Look at studies of proportions people in jail vs. social and racial groups, you'll see what the real picture is.
First, the number of people in jail is a different thing than the number of people who commit robberies and violent crimes. In fact, most people in jail are there for nonviolent drug offenses. Second, I'm speaking to motivations, which cannot be determined by looking at races unless you believe race plays a significant role in motivating people and can statistically show how. Third, the most popularly cited study on the correlation I speak of was normalized for social groups as part of the analysis.
You do realise that the vast, vast bulk of exploited Windows machines weren't "pwned" by any sort of remote attack, right ?
You've made this claim before, but I've never seen you provide support for it. Most infections by number are remote with no user interaction.
Servers have _completely_ different risk and exposure profiles to desktop - particularly unmanaged desktop - PCs. So different that even trying to draw conclusions about one based on the other is laughable.
Yeah, which is probably why the previous poster used it to demonstrate that the concept being presented was flawed, as it does not hold true in all cases. Thus the burden of proof shifts to those claiming that market share is the only important factor, since it has been proven this is not always the case.
Except at the system level, Windows's security model is (relatively) quite solid.
He was using "system" to refer to the Windows desktop system that most people have to deal with, not some component of the core architecture, which he pretty clearly conveys using examples. He's saying Windows plus the included software as it makes its way onto the average user is flawed.
Both sides of the Microsoft vs ODF battle are special interests.
No. One side is a vendor neutral policy created by the state and aimed at improving the technology used by the state. The other is one company lobbying the government to get rid of the vendor neutral policy and standardize only their company as a supplier. Appointing an employee of one of the companies bidding as your tech advisor is not exactly indicative of impartial decision making.
As far as moral jusification goes, I argue that there is plenty of wealth disparity right here in the US to "justify" any criminal behavior a person might engage in.
You're missing the point. Greater wealth disparity correlates with increased rates of robbery and many other crimes. It's not a case of "is there enough wealth disparity?" It is a case of wealth disparity being an order of magnitude greater and thus predictably crime rates with regard to that disparity are higher. This is statistics and quantifiable.
Especially if said criminal is already of an entitlement mentality.
This is an attempt to apply a correlation to predict a given specific case. Specifics are useful for assigning blame or determining ethical responsibility. That is not what I'm trying to do and I don't see a lot of value in trying to do that unless you're looking at an individual case, at which point we should look to the facts, not statistical likelihood.
When it comes to (criminal) hacking, or any other illegal activity, the smart perp will consider the risk-reward of his behavior. Unless the potential payoff of a crime is significant, it simply does not make good economic sense to do it.
This is a common perspective, but there is another motivation that comes into play. Most people are bound mostly by moral reasons to not commit crimes. What is interesting with computer crimes is they could easily have been a predicted consequence of globalization. Crime correlates strongly with wealth disparity. This speaks to both the risk/reward you mention and the ability of criminals to justify their behavior to themselves. Opening up the global market brings people with vast wealth disparity into the same arena. It would be surprising if a hacker in some poor country did not turn to crime which can pay him a year's salary in a day for a low risk crime and at the same time be robbing those fat Americans and Europeans born into extreme luxury while they have had to work long hours just to feed themselves.
First of all the novelty of an alarm system is notification of the police, who job it is to *gasp* uphold the law.
This is untrue. The chances of the police responding in time to do anything is very slim. The main purpose is to alert the owner and other people nearby, thus increasing the risk of this particular robbery or crime. It is the job of the police to investigate crimes, but they have neither the manpower or the will to prevent crime.
There are plenty of processionals that can or profession demands the ability to pick locks, bypass alarm systems and assault a building in a manner that would make a gun have very little effect.
Relative to the general populace or to the criminal populace, this just isn't true. Locks are easy to pick, alarm systems can be bypassed, but very few criminals take the time to do either when there are easier targets.
Perhaps the knowledge that maybe losing a chunk of your life to jail may put some second thoughts into these people.
Threat of punishment is a motivational factor, but surprisingly, not a very significant one. Studies have shown people in general believe they can get away with crimes without being caught. The main motivation for not committing them is actually a moral one. People do not feel justified in robbery. One of the strongest correlations with robbery and violent crime worldwide is wealth disparity. In places where some people are very poor and others are very rich, despite the rich not necessarily working harder or being smarter than the poor, the rates of these crimes is higher. It is easy to justify robbery when you were born into debt while others were born into extreme wealth. And that is exactly what people do.
The problem is that we're living in a world where a computer user has to be able to do the equivalent of changing the oil in his own car -- some people can, but most people can't.
I'm a pretty expert user. I have a very good grasp on security. If I'm running a Windows box and want to run an executable I don't know if I can trust, it is not easy. Sure I can make a new user account, lock that account down, use "run as," and hope the executable does not take advantage of any of the common local escalations in Windows. Or I can install a VM and run the executable in the VM on top of Windows and hope that works, for some types of executables. I don't think either of those situations, however, is equivalent to changing the oil on the car. Maybe one person in 10,000 knows how to properly lock down a user account. More can probably install and run a VM, but at a great deal of additional cost. Realistically, just running it and hoping for the best is the only convenient solution within the abilities of a normal user.
So given that running a random executable (be it a game or an installer for something, or some other software a user wants to try) is a common task that is very, very hard to do safely, I think your analogy is way off.
. Let's say openSUSE replaces Windows as the dominant operating system, I think you'll find that the number times that they are "pwned" will increase significantly. If it's on a network then it's not secure, if someone really wants to screw with your systems then they will figure out how.
Wider adoption of a given Linux distro will increase the number of them compromised. That does not mean it will ever be as bad as Windows is now and let me tell you why. OpenSUSE cannot maintain a monopoly lock-in. It is GPLed and can be forked. That means the developers of OpenSUSE will always be motivated to solve security issues. Microsoft is not strongly motivated to do that.
If OpenSUSE had 90% market share it would be compromised regularly. It would be targeted by worms and trojans and the like. It would also adapt to prevent those problems and address security proactively and reactively. Because it is GPL, there would be little or no motivation for people to use really old versions and if they did, there would still be people providing automated security patches for those versions. It would never get to the state where automated worms compromising thousands of machines daily is commonplace.
You're looking at this in terms of the respective security technologies in the two OS's, but you're missing the underlying causes of those security technologies. The real problem here is that Windows is a monopoly on the desktop and the result of that is a product that dominates, but does not respond to the needs and wants of consumers.
Computer security is a state of mind. Maybe if the internet was more like a construction site, where not being safe = losing a finger... people might take the time to learn how to anticipate threats instead of just blindly applying a set of rules.
But that's the problem. A construction site is an unusually dangerous place so people use extra caution. There are signs and common safety procedures and everyone allowed in is supposed to be a construction worker specially prepared for these risks. Right now it is as though almost every restaurant, playground, store, and sidewalk was held to the same safety standards as construction sites and it is common for everyone to buy and wear a hardhat most of the time. This is unacceptable.
If you want to do a real comparison you should compare the Linux desktop to the Windows desktop. Your average Linux desktop is a security nightmare.
You're mistaken. The average Linux desktop is a potential security nightmare, not an actual one. This is because most of the threats you address are not common on Linux so solutions are not as important. I contend that because of the development models, if such threats do become common on Linux, the security changes needed to deal with them will become common because developers are users and are motivated. The same is not true on Windows, because insecure, commonly compromised Windows boxes don't cost the developers any significant amount.
The underlying problem at the system level is the system, which is basically the same regardless of whether you use Windows, MacOS or Linux. The UNIX/NT security model is incapable of solving the problem of malicious software, period.
Windows, OS X, and Linux all have mandatory access controls, application trust verification, UI reforms, etc. in a semi-usable state. For any system besides Windows, they will become commonly deployed as soon as there is a need. The problem is motivating Microsoft (financially) to do the same.
We're taking the wrong approach to security. You can fight the symptoms like we have been doing and this will cost a LOT and never really make the system secure. Or you can fight a cause and however much it costs you that problem is solved for good.
Agreed.
The biggest problem is C and all the other non-typesafe languages.
I think you're still attacking the problem at too low of a level. How do you get everyone to switch languages? What is the motivation? What about existing software?
Then it's just the higher-level problems like impersonating web pages, xss, some trojans, that kind of thing. Still a problem, yeah, but without the entire class of automatic propagation it is so much less of one.
Again, much of this can be mitigated if OS designers are properly motivated to do it. If we attack the problem at a higher level yet, this too will be largely mitigated.
In my opinion the solution is simple. All we have to do is properly enforce existing laws. If the US DoJ ordered Microsoft broken up into multiple companies, at least two of which had all the rights to the Windows code base and ordered all their file formats and protocols documented this problem would go away. The cause of most malware is greed. The solution is the same thing. If there were two vendors of Windows, each making changes going forward and forbidden from collusion, their stranglehold on the desktop OS market would be gone. The new companies would have to compete with one another and actually solve these problems and they'd do it to, because it would make them money. Also, alternative's to Windows would no longer be locked out so those OS's could enter the market properly and likewise compete. The solution is simply reestablish the free market and let competitive innovation solve the problem as it should.
Linux isn't in the same class target wise as Windows simply because it isn't the OS of choice for Joe Sixpack.
In my opinion the fundamental problem here is that Windows is not the OS of choice for Joe Sixpack. He just buys a computer and Windows comes pre-installed. If he made a choice the competitive market would solve the malware problem.
When that happens, I feel you will see just as many stupidly successful attacks as you see today in Windows. Why? Because the targets will be those same people that use "password" or "12345" for their security.
It's easy to blame the user, but most infections of malware today involve no user interaction. Even for those that do, a properly designed OS can mitigate most of those problems.
The security of any system, be it Linux, Unix, Windows, OS X, etc... Is solely dependent on the one at the keyboard and unfortunately all too often that person is an idiot.
Scenario 1: malware is downloaded, the OS checks the binary against a known list detects and deletes it and blacklists the host you got it from. Have a nice day. Scenario 2: malware is downloaded and run and infects the user with no warnings from the OS. Is the OS in scenario 1 more secure than in scenario 2, or is the user at fault? Obviously the OS matters. Since I've demonstrated that conceptually the OS matters, all that remains to debate is how much it matters. The answer is a whole lot. Windows and most desktop OS's have really lousy security. New binaries should be sandboxed and restricted by default. The OS should tell you what they're doing and give you the power to decide what it can and can't do. Fix the OS first, then worry about the "idiot" user.
Yeah, if only there were some support for that opinion, like MS having been convicted in court of criminally abusing their monopoly in that specific way and fined millions for failing to stop that abuse... oh wait. Dumbass.
There is plenty of demand for something that does what Exchange does.
Almost all office desktops are Windows machines. Those machines have the exchange protocol built in, and so does MS office. That being the case, a sysadmin can either install an all new toolset and put together a server, or they can just go with exchange which is much easier. Most do the latter. If exchange were not built into Windows and office, it would have competition. If the exchange protocol were open and documented as required by law, their would be alternative server implementations that compete. As it is, many shops just buy one exchange server and run everything else on Linux.
It's all very well saying that you were simplifying your argument for simpletons like me, but you've quite plainly stated that you think that many game developers are stupid, when you don't seem to have demonstrated having any experience of the field yourself.
Commenting in a thread where you haven't read the previous posts and thus don't know what is being discussed is a bit rude, but forgivable. Posting a second time, however, where you obviously did not bother to go back and read to find out what the hell you're talking about after someone called you on it is beyond that. Further, making comments about how I plainly stated some group is stupid, when I did no such thing is bordering on flamebait. Go read the previous posts if you want to take part in this discussion.
Ok, so why not add healthcare into the picture then? You don't want to part with an additional.10 on the dollar for that? At least provide it for people who are between jobs, laid off.
I wasn't speaking to what the best balance was with regard to particulars. If we're looking to increase standards of living, adding healthcare and instituting progressive inheritance taxes on the high end would be two socialist measures that would pull the US to a more balanced position and likely help the standard of living greatly.
US is still the most capitalist country in the world.
In some ways maybe, but certainly not in others. We regulate lots of industries more-so than other places. Drugs, telecom, etc. are good examples. There are lots of places in Africa, for example, where I can go buy anything I want without government interference, often without even any taxes.
The job market in the US is the best there is. Not Canada's, Germany's, Sweden's, or whatever... All those practice "socialism" on a grand scale, yet suffer in many ways.
Independent studies have not concluded the same thing. The US practices as much socialism as most of Europe, we just spend the money on different socialist programs, like the military.
I suppose it's a matter of trade offs, but I like the tradeoffs the US has made here better than in other developed countries.
Well, everyone has a preference I suppose. How many other countries have you lived in?
Right. And what works doesn't capture the attention of certain countries because their leaders allegedly know better. So they fly airplaines into buildings.
All countries have leaders that think they know better. People fly buildings into airplanes because they are angry, often because we've given them a lot of reasons to be angry.
I opted for no don't do it, because that's what works, and I know this from prior experience.
It is hard to balance practical considerations with ethical responsibility. I'm not about to judge anyone else's choices in that regard.
...yeah, smack your boss with your moral values type of arguments, up. If he does that, he's bound to lose his job.
That is likely, but sometimes losing your job is the best thing to do. I'm not a mercenary. Sure I do contract work, but I also work for an employer to whom I feel loyalty because of ethical considerations. If not for those, I could make more money elsewhere. I don't, because money is not the most important thing in my life. I'm not even talking about abstract morals here, but quality of living. I'd rather work for a boss I like and who grabs me a beer from the fridge at 9am, without looking at me funny than make another 40K and retire sooner.
9 out of 10, morals only get in the way. The one time where you should hold onto them is very rare...
Discussion of morals is pretty pointless. They are subjective.
Slashdot is, in my opinion, a bunch of fucking retards. About 3 people, you, Geoff and the missile guidance guy, made any fucking sense whatsoever. The rest is just some emotional/belief/moral drivel, completely misplaced and out of context.
There is an increasingly high noise to signal ratio on Slashdot, but there are still more intelligent and knowledgeable people here than most forums. This particular discussion is less technical and thus probably has more subjective and useless opinions than most. The solution is easy, move on. I think I will right now.
The point of the question is: WHERE IS THE OPEN SOURCE ALTERNATIVE?
There are numerous open source exchange replacements. There are even more projects and protocols that replicate one part of the functionality. None of them are very widely adopted, however, because everyone is locked into exchange. If not for MS's monopoly abuse with that regard, there would be a demand for such a server and I imagine there would be one or more mature and common solutions by now.
If not, why not?
No demand due to MS's monopoly abuse.
Its like Excel, in that whatever you come up with, it WONT be better, but maybe just as good? At what point, when you cant win the game, do you just CHANGE the game so you can win?
Umm, what? I have no clue what you're trying to say here.
Who needs a tinfoil hat? Have you been living in a cave? It has been standard procedure for many large companies to fund the publication of "scientific" studies for many, many years. If you aren't aware of it, the chances are you have read some unknowingly. Heck, it is not even uncommon for "news" programs to run advertisements made to look like news announcements in the middle of the news with no disclaimers.
t least I know when I submit my papers to the AIAA they are peer-reviewed by PhD's and that when I pick up a journal from them, those papers have been too.
No you don't. You trust they have been, but you don't know they have been. For all you know News Corp bought AIAA last month. And even if they have been peer reviewed, maybe those PhDs were incompetent twits. I've met enough of them in my day to know they are plentiful. Or maybe PhDs who are very competent read the paper and wrote a rebuttal about how the data conflicts with both their data and that of several other ongoing research projects, but that rebuttal has not been published anywhere you read.
If you rely upon one source, without checking the references and without seeing what other journals have to say, you're just taking it on faith.
There have been cases of 'vandalism' per see where an expert in her field has posted a perfectly valid page on Wikipedia and then had it changed by someone who doesn't understand the underlying science.
Sure there have. And there have been cases of print encyclopedia having intentional lies and data that is simply wrong or out of date. The question is, does the many eyes many hands approach to wikipedia increase or decrease the chances of the information being correct? Statistically, it seems to increase the chances of the data being right, especially for certain topics.
A system that allows that is not a system that can be relied on for any meaningful data.
My point is, no one system can be relied upon for meaningful data. If you're going to rely upon only one system, however, you've not shown any evidence that wikipedia is any worse than average, aside from your unscientific conjecture that you think that is the case. Gather data first, then propose a conclusion, remember?
Our govt. has also become smart about "handling the poor" so they don't rise up in protest. Welfare programs abound...
The situation is actually quite analogous to ancient Rome. They too had a republic with bread and circuses to keep the people pacified while a few ultra wealthy controlled things. Is that where the comparison ends? Nope. They had slaves and subjugated nations doing the hard labor while the locals lived in relative ease. That holds true. So what happened? Well, maybe the germans will invade and crush us, but more likely we will decline and stagnate like the Romans while other places will have more progressive societies. Already we're slipping technologically as research and initial implementation move overseas. Jobs requiring higher education are being outsourced every day. Eventually, the empire sort of collapses, weakened on many fronts.
I have no doubt the US too will fall, whether to outside forces, internal ones or a combination of the two. Unless those in power look to the past and care to use that lesson to shape the future, it is inevitable.
Do you think that industry-created "think tank" fronts are in any way comparable to scientists working on grants? Have you considered that a scientist who fakes evidence and fudges numbers to garner reputation is taking a tremendous risk of being utterly discredited and never trusted again...
Yes, but those scientists are mostly working to get grants, and fudging numbers can do that for them. My girlfriend works in a bookstore. Up until about a year ago, however, she was a biochemist. She quit the field entirely after years of job after job where she was constantly asked to make up numbers, change numbers, sign her name to grant requests and papers that conveniently failed to mention the obviously biased and nonstandard methodologies used, etc. She delivered a photocopied page of her lab journal to the dean of the department at a major research university. On that page, her boss had written "add 20% to all these numbers" for some cancer research that was ongoing. The dean was more concerned she might talk to the press than in doing anything about correcting the situation. He still runs the lab and was not punished in any way. A friend in the next lab commented to her a few weeks after she quit that "They hired a chinese woman who can hardly speak English and needs work to stay in the country. She won't make any noise like you did."
What does my anecdote prove? Nothing. Nonetheless, you might want to rethink your faith in researchers' concern over their reputations as compared to their desire to get that grant funding.
Yeah, because the entire population of the US is going to rise up against it's oppressors simultaneously...
I said 50% of the men in a certain age range, not in the military. It would take a lot less than that to actually change the course of things.
Get real. The middle class don't care, the lower class is too poor to do anything, and the upper class likes things the way they are.
The middle class is vanishing. The upper class is concentrating itself. The lower class is growing and being poor makes it more likely you will take part in a revolution. Wealth disparity is a huge motivator.
Combine that with a mass propaganda campaign against any likely insurgent groups, and the chance of an uprising catching any level of support are essentially zero.
Ahh yes I can see the propaganda now, "You're not starving, there is plenty of food, your children are not about to die." Take away television or enough food or booze and the people will rise up and overthrow the government. Just take a look at the "war on drugs." Most of the population already disobeys it. A huge portion of the population is locked up. There may come a time when the imprisoned population and those peripherally effected becomes too large to contain.
Under the right circumstances, there is very much a nonzero chance of a revolution, but it won't be over the issues currently being discussed.
I believe the point is this: if you have a small scale uprising then small arms won't help, you'll get branded as terrorists, get little sympathy from the general populace, and at best provide a nuisance; if you have a large scale uprising then you can be just as effective without small arms in the hands of ordinary citizens - just having mass protests with people standing up nd saying "No" will do the job as well as anything else.
First, who is to say what is small and what is large? What if you have a medium sized uprising? Second, no a large scale uprising without firearms won't work just as well. If you are no danger to the people in charge and the people enforcing their wished (police or military) then they can just round up and shoot you. Take a look at Nazi Germany for an example.
You might like to point out that the insurgents in Iraq are doing well - except they are not threatening to overthrow Iraq, not while the US military remains there.
While it is not their main goal, they are threatening to force the US out of Iraq, not through sheer force of arms but through a combination of attrition and the political response to that attrition.
You're not going to get that when you're fighting a war in the US with US civilians as the collateral damage of the conflict. Either you have the support of the general populace, or you don't.
Not so. The more people that are killed or imprisoned the more people will disapprove of your actions and you lose that approval.
The more violent you get, the less likely you are to gain support from the general populace.
This doesn't matter if your goal is not to gain power for yourself but to remove those in power. The people can simultaneously disapprove of the resistance and the existing regime that causes the resistance and cannot effectively suppress it. And if they do effectively suppress it, the means will likely lose them even more support.
If all those people, instead of arming themselves, simply take to the streets in coordinated mass protest calling for a change in government and or refusing to follow government directives then what is the government to do?
So far, building one of the largest police forces and prison systems in the world and locking them all up in prison has worked. It's called "the war on drugs" remember?
The more harshly you try to suppress the protestors the less likely the military are to follow the orders given.
So here are two things you're missing. An armed resistance can present more resistance for the same number of people. An unarmed people can be pacified without resorting to shooting them, which is what is most likely to cause the military to stop. The threat to the soldiers is also a factor. A soldier does not want to go onto the streets and shoot it out with some 16 year old kid, endangering his own life in the process in order to promote something they do not believe in. That same soldier might be willing to go use CS gas to pacify the teenager without killing them and ship them to a detention facility.
All of this, of course, presumes freedom of speech. If there is no freedom of speech and free press then the government can violently suppress protest with little concern for any repurcussion: think Tiananmen square.
But if the government does effectively suppress free speech, you probably won't know. An armed resistance is a necessary check in our system of checks and balances both as a deterrent and as an indication of when other rights may have been silently lost.
We'll have to agree to disagree on this one. But keep in mind, the right to bear arms has already been used to overthrow local government oppression.
But seriously, I think the problem with many environmental groups is that that tacitly support the extreme radical groups like PETA, Earth First!, the Animal Liberation Front, etc.
I think your assertion is offensive. You might as well write that the problem with christian groups is that they tacitly support radical groups like the KKK and Anti-abortionists. Many environmental groups do speak out against the organizations you speak of. To claim that "environmentalists" support them in general is nothing but an empty assertion.
And many of those that "get it" don't get it. You can no longer reshape the government with FORCE by bearing arms. Their guns are much bigger than our guns.
I think maybe you don't get it. Small arms are effective for a civil war. It's not like the government can nuke cities within its own borders without creating even more rebels elsewhere. Also, in most civil conflicts a significant portion of the military sides with each faction. So the guns they have are also the guns we have, in some proportion.
Even to put this in terms of simple numbers, if the entire military had chips installed so they always followed orders and half the able men 18-30 not in the military rose up and lost at a rate of 100 people to kill one brainwashed soldier, there would still be some left over in addition to the rest of the populace.
Slashdot Mirror
Look at studies of proportions people in jail vs. social and racial groups, you'll see what the real picture is.
First, the number of people in jail is a different thing than the number of people who commit robberies and violent crimes. In fact, most people in jail are there for nonviolent drug offenses. Second, I'm speaking to motivations, which cannot be determined by looking at races unless you believe race plays a significant role in motivating people and can statistically show how. Third, the most popularly cited study on the correlation I speak of was normalized for social groups as part of the analysis.
Get a clue.
You do realise that the vast, vast bulk of exploited Windows machines weren't "pwned" by any sort of remote attack, right ?
You've made this claim before, but I've never seen you provide support for it. Most infections by number are remote with no user interaction.
Servers have _completely_ different risk and exposure profiles to desktop - particularly unmanaged desktop - PCs. So different that even trying to draw conclusions about one based on the other is laughable.
Yeah, which is probably why the previous poster used it to demonstrate that the concept being presented was flawed, as it does not hold true in all cases. Thus the burden of proof shifts to those claiming that market share is the only important factor, since it has been proven this is not always the case.
Except at the system level, Windows's security model is (relatively) quite solid.
He was using "system" to refer to the Windows desktop system that most people have to deal with, not some component of the core architecture, which he pretty clearly conveys using examples. He's saying Windows plus the included software as it makes its way onto the average user is flawed.
Both sides of the Microsoft vs ODF battle are special interests.
No. One side is a vendor neutral policy created by the state and aimed at improving the technology used by the state. The other is one company lobbying the government to get rid of the vendor neutral policy and standardize only their company as a supplier. Appointing an employee of one of the companies bidding as your tech advisor is not exactly indicative of impartial decision making.
As far as moral jusification goes, I argue that there is plenty of wealth disparity right here in the US to "justify" any criminal behavior a person might engage in.
You're missing the point. Greater wealth disparity correlates with increased rates of robbery and many other crimes. It's not a case of "is there enough wealth disparity?" It is a case of wealth disparity being an order of magnitude greater and thus predictably crime rates with regard to that disparity are higher. This is statistics and quantifiable.
Especially if said criminal is already of an entitlement mentality.
This is an attempt to apply a correlation to predict a given specific case. Specifics are useful for assigning blame or determining ethical responsibility. That is not what I'm trying to do and I don't see a lot of value in trying to do that unless you're looking at an individual case, at which point we should look to the facts, not statistical likelihood.
When it comes to (criminal) hacking, or any other illegal activity, the smart perp will consider the risk-reward of his behavior. Unless the potential payoff of a crime is significant, it simply does not make good economic sense to do it.
This is a common perspective, but there is another motivation that comes into play. Most people are bound mostly by moral reasons to not commit crimes. What is interesting with computer crimes is they could easily have been a predicted consequence of globalization. Crime correlates strongly with wealth disparity. This speaks to both the risk/reward you mention and the ability of criminals to justify their behavior to themselves. Opening up the global market brings people with vast wealth disparity into the same arena. It would be surprising if a hacker in some poor country did not turn to crime which can pay him a year's salary in a day for a low risk crime and at the same time be robbing those fat Americans and Europeans born into extreme luxury while they have had to work long hours just to feed themselves.
First of all the novelty of an alarm system is notification of the police, who job it is to *gasp* uphold the law.
This is untrue. The chances of the police responding in time to do anything is very slim. The main purpose is to alert the owner and other people nearby, thus increasing the risk of this particular robbery or crime. It is the job of the police to investigate crimes, but they have neither the manpower or the will to prevent crime.
There are plenty of processionals that can or profession demands the ability to pick locks, bypass alarm systems and assault a building in a manner that would make a gun have very little effect.
Relative to the general populace or to the criminal populace, this just isn't true. Locks are easy to pick, alarm systems can be bypassed, but very few criminals take the time to do either when there are easier targets.
Perhaps the knowledge that maybe losing a chunk of your life to jail may put some second thoughts into these people.
Threat of punishment is a motivational factor, but surprisingly, not a very significant one. Studies have shown people in general believe they can get away with crimes without being caught. The main motivation for not committing them is actually a moral one. People do not feel justified in robbery. One of the strongest correlations with robbery and violent crime worldwide is wealth disparity. In places where some people are very poor and others are very rich, despite the rich not necessarily working harder or being smarter than the poor, the rates of these crimes is higher. It is easy to justify robbery when you were born into debt while others were born into extreme wealth. And that is exactly what people do.
The problem is that we're living in a world where a computer user has to be able to do the equivalent of changing the oil in his own car -- some people can, but most people can't.
I'm a pretty expert user. I have a very good grasp on security. If I'm running a Windows box and want to run an executable I don't know if I can trust, it is not easy. Sure I can make a new user account, lock that account down, use "run as," and hope the executable does not take advantage of any of the common local escalations in Windows. Or I can install a VM and run the executable in the VM on top of Windows and hope that works, for some types of executables. I don't think either of those situations, however, is equivalent to changing the oil on the car. Maybe one person in 10,000 knows how to properly lock down a user account. More can probably install and run a VM, but at a great deal of additional cost. Realistically, just running it and hoping for the best is the only convenient solution within the abilities of a normal user.
So given that running a random executable (be it a game or an installer for something, or some other software a user wants to try) is a common task that is very, very hard to do safely, I think your analogy is way off.
. Let's say openSUSE replaces Windows as the dominant operating system, I think you'll find that the number times that they are "pwned" will increase significantly. If it's on a network then it's not secure, if someone really wants to screw with your systems then they will figure out how.
Wider adoption of a given Linux distro will increase the number of them compromised. That does not mean it will ever be as bad as Windows is now and let me tell you why. OpenSUSE cannot maintain a monopoly lock-in. It is GPLed and can be forked. That means the developers of OpenSUSE will always be motivated to solve security issues. Microsoft is not strongly motivated to do that.
If OpenSUSE had 90% market share it would be compromised regularly. It would be targeted by worms and trojans and the like. It would also adapt to prevent those problems and address security proactively and reactively. Because it is GPL, there would be little or no motivation for people to use really old versions and if they did, there would still be people providing automated security patches for those versions. It would never get to the state where automated worms compromising thousands of machines daily is commonplace.
You're looking at this in terms of the respective security technologies in the two OS's, but you're missing the underlying causes of those security technologies. The real problem here is that Windows is a monopoly on the desktop and the result of that is a product that dominates, but does not respond to the needs and wants of consumers.
Computer security is a state of mind. Maybe if the internet was more like a construction site, where not being safe = losing a finger... people might take the time to learn how to anticipate threats instead of just blindly applying a set of rules.
But that's the problem. A construction site is an unusually dangerous place so people use extra caution. There are signs and common safety procedures and everyone allowed in is supposed to be a construction worker specially prepared for these risks. Right now it is as though almost every restaurant, playground, store, and sidewalk was held to the same safety standards as construction sites and it is common for everyone to buy and wear a hardhat most of the time. This is unacceptable.
If you want to do a real comparison you should compare the Linux desktop to the Windows desktop. Your average Linux desktop is a security nightmare.
You're mistaken. The average Linux desktop is a potential security nightmare, not an actual one. This is because most of the threats you address are not common on Linux so solutions are not as important. I contend that because of the development models, if such threats do become common on Linux, the security changes needed to deal with them will become common because developers are users and are motivated. The same is not true on Windows, because insecure, commonly compromised Windows boxes don't cost the developers any significant amount.
The underlying problem at the system level is the system, which is basically the same regardless of whether you use Windows, MacOS or Linux. The UNIX/NT security model is incapable of solving the problem of malicious software, period.
Windows, OS X, and Linux all have mandatory access controls, application trust verification, UI reforms, etc. in a semi-usable state. For any system besides Windows, they will become commonly deployed as soon as there is a need. The problem is motivating Microsoft (financially) to do the same.
how many time do you plan to use that argument?
Constantly until the abuse stops.
"Linux going to take over the desktop" - 1999
Umm, this has jack and shit to do with anything I've said. If you can't even address my argument, why would anyone listen to you?
We're taking the wrong approach to security. You can fight the symptoms like we have been doing and this will cost a LOT and never really make the system secure. Or you can fight a cause and however much it costs you that problem is solved for good.
Agreed.
The biggest problem is C and all the other non-typesafe languages.
I think you're still attacking the problem at too low of a level. How do you get everyone to switch languages? What is the motivation? What about existing software?
Then it's just the higher-level problems like impersonating web pages, xss, some trojans, that kind of thing. Still a problem, yeah, but without the entire class of automatic propagation it is so much less of one.
Again, much of this can be mitigated if OS designers are properly motivated to do it. If we attack the problem at a higher level yet, this too will be largely mitigated.
In my opinion the solution is simple. All we have to do is properly enforce existing laws. If the US DoJ ordered Microsoft broken up into multiple companies, at least two of which had all the rights to the Windows code base and ordered all their file formats and protocols documented this problem would go away. The cause of most malware is greed. The solution is the same thing. If there were two vendors of Windows, each making changes going forward and forbidden from collusion, their stranglehold on the desktop OS market would be gone. The new companies would have to compete with one another and actually solve these problems and they'd do it to, because it would make them money. Also, alternative's to Windows would no longer be locked out so those OS's could enter the market properly and likewise compete. The solution is simply reestablish the free market and let competitive innovation solve the problem as it should.
Linux isn't in the same class target wise as Windows simply because it isn't the OS of choice for Joe Sixpack.
In my opinion the fundamental problem here is that Windows is not the OS of choice for Joe Sixpack. He just buys a computer and Windows comes pre-installed. If he made a choice the competitive market would solve the malware problem.
When that happens, I feel you will see just as many stupidly successful attacks as you see today in Windows. Why? Because the targets will be those same people that use "password" or "12345" for their security.
It's easy to blame the user, but most infections of malware today involve no user interaction. Even for those that do, a properly designed OS can mitigate most of those problems.
The security of any system, be it Linux, Unix, Windows, OS X, etc... Is solely dependent on the one at the keyboard and unfortunately all too often that person is an idiot.
Scenario 1: malware is downloaded, the OS checks the binary against a known list detects and deletes it and blacklists the host you got it from. Have a nice day. Scenario 2: malware is downloaded and run and infects the user with no warnings from the OS. Is the OS in scenario 1 more secure than in scenario 2, or is the user at fault? Obviously the OS matters. Since I've demonstrated that conceptually the OS matters, all that remains to debate is how much it matters. The answer is a whole lot. Windows and most desktop OS's have really lousy security. New binaries should be sandboxed and restricted by default. The OS should tell you what they're doing and give you the power to decide what it can and can't do. Fix the OS first, then worry about the "idiot" user.
Yeah, if only there were some support for that opinion, like MS having been convicted in court of criminally abusing their monopoly in that specific way and fined millions for failing to stop that abuse... oh wait. Dumbass.
There is plenty of demand for something that does what Exchange does.
Almost all office desktops are Windows machines. Those machines have the exchange protocol built in, and so does MS office. That being the case, a sysadmin can either install an all new toolset and put together a server, or they can just go with exchange which is much easier. Most do the latter. If exchange were not built into Windows and office, it would have competition. If the exchange protocol were open and documented as required by law, their would be alternative server implementations that compete. As it is, many shops just buy one exchange server and run everything else on Linux.
It's all very well saying that you were simplifying your argument for simpletons like me, but you've quite plainly stated that you think that many game developers are stupid, when you don't seem to have demonstrated having any experience of the field yourself.
Commenting in a thread where you haven't read the previous posts and thus don't know what is being discussed is a bit rude, but forgivable. Posting a second time, however, where you obviously did not bother to go back and read to find out what the hell you're talking about after someone called you on it is beyond that. Further, making comments about how I plainly stated some group is stupid, when I did no such thing is bordering on flamebait. Go read the previous posts if you want to take part in this discussion.
Ok, so why not add healthcare into the picture then? You don't want to part with an additional .10 on the dollar for that? At least provide it for people who are between jobs, laid off.
I wasn't speaking to what the best balance was with regard to particulars. If we're looking to increase standards of living, adding healthcare and instituting progressive inheritance taxes on the high end would be two socialist measures that would pull the US to a more balanced position and likely help the standard of living greatly.
US is still the most capitalist country in the world.
In some ways maybe, but certainly not in others. We regulate lots of industries more-so than other places. Drugs, telecom, etc. are good examples. There are lots of places in Africa, for example, where I can go buy anything I want without government interference, often without even any taxes.
The job market in the US is the best there is. Not Canada's, Germany's, Sweden's, or whatever... All those practice "socialism" on a grand scale, yet suffer in many ways.
Independent studies have not concluded the same thing. The US practices as much socialism as most of Europe, we just spend the money on different socialist programs, like the military.
I suppose it's a matter of trade offs, but I like the tradeoffs the US has made here better than in other developed countries.
Well, everyone has a preference I suppose. How many other countries have you lived in?
Right. And what works doesn't capture the attention of certain countries because their leaders allegedly know better. So they fly airplaines into buildings.
All countries have leaders that think they know better. People fly buildings into airplanes because they are angry, often because we've given them a lot of reasons to be angry.
I opted for no don't do it, because that's what works, and I know this from prior experience.
It is hard to balance practical considerations with ethical responsibility. I'm not about to judge anyone else's choices in that regard.
That is likely, but sometimes losing your job is the best thing to do. I'm not a mercenary. Sure I do contract work, but I also work for an employer to whom I feel loyalty because of ethical considerations. If not for those, I could make more money elsewhere. I don't, because money is not the most important thing in my life. I'm not even talking about abstract morals here, but quality of living. I'd rather work for a boss I like and who grabs me a beer from the fridge at 9am, without looking at me funny than make another 40K and retire sooner.
9 out of 10, morals only get in the way. The one time where you should hold onto them is very rare...
Discussion of morals is pretty pointless. They are subjective.
Slashdot is, in my opinion, a bunch of fucking retards. About 3 people, you, Geoff and the missile guidance guy, made any fucking sense whatsoever. The rest is just some emotional/belief/moral drivel, completely misplaced and out of context.
There is an increasingly high noise to signal ratio on Slashdot, but there are still more intelligent and knowledgeable people here than most forums. This particular discussion is less technical and thus probably has more subjective and useless opinions than most. The solution is easy, move on. I think I will right now.
The point of the question is: WHERE IS THE OPEN SOURCE ALTERNATIVE?
There are numerous open source exchange replacements. There are even more projects and protocols that replicate one part of the functionality. None of them are very widely adopted, however, because everyone is locked into exchange. If not for MS's monopoly abuse with that regard, there would be a demand for such a server and I imagine there would be one or more mature and common solutions by now.
If not, why not?
No demand due to MS's monopoly abuse.
Its like Excel, in that whatever you come up with, it WONT be better, but maybe just as good? At what point, when you cant win the game, do you just CHANGE the game so you can win?
Umm, what? I have no clue what you're trying to say here.
Oh. Sorry. Left my tinfoil hat at home.
Who needs a tinfoil hat? Have you been living in a cave? It has been standard procedure for many large companies to fund the publication of "scientific" studies for many, many years. If you aren't aware of it, the chances are you have read some unknowingly. Heck, it is not even uncommon for "news" programs to run advertisements made to look like news announcements in the middle of the news with no disclaimers.
t least I know when I submit my papers to the AIAA they are peer-reviewed by PhD's and that when I pick up a journal from them, those papers have been too.
No you don't. You trust they have been, but you don't know they have been. For all you know News Corp bought AIAA last month. And even if they have been peer reviewed, maybe those PhDs were incompetent twits. I've met enough of them in my day to know they are plentiful. Or maybe PhDs who are very competent read the paper and wrote a rebuttal about how the data conflicts with both their data and that of several other ongoing research projects, but that rebuttal has not been published anywhere you read.
If you rely upon one source, without checking the references and without seeing what other journals have to say, you're just taking it on faith.
There have been cases of 'vandalism' per see where an expert in her field has posted a perfectly valid page on Wikipedia and then had it changed by someone who doesn't understand the underlying science.
Sure there have. And there have been cases of print encyclopedia having intentional lies and data that is simply wrong or out of date. The question is, does the many eyes many hands approach to wikipedia increase or decrease the chances of the information being correct? Statistically, it seems to increase the chances of the data being right, especially for certain topics.
A system that allows that is not a system that can be relied on for any meaningful data.
My point is, no one system can be relied upon for meaningful data. If you're going to rely upon only one system, however, you've not shown any evidence that wikipedia is any worse than average, aside from your unscientific conjecture that you think that is the case. Gather data first, then propose a conclusion, remember?
Our govt. has also become smart about "handling the poor" so they don't rise up in protest. Welfare programs abound...
The situation is actually quite analogous to ancient Rome. They too had a republic with bread and circuses to keep the people pacified while a few ultra wealthy controlled things. Is that where the comparison ends? Nope. They had slaves and subjugated nations doing the hard labor while the locals lived in relative ease. That holds true. So what happened? Well, maybe the germans will invade and crush us, but more likely we will decline and stagnate like the Romans while other places will have more progressive societies. Already we're slipping technologically as research and initial implementation move overseas. Jobs requiring higher education are being outsourced every day. Eventually, the empire sort of collapses, weakened on many fronts.
I have no doubt the US too will fall, whether to outside forces, internal ones or a combination of the two. Unless those in power look to the past and care to use that lesson to shape the future, it is inevitable.
Do you think that industry-created "think tank" fronts are in any way comparable to scientists working on grants? Have you considered that a scientist who fakes evidence and fudges numbers to garner reputation is taking a tremendous risk of being utterly discredited and never trusted again...
Yes, but those scientists are mostly working to get grants, and fudging numbers can do that for them. My girlfriend works in a bookstore. Up until about a year ago, however, she was a biochemist. She quit the field entirely after years of job after job where she was constantly asked to make up numbers, change numbers, sign her name to grant requests and papers that conveniently failed to mention the obviously biased and nonstandard methodologies used, etc. She delivered a photocopied page of her lab journal to the dean of the department at a major research university. On that page, her boss had written "add 20% to all these numbers" for some cancer research that was ongoing. The dean was more concerned she might talk to the press than in doing anything about correcting the situation. He still runs the lab and was not punished in any way. A friend in the next lab commented to her a few weeks after she quit that "They hired a chinese woman who can hardly speak English and needs work to stay in the country. She won't make any noise like you did."
What does my anecdote prove? Nothing. Nonetheless, you might want to rethink your faith in researchers' concern over their reputations as compared to their desire to get that grant funding.
Yeah, because the entire population of the US is going to rise up against it's oppressors simultaneously...
I said 50% of the men in a certain age range, not in the military. It would take a lot less than that to actually change the course of things.
Get real. The middle class don't care, the lower class is too poor to do anything, and the upper class likes things the way they are.
The middle class is vanishing. The upper class is concentrating itself. The lower class is growing and being poor makes it more likely you will take part in a revolution. Wealth disparity is a huge motivator.
Combine that with a mass propaganda campaign against any likely insurgent groups, and the chance of an uprising catching any level of support are essentially zero.
Ahh yes I can see the propaganda now, "You're not starving, there is plenty of food, your children are not about to die." Take away television or enough food or booze and the people will rise up and overthrow the government. Just take a look at the "war on drugs." Most of the population already disobeys it. A huge portion of the population is locked up. There may come a time when the imprisoned population and those peripherally effected becomes too large to contain.
Under the right circumstances, there is very much a nonzero chance of a revolution, but it won't be over the issues currently being discussed.
I believe the point is this: if you have a small scale uprising then small arms won't help, you'll get branded as terrorists, get little sympathy from the general populace, and at best provide a nuisance; if you have a large scale uprising then you can be just as effective without small arms in the hands of ordinary citizens - just having mass protests with people standing up nd saying "No" will do the job as well as anything else.
First, who is to say what is small and what is large? What if you have a medium sized uprising? Second, no a large scale uprising without firearms won't work just as well. If you are no danger to the people in charge and the people enforcing their wished (police or military) then they can just round up and shoot you. Take a look at Nazi Germany for an example.
You might like to point out that the insurgents in Iraq are doing well - except they are not threatening to overthrow Iraq, not while the US military remains there.
While it is not their main goal, they are threatening to force the US out of Iraq, not through sheer force of arms but through a combination of attrition and the political response to that attrition.
You're not going to get that when you're fighting a war in the US with US civilians as the collateral damage of the conflict. Either you have the support of the general populace, or you don't.
Not so. The more people that are killed or imprisoned the more people will disapprove of your actions and you lose that approval.
The more violent you get, the less likely you are to gain support from the general populace.
This doesn't matter if your goal is not to gain power for yourself but to remove those in power. The people can simultaneously disapprove of the resistance and the existing regime that causes the resistance and cannot effectively suppress it. And if they do effectively suppress it, the means will likely lose them even more support.
If all those people, instead of arming themselves, simply take to the streets in coordinated mass protest calling for a change in government and or refusing to follow government directives then what is the government to do?
So far, building one of the largest police forces and prison systems in the world and locking them all up in prison has worked. It's called "the war on drugs" remember?
The more harshly you try to suppress the protestors the less likely the military are to follow the orders given.
So here are two things you're missing. An armed resistance can present more resistance for the same number of people. An unarmed people can be pacified without resorting to shooting them, which is what is most likely to cause the military to stop. The threat to the soldiers is also a factor. A soldier does not want to go onto the streets and shoot it out with some 16 year old kid, endangering his own life in the process in order to promote something they do not believe in. That same soldier might be willing to go use CS gas to pacify the teenager without killing them and ship them to a detention facility.
All of this, of course, presumes freedom of speech. If there is no freedom of speech and free press then the government can violently suppress protest with little concern for any repurcussion: think Tiananmen square.
But if the government does effectively suppress free speech, you probably won't know. An armed resistance is a necessary check in our system of checks and balances both as a deterrent and as an indication of when other rights may have been silently lost.
We'll have to agree to disagree on this one. But keep in mind, the right to bear arms has already been used to overthrow local government oppression.
But seriously, I think the problem with many environmental groups is that that tacitly support the extreme radical groups like PETA, Earth First!, the Animal Liberation Front, etc.
I think your assertion is offensive. You might as well write that the problem with christian groups is that they tacitly support radical groups like the KKK and Anti-abortionists. Many environmental groups do speak out against the organizations you speak of. To claim that "environmentalists" support them in general is nothing but an empty assertion.
And many of those that "get it" don't get it. You can no longer reshape the government with FORCE by bearing arms. Their guns are much bigger than our guns.
I think maybe you don't get it. Small arms are effective for a civil war. It's not like the government can nuke cities within its own borders without creating even more rebels elsewhere. Also, in most civil conflicts a significant portion of the military sides with each faction. So the guns they have are also the guns we have, in some proportion.
Even to put this in terms of simple numbers, if the entire military had chips installed so they always followed orders and half the able men 18-30 not in the military rose up and lost at a rate of 100 people to kill one brainwashed soldier, there would still be some left over in addition to the rest of the populace.