Yes, there is a cost. Training and manpower to run another set of protocols, another set of firewall rules, another set of services, and the fascinating failures of older switches when some fool turns on IPv6 without telling anyone are not cheap. Neither is the bandwidth of allowing home users to run their web and file servers from their desktops, which widespread IPv6 supports in a way that the popular NAT usage of IPv4 does not support.
Look at AOL: millions of typical home users on a 10.* NAT, doing most of what they need. Switching big groups like that to IPv6 is not trivial.
This is especially if you don't want to be behind a NAT, and want to be able to publish web pages or serve things directly from your desktop. Limiting IP space and enforcing the use of NAT to protect its limits also keeps ISP's from having to deal with quite so many home pr0n websites and zombied servers sucking up their bandwidth.
You've also raised an interesting point: the filtering necessary to protect themselves from various manipulations of their page rankings is a fascinating problem, and may be relevant to their legal protections where they may claim common-carrier status.
However, the censorship of content for the Chinese government and the censorship of Nazi materials you've measured are profoundly different from altering page rangkings to punish webspammers or manipulations of their web rankings. I've referring to *actual censorship*, where the links are blocked or not displayed at all, not merely given a lower ranking than expected.
Altering page ranking is an editorial decision: Blocking content or references altogether at government request is outright censorship, and I think we can make a clear distinction.
I'm afraid that Google doesn't deserve common carrier status: they haven't earned it, due to their willingness to censor content with unfounded copyright claims, and to censor references to dissident content, etc. It's not that Google is bad, or historically outrageous about this, but engaging in that kind of censorship as a matter of policy can ruin your status as a common carrier.
You're saying they didn't start from the MIT Kerberos code base? Do you have a user agreement where you can review the code base for that? I admittedly haven't had that kind of license in a few years now.
I strongly suspect that writing Kerberos, from the API's only, without the ocmmunity involvement that crated Kerberos, is beyond the technical skills of Microsoft's current developers. The project would have died or been ousourced to someone who could and would use the Kerberos code.
Within the next 5 years? Probably so. But a huge and exciting advance in computing that all consumers demand and all developers should focus their efforts on? Hardly.
Based on my own work observations, well over 50% of those Vista licenses are and will remain unused for at least one year.
Please review the expert testimony about the "extensions", and the attempts to keep them trade secret or require extremely restrictive licensing agreements before the "extensions" could be directly viewed or analyzed. It was a clear attempt to create a closed fork, licensed so that others could not write or use interoperable software but allowing them to publish it as "Kerberos", a trademark with well-earned respect. Extending the standard was reasonable: but Microsoft extended it in secret and refused to publish the extension, breaking compatibility with MS's Active Directory server with every MIT Kerberos based client, until the lawsuit and the analysis and the patching to MIT's code base to accomodate the secret extension.
And this sort of behavior is allowed, even expected, under the BSD style licenses so that businesses can "enhance" and proprietize the software built on top of the previously open source. The GPL license specifically forbids this: if you're going to stand on the shoulders of software giants, you have to tell the giant what you see from up there and change the light bulbs while you're up there.
No, normal users call the nearest 12 year old if they can't spare the $100 re-installation fee and losing all their data. I've been that 12 year old for decades now.
You, as a member of the BSD license-happy crowd, failed to pay close attention to the Microsoft/MIT Kerberos case. Microsoft took MIT's code base, modified it, broke it by extending, and made it compatible only with other Microsoft servers and clients. Under a BSD style license, this would have bene perfectly reasonable, they could keep the changes secret and proprietary, and even patent the change, and no one else could write a patch to fix it.
Fortunately, the extension wasn't patented, and the patch was easy to write, but there was a rather nasty lawsuit about it and a lot of promised "compatible with Kerberos" functionality didn't happen for a long time after the software release.
That's what forks are for, which are protected by the GPL license. The BSD license and patents do *not* protect you from forks which you happen to duplicate by parallel development, and they don't protect you against patent claims.
This is *precisely* why the BSD crowd is more business friendly, and tends to pure code bases managed by individual gurus, and the GPL license actually leads to faster development cycles and broader broader software development.
It would be deadly to some careers of lawyers and middle management who specialize in manipulating patents for corporate benefit. But software patents have clearly been a massive dead-weight on technical development in the US, and worldwide. Thousands of poor quality, even fraudulent software patents are granted annually. (Take a look at the Ebay 1-click case for real prior art nuttiness.)
The limited benefit of software patents providing corporate revenue is wildly, wildly outweighed by the cost passed on to the consumer and applied against smaller compaanies or programmers of patent searches, patentn litigation, and patent applications to protect themselves from larger companies who are very efficient at building patent portfolios of every variation of a very limited number of new or purchased ideas.
A bit. I've been in some secret rooms in major datacenters, and been confronted with some very questionable requests for user information that I've had to cope with with legal and managerial support. So I know the policies exist and are a devil to cope with.
I'm just saying it doesn't buy you as much protection as you seem to think, since the communication channels are still vulnerable and the storage itself is accessible to another country's screwups.
A famous example of this is the death of anon.penet.fi, after numerous assaults on it with and without warrants. It's well-described over at Wikipedia.
But that's not what you said. You said, and I quote "They need to provide evidence, get a court order, and disclose their discoveries to the defense when they press criminal charges.".
This is clearly not the case. And whatever made you think charges will be pressed? Not only do they not need to press charges, under the Patriot Act and similar laws and policies, you can be held without bail, without a lawyer, and without the government admitting you exist under situations like Guantanamo Bay. And you can be seized in another country and deported to countries where torture is legal.
It can't be done to US citizens? How do you know it hasn't been? Do you have a list of who's in Guantanamo Bay? Can you even *get* such a list?
Yes, I verge a bit on the tin foil hat wearing crowd about thus, but not without cause. This stuff is nasty and it's verifiable that it's occurring.
The extent to which you hammer the hard drive makes a huge difference in their lifespan. Linux, for example, is pretty efficient about only writing to the drive when you need to, but running a very busy web proxy server tends to invite a lot of writing and reading from disk. So the very busy drives all tend to fail at the same time: this turns out to be deadly for RAID 1 or RAID 5 setups, since they often start failing without warning and both drives fail before you can rebuild the array with new drives.
I suspect your systems are under a pretty light load and thus last quite some time.
Please go take a look at the "Trusted Computing" tools from Microsoft, designed to support exactly this sort of digital rights management. The keys are designed to be robust, to be revocable from a central authority, and to be supported an a host-by-host and software-by-software or even file-by-file method.
It's actually fairly robustly designed, and hardware support for it is included in current Intel and AMD CPU's by default.
David was a lucky bastard who took on an arrogant giant and got in a lucky shot. He also turned out to be one of the worst kings in Biblical history: kind of like Bill Gates and his early effective defeat of IBM in the small computer market.
I'm sorry, but you are sadly mistaken. Go actually read the unclassified parts of the Patriot Act. Then take a look at the existence of the secret NSA wiretap rooms in on the core internat backbone providers such as AT&T, rooms whose existence was revealed by a company whistleblower and for which AT&T is being suied now by the EFF and other civil liberties groups. The NSA certainly can and does monitor international traffic legally, with no authorization required. It's their *job*. Unfortunately, so do other countries. And the NSA trades with them to get domestic materials.
The three branches are *not* involved in this. The handling of the monitoring does not require warrants, and is thus executive policy, without court involvement or even notification of what is beiing monitored. And even if the three branches are involved, the people being monitored are *not* being notified of the monitoring!!! There is no warrant served: even libraries are prohibited by the Patriot Act from telling book borrowers that they've been forced to turn over records, without warrants, under the Patriot Act.
Yes, it's been going on for years. It's going to happen again and again, and it needs to get slapped down each time it occurs to prevent it becoming ubiquitous and a means of interfering with public policy or personal lives of the innocent. Given the documented monitoring of Martin Luther King by the FBI, the McCarthy era files of who was a communist and forced confessions of other potential "communist" americans, and stupidities of federal raids with warrants such as the "Operation Sundevil" raids on Steve Jackson games, there is just no reason to trust federal investigations or monitoring without public exposure and review.
Unless your email is encrypted, much of your domestic and almost all international traffic is already monitored via the spy rooms installed by the NSA in core backbone network provider's facilities, such as those installed at AT&T. And with the massive bandwidth and facilities available at such centers, and the truly abysmal security of many switches and routers including documented backdoors installed for federal use, it's easy to reroute other traffic to those rooms. So let's be clear: almost all unencrypted internet traffic is monitorable by the NSA. Even though it's illegal for the NSA to monitor most domestic traffic, there are no safeguards in place to prevent it, and with the US Patriot Act in place, all they or other federal agencies need do is mumble "terrorists" to gain unfettered access to it.
I'm afraid it's going to be difficult to coordinate protests with this kind of monitoring in place. And we're still seeing people say "but if it saves one life from terrorists", not realizing that it actually encourages terrorism by ruining trust in government and making people feel that only violent action might be effective.
SSL private keys and SSH private keys can and have been stolen from remotely deployed systems and used for man-in-the-middle monitoring. And a penetrated router or smart switch on the *internal* side of the OpenVPN is a common approach for really sophisticated crackers to tap all your traffic *after* it's been decrypted by the VPN system.
Weven where communications are more secure at the application layer, most people simply click on the "do you accept this key" buttons when making an encrypted connection, which makes such monitoring even easier because the user in the field winds up using the man-in-the-middle's public keys, instead of the target destination's public keys. I saw this about six years ago in a rather clever router reconfiguration to minotor all SSH traffic to a victim's internal network administration servers. We only noticed it when I got brought in to see why there were such large latencies on incoming traffic, and dumped the configuration to plain text and actually *read* it, along with noticing that the previous admin had never bothered to install and enable the SSH tools. Then I found out he had been programming it, via telnet, from his laptop on the road.
We had a long, private talk before I went to the company president with the analysis. He hadn't been allowed the time or resources to do things more securely, and his manager had been saying "we have a firewall, we can trust people inside the network" and had denied this engineer's attempts to do things more securely. It would have been a lot cheaper to do it right than to have me try to clean up the mess later, but it's often difficult to get people to do things right.
If you think a colo service is robust protection, then go ahead and check how many of your colo setups have encrypted file systems, password protected boot loaders, and password protected BIOS's, just to start with. Then compare what you could do with the same money and resources to secure your systems against rootkits, implement proper password management, etc.
Check out Steve Hassan's page on Wikipedia, or some of his books. He lays out the distinction pretty carefully, especially when he descibes a destructive cult in terms of the inability of members to safely leave or change their beliefs.
Slashdot Mirror
Yes, there is a cost. Training and manpower to run another set of protocols, another set of firewall rules, another set of services, and the fascinating failures of older switches when some fool turns on IPv6 without telling anyone are not cheap. Neither is the bandwidth of allowing home users to run their web and file servers from their desktops, which widespread IPv6 supports in a way that the popular NAT usage of IPv4 does not support. Look at AOL: millions of typical home users on a 10.* NAT, doing most of what they need. Switching big groups like that to IPv6 is not trivial.
Or downloading the Linux source code.
This is especially if you don't want to be behind a NAT, and want to be able to publish web pages or serve things directly from your desktop. Limiting IP space and enforcing the use of NAT to protect its limits also keeps ISP's from having to deal with quite so many home pr0n websites and zombied servers sucking up their bandwidth.
If Starcraft 2 comes out first, do I win the bet? (See http://ars.userfriendly.org/cartoons/?id=20070523) .
You've also raised an interesting point: the filtering necessary to protect themselves from various manipulations of their page rankings is a fascinating problem, and may be relevant to their legal protections where they may claim common-carrier status.
However, the censorship of content for the Chinese government and the censorship of Nazi materials you've measured are profoundly different from altering page rangkings to punish webspammers or manipulations of their web rankings. I've referring to *actual censorship*, where the links are blocked or not displayed at all, not merely given a lower ranking than expected.
Altering page ranking is an editorial decision: Blocking content or references altogether at government request is outright censorship, and I think we can make a clear distinction.
I'm afraid that Google doesn't deserve common carrier status: they haven't earned it, due to their willingness to censor content with unfounded copyright claims, and to censor references to dissident content, etc. It's not that Google is bad, or historically outrageous about this, but engaging in that kind of censorship as a matter of policy can ruin your status as a common carrier.
Because so many slashdotter's social life involves nude pictures and their thumbnails? Or at least their right hand?
You're saying they didn't start from the MIT Kerberos code base? Do you have a user agreement where you can review the code base for that? I admittedly haven't had that kind of license in a few years now.
I strongly suspect that writing Kerberos, from the API's only, without the ocmmunity involvement that crated Kerberos, is beyond the technical skills of Microsoft's current developers. The project would have died or been ousourced to someone who could and would use the Kerberos code.
Within the next 5 years? Probably so. But a huge and exciting advance in computing that all consumers demand and all developers should focus their efforts on? Hardly.
Based on my own work observations, well over 50% of those Vista licenses are and will remain unused for at least one year.
Please review the expert testimony about the "extensions", and the attempts to keep them trade secret or require extremely restrictive licensing agreements before the "extensions" could be directly viewed or analyzed. It was a clear attempt to create a closed fork, licensed so that others could not write or use interoperable software but allowing them to publish it as "Kerberos", a trademark with well-earned respect. Extending the standard was reasonable: but Microsoft extended it in secret and refused to publish the extension, breaking compatibility with MS's Active Directory server with every MIT Kerberos based client, until the lawsuit and the analysis and the patching to MIT's code base to accomodate the secret extension.
And this sort of behavior is allowed, even expected, under the BSD style licenses so that businesses can "enhance" and proprietize the software built on top of the previously open source. The GPL license specifically forbids this: if you're going to stand on the shoulders of software giants, you have to tell the giant what you see from up there and change the light bulbs while you're up there.
No, normal users call the nearest 12 year old if they can't spare the $100 re-installation fee and losing all their data. I've been that 12 year old for decades now.
You, as a member of the BSD license-happy crowd, failed to pay close attention to the Microsoft/MIT Kerberos case. Microsoft took MIT's code base, modified it, broke it by extending, and made it compatible only with other Microsoft servers and clients. Under a BSD style license, this would have bene perfectly reasonable, they could keep the changes secret and proprietary, and even patent the change, and no one else could write a patch to fix it.
Fortunately, the extension wasn't patented, and the patch was easy to write, but there was a rather nasty lawsuit about it and a lot of promised "compatible with Kerberos" functionality didn't happen for a long time after the software release.
That's what forks are for, which are protected by the GPL license. The BSD license and patents do *not* protect you from forks which you happen to duplicate by parallel development, and they don't protect you against patent claims. This is *precisely* why the BSD crowd is more business friendly, and tends to pure code bases managed by individual gurus, and the GPL license actually leads to faster development cycles and broader broader software development.
It would be deadly to some careers of lawyers and middle management who specialize in manipulating patents for corporate benefit. But software patents have clearly been a massive dead-weight on technical development in the US, and worldwide. Thousands of poor quality, even fraudulent software patents are granted annually. (Take a look at the Ebay 1-click case for real prior art nuttiness.)
The limited benefit of software patents providing corporate revenue is wildly, wildly outweighed by the cost passed on to the consumer and applied against smaller compaanies or programmers of patent searches, patentn litigation, and patent applications to protect themselves from larger companies who are very efficient at building patent portfolios of every variation of a very limited number of new or purchased ideas.
You mean like SCO did with Microsoft fiscal sponsorship?
A bit. I've been in some secret rooms in major datacenters, and been confronted with some very questionable requests for user information that I've had to cope with with legal and managerial support. So I know the policies exist and are a devil to cope with.
I'm just saying it doesn't buy you as much protection as you seem to think, since the communication channels are still vulnerable and the storage itself is accessible to another country's screwups.
A famous example of this is the death of anon.penet.fi, after numerous assaults on it with and without warrants. It's well-described over at Wikipedia.
But that's not what you said. You said, and I quote "They need to provide evidence, get a court order, and disclose their discoveries to the defense when they press criminal charges.".
This is clearly not the case. And whatever made you think charges will be pressed? Not only do they not need to press charges, under the Patriot Act and similar laws and policies, you can be held without bail, without a lawyer, and without the government admitting you exist under situations like Guantanamo Bay. And you can be seized in another country and deported to countries where torture is legal.
It can't be done to US citizens? How do you know it hasn't been? Do you have a list of who's in Guantanamo Bay? Can you even *get* such a list?
Yes, I verge a bit on the tin foil hat wearing crowd about thus, but not without cause. This stuff is nasty and it's verifiable that it's occurring.
The extent to which you hammer the hard drive makes a huge difference in their lifespan. Linux, for example, is pretty efficient about only writing to the drive when you need to, but running a very busy web proxy server tends to invite a lot of writing and reading from disk. So the very busy drives all tend to fail at the same time: this turns out to be deadly for RAID 1 or RAID 5 setups, since they often start failing without warning and both drives fail before you can rebuild the array with new drives. I suspect your systems are under a pretty light load and thus last quite some time.
Please go take a look at the "Trusted Computing" tools from Microsoft, designed to support exactly this sort of digital rights management. The keys are designed to be robust, to be revocable from a central authority, and to be supported an a host-by-host and software-by-software or even file-by-file method.
It's actually fairly robustly designed, and hardware support for it is included in current Intel and AMD CPU's by default.
David was a lucky bastard who took on an arrogant giant and got in a lucky shot. He also turned out to be one of the worst kings in Biblical history: kind of like Bill Gates and his early effective defeat of IBM in the small computer market.
I'm sorry, but you are sadly mistaken. Go actually read the unclassified parts of the Patriot Act. Then take a look at the existence of the secret NSA wiretap rooms in on the core internat backbone providers such as AT&T, rooms whose existence was revealed by a company whistleblower and for which AT&T is being suied now by the EFF and other civil liberties groups. The NSA certainly can and does monitor international traffic legally, with no authorization required. It's their *job*. Unfortunately, so do other countries. And the NSA trades with them to get domestic materials.
The three branches are *not* involved in this. The handling of the monitoring does not require warrants, and is thus executive policy, without court involvement or even notification of what is beiing monitored. And even if the three branches are involved, the people being monitored are *not* being notified of the monitoring!!! There is no warrant served: even libraries are prohibited by the Patriot Act from telling book borrowers that they've been forced to turn over records, without warrants, under the Patriot Act.
Yes, it's been going on for years. It's going to happen again and again, and it needs to get slapped down each time it occurs to prevent it becoming ubiquitous and a means of interfering with public policy or personal lives of the innocent. Given the documented monitoring of Martin Luther King by the FBI, the McCarthy era files of who was a communist and forced confessions of other potential "communist" americans, and stupidities of federal raids with warrants such as the "Operation Sundevil" raids on Steve Jackson games, there is just no reason to trust federal investigations or monitoring without public exposure and review.
Unless your email is encrypted, much of your domestic and almost all international traffic is already monitored via the spy rooms installed by the NSA in core backbone network provider's facilities, such as those installed at AT&T. And with the massive bandwidth and facilities available at such centers, and the truly abysmal security of many switches and routers including documented backdoors installed for federal use, it's easy to reroute other traffic to those rooms. So let's be clear: almost all unencrypted internet traffic is monitorable by the NSA. Even though it's illegal for the NSA to monitor most domestic traffic, there are no safeguards in place to prevent it, and with the US Patriot Act in place, all they or other federal agencies need do is mumble "terrorists" to gain unfettered access to it.
I'm afraid it's going to be difficult to coordinate protests with this kind of monitoring in place. And we're still seeing people say "but if it saves one life from terrorists", not realizing that it actually encourages terrorism by ruining trust in government and making people feel that only violent action might be effective.
SSL private keys and SSH private keys can and have been stolen from remotely deployed systems and used for man-in-the-middle monitoring. And a penetrated router or smart switch on the *internal* side of the OpenVPN is a common approach for really sophisticated crackers to tap all your traffic *after* it's been decrypted by the VPN system.
Weven where communications are more secure at the application layer, most people simply click on the "do you accept this key" buttons when making an encrypted connection, which makes such monitoring even easier because the user in the field winds up using the man-in-the-middle's public keys, instead of the target destination's public keys. I saw this about six years ago in a rather clever router reconfiguration to minotor all SSH traffic to a victim's internal network administration servers. We only noticed it when I got brought in to see why there were such large latencies on incoming traffic, and dumped the configuration to plain text and actually *read* it, along with noticing that the previous admin had never bothered to install and enable the SSH tools. Then I found out he had been programming it, via telnet, from his laptop on the road.
We had a long, private talk before I went to the company president with the analysis. He hadn't been allowed the time or resources to do things more securely, and his manager had been saying "we have a firewall, we can trust people inside the network" and had denied this engineer's attempts to do things more securely. It would have been a lot cheaper to do it right than to have me try to clean up the mess later, but it's often difficult to get people to do things right.
If you think a colo service is robust protection, then go ahead and check how many of your colo setups have encrypted file systems, password protected boot loaders, and password protected BIOS's, just to start with. Then compare what you could do with the same money and resources to secure your systems against rootkits, implement proper password management, etc.
Check out Steve Hassan's page on Wikipedia, or some of his books. He lays out the distinction pretty carefully, especially when he descibes a destructive cult in terms of the inability of members to safely leave or change their beliefs.