It seems your bank was seriously tricked by some MS puppet company.
Read the comment more carefully. My bank has a hardtoken. It doesn't completely protect against MIM attacks if someone can act as a proxy between me and the bank for a while - they can wait until I make a transfer and hijack all my money. But it is OS independent.
If you want to protect against MIM attacks where the attacker acts as proxy, I think you need something much beefier. Given that you need to get the client to pass things to a USB dongle to be signed, I think you need a proprietary solution. I know how to do this on Windows, but I've got no idea how to do it for other OSs.
Of course, if you or anyone else can think of a way to do it in a OS independent way, I'd be interested in hearing about it.
Actually I found that someone has actually done a Windows only trusted client for banking
http://digg.com/linux_unix/SEED_How_South_Korea_s_ Encryption_Standard_is_Holding_the_Nation_Back In Korea, you have certificate issued by your bank. When you shop online, instead of typing in your credit card number and billing address/CCV as you do in the US, you give you credit card number, certificate (protected by passphrase) and usually some kind of challence/response system like a printed security card with numbers on it.. When you pay your taxes or go online to get a government form, you use the same certificate to verify your identity. The US government have no way to verify your identity to provide government services such as to check your property taxes or social security, get the USPS to setup mail forwarding etc.
So they're using an ActiveX control to verify the identity of the client.
It occured to me that if you could get the clients to sign all HTTP requests with a hardware dongle, you'd have solved the problem, since the MIM attacker can't do this. For the attack to work, he needs to modify your requests before he passes them on to the bank. If the request was protected by a signature and the signature was generated by hardware, the bank would be able to tell.
I wonder if there's an OS independent way of doing this?
The SEB system can't protect against an MIM attack.
Consider. I go to the website to pay a bill. Someone sits between me and the bank - they could install some malware that sets them up as a proxy. I enter 100SEK and the phone company's bank account in the the MIM site. The MIM site intercepts this and puts 1000SEK and their account into the bank site. The bank then sends them the two numbers which are either random or linked to the fraudulent transaction. They send them to me. I sign them and enter them into the MIM site. They send them on to the bank.
Bingo, I've just agreed to transfer money to their account. If the MIM site can act as a proxy, they can just wait for me to make a transaction and grab the cash.
For some reason, many banks and payment providers in the US only use username/password (one-factor) authentication. In Europe most banks use at least a 2-factor security system, where the logon information is combined with either a physical security token (RSA or similar), an encryption key file, a supplemental 6 digit PIN sent by SMS to the user, etc
SEB, my Swedish bank, sent me a hardtoken - a little calculator like gizmo. The bank sends you two 4 digit numbers, then you enter your 4 digit pin to log into the device and the numbers and it generates a 6 digit hash which you enter into the password box. Each time you need to do a transaction you need to go through the process again. All of which is pretty good, certainly better than one factor security, or one factor plus a code from hardtoken which doesn't need user input since that could be stolen.
Unlike a one factor authentication, you can't steal someone's ID since the hardtoken is part of that.
It still doesn't protect completely against MIM attacks though, since the MIM could enter whatever data he wanted into the website and pass you an emulation of it which looks ok. So if you made a payment for 100SEK to Telia, he could hijack it into a payment of your bank balance to himself. You'd need to make a payment for him to steal money though. But you don't know if the numbers the bank send are a hash of your transaction or a hash of his.
But I think it could. If you could make the numbers depend on the state of the transaction - e.g. the webserver could make you agree to each page transtition, or each keypress. Rather than having the user sign manually when he needs to transfer money, software and a hardtoken would get hardware to sign for any UI event in the window. The idea is that the MIM can't do this, since he has no hardtoken. But he meeds to be able to click the mouse and use the keyboard to get the details of his fraudulent transaction into the bank.
It's pretty much Windows only though - the idea is something like custom software and and a USB hardtoken. The user would need to enter a password into the hardtoken to start the whole process off, after that the server would send a stream of random numbers and the client would hash these with each keystroke, sign the result and send it back. So if I want to send $100 to telia and the MIM wants to send $100 to himself, the bank would know that I was agreeing to a different transaction. A signed ActiveX control talking to a USB device would be ideal - it could listen for the stream of random numbers and queue them an pick numbers out of the queue whenever a key is pressed, do the math and send the stream of results back.
Maybe keystrokes are too fine grain since you don't want the bank server to have to keep track of them - you could do it at the HTTP form granularity. So the bank would send the random numbers in hidden form fields, and the control could sign them and the form data with hardware and put the result in another hidden field. Then the bank knows you've agreed to each form submission. But you need signed, trusted code and hardware to make this sort of think work I think.
Of course the great irony is W98 is more secure than either.
No it's not. I remember in Systems Programming for Windows 95, there was a great quote. They talked about protected mode, descriptor tables and so on. At the end of it, the author said something like
"I bet now you're trying to work out if it's possible to subvert this stuff. Well, it's so easy that there's no point. Windows doesn't protect the descriptor tables from Ring 3 [the least privileged] code so it's easy to create a trap gate or call gate for yourself to get into Ring 0 [the most privileged] where you'll probably crash and burn because you can't handle interrupts correctly. It's a "personal computer" - and you're free to do whatever you want to it, just like you're free to run your car without oil until the engine seizes up"
Which sums up Microsoft's attitude to security right up to the security push for XP that resulted in SP2 being deployed and all those patches getting downloaded unless the user stopped them. On the other hand people used to collect email over a dialup connection then if they used the internet at all and so the "personal computer" rule was kind of true. Before people started sending executables by email, probably the only ones people installed were ones that they got from the admin at work, or very occasionally bought in a shop.
So Win 9x and Dos seemed to be more secure because they weren't under constant attack in the way that a machine connected to DSL most of the time and bombarded with malicious software by email and websites is now. Actually another difference is that Dos and Win95 were mostly configured as client OSs - they aren't listening for (overly) complex protocols over a wider range of ports the way an NT machine does.
Theoretically... but this is science fiction television... if it keeps the show going, rules were made to be broken.
I felt a great disturbance in the Force, as if millions of obsessed fans cried out in terror and were suddenly silenced. I fear something terrible has been revealed.
Serious question. My company has a site which gets a few hundred hits a day. What sort of money would Google Ads bring in? It costs £10 (about 20 US dollars) per month, mostly because I've had it for about 15 years back when that was a good deal.
More to the point it, I host open source utilities that I've written that a few hundred people download a day. Is there some way I could moneterize this? At one point I put a comment about people emailing me if they found it useful. Well I actually got more emails than I could answer. So presumably, I could say "please visit our sponsors" and I'd get a decent click rate.
Mind you, I'm not sure what Google Ads policy on this is. Maybe I should put a Paypal donation on there instead. I only want text ads too, the site has a no graphics retro feel to it.
To be honest my company pays the tenner a month because the site occasionally brings in paid work so it's not really that urgent. Mind you, I like the idea of the site being self supporting, and it seems like it could be done with a bit of thought. And it makes coding and giving away the results seem like a better use of my time.
Thought even after GPL 3 comes out authors had the right to choose which license they could use.
No, the users may have a right to choose GPL3 over GPL2. Most software comes with a GPL license 2 that allows the users to choose "version 2 or later".
Linus took out this clause. Which was lucky for him, since he doesn't agree with giving away signing keys for example -
These are mentioned four places in the draft. The goals here are modest: essentially, to force programmers to relinquish patent-related controls if they use free software. If they have patents on free software, they must give a patent license to anyone using it. If they have cross-licensed patents or otherwise gained rights to use patents, they must help spread this protection to the users of their software.
Now if you're a big company, and have been involved in patent litigation, you probably ended up settling it by signing an exclusive cross license agreement with the company which you fought. It looks to me as if GPL3 would force you to extend that agreement to users of your software. But the company which signed the exclusive agreement licensing patents to your company will probably not want you to do this if your users include their competitors.
E.g. consider
Company A sues company B for infringing A's patents. Company B countersues B for infringing B's patents. After a complicated legal battle, A and B settle. A has more patents, so B pays A a license fee each year and both of them grant each other exclusive rights to each others patents.
Now if company B is releasing GPL software with the "this version or later" clause, company C can buy a copy, opt to license it under GPL3 and ask for a license to all company B's patents. But A has to pay B to do this.
1) Al-Jazeera is possibly the only middle eastern news organisation that presents the news as it finds it, (as opposed to the news as X countries information ministry dictates it) it should be applauded for its efforts. It should be supported in its attempt to bring news from the region to the world whilst supplying information to the populace of a region where accurate information is often unavailable and misinformation the norm.
I still disagree. It's funded by the Emir of Qatar. Mind you, I think the editorial point of view is more representative of various Islamists than him. I think there's something deeper going on here, which is that the Bush/Blair attempt to democratize the middle east is basically misguided. Democracy there now will only last as long as it takes for Islamists to take over.
1) Al-Jazeera is possibly the only middle eastern news organisation that presents the news as it finds it, (as opposed to the news as X countries information ministry dictates it) it should be applauded for its efforts. It should be supported in its attempt to bring news from the region to the world whilst supplying information to the populace of a region where accurate information is often unavailable and misinformation the norm.
If people are pumping out propaganda for some totalitarian movement, then I don't agree with killing them just for that. Mind you, lots of what al Jazeera steps beyond this. It seems to be characteristic of Islamists that they attempt to exploit the fact that civilized countries are wary of killing journalists and other civillians, but they don't understand that the protection comes with some costs. E.g. journalists are not allowed to bring money to one of the sides in a conflict if they expect to be protected by the other.
You can see the same sort of thing in Palestine too. They complain that the Israelis target ambulances, but use them to transport weapons. Or they complain that the Israelis kill children but distribute pictures of them with suicide belts on.
I actually think that fighting people like that is bad for the West, since it will tend to make Western armed forces lose all restraint. We should stop doing it and avoid it in future. But if they attack us and we're forced to fight, we should basically give up on the idea of fighting a civilised war where there are protected categories of non combatants. You can see that the Israelis for example have gone farther down this root than I'd want the UK or the US to go.
Look, The point is really simple, just because you don't like what is reported by Al-Jazeera doesn't mean what they report is wrong, just because it goes against the US position, does not make Al-Jazeera a terrorist organisation. Moreover just because someone is a Muslim doesn't make them intolerant, violent or anti-western/anti-American, just as being Christian doesn't make someone intolerant, violent or anti-evolution, and neither position excludes the possibility of being any or all of those things.
I don't really like Christianity either, but comparing it to present day Islam is laughable. Present day Islam is more like Dark Ages Christianity, and in practice it does make you hostile, at least theoretically to all the things that make up a decent society. I think comparisons with other totalitarian ideologies are not overstating this.
The only official documentation that says anything other than "conspiracy" is a statement by Tayssir Alouni, prior to his arrest stating that he carried messages between Al-Jazeera and the Taliban, and cash to help some of his friends, there is no explanation as to what amounts of cash or its purpose. According to information that came out during the trial he was supposed to have taken about $4,500 US to Mohamed Bahaiah, who is, apparently "considered at the international level as a supposed courier for the Al Qaeda organization between Afghanistan and Europe".
Jesus what a whiner. Cash for his friends. The most annoying thing about people like him is the way the dissimulate to fool the naive.
He brought money to "his friends" the Taliban, and helped them infiltrate Spain so they could kill people. As far as I'm concerned if you are a Muslim living in the West, helping the Taliban or any similar movement attack your country is treason and you should be locked up somewhere very unpleasant.
And with respect to the gay rights stuff, you specifically mentioned it as evidence that al Jazeera were liberal with respect to homosexuality. My point about the report is that a typical Muslim reader will probably not read the report in this way - they will see it as a sign that the Russians are rejecting liberal values.
Oh and one more question - Alluni was able to capture images of civilian victims in the destitute villages of Afghanistan and the miserable streets of Kabul. - How do you take bias pictures? Should civilian victims in Afghanistan not be shown?
If they are genuine and your report on both sides equally then yes. But I've heard other examples of Arab media fabricating reports of civilian casualties by the US and hiding reports of casualties by the insurgents. E.g. two young Iraqi girls used to sleep near to US soldiers because it was the safest place. The Arab media used the picture of them sleeping but claimed the Americans had shot them. Insurgents and terrorists are utterly unconcerned about Iraqi civilian casualties - suicide bombing crowds of children to get the few GIs giving them candy - but the Arab media never report this.
It's not pacifism if you exaggerate the sins of the good guys and hide the sins of the bad ones. You're actually on the side of the bad guys. And it's not journalism either, and shouldn't be protected as such.
Those are due to driver bugs. Page fault in non paged area means a bad pointer - you touched a page that was marked as not present, but since the area is unpaged the OS can't do anything to fix it.
IRQL not less than or equal is more interesting. NT has a concept of IRQL. It's an abstraction, and it means which interrupts are enabled. The lowest level in kernel mode is PASSIVE_LEVEL which means the scheduler is enabled. The next highest level is DISPATCH_LEVEL where it is not. Above that are the hardware interrupt levels. Now consider a spinlock, an OS synchronisation primitive. These are to protect shared resources. Drivers call KeAcquireSpinLock() to get them, do some stuff and then KeReleaseSpinLock() to release them. On a SMP system, KeAcquireSpinLock needs to raise IRQL and then acquire the lock. On a single processor system it just raises the IRQL.
So IRQL in Windows NT is very important thing. If the system is running at a raised IRQL, someone is holding a spinlock, or an interrupt is in progress.
Lots of kernel routines are documented in the DDK as being only callable at a certain maximum IRQL. Typically, IRQL_NOT_LESS_THAN_OR_EQUAL is caused by touching paged data at a raised IRQL which can't work as the pager risks a deadlock when it tries to acquire spinlocks to page it in, or less likely by calling a function which is documented as not being callable at that IRQL.
If you look at the stackframe, you can see which driver is to blame and either disable or update it. If the system has always been unstable, check the RAM.
Interestingly enough, Microsoft are experimenting with static code analysis and automated test cases to catch driver errors like this
Now to move on to your comments about Tayssir Alouni, I have one question to ask, what was he convicted of? The answer is collaborating with terrorists. In short he was accused and found guilty of having contact with suspected terrorists and links to the Taliban in Afghanistan. Wouldn't you expect a journalist who was working in Afghanistan, covering a war between the Taliban and the US/UK to have contacts with people like the Taliban?
Umm, no. Admittedly, if you read through all the statements by al Jazeera and various "Arab Human Rights" commissions (wonder how they feel about rights for homosexuals, or women, or athiests?), you get that impression.
But what he was actually convicted of is being a financial courier for al-Qaida and helping al-Qaida members infiltrate Spain. Incidentally, bin Laden has put 'getting back' Spain up there along with getting back 'Palestine'
http://olm.blythe-systems.com/pipermail/nytr/Week- of-Mon-20050926/024363.html Alluni, who began his career as an Arabic translator for a news agency in Granada, Spain, is credited as being the only journalist based in Afghanistan in October 2001 to show the world what the US war machine was doing to one of the world's poorest countries.
By then working for Aljazeera, Alluni was able to capture images of civilian victims in the destitute villages of Afghanistan and the miserable streets of Kabul. His coverage triggered international outrage over the US action in Afghanistan.
The indictment details his travels and wiretapped phone conversations in which Alouni allegedly agrees to carry money and messages to al Qaeda operatives planning the Sept. 11 attacks. It also charges that Alouni later used his job at al Jazeera while based in Afghanistan to make it easier for him to pass money to al Qaeda members.
Alouni also helped Mohammed Bahaiah, also known as Abu Khaled and a member of al Qaeda, get permanent residency in Spain, the indictment maintains. Bahaiah attended al Qaeda training camps in Afghanistan, but also stayed with both Yarkas in Madrid and Alouni in Granada. Alouni also allowed Bahaiah to use his mailing address on his immigration forms.
Finally, the indictment says that when Alouni started working for al Jazeera in Afghanistan in January, 2000, he brought money from Yarkas to Bahaiah, who was at the training camps.
So he couriered money to people in terrorist training camps and sponsored several terrorists when then applied to enter Spain. All the stuff about his contacts being just about his job from his al Jazeera colleagues makes me think that they are equally implicated.
As for Al-Jazeera having "rabidly anti liberal politics", I would suggest you look at their website and find an example of this, they seem happy to report on gay rights issues in Russia and highlight the plight of Afghan women, none of which would seem to fit into the anti-liberal view you are crediting them with.
I see they have "Mecca time" on the first page of their website. If you're a Muslim, you don't believe in gay or women's rights. Period. Try reading up on it. And reporting on a bunch of gay rights protesters getting beaten up by people who claim 'Moscow is not Sodom' doesn't tell you which side the reporter or the readers sympathize with.
Pretty much. It's amazing how people round here believe that it's more important to have good technical skills than good interpersonal skills and then admit that they can't design a mulitithreaded application, or figure out Win32's subleties. And that their Windows boxes crash all the time.
I know many physicists, not professional programmers, who write code (using MPI) that scales well to dozens -- sometimes hundreds -- of processors. They are intelligent people, but programming is not their main job or what they were trained in. Also, their code is not user-friendly, but that's a cosmetic matter that can easily be fixed if needed. If they can do it, why can't professionals?
Physicists are more able to work with non intuitively obvious systems? Just plain smart trumps being a professional?
First off, here is the correct link Volkischer Beobachter. It should be noted that that particular paper was the newspaper of the National Socialist German Workers' Party, i.e. the Nazi party, whilst Al-Jazeera isn't and has never been related to either the Baath Party in Iraq, or Al-Qa'ida.
Al-Jazeera is a Doha based organisation, Doha being the capital of Qatar, and Qatar being an apparently key US ally in the middle east, along with Saudi Arabia. It tends to carry news aimed at middle eastern readers/viewers.
The link was fine until slashdot stripped out the o with an umlaut. Guess you gotta keep those dodgy foreign characters out;-)
The paper I had in mind was Al Hawsa, which is a Muqtada al-Sadr newspaper which did encourage attacks on American troops. Sadrists are hardly a democratic party too, and at that point Iraq as under military occupation, so it's hard to get too worked up about their rights to free speech.
Al-Jazeera isn't significantly anti-western, or pro Al-Qa'ida. The stories it carries and even the opinions offered are often similar to what you might see on the BBC, ITN and CNN.
Yeah right. It's staffed by people who left the BBC because it wasn't sufficiently pro fundamentalist and anti American.
The only thing that makes Al-Jazeera different from the mainly western news agencies out there is that it has the capability of being on the ground in the midst of things and then reports what it sees, often including the views and opinions of people in the region
I've heard that Al Jazeera crews occasionally turn up before bombings that kill US soldiers. And the coverage is certainly anti American enough to count as incitement.
Actually, the more you read about them, the more it looks like they are fellow travellers of al Qaeda, despised by most non fundamentalists. And it's ironic that US/UK liberals seem to like them so much, given their rabidly anti liberal politics.
Suppose you were in the occupation authority of Germany after World War II and Völkischer Beobachter decided to keep publishing and encouraged Germans to kill American troops. Would you ban it?
I guess you think your civilization is perfect and should be implemented worldwide at any cost, disrespecting any local traditions or cultures by supplanting your own views
No, I just think that China would be improved if it had free elections. And all those Islamic countries would be improved if they had a culture which respected the rights of people other than rich, straight men - probably expecting a Jeffersonian democracy there is wishful thinking at this point. More to the point, not only would these changes be better for the Chinese and Arabs, they would make the world a safer place for the US and its allies.
Incidentally, don't you see the irony of arguing anonymously on the internet that local traditions like secret police torturing people for discussing politics should be respected? The only reason that you're free to do it is because your ancestors were willing to kill and die to stamp out those sorts of traditions.
I think you should re-read 1984 and consider what part the Ministry of Truth played.
You realise that Orwell actually worked for the IRD and other propaganda bodies which did exactly what I suggested, right? Both against the Fascists in WWII and the Communists in the Cold War. Incidentally 1984 is set in hellish world where people allowed totalitarian movements to take over everywhere so it shouldn't be entirely unexpected that he would do this, if you actually understand what it is about.
No, actually AP and UPI are fine. The problem is that so many rely on them... even the papers from China and Al Jazeera are just using them sometimes
The CIA should put agents into AP and UPI to pick stories in a way that corrodes competing unfree civilisations by encouraging them to liberalise. Popular US culture and feminism for example, or the benefits of property rights. Or economic statistics that show Taiwan is doing better economically. I guess it's a kind of trolling, drawing attention to facts that hostile tyrannies need to supress.
Yeah, I wondered about that too. I went to mainland china for a couple of days last year and it seemed to be economically very unimpressive. I flew over Beijing which was completely quiet in the middle of the day. And Shenzen, just over the border from Hong Kong seemed as repressive as Tirana in the 1970s or Pyongyang today. I got the impression that the whole low labour costs thing was a complete myth actually. Chinese workers may be cheaper than Taiwanese, but unlike the Taiwanese they seemed to be much more docile. And in the 21st Century, how much does labour costs matter really? A small group of people who get a high percentage of the profits if it works seems to be much better bet than a much larger group of people who are basically pretending to work for a tiny salary.
That's not to say that big dumb companies won't try to offshore to China, but even they have issues with the rampant piracy and the fact that the Party can expropriate things on a whim. Taiwan kicks ass at engneering though, I thought the enigneers I met were absolutely superb.
Lucasfilm are concerned that merchandise and special edition DVDs won't quite extract optimal value from the franchise. If you want to find out what happens between III and IV, you need to join the Church of Jediology. It's a joint venture between Lucasfilm and Scientology.
Slashdot Mirror
3. This TV station is real crap in quality.
Right, so it's ok to ban it.
My strength is of a thousand men for yea, I am wired to the gills with espresso.
It's a bit insensitive to write that on a public website. Mormons might read it and be offended.
It seems your bank was seriously tricked by some MS puppet company.
Read the comment more carefully. My bank has a hardtoken. It doesn't completely protect against MIM attacks if someone can act as a proxy between me and the bank for a while - they can wait until I make a transfer and hijack all my money. But it is OS independent.
If you want to protect against MIM attacks where the attacker acts as proxy, I think you need something much beefier. Given that you need to get the client to pass things to a USB dongle to be signed, I think you need a proprietary solution. I know how to do this on Windows, but I've got no idea how to do it for other OSs.
Of course, if you or anyone else can think of a way to do it in a OS independent way, I'd be interested in hearing about it.
Actually I found that someone has actually done a Windows only trusted client for banking
_ Encryption_Standard_is_Holding_the_Nation_Back
http://digg.com/linux_unix/SEED_How_South_Korea_s
In Korea, you have certificate issued by your bank. When you shop online, instead of typing in your credit card number and billing address/CCV as you do in the US, you give you credit card number, certificate (protected by passphrase) and usually some kind of challence/response system like a printed security card with numbers on it.. When you pay your taxes or go online to get a government form, you use the same certificate to verify your identity. The US government have no way to verify your identity to provide government services such as to check your property taxes or social security, get the USPS to setup mail forwarding etc.
So they're using an ActiveX control to verify the identity of the client.
It occured to me that if you could get the clients to sign all HTTP requests with a hardware dongle, you'd have solved the problem, since the MIM attacker can't do this. For the attack to work, he needs to modify your requests before he passes them on to the bank. If the request was protected by a signature and the signature was generated by hardware, the bank would be able to tell.
I wonder if there's an OS independent way of doing this?
The SEB system can't protect against an MIM attack.
Consider. I go to the website to pay a bill. Someone sits between me and the bank - they could install some malware that sets them up as a proxy. I enter 100SEK and the phone company's bank account in the the MIM site. The MIM site intercepts this and puts 1000SEK and their account into the bank site. The bank then sends them the two numbers which are either random or linked to the fraudulent transaction. They send them to me. I sign them and enter them into the MIM site. They send them on to the bank.
Bingo, I've just agreed to transfer money to their account. If the MIM site can act as a proxy, they can just wait for me to make a transaction and grab the cash.
For some reason, many banks and payment providers in the US only use username/password (one-factor) authentication. In Europe most banks use at least a 2-factor security system, where the logon information is combined with either a physical security token (RSA or similar), an encryption key file, a supplemental 6 digit PIN sent by SMS to the user, etc
SEB, my Swedish bank, sent me a hardtoken - a little calculator like gizmo. The bank sends you two 4 digit numbers, then you enter your 4 digit pin to log into the device and the numbers and it generates a 6 digit hash which you enter into the password box. Each time you need to do a transaction you need to go through the process again. All of which is pretty good, certainly better than one factor security, or one factor plus a code from hardtoken which doesn't need user input since that could be stolen.
Unlike a one factor authentication, you can't steal someone's ID since the hardtoken is part of that.
It still doesn't protect completely against MIM attacks though, since the MIM could enter whatever data he wanted into the website and pass you an emulation of it which looks ok. So if you made a payment for 100SEK to Telia, he could hijack it into a payment of your bank balance to himself. You'd need to make a payment for him to steal money though. But you don't know if the numbers the bank send are a hash of your transaction or a hash of his.
But I think it could. If you could make the numbers depend on the state of the transaction - e.g. the webserver could make you agree to each page transtition, or each keypress. Rather than having the user sign manually when he needs to transfer money, software and a hardtoken would get hardware to sign for any UI event in the window. The idea is that the MIM can't do this, since he has no hardtoken. But he meeds to be able to click the mouse and use the keyboard to get the details of his fraudulent transaction into the bank.
It's pretty much Windows only though - the idea is something like custom software and and a USB hardtoken. The user would need to enter a password into the hardtoken to start the whole process off, after that the server would send a stream of random numbers and the client would hash these with each keystroke, sign the result and send it back. So if I want to send $100 to telia and the MIM wants to send $100 to himself, the bank would know that I was agreeing to a different transaction. A signed ActiveX control talking to a USB device would be ideal - it could listen for the stream of random numbers and queue them an pick numbers out of the queue whenever a key is pressed, do the math and send the stream of results back.
Maybe keystrokes are too fine grain since you don't want the bank server to have to keep track of them - you could do it at the HTTP form granularity. So the bank would send the random numbers in hidden form fields, and the control could sign them and the form data with hardware and put the result in another hidden field. Then the bank knows you've agreed to each form submission. But you need signed, trusted code and hardware to make this sort of think work I think.
Of course the great irony is W98 is more secure than either.
No it's not. I remember in Systems Programming for Windows 95, there was a great quote. They talked about protected mode, descriptor tables and so on. At the end of it, the author said something like
"I bet now you're trying to work out if it's possible to subvert this stuff. Well, it's so easy that there's no point. Windows doesn't protect the descriptor tables from Ring 3 [the least privileged] code so it's easy to create a trap gate or call gate for yourself to get into Ring 0 [the most privileged] where you'll probably crash and burn because you can't handle interrupts correctly. It's a "personal computer" - and you're free to do whatever you want to it, just like you're free to run your car without oil until the engine seizes up"
Which sums up Microsoft's attitude to security right up to the security push for XP that resulted in SP2 being deployed and all those patches getting downloaded unless the user stopped them. On the other hand people used to collect email over a dialup connection then if they used the internet at all and so the "personal computer" rule was kind of true. Before people started sending executables by email, probably the only ones people installed were ones that they got from the admin at work, or very occasionally bought in a shop.
So Win 9x and Dos seemed to be more secure because they weren't under constant attack in the way that a machine connected to DSL most of the time and bombarded with malicious software by email and websites is now. Actually another difference is that Dos and Win95 were mostly configured as client OSs - they aren't listening for (overly) complex protocols over a wider range of ports the way an NT machine does.
Theoretically... but this is science fiction television... if it keeps the show going, rules were made to be broken.
I felt a great disturbance in the Force, as if millions of obsessed fans cried out in terror and were suddenly silenced. I fear something terrible has been revealed.
Serious question. My company has a site which gets a few hundred hits a day. What sort of money would Google Ads bring in? It costs £10 (about 20 US dollars) per month, mostly because I've had it for about 15 years back when that was a good deal.
More to the point it, I host open source utilities that I've written that a few hundred people download a day. Is there some way I could moneterize this? At one point I put a comment about people emailing me if they found it useful. Well I actually got more emails than I could answer. So presumably, I could say "please visit our sponsors" and I'd get a decent click rate.
Mind you, I'm not sure what Google Ads policy on this is. Maybe I should put a Paypal donation on there instead. I only want text ads too, the site has a no graphics retro feel to it.
To be honest my company pays the tenner a month because the site occasionally brings in paid work so it's not really that urgent. Mind you, I like the idea of the site being self supporting, and it seems like it could be done with a bit of thought. And it makes coding and giving away the results seem like a better use of my time.
Has anyone got any experience of this?
Thought even after GPL 3 comes out authors had the right to choose which license they could use.
No, the users may have a right to choose GPL3 over GPL2. Most software comes with a GPL license 2 that allows the users to choose "version 2 or later".
Linus took out this clause. Which was lucky for him, since he doesn't agree with giving away signing keys for example -
http://lkml.org/lkml/2006/1/25/273
But if you just copy pasted the default GNU supplied files into your code, then the users can choose a later version.
http://www.onlamp.com/pub/wlg/9044
Patents
These are mentioned four places in the draft. The goals here are modest: essentially, to force programmers to relinquish patent-related controls if they use free software. If they have patents on free software, they must give a patent license to anyone using it. If they have cross-licensed patents or otherwise gained rights to use patents, they must help spread this protection to the users of their software.
Now if you're a big company, and have been involved in patent litigation, you probably ended up settling it by signing an exclusive cross license agreement with the company which you fought. It looks to me as if GPL3 would force you to extend that agreement to users of your software. But the company which signed the exclusive agreement licensing patents to your company will probably not want you to do this if your users include their competitors.
E.g. consider
Company A sues company B for infringing A's patents.
Company B countersues B for infringing B's patents.
After a complicated legal battle, A and B settle. A has more patents, so B pays A a license fee each year and both of them grant each other exclusive rights to each others patents.
Now if company B is releasing GPL software with the "this version or later" clause, company C can buy a copy, opt to license it under GPL3 and ask for a license to all company B's patents. But A has to pay B to do this.
1) Al-Jazeera is possibly the only middle eastern news organisation that presents the news as it finds it, (as opposed to the news as X countries information ministry dictates it) it should be applauded for its efforts. It should be supported in its attempt to bring news from the region to the world whilst supplying information to the populace of a region where accurate information is often unavailable and misinformation the norm.
I still disagree. It's funded by the Emir of Qatar. Mind you, I think the editorial point of view is more representative of various Islamists than him. I think there's something deeper going on here, which is that the Bush/Blair attempt to democratize the middle east is basically misguided. Democracy there now will only last as long as it takes for Islamists to take over.
1) Al-Jazeera is possibly the only middle eastern news organisation that presents the news as it finds it, (as opposed to the news as X countries information ministry dictates it) it should be applauded for its efforts. It should be supported in its attempt to bring news from the region to the world whilst supplying information to the populace of a region where accurate information is often unavailable and misinformation the norm.
If people are pumping out propaganda for some totalitarian movement, then I don't agree with killing them just for that. Mind you, lots of what al Jazeera steps beyond this. It seems to be characteristic of Islamists that they attempt to exploit the fact that civilized countries are wary of killing journalists and other civillians, but they don't understand that the protection comes with some costs. E.g. journalists are not allowed to bring money to one of the sides in a conflict if they expect to be protected by the other.
You can see the same sort of thing in Palestine too. They complain that the Israelis target ambulances, but use them to transport weapons. Or they complain that the Israelis kill children but distribute pictures of them with suicide belts on.
I actually think that fighting people like that is bad for the West, since it will tend to make Western armed forces lose all restraint. We should stop doing it and avoid it in future. But if they attack us and we're forced to fight, we should basically give up on the idea of fighting a civilised war where there are protected categories of non combatants. You can see that the Israelis for example have gone farther down this root than I'd want the UK or the US to go.
Look, The point is really simple, just because you don't like what is reported by Al-Jazeera doesn't mean what they report is wrong, just because it goes against the US position, does not make Al-Jazeera a terrorist organisation. Moreover just because someone is a Muslim doesn't make them intolerant, violent or anti-western/anti-American, just as being Christian doesn't make someone intolerant, violent or anti-evolution, and neither position excludes the possibility of being any or all of those things.
g lish/e_patw
I don't really like Christianity either, but comparing it to present day Islam is laughable. Present day Islam is more like Dark Ages Christianity, and in practice it does make you hostile, at least theoretically to all the things that make up a decent society. I think comparisons with other totalitarian ideologies are not overstating this.
The only official documentation that says anything other than "conspiracy" is a statement by Tayssir Alouni, prior to his arrest stating that he carried messages between Al-Jazeera and the Taliban, and cash to help some of his friends, there is no explanation as to what amounts of cash or its purpose. According to information that came out during the trial he was supposed to have taken about $4,500 US to Mohamed Bahaiah, who is, apparently "considered at the international level as a supposed courier for the Al Qaeda organization between Afghanistan and Europe".
Jesus what a whiner. Cash for his friends. The most annoying thing about people like him is the way the dissimulate to fool the naive.
He brought money to "his friends" the Taliban, and helped them infiltrate Spain so they could kill people. As far as I'm concerned if you are a Muslim living in the West, helping the Taliban or any similar movement attack your country is treason and you should be locked up somewhere very unpleasant.
And with respect to the gay rights stuff, you specifically mentioned it as evidence that al Jazeera were liberal with respect to homosexuality. My point about the report is that a typical Muslim reader will probably not read the report in this way - they will see it as a sign that the Russians are rejecting liberal values.
Oh and one more question - Alluni was able to capture images of civilian victims in the destitute villages of Afghanistan and the miserable streets of Kabul. - How do you take bias pictures? Should civilian victims in Afghanistan not be shown?
If they are genuine and your report on both sides equally then yes. But I've heard other examples of Arab media fabricating reports of civilian casualties by the US and hiding reports of casualties by the insurgents. E.g. two young Iraqi girls used to sleep near to US soldiers because it was the safest place. The Arab media used the picture of them sleeping but claimed the Americans had shot them. Insurgents and terrorists are utterly unconcerned about Iraqi civilian casualties - suicide bombing crowds of children to get the few GIs giving them candy - but the Arab media never report this.
Once again, the Orwell link springs to mind.
http://www.orwell.ru/library/articles/pacifism/en
It's not pacifism if you exaggerate the sins of the good guys and hide the sins of the bad ones. You're actually on the side of the bad guys. And it's not journalism either, and shouldn't be protected as such.
If your illiterate President....
He's not my President, as you'd know if you bothered to actually read what I wrote.
If you're trying to suggest BSODs are a thing of the past, I have just two things to say:
/ seminar/scpresentation.pdf
PAGE_FAULT_IN_NONPAGED_AREA
IRQ_NOT_LESS_THAN_OR_EQUAL
Those are due to driver bugs. Page fault in non paged area means a bad pointer - you touched a page that was marked as not present, but since the area is unpaged the OS can't do anything to fix it.
IRQL not less than or equal is more interesting. NT has a concept of IRQL. It's an abstraction, and it means which interrupts are enabled. The lowest level in kernel mode is PASSIVE_LEVEL which means the scheduler is enabled. The next highest level is DISPATCH_LEVEL where it is not. Above that are the hardware interrupt levels. Now consider a spinlock, an OS synchronisation primitive. These are to protect shared resources. Drivers call KeAcquireSpinLock() to get them, do some stuff and then KeReleaseSpinLock() to release them. On a SMP system, KeAcquireSpinLock needs to raise IRQL and then acquire the lock. On a single processor system it just raises the IRQL.
http://ext2fsd.sourceforge.net/documents/irql.htm
So IRQL in Windows NT is very important thing. If the system is running at a raised IRQL, someone is holding a spinlock, or an interrupt is in progress.
Lots of kernel routines are documented in the DDK as being only callable at a certain maximum IRQL. Typically, IRQL_NOT_LESS_THAN_OR_EQUAL is caused by touching paged data at a raised IRQL which can't work as the pager risks a deadlock when it tries to acquire spinlocks to page it in, or less likely by calling a function which is documented as not being callable at that IRQL.
If you look at the stackframe, you can see which driver is to blame and either disable or update it. If the system has always been unstable, check the RAM.
Interestingly enough, Microsoft are experimenting with static code analysis and automated test cases to catch driver errors like this
http://www.inf.uni-konstanz.de/soft/teaching/ws05
Umm, no. Admittedly, if you read through all the statements by al Jazeera and various "Arab Human Rights" commissions (wonder how they feel about rights for homosexuals, or women, or athiests?), you get that impression.
But what he was actually convicted of is being a financial courier for al-Qaida and helping al-Qaida members infiltrate Spain. Incidentally, bin Laden has put 'getting back' Spain up there along with getting back 'Palestine'
http://olm.blythe-systems.com/pipermail/nytr/Week- of-Mon-20050926/024363.html
Alluni, who began his career as an Arabic translator for a news agency in Granada, Spain, is credited as being the only journalist based in Afghanistan in October 2001 to show the world what the US war machine was doing to one of the world's poorest countries.
By then working for Aljazeera, Alluni was able to capture images of civilian victims in the destitute villages of Afghanistan and the miserable streets of Kabul. His coverage triggered international outrage over the US action in Afghanistan.
Yeah, sounds unbiased to me.
More info here
http://abcnews.go.com/WNT/story?id=129407&page=1
The indictment details his travels and wiretapped phone conversations in which Alouni allegedly agrees to carry money and messages to al Qaeda operatives planning the Sept. 11 attacks. It also charges that Alouni later used his job at al Jazeera while based in Afghanistan to make it easier for him to pass money to al Qaeda members.
Alouni also helped Mohammed Bahaiah, also known as Abu Khaled and a member of al Qaeda, get permanent residency in Spain, the indictment maintains. Bahaiah attended al Qaeda training camps in Afghanistan, but also stayed with both Yarkas in Madrid and Alouni in Granada. Alouni also allowed Bahaiah to use his mailing address on his immigration forms.
Finally, the indictment says that when Alouni started working for al Jazeera in Afghanistan in January, 2000, he brought money from Yarkas to Bahaiah, who was at the training camps.
So he couriered money to people in terrorist training camps and sponsored several terrorists when then applied to enter Spain. All the stuff about his contacts being just about his job from his al Jazeera colleagues makes me think that they are equally implicated.
I see they have "Mecca time" on the first page of their website. If you're a Muslim, you don't believe in gay or women's rights. Period. Try reading up on it. And reporting on a bunch of gay rights protesters getting beaten up by people who claim 'Moscow is not Sodom' doesn't tell you which side the reporter or the readers sympathize with.
Come to think of it, notice the Sodom reference.
http://en.wikipedia.org/wiki/Sodom_and_Gomorrah#Is lamic_view
The story of Sodom is used by Muslims as an example of how homosexuality is condemned by Allah.
Pretty much. It's amazing how people round here believe that it's more important to have good technical skills than good interpersonal skills and then admit that they can't design a mulitithreaded application, or figure out Win32's subleties. And that their Windows boxes crash all the time.
I know many physicists, not professional programmers, who write code (using MPI) that scales well to dozens -- sometimes hundreds -- of processors. They are intelligent people, but programming is not their main job or what they were trained in. Also, their code is not user-friendly, but that's a cosmetic matter that can easily be fixed if needed. If they can do it, why can't professionals?
Physicists are more able to work with non intuitively obvious systems? Just plain smart trumps being a professional?
Here's a hint.
o zacs-i-has-it.html
http://anotherlolcatzblog.blogspot.com/2007/05/pr
Seriously, if you feel like that about music it's SSRI time.
First off, here is the correct link Volkischer Beobachter. It should be noted that that particular paper was the newspaper of the National Socialist German Workers' Party, i.e. the Nazi party, whilst Al-Jazeera isn't and has never been related to either the Baath Party in Iraq, or Al-Qa'ida.
;-)
q .main/
Al-Jazeera is a Doha based organisation, Doha being the capital of Qatar, and Qatar being an apparently key US ally in the middle east, along with Saudi Arabia. It tends to carry news aimed at middle eastern readers/viewers.
The link was fine until slashdot stripped out the o with an umlaut. Guess you gotta keep those dodgy foreign characters out
The paper I had in mind was Al Hawsa, which is a Muqtada al-Sadr newspaper which did encourage attacks on American troops. Sadrists are hardly a democratic party too, and at that point Iraq as under military occupation, so it's hard to get too worked up about their rights to free speech.
http://edition.cnn.com/2004/WORLD/meast/03/28/ira
Al-Jazeera isn't significantly anti-western, or pro Al-Qa'ida. The stories it carries and even the opinions offered are often similar to what you might see on the BBC, ITN and CNN.
Yeah right. It's staffed by people who left the BBC because it wasn't sufficiently pro fundamentalist and anti American.
The only thing that makes Al-Jazeera different from the mainly western news agencies out there is that it has the capability of being on the ground in the midst of things and then reports what it sees, often including the views and opinions of people in the region
I've heard that Al Jazeera crews occasionally turn up before bombings that kill US soldiers. And the coverage is certainly anti American enough to count as incitement.
Tayssir Alouni is actually in prison for links to Al Qaeda
http://en.wikipedia.org/wiki/Tayssir_Alouni
Actually, the more you read about them, the more it looks like they are fellow travellers of al Qaeda, despised by most non fundamentalists. And it's ironic that US/UK liberals seem to like them so much, given their rabidly anti liberal politics.
Suppose you were in the occupation authority of Germany after World War II and Völkischer Beobachter decided to keep publishing and encouraged Germans to kill American troops. Would you ban it?
I guess you think your civilization is perfect and should be implemented worldwide at any cost, disrespecting any local traditions or cultures by supplanting your own views
g lish/e_patw
No, I just think that China would be improved if it had free elections. And all those Islamic countries would be improved if they had a culture which respected the rights of people other than rich, straight men - probably expecting a Jeffersonian democracy there is wishful thinking at this point. More to the point, not only would these changes be better for the Chinese and Arabs, they would make the world a safer place for the US and its allies.
Incidentally, don't you see the irony of arguing anonymously on the internet that local traditions like secret police torturing people for discussing politics should be respected? The only reason that you're free to do it is because your ancestors were willing to kill and die to stamp out those sorts of traditions.
I think you should re-read 1984 and consider what part the Ministry of Truth played.
You realise that Orwell actually worked for the IRD and other propaganda bodies which did exactly what I suggested, right? Both against the Fascists in WWII and the Communists in the Cold War. Incidentally 1984 is set in hellish world where people allowed totalitarian movements to take over everywhere so it shouldn't be entirely unexpected that he would do this, if you actually understand what it is about.
Maybe you should read this
http://www.orwell.ru/library/articles/pacifism/en
No, actually AP and UPI are fine. The problem is that so many rely on them ... even the papers from China and Al Jazeera are just using them sometimes
e n_Eighty-Four_and_final_years
The CIA should put agents into AP and UPI to pick stories in a way that corrodes competing unfree civilisations by encouraging them to liberalise. Popular US culture and feminism for example, or the benefits of property rights. Or economic statistics that show Taiwan is doing better economically. I guess it's a kind of trolling, drawing attention to facts that hostile tyrannies need to supress.
Sort of like a 21st century version of the Information Research Department.
http://en.wikipedia.org/wiki/George_Orwell#Ninete
Yeah, I wondered about that too. I went to mainland china for a couple of days last year and it seemed to be economically very unimpressive. I flew over Beijing which was completely quiet in the middle of the day. And Shenzen, just over the border from Hong Kong seemed as repressive as Tirana in the 1970s or Pyongyang today. I got the impression that the whole low labour costs thing was a complete myth actually. Chinese workers may be cheaper than Taiwanese, but unlike the Taiwanese they seemed to be much more docile. And in the 21st Century, how much does labour costs matter really? A small group of people who get a high percentage of the profits if it works seems to be much better bet than a much larger group of people who are basically pretending to work for a tiny salary.
That's not to say that big dumb companies won't try to offshore to China, but even they have issues with the rampant piracy and the fact that the Party can expropriate things on a whim. Taiwan kicks ass at engneering though, I thought the enigneers I met were absolutely superb.
Lucasfilm are concerned that merchandise and special edition DVDs won't quite extract optimal value from the franchise. If you want to find out what happens between III and IV, you need to join the Church of Jediology. It's a joint venture between Lucasfilm and Scientology.
Damnit, you'd think Lucas would realise that the people who buy the most merchandise view websites by telnetting to port 80 and piping it into less.