Slashdot Mirror


User: clodney

clodney's activity in the archive.

Stories
0
Comments
469
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 469

  1. Re:Don't use windows for this on Medical Equipment Crashes During Heart Procedure Because Of Antivirus Scan (softpedia.com) · · Score: 1

    Use some dedicated hardware with a custom software system with only components designed for the purpose of the machine and nothing else. Harden and sanity check the hell out of the I/O and connect THAT to your idiot box.

    On the one hand, that makes perfect sense, and removes a whole bunch of failure modes.

    On the other hand, that makes it a more expensive device to build and maintain, increasing the cost of health care all around, and ultimately squeezing out other components of health care.

    Medical devices deal with risk minimization, and that often involves deciding which risks are acceptable. If the device can be sold for $5,000 based on a Windows PC, and $15,000 based on a proprietary hardware stack, and because of that a hospital buys 1 expensive machine instead of 3 cheap ones, patient outcomes as a whole will probably be worse.

    And dedicated hardware has its own issues - it is rarely updated when vulnerabilities are discovered, and often lingers one for years after the manufacturer is gone or has moved on. At least putting an off the shelf PC in the system makes it possible to update some of the components.

  2. Re:What's your plan to stop terrorism? on Spy Chief Complains That Edward Snowden Sped Up Spread of Encryption By 7 Years (theintercept.com) · · Score: 1

    To make this point, I simply keep pointing out that the term "metadata" contains the word "data" and therefore metadata is data. To which, there is no logical reply except agreement.

    And the word "women" includes the word "men", so therefore women are men?

    One crucial distinction between the content and the usual metadata - who you called and for how long for instance, is that it really can't be encrypted. The network needs to know who you are calling so they can connect you. It needs to know where you are so it can route the call to the correct cell tower. And for billing purposes it will keep track of how long the call lasts. Even it there are technical solutions to that, there is no incentive for the network operator to pursue them. But content can be encrypted in a way that doesn't interfere with network operations, in a fashion analogous to the fact that the postal service doesn't need to know what is inside the letter in order to deliver it.

  3. Re:What's your plan to stop terrorism? on Spy Chief Complains That Edward Snowden Sped Up Spread of Encryption By 7 Years (theintercept.com) · · Score: 1

    I completely agree that metadata is 99% as dangerous as actual data, but my reply was limited to the current state, where they are legally distinct from one another.

  4. Re:What's your plan to stop terrorism? on Spy Chief Complains That Edward Snowden Sped Up Spread of Encryption By 7 Years (theintercept.com) · · Score: 1

    I ask you this: I could use physical mail to send communication back and forth. Without a warrant, this communication cannot be read. I could also write this communication in a code, before I mail it. These facts are set. The legal protection of these papers is set. Any yet, some people believe that electronic communication should not be private. There are wonderful existing reasons why physical mail is protected. Why have we allowed governments to decide that simply because the format of communication has changed, its protection is no longer needed?

    While I agree with where you want to end up, the problem is not the difference in treatment between a physical letter and an electronic one. Warrantless access in most cases is limited to metadata. Law enforcement does need a warrant to read your email (with the exception of the glaring "still on the server after 6 months" exclusion). And they haven't (yet) proposed to make it illegal to encrypt it with the software of your choice before sending. What they have done is proposed that US companies can not provide you with secure encryption. Which is kind of the difference between DRM to stop the casual user and thinking it will stop all piracy.

    If I had to offer a compromise between what I want and what the feds want, I could live with this:
    * Access to a device requires a warrant
    * Any form of encryption backdoor requires physical access to the device
    * Using the backdoor breaks the device or in some unambiguous way signals that the backdoor has been used.

    I don't mind a backdoor existing in that limited scenario. My concern is what happens if backdoors can be applied remotely, non-destructively and without a warrant. That way takes us right back to mass surveillance. But if they first have to get my phone, and opening the backdoor either breaks the device or makes it clear that the backdoor is open, it becomes less likely to be abused.

    I recognize that any backdoor represents a lessening of overall security. But I think the government doesn't care.

  5. Re:who does knowledge belong to? on IT Employees At EmblemHealth Fight To Save Jobs (computerworld.com) · · Score: 1

    Also keep in mind that the world is a pretty small place. Word gets around. I expect that if these folks make it hard to get rid of them, they will find themselves black balled.

    If they go far enough that popular sentiment shifts against them and they are viewed as asshats, then there are indeed negative repercussions. But in most cases the front line hiring managers are no more eager to be replaced by H1-B visa holders than anyone else, and will likely admire people who had the ability to make an effective change.

    Of course, if they really manage to stop it, they won't be looking for work.

  6. Re:Yes, yes they should... on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1

    Think about what it takes to keep this kind of large conspiracy somewhat secret.

    Which is precisely why I don't believe that there is a conspiracy.

  7. Re:They should do it, but they haven't. Why? on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 2

    That is it exactly. This is a high profile case. A major terrorist attack on US soil.

    I will probably go to hell for saying this, and I mean no disrepect to anyone affected by the San Bernadino shootings, but I quibble with "A major terrorist attack on US soil". This was two people with easily available weapons which can be had at thousands of locations throughout the US. If the "major terrorist attack" bar is set that low, we can never be safe from terrorism, since literally any two people in the country might be terrorists. The 9/11 attacks were definitely a major attack. McVeigh blowing up the federal building in Oklahoma City was a major attack. One or two people shooting up a workplace is a tragedy, but hardly an existential threat. It captures the imagination and makes people nervous, but in terms of impact on the country as a whole it is nothing.

    We need to acknowledge terrorism as an ongoing threat to be managed, like gangs, or drunk drivers, not as a war to be won.

  8. Re:Yes, yes they should... on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1

    You do know that you actually can make laws, right? It's a citizen government, where you can run for office, or even go through the process of getting a ballot measure passed.

    If you have a couple of million/billion dollars to spare and/or enough of the right friends. Preferably in one or the other major political parties.

    Otherwise, good luck - you'll need it!

    Here is how it works. You run for something local, like city council or school board. You show up at party functions to become a member of a party, and gain credibility within the party. You develop a name for yourself so that when you want to run for state office people have heard of you and you seem like a reasonable candidate.

    Then you start thinking about running for a national office.

    If you have millions of your own money or friends willing to fund you you can skip some of those steps, but if you go the usual route you don't need to be a millionaire.

    And why should it be different? Do you hire somebody with no experience to be an architect or senior engineer, just because they have strong opinions on how things should be done? Why would I vote for your for Congress or President if you haven't shown me you can perform well at a lower level office? Why wouldn't I think that you are likely to be a single issue crank that has one hot button issue that has you all worked up, and zero interest in the rest of the mechanism of being a legislator?

  9. Re:Hipster Terrorist? on DoJ Wants Apple To Decrypt 12 More iPhones (macrumors.com) · · Score: 1

    What you described in the second paragraph is already how it works in current iOS versions. You can't update a locked phone without unlocking it OR wiping it.

    From what I have read about this case I don't think that is true. I think the phone is up to date (or at least on iOS 9.something), but I thought the firmware will permit (signed) updates without wiping a locked phone, which makes this particular attack feasible. I think the current state is that the firmware can be updated but the lock remains intact, and 10 failed unlock attempts wipe it. So the FBI is asking for an update to the firmware to remove the 10 try limit and the enforced wait between unlock attempts.

  10. Re:Bruce Schneier says on DoJ Wants Apple To Decrypt 12 More iPhones (macrumors.com) · · Score: 1

    This is an existing vulnerability in iPhone security that could be exploited by anyone.

    There's nothing preventing the FBI from writing that hacked software itself, aside from budget and manpower issues. There's every reason to believe, in fact, that such hacked software has been written by intelligence organizations around the world. Have the Chinese, for instance, written a hacked Apple operating system that records conversations and automatically forwards them to police? They would need to have stolen Apple's code-signing key so that the phone would recognize the hacked as valid, but governments have done that in the past with other keys and other companies. We simply have no idea who already has this capability.

    I think this is overly simplistic. I have no idea what precautions Apple takes with its code-signing key, but other organizations I know take this very seriously - a USB key in a locked safe, with 2 people required for access, and the signing only done by loading the binary onto an air gapped computer, signing the binary, and then returning the key to the safe.

    If Apple takes precautions at that level, it is by no means a given that the code signing key has leaked. On the other hand, if phones are signed at the end of a production line in Foxconn, it is a whole different story.

  11. Re:Hipster Terrorist? on DoJ Wants Apple To Decrypt 12 More iPhones (macrumors.com) · · Score: 4, Interesting

    Where I think this is going to get interesting is what happens next.

    From my perspective, and I assume from Apple's, they have a security vulnerability in the current version of iOS: anyone with the Apple signing key can sign firmware, which can then be loaded onto the phone without unlocking the phone first. This custom firmware can then defeat the measures designed to prevent brute forcing of the users passcode.

    Regardless of whether they win or lose the current court battle, I expect Apple to fix the vulnerability in the next version of iOS. I think that is as simple as altering the operating system so that if new updates are applied without an unlock, the original OS/firmware wipes the phone *before* applying the update. That plugs the hole because before the brute force friendly firmware gets installed, the data is destroyed.

    Suppose Apple loses the case - I doubt this new version of firmware technically counts as contempt of court, but certainly after having had their cooperation be compelled by the government, said government will not be happy if Apple decides to make sure they can't get forced in that particular way again, and I would expect some level of retaliation by the courts/government.

  12. Re:No such thing on Adblock Plus Maker Seeks Deal With Ad Industry Players (yahoo.com) · · Score: 1

    If you had tens of thousands of visitors a day, then it would have behooved you to sell your own ads. That means:

    1. Call big company that may be interested in advertising on your web site.

    At which point big company says that "We do all of our online advertising via -insert ad network here-. Contact them at this number..."

  13. Re:Customer-centric? on Amazon's Thin Helvetica Syndrome: Font Anorexia vs. Kindle Readability (teleread.com) · · Score: 1

    Since when is a large corporation customer-centric? It's stockholder-centric, silly!

    And since stockholders prefer that the corporation actually have customers, they usually think it is a good thing if the corporation is customer centric. See how that works?

  14. Re:What's the deal... on First Hidden Electric Motor In Cycling World Championship (cxmagazine.com) · · Score: 1

    When's the last time you watched a Hockey, Basketball, or Football game (of either kind) without seeing a penalty? Those guys cheat constantly.

    That is not the level of cheating we are talking about. Routine fouls in sports (even when intentional) compared to doping or motorized bikes are like parking tickets vs. felonies.

    Cycling does have the equivalent of fouls - you can get a time penalty for drafting off a team car, or be "relegated" to the back of the pack when shoving someone out of the way during a final sprint.

  15. Re:When is a patch not a patch? on Attackers Use Microsoft Office To Push BlackEnergy Malware (csoonline.com) · · Score: 1

    'BlackEnergy 3 exploits an Office 2013 vulnerability that was patched some time ago, so it only works if the target machine isn't patched or an employee (either deliberately or after being tricked into it) executes the malicious Excel document,' writes CSO's Steve Ragan.

    A vulnerability that is still present if user behavior allows triggering the payload is NOT PATCHED. It's a workaround, at best.

    Nonsense. If the user is running as administrator, then the user triggering the payload is perfectly acceptable as far as Windows is concerned, because an admin user is allowed to do whatever they want to the machine. And before you say that it is still MS fault because users need to run as admin - that hasn't been true in years. Some sites still allow users to be admins of their own machines, but that is a policy decision, not something that Windows forces on them.

  16. Re:Rather stupid, apparently. on NSA Wants To Dump the Phone Records It Gathered Over 14 Years (thenextweb.com) · · Score: 1

    A quick google search says that Americans make 3 billion calls a day.

    Metadata consists of at least originating number, called number, time, and duration. Call it 64 bytes per call. Add in cell tower location data and it can be much bigger.

    Directory information changes over time, so if you are looking at a 14 year old record, you need to know who held each of those numbers at the time the call was made. So each call has linkages to 2 different pieces of directory information, call it 200 bytes per entry. And additional foreign keys in our metadata records.

    Lets make a wild ass guess at how many directory records there are, and how many are added/changed each year. I will postulate 250 million directory entries, with 10 million changing per year.

    So now we have:

    64 bytes * 3,000,000,000 calls a day * 365 days a year * 14 years = 981,120 gigabytes of data or 981 terabytes of data.
    (250,000,000 directory entries + (14 years * 10,000,000 changes per year)) * 200 bytes per = 78 gigabytes of data.

    And that assumes that only metadata is kept (no text to speech or compressed audio), and that only calls made within the US are captured (unlikely).

    The data can be compressed, but you are starting with on the order of a petabyte. I don't think it fits on a thumbdrive.

  17. Re:Is it really a big issue? on Insurance Companies Looking For Fallback Plans To Survive Driverless Cars (csmonitor.com) · · Score: 1

    I think there are 2 completely different scenarios:

    1. You call for a driverless car service, like a taxi or an Uber today - you don't have insurance, the service does. You are a passenger.
    2. You own a driverless car, and have it pick you up. You carry the liability insurance on the vehicle. You may turn around and sue the manufacturer, but there are going to be a whole host of things where you need insurance. What if the vehicle was negligently maintained? What if you engaged an emergency override of some sort and caused the accident? What if you threw something from the window of the vehicle?

    So for a vehicle you own, you still carry insurance, but since the frequency of accidents should be significantly lower, the insurance should be cheaper, meaning that industry revenue and profits will fall signficantly.

  18. Re:It's all in the execution on Surprising Support Among Americans For Purchasing Smart Guns (jhsph.edu) · · Score: 1

    I would definitely buy a smart gun if I could. Having a weapon for self defense does have the risk of it being turned on you.

    However, I would need to be convinced that it would work when I needed it to. If they try and require smart guns, but the unlock mechanism is faulty and causes me to be unable to use my weapon, I don't want it and I don't want that law.

    They need to have a mechanism that is nearly foolproof before I'd ever consider that rule. Otherwise, it's a license for the makers of shitty smart gun technology to mint money while no one is any safer.

    I've never felt the need for a gun, but knowing how many gun accidents there are each year, I would certainly consider a smart gun if I found myself wanting a gun.

    Rather than making them compulsory (which is nowhere in the article), maybe the answer is to change the liability equation.

    Smart gun didn't fire when it should have -> manufacturer is potentially liable
    Didn't buy a smart gun and gun discharged accidentally or after a theft -> gun buyer is potentially liable

    That would force owners and manufacturers to consider the risk of misuse/failure.

  19. Re:Seems pretty reasonable on German Court Orders Man To Destroy Naked Images of Ex-Partner (bbc.com) · · Score: 1

    But that's the point. Consent was granted. You can't retroactively revoke it. It's polite to do so, yes, but a stunning overreach of state power to make this a law. You consent to me taking your photo, that photo is mine, and that state will have to pry it from my cold dead hand. Zero tolerance for government censorship.

    I think that willfully ignores the reality of couples in a relationship. During the relationship, the consent is clearly understood that the pictures are private between the couple. So long as the couple remains together, there is likely no disagreement about the bounds of that consent.

    Treating the consent as blanket after the relationship has ended is silly, and asshattery of the highest order.

  20. Re:END THE FED! I saw this coming 30 years ago. on US Bureau of Labor Statistics: Programmer Jobs Will Decline 8% (computerworld.com) · · Score: 1

    I can confirm that hiring talented C++ or Java developers in the Twin Cities area is very difficult. It takes us a long time to fill open positions, and headhunters are calling people everyday. And we are losing people to other firms that routinely offer someone a big bump to switch.

  21. Re:How can there be? on No Such Thing As 'Unlimited' Data (wired.com) · · Score: 1

    These services are built around the idea of a normalized distribution of usage. If one user uses a million times the average of the rest of the users, then "unlimited" offers can't be economically sustained.

    You don't have to agree that it's "abuse". It just makes "unlimited" service models impossible -- one user can ruin it for everyone else. ...

    Yes and no. Since the unlimited plans are time based, and the speed of the connection is fixed, the maximum potential usage of someone is speed * hours in a billing period. That means that the outliers aren't as far out there as you might expect. 24 hours * 31 days = 744 hours in a month. If most broadband users manage to use 2 hours a month (no idea, but that feels low to me), then the outliers are at most using 372 times the amount of an average customer. That doesn't seem like an amount that is going to destroy the business model.

    I do think that usage based pricing makes sense - in the end the big providers pay for bandwidth, so why wouldn't that be reflected in the pricing you and I pay? But I do have a hard spot for the providers trying to wiggle out of what they have been offering. Why don't they simply refuse to offer/continue the "unlimited" plans and just be honest about it?

  22. Re:It's happened to me several times... on When Fraud Detection Shuts Down Credit Cards Inappropriately · · Score: 1

    Unless you have one of those accounts that sends you a notice for every transaction done on the card, how do you know how many transactions are rejected without your knowledge? It sounds like the only ones you would encounter would be the false positives.

  23. Re:Stupid people are stupid on 9th-Grader May Face Charges After Homemade Clock Mistaken For Bomb · · Score: 5, Insightful

    You make a judgement call, and the teachers here erred on the side of caution. Imagine if this kid was a terrorist and it actually was a bomb, and they had done nothing. I bet you would be the first first person screaming "A muslim kid who no one knows shows up to school carrying a box with a timer on it and NO ONE SAYS ANYTHING??"

    Sorry, but erring on the side of caution would be to look at the clock and inspect it for explosives. Or to politely say that because of nervousness around things that look like bombs, they need to take it away and ask the police to look at it. And then when it turns out to be a clock, apologize profusely and say he can pick it up at the end of the day.

    Intense questioning, perp walk in handcuffs, and fingerprinting at juvie is an epic level of overreaction. Nobody disputes that it was anything more than a bomb. He didn't leave it somewhere where it would be mistaken for a bomb, he had it in his backpack, and it only came to light because it had an alarm he had to silence. I like the notion that somebody else posted - a public apology by everyone involved, either in the form of a letter to all the parents, a student assembly, or both.

  24. Re:"Drug Companies Seek to Exploit"!!! on How Drug Companies Seek To Exploit Rare DNA Mutations · · Score: 1

    Drug companies have no intrrest in researching cures.

    Drug companies are for-profit. While there is obviously immense profit in providing treatment for maladies, there is a very limited profit available in cures.

    Thus, drug companies do not have any intention of curing anything. It would be bad for business, you see.

    And yet, I was just reading that there are multiple new (and phenomenally expensive) drugs that cure Hepatitis C. Insurers don't want to pay for the cure, because the course of drugs necessary for the cure can run in excess of $100K. And the latest drug is better than the previous cure, but even more expensive.

    Presumably the companies bringing the cure to market are different than the ones selling the palliative care, so they have an incentive to sell the cure.

  25. Re:Outsource polling on Political Polls Become Less Reliable As We Head Into 2016 Presidential Election · · Score: 1

    What interests me, though, is the demographic shift this will tend to have on any number of results. Landline use skews older and older each year, nevermind peoples' habits with the phone. I usually don't even answer my mobile unless I recognize the caller - if it's important, they can leave a message and I'll call back.

    And I think things like that will end up driving polling behavior. They will have to adapt to the callback model, or offer people some form of payment to participate in a poll.

    Longer term, I suspect the rules prohibiting auto dialers on cellphone lines will go away. IIRC, the nominal justification for that is based on the fact that cell phone users pay by the minute, so the time it takes for the pollster to connect has an actual financial impact. I suspect we are only a few years away from having unlimited talk and text become the norm.

    What about SMS surveys? You might get better responses, especially if each respondent only get asked one or two questions.