
That, unfortunately, is as far as I've got with that theory. Bit of a shame really - if I could solve all the IT management problems in the world that easily I'd be a very rich man.
Virtually every company out there has a website, some means of emailing its staff, and where they provide a service to the general public, a published telephone number to contact them. These "automatic subscription" security services are a prime example.
Why, then, is it quicker and easier to write a letter to the head office to get something done?
I can dash out a letter saying "thanks for the service, now please cancel it" in 10 minutes. I can get it stamped and posted in another 10-15 minutes. That's 25 minutes, after which I don't have to worry any more. If I really think the company I'm sending the letter to is going to try and screw me, I send it recorded delivery and I then have proof of receipt once they get it.
Compare this with spending 20 minutes on hold being told that "my call is important", 10 minutes explaining that I want to cancel to some call centre drone who's not allowed to deviate from their script (and whose script doesn't include a "Customer wishes to cancel" section), another 10 minutes on hold after my call is transferred to the "right department", the line being cut off as soon as it's answered, then calling up again to spend another 20 minutes on hold before finally giving up.
Alternatively, email them (or use the form on the website). Of course, the form offers a drop-down to select which department to send the message to, but it's not clear which department you need to cancel so you send it and hope for the best - much the same as you did when you pressed 3 for customer services with the call centre. Only instead of waiting on hold for 20 minutes you wait for 3 days only to get a reply saying "you've emailed the wrong department". If you're lucky, they have the good grace to forward your email to the right department, which then completely ignores your email. You're pretty certain the right person's got it, but you've got no hard receipt and blaming the technology is so easy these days that nobody will bat an eyelid if someone claims "not to have received" your email. Certainly pointing out that emails seldom just disappear into computer land never to be seen again won't help you.
I'll bet most of them are called managers as a sort of alternative to giving them a payrise.
I've noticed this in some US companies. One example I can think of is about 50 people and it has a CEO, Vice President, Junior Vice President, Vice President in charge of Multimedia (whose job has nothing to do with multimedia), Managing Director and a whole bunch of others in a similar vein.
If you believe the job titles, they don't employ a single person who does any work.
The vulnerability cannot be caused by or require any additional third party software installed on the target system
Exactly. Apache without any extra modules, just the core? There's not much to exploit, and that which there is has been worked over and over for years.
I suspect you'll find that most web exploits today rely more on the application than the web server. There's only a handful of web servers in common use today and the core developers all understand the potential security issues that surround them. I'd argue that this is not the case for web applications and frameworks.
The UK military has been trained in keeping the peace as much as handling battle - mainly as a result of how sensitive Northern Ireland was for so many years.
Don't know if you're trying to invoke Godwin's law or what, but I would point out a few things:
1. For most of the second world war, Germany wasn't invaded. Germany did the invading. 2. Citizens owning guns is not in any way related to whether or not the government can be either persuaded to surrender or otherwise toppled. In fact, if the government is toppled it could work against the country as a whole by fostering warring factions - cf. large parts of the Middle East and Africa.
Slashdot Mirror
Come on, be fair.
They've got the "full compensation" bit down to a fine art. It's the "for artists" bit they have trouble with.
Sounds like it.
The amount of abuse this database would be open to... urgh. Off the top of my head:
1. Government departments hire a lot of people who have write access to these databases.
2. It is SOP that a record added to the database is not automatically brought to the attention of someone else to check.
3. It is also common for the procedures to get off the database are substantially more complicated than the procedures to get on it.
4. The people mentioned in 1. above are humans. They're corruptible, they have emotions.
5. So, all I need to do to really screw you over is bribe such a person to add your name to the "do not work" list. It may not affect you now, but in 6 months/a year/5 years time...
At least when you're issued papers, they generally suffice and it's pretty hard for someone to take them off you.
I'm sure others can come up with more imaginative abuses of the system.
Several years ago, I had a theory about technology development. I think I'm going to have to update it.
Theory:
In order to form a successful company, you have a number of options:
1. Build a good quality product, sell it at a competitive price and look after your customers.
2. Build garbage, send out flyers to every school you can think of saying "We are specialists in education!"
3. New! Threaten, cajole, scream at and otherwise make life difficult for your competitors' customers. This option is in trial in a number of companies around the world following great success in Microsoft.
That really is stretching the definition of a legitimate business.
Granted, there may be no specific law, but it's not as if there's a single respectable university in the land which will knowingly accept work prepared in this way.
FWIW, I agree that Unix, like any desktop computer system, is only as secure as the user who's sat in front of it.
IMO, all these people saying "Unix can't suffer from viruses therefore it's secure!" are living in a fools paradise where they don't appear to have realised that the "executable file infector which spreads when the infected file is executed"-type virus is all but dead, and most things described as viruses today would be more accurately described as trojans.
I don't think anything much will change in terms of that perception unless and until there's a major worm attack.
In any company, there's a whole bunch of departments other than IT.
Those departments don't always fancy calling the IT department when they have an IT requirement - particularly if it doesn't seem that complicated. There is always someone in the department who knows their way around Excel (and possibly Access) better than any of their colleagues. So they cobble something together in some 'orrible mess of VB macros linking who knows what files, referential integrity or scalable design be damned.
Were you to audit any sizeable business for spreadsheets made somehow interactive with scripts and badly designed databases thrown together in Access, I guarantee you'd be amazed and disturbed in equal measure. And you really don't want to start trying to figure out which ones have somehow become critical to the business.
This has been going on for years. Try taking that functionality away today, you might as well suggest replacing their computers with slide rules.
Possible explanations I can think of:
1. Microsoft was planning to sue everyone and his dog until someone pointed out the various Open Patent movements, and it might be a bad idea to wake up such a sleeping giant.
I doubt it. I don't think it's a sleeping giant as much as a sleeping leprechaun, and Microsoft is pretty careful about what they publicly announce these days.
2. The whole "we've got patents" thing was intended to stir up some nice headlines in magazines like Forbes, with a view to getting some nice op-ed FUD. Basically, a means of encouraging Microsoft-friendly top level CTOs to kill any Linux projects they hear about. It's not like there's going to be anywhere near so many editorials printed next week saying "Further to Microsoft announcing their patents, they've now announced they don't intend to sue" as there were editorials announcing the patents in the first place.
Much more likely. Unlike Microsoft to admit to spreading FUD quite so flagrantly, though.
Dell.
Be honest now, how many people in the real world can you see voluntarily buying a Dell in the knowledge that if they want to run Windows, the first thing they're going to have to do is buy a license and install it separately?
Software itself violates the free market. For an item to have value, it must have utility and scarcity. As the marginal cost of production of a unit of software is damn near 0 (its fractions of a penny of electricity), software does not have scarcity. Thus it has no value.
There's still an R&D cost. The same thing is true in the pharmaceutical industry - most of the products cost a remarkably small fraction of their retail price to produce, but the R&D is crucifyingly expensive.
As with pharma, the R&D is substantially more expensive for a product which attempts to solve a "difficult" problem, or one which hasn't already been solved. I don't think we'll see the death of proprietary software any time soon for exactly this reason - though I wouldn't be too surprised to see the majority of proprietary software become custom-produced, either from scratch or on the back of Free software with suitable licenses.
This shouldn't be too concerning because a large number of the world's developers don't work on commercial software which is likely to be commoditized by the Free/Open Source movement for one reason or another. If you don't, well, there's never any harm in having a few months expenses tucked away in a savings account.
If you haven't RTFA, do so.
It's a beautiful bit of self-contradiction. The best bit is:
The spy plane was launched as a senior police officer warned the surveillance society in the UK is eroding civil liberties.
Well, nobody's forcing you to deploy these, Mr. Senior Police Officer.
As I said, it matters not in the slightest what GMail allows you to do right now. That's exactly the kind of feature Google could restrict so ISPs can then offer a tiered mail service.
In other words, "Pay us extra to get the functionality you already had until recently".
Tell me about it... my g/f's Irish, but we live together in the UK. When her mother had a recent health scare, our phone bill went through the roof. It may only be 45 minutes flight away but it is another country so as far as the telco's concerned, that's international rates. And international rates to mobile phones are even worse.
We're now on a flat fee and get 200 minutes/month to almost any number on the planet, including cellphones but excluding premium rate sex lines. Much better - I just wish the telco offered this years ago.
Perpetual copyright is tanamount to having the most beautiful spouse in the world... but being unable to touch them or speak to them.
Oh, so you've met my girlfriend?
1. Google announces that ISP's will be able to release a google-apps branded for their users. This includes domain management, docs, spreadsheets, calendar, web page creator, gmail, and 24 hour phone support.
Doesn't say anything about making domain management available to users. It only says "manage your domain and user accounts online" for ISPs.
And I am pretty sure Google will allow ISPs to decide exactly what subset of those options they make available.
Want domain management as a customer (or even to just be able to send your email with the "From" address being something in your domain rather than the ISPs)? Pay for the premium package.
Sometimes, yes. Some of them have some logic built into their website so if it looks like the part before the @ symbol is specific to them, it automatically rejects the email address as "invalid". ("Where Are You Now?", a site trying to cash in on the success of FriendsReunited, does this).
Seldom is the logic that good. There's almost always a way to come up with an email address which easily identifies the culprit without tripping such a filter.
Not necessarily. I use my own domain for email, which forwards everything to my ISP so I can download it through POP3.
My ISPs SMTP relay is set up to allow customers coming from their IP blocks to set up any "from" address they like. Therefore, it's more or less transparent to anyone I exchange email with.
If my ISP drops their POP3 service in favour of a webmail-based interface on Google, I may lose this flexibility. I don't know if Google allows you to set your own from: address now, but it's not really important. They'll brand the product for ISPs and add/remove features as requested - if one of those features is "don't allow users to set their own email address" - then I guess I'll have to find someone else to host my email. I'm buggered if I'm running my own SMTP relay for the sake of what is little more than a vanity domain, which only exists so I can change ISP at will.
Not really, I can buy a single first-class stamp from my local shop which is only a couple of hundred yards from where I live.
Perhaps I'm lucky, living in the UK rather than certain parts of the US where you seem to get funny looks if you cross the street on foot rather than driving.
You're absolutely right.
My computer science course, for instance, did spend some time in the first year emphasising that getting user requirements was absolutely crucial, and if you didn't have a good idea what they wanted you may as well go home now.
But most of the marks came from designing and producing code. There was only one project which required us to go out and find user requirements before implementing them, and that was in the final year. Everything else, the requirements were given to you in plain language right at the start. Even developing some sort of sane user interface was of minimal importance.
This might work OK if you're a developer in a huge organisation and all you ever do is churn out code to requirements which have already been given to you - but you'll have to put in a lot of work to advance beyond that point.
Particularly one surrounding processes.
On the one side, you've got the stereotypical salesperson who "doesn't care about the tool or if something's wrong with it - they just want to get the job done".
On the other, you've got the stereotypical techie who "doesn't care about the salesperson - he's got the requirements in front of him and as far as he's concerned, that's it".
Both of these people (and real examples of these stereotypes do exist) need to get off their high horse for a minute. The salesman's right, it is a tool. But it's not like a spanner where it either works or it doesn't and it would pretty clear to a small child if there were something wrong with it. The person who creates the tool has no idea what the tool should do or how it should work without speaking to the salesman, and the salesman needs to understand that either he or someone in his department is going to have to spend a long time talking with IT to ensure that they understand his needs.
Similarly, the techie is well aware that he's got a bunch of complex tools at his disposal. However, it's all too common to find that his familiarity with those tools has led him to expect a similar level of familiarity in others, and he has disdain for those who don't. It doesn't take much scrutiny to realise that this simply isn't how the real world works - my mechanic doesn't expect me to know that there's an oxygen sensor built into my exhaust or what it's there for. All I know is petrol goes in one hole, oil in another, water in a third - and that all need to be present. Turn the key, put it in gear, hit the accelerator and you've got forward motion.
I'd argue that the problem here is one of interfaces - not just the human-computer one, but also the human-human one. With cars, all cars are fairly similar in terms of how you drive them. Sure, the more you spend the more refined things become, but that's as far as it goes. That's certainly not true of either computer interfaces or of people.
That, unfortunately, is as far as I've got with that theory. Bit of a shame really - if I could solve all the IT management problems in the world that easily I'd be a very rich man.
It is 2007.
Virtually every company out there has a website, some means of emailing its staff, and where they provide a service to the general public, a published telephone number to contact them. These "automatic subscription" security services are a prime example.
Why, then, is it quicker and easier to write a letter to the head office to get something done?
I can dash out a letter saying "thanks for the service, now please cancel it" in 10 minutes. I can get it stamped and posted in another 10-15 minutes. That's 25 minutes, after which I don't have to worry any more. If I really think the company I'm sending the letter to is going to try and screw me, I send it recorded delivery and I then have proof of receipt once they get it.
Compare this with spending 20 minutes on hold being told that "my call is important", 10 minutes explaining that I want to cancel to some call centre drone who's not allowed to deviate from their script (and whose script doesn't include a "Customer wishes to cancel" section), another 10 minutes on hold after my call is transferred to the "right department", the line being cut off as soon as it's answered, then calling up again to spend another 20 minutes on hold before finally giving up.
Alternatively, email them (or use the form on the website). Of course, the form offers a drop-down to select which department to send the message to, but it's not clear which department you need to cancel so you send it and hope for the best - much the same as you did when you pressed 3 for customer services with the call centre. Only instead of waiting on hold for 20 minutes you wait for 3 days only to get a reply saying "you've emailed the wrong department". If you're lucky, they have the good grace to forward your email to the right department, which then completely ignores your email. You're pretty certain the right person's got it, but you've got no hard receipt and blaming the technology is so easy these days that nobody will bat an eyelid if someone claims "not to have received" your email. Certainly pointing out that emails seldom just disappear into computer land never to be seen again won't help you.
I'll bet most of them are called managers as a sort of alternative to giving them a payrise.
I've noticed this in some US companies. One example I can think of is about 50 people and it has a CEO, Vice President, Junior Vice President, Vice President in charge of Multimedia (whose job has nothing to do with multimedia), Managing Director and a whole bunch of others in a similar vein.
If you believe the job titles, they don't employ a single person who does any work.
The vulnerability cannot be caused by or require any additional third party software installed on the target system
Exactly. Apache without any extra modules, just the core? There's not much to exploit, and that which there is has been worked over and over for years.
I suspect you'll find that most web exploits today rely more on the application than the web server. There's only a handful of web servers in common use today and the core developers all understand the potential security issues that surround them. I'd argue that this is not the case for web applications and frameworks.
Speak for yourself.
The UK military has been trained in keeping the peace as much as handling battle - mainly as a result of how sensitive Northern Ireland was for so many years.
Don't know if you're trying to invoke Godwin's law or what, but I would point out a few things:
1. For most of the second world war, Germany wasn't invaded. Germany did the invading.
2. Citizens owning guns is not in any way related to whether or not the government can be either persuaded to surrender or otherwise toppled. In fact, if the government is toppled it could work against the country as a whole by fostering warring factions - cf. large parts of the Middle East and Africa.