His point is that your statistics don't back your argument. Saying 80% of DEA arrests are for users does not constitute evidence that the DEA cares about busting people with $100 worth of LSD -- it doesn't really say anything about their emphasis at all, it's a gross generalization. In order for your point to prevail on your evidence, you must establish that dealers make up a proportion of the criminally liable population in excess of 20%.
Following the money. So you are saying that if I go to instawallet.org from a library, a wifi spot or though tor, create a wallet, anonymously send money to that wallet, bitinstant.com, make another, and another and another, series of one time use bitcoin wallet addresses, before it gets sent to SilkRoad, which tumbles that, they are going to track that? How? You can set 6 one time use wallets up and transfer random amounts.
It's not clear how you're funding this wallet in the first instance. At some point you're going to have to wire some money to an exchange or pass it through Dwolla or BitInstant, both of which keep logs of everything, and in the case of BitInstant, it's a US company and will get you on security cameras at a 7-11 or a Walmart. You can juggle the money from BTC endpoint to endpoint as much as you like, but all the transactions are public record and lead back to the funding event.
That only works if the value of your scam is greater than the potential earnings your good reputation could net. It's a quick payoff, but chances are that you could make more in the long run with a continuous business as a reputable dealer (pun not intended).
Bernie Madoff always kept telling himself that he'd make back his client's money, he just needed a few good months on the market and all would be right again...
My experience with Mt. Gox, let alone Silk Road, is that digital entities (with either anonymous or inconsequential, unregulated "meatspace" personality) can be quite casual about fiduciary duty. Even if (particularly if???) they have good intentions.
OTOH, as a delivery system for illegal drugs, this system probably works great, or at least an order of magnitude better than the 1990s state-of-the-art in drug buying; if the worst crime a dealer can practice upon you is larceny, that's Progress!
One "like" from a "friend" is worth a hundred thousand likes from random strangers (even if they're real people). And one detailed comment about a product from an actual trusted friend is worth more than a hundred thousand likes from friends.
That was supposed to be the whole point of Facebook. It's easy to "like" anything, but having a relationship graph gives you the context necessary to decide who the hell is "liking" something in the first place, and what that means. It all starts to break down when people friend anyone will-nilly, or sell their friendship to bots.
The problem is that friendship on Facebook (or Google Plus, for that matter) is an exhaustible resource. They'd probably kill fake accounts dead if they rationed the number of friends you're allowed to make, and only allowed people to create new accounts on the basis of several invitations and community rating -- essentially a proper web of trust.
Of course the whole business model for these sorts of sites is to bilk advertisers with clickfraud, and bots with phony accounts are a great way of doing that, so the goal isn't to eliminate phony accounts or friend relations, but to find the perfect balance of just enough humans to make the ads profitable, and advertisers feel like they're actually hitting an eyeball every now and then.
Basically you're saying that no one should have an entry in the whois database because we can't have nice things.
The whois was just one way of doing this, I'm sure more than a few people's mailing address can be obtained from a google search (I know mine can, I've had to post too many PDF resumes.)
The problem is Apple and Amazon use knowledge of a mailing address as a credential, in the same way that many silly organizations use knowledge of the last four of your SSN.
Wow, so it's "community" now to out your neighbors and friends as to political leanings?
While voting should be secret, it seems bizarre that people should go around trying to change their neighbor's lives with laws all while claiming the process is none of their neighbor's business. I'm a very staunch Democrat but I don't mind publishing petition signatures, for example. The idea that politics is this process that works by remote control from the privacy of your home, instead of constant face-to-face confrontation, challenge, debate and social interaction is poisonous. IMHO.
Thank you Democrats for birthing yet another wave of libertarians, keep tugging on that wool.
As long as the specter of the 2000 election still haunts left-wingers, and Republicans remain the Jesus party, the Democrats can afford to lose quite a few people to quixotic identifications, because they'll always come back. Lefty "cosmotarian" libertarians have no one to vote for, and rightist paleos are stuck throwing their vote away on whoever the LP candiate is, and LP/Constitution Party internal politics make the Democrats look like an elementary school student council debating field trips.
This is the US. We have plurality first-past-the-post, winner-take-all elections. The system is designed to prevent you from voting for pure ideology.
The nice thing about android is that you don't have to get googles permission to use it in whatever form factor you want.
It'd be nice if phone manufacturers actually used that freedom to make phones with a variety of features at the bleeding edge, instead of just bashing out a buncha iPhone killers. Who cares how much freedom Google gives manufacturers if manufacturers don't use it.
Handsets with keyboards, not handsets that let you bring your own laptop keyboard.
And the GP is right, for all of the talk about the freedom to "choose" in the Android ecosystem, the top of the line phones, the ones that are meant to meet the iPhone on performance, are all basically identical -- large screens, no keyboards, lotsa camera, AMOLED screen, removable battery, 4G. Candybar-format phones with hardware keyboards are also-rans running Eclair or Froyo, or only available on Sprint, and with second-rate processors. The best hardware keyboard phone, if we admit sliders, would probably be the Droid 4, which came out a month ago(?), and it ships with friggin Gingerbread and a brand-X CPU.
Who gives a darn about legality, it's about morality.
You know there is a difference between an allegation and a conviction, right? What if an accuser is mentally deranged, or what if she is raped by a family member and is accusing someone else in order to protect the real criminal? Or what if she just makes a mistake? Even if the accused has an solid alibi, her accusation is prejudicial and will ruin his life.
Guilt is for a court to decide, not some hacks on the 7PM news and a mob with signs and pitchforks -- which in America is what passes for "morality."
Many manufacturers sell items to foreign markets, but only wholesale, and leave the marketing to the retailers or importers, in which case a "Marketing" guy is actually going to have a very different job description than a "worldwide marketing" guy.
I'm not sure how any of this vindicates Curt Schilling's ethics, which is the matter in question here. Nobody forced him to do anything, of course he was desperate to keep his company going, but a lot of people have been desperate in the last 4 years to keep themselves fed, let alone their software companies in the black. Being ethical requires more than simply doing the cheapest and most effective thing for you at this moment.
I also really do think that when government intercedes in the market place and makes money overly cheap, either via loan grantees or direct lending, it does lead otherwise savvy business people to make poorer decisions.
When anyone acts in any marketplace and makes certain decisions, they can create a situation where adverse selection makes people work against their long-term best interests. If you sell cigarettes for less than the cost of cancer treatment, the outcome is often calamity; if you sell gasoline for less than the price of carbon-resequestration, the outcome is often calamity -- there's nothing evil about this, it's just the way these things are priced, and people make their decisions accordingly, and everyone walks away happy, until later when the externalities catch up to them. This is not an exclusive province of government action, any market actor that is sufficiently wealthy and stupid can induce inefficiency and deadweight loss, we simply call this waste good waste because nobody forced anyone to do anything.
The App Store does not solve any existing problems for me, as a user.
It's meant to solve Apple's and Apple developers' problems, not yours -- it's more reliable, less crackable, and cheaper (up front) than eSellerate or Kagi.
Name one thing in the terminal that's "messy," as opposed to merely "different" from the way Linux, IRIX or SunOS works. All of those look pretty "messy" in the terminal, if you've only used one of the others.
A lot of those do. Mail does, the mothership process of Safari does not, but it's "Web Content" processes, the ones that present URLs, do. Quicktime Player does. Facetime and the Reminders app do, the Calendar does not, TextEdit does, the productivity apps don't -- it's pretty much hit or miss, I don't think there's any agenda to it, they just update the apps when they get around to it. I know they'd rather have most of their user-facing apps in a sandbox, so they can't be used as an exploitable surface to their underlying services (the camera API, the filesystem, the sloppy blob that is Quicktime...). Several OS processes run in a sandbox as well, like the metadata indexer and the pasteboard daemon, because they have to crunch through gobs of roudy and arbitrary data and are rather intimate with the underlying system.
But the sandbox and entitlements are about maintaining a chain of trust. If you don't trust the developer, in this case the organization known as Apple Inc, you shouldn't be running anything they make, starting with their OS and hardware, so the question is sorta mute.
No free trials No discounted upgrades No free upgrades if the prior version was purchased after a specific date No way to provide license keys that could be used on Windows (many of our customers use both platforms) No volume discounts or site licensing No access to customer information, which prevented us from validating orders, offering discounts, running promotions, newsletter signups, etc. Unclear refund policies Most importantly, we had to create another version of Postbox for the Mac App Store that removed features such as iCal support, iPhoto integration, and Add-Ons in order to comply with Apple’s Application Guidelines
None of these, save the last one, have anything to do with sandboxing. The last one does, but I don't understand it, because access to the user's calendar and photos are explicitly-defined entitlements that you can access, all you have to do is check a box in Xcode. A sandboxed app cannot access the filesystem of the computer, except for paths specifically named by the user in an Open or Save dialogue (the dialogue boxes are run by a separate daemon that passes the paths to the client application over IPC, so you can't futz with it to pick open more of the user's fs than they specifically let the application see.) Obviously this is deadly to bulk renamers, but I don't understand the complaint in the context of document creation, utilities or accessories, games, or really anything but document indexers -- which would have to just be sold the old fashioned way, on a website.
Here are some videos. He represents the phones as unmodified, though running an old version.
The distance isn't so much of an issue because he was able to use an NFC tag, not a transmitter, not an active device of any kind, but a mere tag to cause the phone to switch on its bluetooth radio and give him a sudoer's command line over the BT radio. An attacker could hide an NFC tag in a table or at waist level in a public place, or in a tag that's disguised to be legitimate, where people are liable to stand for more than 10 seconds: the tag cracks the phone open, and then someone with a laptop within BT distance conducts a brief session to grab what they can, or install a rootkit.
If an executable has sufficient privilege to run an arbitrary command, it can accomplish everything the effective UID allows it to. You still have all the second-line defenses, Unix permissions, Kernel and library ASLR, the Firewall, the signed entitlements system (if it applies)...
The trick is getting a browser to call system(); this problem exists now and it's extremely difficult. Library ASLR has pretty much defeated it.
Any executable that's downloaded is "tainted." Mach-O executables carry their certificates and checksums as metadata segments in the executable, and if you don't have those, or they don't resolve to a certificate with an Apple signature, Gatekeeper will stop it from running according to the user's preference setting.
Taintedness can be removed with
$ sudo xattrs -d...
to delete it (it's stored in the filesystem extended attributes), or by launching the app from the "Open" command contextual menu. It will not launch by double-clicking, Apple-O'ing, or with Apple Events (like Firefox would do).
Well, one admittedly small loss is that my little shareware app that existed for over a decade will no longer work out of the box on OSX thanks to Gatekeeper.
Fortunately it's a five-second fix: Control-click on the app and select "Open." This whitelists the app, regardless of its credentials.
NB. Gatekeeper only works on applications that are downloaded subsequent to Gatekeeper being installed. If you had an app before, Gatekeeper won't see it. If you copy it from a USB key, or a CD, or from a shared disk, Gatekeeper won't see it. If you compile it on your system, Gatekeeper won't see it.
Slashdot Mirror
That's interesting. Is there any way to fund a BTC wallet with real world money that doesn't require deliberately lying about your identity?
His point is that your statistics don't back your argument. Saying 80% of DEA arrests are for users does not constitute evidence that the DEA cares about busting people with $100 worth of LSD -- it doesn't really say anything about their emphasis at all, it's a gross generalization. In order for your point to prevail on your evidence, you must establish that dealers make up a proportion of the criminally liable population in excess of 20%.
It's not clear how you're funding this wallet in the first instance. At some point you're going to have to wire some money to an exchange or pass it through Dwolla or BitInstant, both of which keep logs of everything, and in the case of BitInstant, it's a US company and will get you on security cameras at a 7-11 or a Walmart. You can juggle the money from BTC endpoint to endpoint as much as you like, but all the transactions are public record and lead back to the funding event.
Bernie Madoff always kept telling himself that he'd make back his client's money, he just needed a few good months on the market and all would be right again...
My experience with Mt. Gox, let alone Silk Road, is that digital entities (with either anonymous or inconsequential, unregulated "meatspace" personality) can be quite casual about fiduciary duty. Even if (particularly if???) they have good intentions.
OTOH, as a delivery system for illegal drugs, this system probably works great, or at least an order of magnitude better than the 1990s state-of-the-art in drug buying; if the worst crime a dealer can practice upon you is larceny, that's Progress!
That was supposed to be the whole point of Facebook. It's easy to "like" anything, but having a relationship graph gives you the context necessary to decide who the hell is "liking" something in the first place, and what that means. It all starts to break down when people friend anyone will-nilly, or sell their friendship to bots.
The problem is that friendship on Facebook (or Google Plus, for that matter) is an exhaustible resource. They'd probably kill fake accounts dead if they rationed the number of friends you're allowed to make, and only allowed people to create new accounts on the basis of several invitations and community rating -- essentially a proper web of trust.
Of course the whole business model for these sorts of sites is to bilk advertisers with clickfraud, and bots with phony accounts are a great way of doing that, so the goal isn't to eliminate phony accounts or friend relations, but to find the perfect balance of just enough humans to make the ads profitable, and advertisers feel like they're actually hitting an eyeball every now and then.
Basically you're saying that no one should have an entry in the whois database because we can't have nice things.
The whois was just one way of doing this, I'm sure more than a few people's mailing address can be obtained from a google search (I know mine can, I've had to post too many PDF resumes.)
The problem is Apple and Amazon use knowledge of a mailing address as a credential, in the same way that many silly organizations use knowledge of the last four of your SSN.
While voting should be secret, it seems bizarre that people should go around trying to change their neighbor's lives with laws all while claiming the process is none of their neighbor's business. I'm a very staunch Democrat but I don't mind publishing petition signatures, for example. The idea that politics is this process that works by remote control from the privacy of your home, instead of constant face-to-face confrontation, challenge, debate and social interaction is poisonous. IMHO.
As long as the specter of the 2000 election still haunts left-wingers, and Republicans remain the Jesus party, the Democrats can afford to lose quite a few people to quixotic identifications, because they'll always come back. Lefty "cosmotarian" libertarians have no one to vote for, and rightist paleos are stuck throwing their vote away on whoever the LP candiate is, and LP/Constitution Party internal politics make the Democrats look like an elementary school student council debating field trips.
This is the US. We have plurality first-past-the-post, winner-take-all elections. The system is designed to prevent you from voting for pure ideology.
It'd be nice if phone manufacturers actually used that freedom to make phones with a variety of features at the bleeding edge, instead of just bashing out a buncha iPhone killers. Who cares how much freedom Google gives manufacturers if manufacturers don't use it.
I consider all TI silicon second-rate. But I'm a bit of a prick :)
Handsets with keyboards, not handsets that let you bring your own laptop keyboard.
And the GP is right, for all of the talk about the freedom to "choose" in the Android ecosystem, the top of the line phones, the ones that are meant to meet the iPhone on performance, are all basically identical -- large screens, no keyboards, lotsa camera, AMOLED screen, removable battery, 4G. Candybar-format phones with hardware keyboards are also-rans running Eclair or Froyo, or only available on Sprint, and with second-rate processors. The best hardware keyboard phone, if we admit sliders, would probably be the Droid 4, which came out a month ago(?), and it ships with friggin Gingerbread and a brand-X CPU.
You know there is a difference between an allegation and a conviction, right? What if an accuser is mentally deranged, or what if she is raped by a family member and is accusing someone else in order to protect the real criminal? Or what if she just makes a mistake? Even if the accused has an solid alibi, her accusation is prejudicial and will ruin his life.
Guilt is for a court to decide, not some hacks on the 7PM news and a mob with signs and pitchforks -- which in America is what passes for "morality."
Except at the ballot box.
Many manufacturers sell items to foreign markets, but only wholesale, and leave the marketing to the retailers or importers, in which case a "Marketing" guy is actually going to have a very different job description than a "worldwide marketing" guy.
Also Phil probably has the title in his contract.
I'm not sure how any of this vindicates Curt Schilling's ethics, which is the matter in question here. Nobody forced him to do anything, of course he was desperate to keep his company going, but a lot of people have been desperate in the last 4 years to keep themselves fed, let alone their software companies in the black. Being ethical requires more than simply doing the cheapest and most effective thing for you at this moment.
When anyone acts in any marketplace and makes certain decisions, they can create a situation where adverse selection makes people work against their long-term best interests. If you sell cigarettes for less than the cost of cancer treatment, the outcome is often calamity; if you sell gasoline for less than the price of carbon-resequestration, the outcome is often calamity -- there's nothing evil about this, it's just the way these things are priced, and people make their decisions accordingly, and everyone walks away happy, until later when the externalities catch up to them. This is not an exclusive province of government action, any market actor that is sufficiently wealthy and stupid can induce inefficiency and deadweight loss, we simply call this waste good waste because nobody forced anyone to do anything.
It's meant to solve Apple's and Apple developers' problems, not yours -- it's more reliable, less crackable, and cheaper (up front) than eSellerate or Kagi.
Name one thing in the terminal that's "messy," as opposed to merely "different" from the way Linux, IRIX or SunOS works. All of those look pretty "messy" in the terminal, if you've only used one of the others.
A lot of those do. Mail does, the mothership process of Safari does not, but it's "Web Content" processes, the ones that present URLs, do. Quicktime Player does. Facetime and the Reminders app do, the Calendar does not, TextEdit does, the productivity apps don't -- it's pretty much hit or miss, I don't think there's any agenda to it, they just update the apps when they get around to it. I know they'd rather have most of their user-facing apps in a sandbox, so they can't be used as an exploitable surface to their underlying services (the camera API, the filesystem, the sloppy blob that is Quicktime...). Several OS processes run in a sandbox as well, like the metadata indexer and the pasteboard daemon, because they have to crunch through gobs of roudy and arbitrary data and are rather intimate with the underlying system.
But the sandbox and entitlements are about maintaining a chain of trust. If you don't trust the developer, in this case the organization known as Apple Inc, you shouldn't be running anything they make, starting with their OS and hardware, so the question is sorta mute.
If you go back to the article Ament links to, their complaints are:
None of these, save the last one, have anything to do with sandboxing. The last one does, but I don't understand it, because access to the user's calendar and photos are explicitly-defined entitlements that you can access, all you have to do is check a box in Xcode. A sandboxed app cannot access the filesystem of the computer, except for paths specifically named by the user in an Open or Save dialogue (the dialogue boxes are run by a separate daemon that passes the paths to the client application over IPC, so you can't futz with it to pick open more of the user's fs than they specifically let the application see.) Obviously this is deadly to bulk renamers, but I don't understand the complaint in the context of document creation, utilities or accessories, games, or really anything but document indexers -- which would have to just be sold the old fashioned way, on a website.
Number of players: zero.
Agreed, though he would have maxed his geek points if he'd implemented his machine emulator with Minecraft Redstones.
Here are some videos. He represents the phones as unmodified, though running an old version.
The distance isn't so much of an issue because he was able to use an NFC tag, not a transmitter, not an active device of any kind, but a mere tag to cause the phone to switch on its bluetooth radio and give him a sudoer's command line over the BT radio. An attacker could hide an NFC tag in a table or at waist level in a public place, or in a tag that's disguised to be legitimate, where people are liable to stand for more than 10 seconds: the tag cracks the phone open, and then someone with a laptop within BT distance conducts a brief session to grab what they can, or install a rootkit.
If an executable has sufficient privilege to run an arbitrary command, it can accomplish everything the effective UID allows it to. You still have all the second-line defenses, Unix permissions, Kernel and library ASLR, the Firewall, the signed entitlements system (if it applies)...
The trick is getting a browser to call system(); this problem exists now and it's extremely difficult. Library ASLR has pretty much defeated it.
All libraries and frameworks, including their bundled static resources, images, strings files, and so on, must also be signed.
Any executable that's downloaded is "tainted." Mach-O executables carry their certificates and checksums as metadata segments in the executable, and if you don't have those, or they don't resolve to a certificate with an Apple signature, Gatekeeper will stop it from running according to the user's preference setting.
Taintedness can be removed with
to delete it (it's stored in the filesystem extended attributes), or by launching the app from the "Open" command contextual menu. It will not launch by double-clicking, Apple-O'ing, or with Apple Events (like Firefox would do).
Fortunately it's a five-second fix: Control-click on the app and select "Open." This whitelists the app, regardless of its credentials.
NB. Gatekeeper only works on applications that are downloaded subsequent to Gatekeeper being installed. If you had an app before, Gatekeeper won't see it. If you copy it from a USB key, or a CD, or from a shared disk, Gatekeeper won't see it. If you compile it on your system, Gatekeeper won't see it.