because somehow, someone in government believes that watching violence makes you violent. You are what you watch?
Even though there is no evidence of this. Our society isn't less violent than it was when people were watching people being hung, lynched, fed to lions, beat to death, burned, impaled, crucified and beheaded.
We just want to pretend the Disney universe exists because some rich snobby sheltered families want to raise their children according to that standard which is impossible for the vast majority of the world or even the USA in 2011. Most children in the USA experience violence IRL not on TV. Only the upper class suburban type kids are protected from all the violence.
And when the kids who do experience violence talk about how the real world is, whether in music, or through movies, or books, then people want to ban it so they can't even express what goes on. And of course authorities want to ban the guns, or the drugs, because it just can't be that human nature is naturally violent.
When we accept that humans are always going to have a violent nature then we can do something about it. We wont need to worry about what people watch or who has a gun because nobody will have the instinct to want to be violent. But we are a long way from that, and the desire to domesticate the sheep comes from the top not from the bottom. They might disguise gun control as coming from the bottom by talking to victims of gun violence who happen to be living in ghettos or slums, and act like this violence happened to them because of the gun, but I could just as easily say lets ban bullets or steel, because steel can be used to make swords to behead people, and I could say ban rocks because rocks are used to stone people to death in some places.
It's one thing if you are 30 or 40 sleeping with teenagers. It's another if you are 20. What is the age difference? Is it realistic that they could be in love, or is it just sex?
That being said, teen porn and shows like MTV skin or whatever it was called only exacerbate the situation. Also it's not really pedophillia, it's normal to be attracted to post puberty teens. It's not normal to be attracted to pre-puberty teens. And I think this is the defining difference between pedophiles and normal people.
Then I have little to no confidence in the FBI. Look it's not hard to set up honeypots. The FBI should set up it's own USPS style bit torrent site. Want to make it even more believable? Set up a VPN service too and a web forum. Let all the child porn addicts upload stuff on there, and only through uploading can there be downloading.
Now instantly the FBI would have an army of informants and others. You are right most of them probably are nerds with no history of violence or sex offenses. These are the ones who can help catch USPS. It's not hard to take a midget adult, or use CGI to make it look like an actual child, to take a childs face and put it on an adult body, virtual child pornography should be used to get into these sorts of organizations. And once in, thats all it would take.
And if they can't get in by virtual child porn they just catch one person who is in, they turn that person into an informant, pay that person or threaten that person with life in prison or death even if they aren't an American citizen. That person can be used to infiltrate the group and destroy it from within.
It's really simple. The FBI should host the child porn. This way they know all the IP addresses. They should approach the ones who are the most addicted to viewing it, and rather than calling them sick or calling them pedophiles, the FBI should let them help investigate. Of course it would have to be only certain types of individuals who are sane, with a conscience, who have no history of harming children. The sort of person who looks but doesn't actually do anything more. This sort of person would be perfect to track down the source.
And this is really the only way to ever solve these sorts of crimes. You can't use people who hate pedophiles to go undercover and catch pedophiles. And FBI agents investigating pedophiles shouldn't hate pedophiles. So you need an unusual type person who would want to keep children from being harmed but at the same time a person who can work with others. The child porn laws could be used as a way to actually keep children safe or it could be a witch hunt. If it's about keeping children safe then the FBI shouldn't be concerned at who views what or who downloads what, but the source of the images, which camera did it come from and where was the photo taken, and who is the child in the photo, and this can only be found if you track it all the way back to the source from the viewers, to the distributors who post it on the site, to the individuals who gave it to them, all the way down, IP address to IP address, screen name to screen name, until you get to that one guy or that one IRC chatroom or that one forum where it's all coming from.
And if the FBI really wants to get it right they'd buy out the owner of that forum, and host the forum themselves and the moment someone uploads something, they get put under surveillance and then just wait, weeks or months, collect as much evidence from the honeypot as possible, and then arrest everyone who uploaded.
And let the child porn addicts watch as many images as they want on a 4chan like site. Capture their IP addresses over time, and if a child goes missing then question the people known to frequent these sorts of sites. Maybe turn some of them into informants, maybe use some of them to help catch the producers.
A honeypot is smarter than mass arrests when trying to find the producers.
If the FBI were to focus almost entirely on national security issues, most Americans would support the FBI. When the FBI is more concerned about what pornography people are watching, and what drugs people are using, then people wont support the FBI. This is not rocket science.
The FBI needs to focus on foreign enemies and on actual domestic terrorists. Actual pedophiles who actually molest children and film it. Not tracking and chasing pornography through the internet. Not going after downloaders and shutting down torrent sites. These activities were never popular, and while there are a lot of parents in this country, there is no scientific evidence that proves watching child pornography causes child molestation.
If 40% or whatever the ridiculous number was, were focused on child pornography maybe that and all the focus on arresting small time drug dealers are the source of discontent. Obscenity crimes are a complete waste of money and the drug laws make sense if the drug money is being shipped overseas to fund terrorist networks, but if it's a local drug dealer trying to survive the recession this does not make sense.
5 years to learn to reconfigure a linux kernel?! By reconfigure you mean compile? It shouldn't take more than a week to learn to compile a linux kernel if that.
Also wouldn't they need to focus more on forensics than compiling linux kernels?
Yeah, so, they'll get a fine to offer affected customers a free downloadable game right? So what, they're just Custopeons.
But if you copy their game first, you're going DOWN terrorist!!
And it's this profit over customers attitude that has turned customers against Sony. I'm sure many of these hackers like games and probably were fans of Sony before the boycott and protesting.
Now we see Sony doesn't care about customers at all beyond using them as a type of cattle to profit from.
I'm furious for the same reason. There is no reasonable excuse for being that ignorant when they have billions of dollars. They could have hired you, they could have hired me, and either of us could have secured their network better than that.
Do they even have an audit trail? What is the name of the man who was the Administrator? Or did they just root the Administrator computer and find a text file with everything on it?
Side channel attacks can work even when everything is right meaning implementation of a cipher is often a lot harder than the actual security mathematically. It's actually fairly easy to code or even design (theory) a cipher which cannot be cracked on paper, but then when you try to implement it that is a different story. If the cipher is symmetric then its very easy to make it uncrackable and it wouldn't require a difficult design, but then the user has to memorize an extremely long password. This wouldn't work unless the user has a smart card with a smart card reader, or is some sort of rainman genius who can remember all the digits of pi.
Security has to be strong and simple. Simple enough that a child can use, strong enough that a PHD student would have to crack it. Passwords no longer are simple enough, and they never were strong enough when the websites limit password length to 12 characters. So truthfully we need to move away from passwords and move toward symmetric encryption. A smart card and a reader with hardware encryption, hardware generated entropy, hardware is harder to hack than software. And on the other end the company or bank has hardware, and a smart card reader. It's just not going to be cracked period, you can use symmetric AES256 and guarantee it.
For one, you don't make getting in as simple as cracking one password from one computer which just happens to be connected to the internet and sending and receiving emails, running and downloading files, etc.
Malware is easy to protect a network from. Just don't let the network run anything it's not supposed to be running. Check files on the computer for changes once a day, basic stuff.
On top of all this, use encryption, and don't rely on passwords. Rely on something more secure than something which can be cracked by a dictionary or standard password cracker. Make the hackers crack the hardware and actually have to write code to hack the network.
It's always going to be possible with social engineering and unknown exploits or bugs in code, but you can audit code, you can use hardware to secure things that software can't, and you don't have to trust your employees.
They could have warned you but they didn't. They knew it would cause panic and this panic could cause them to lose some customers.
Now we know 77 million customers are owned by hackers. We can thank Sony for waiting so long to tell us, and we can thank Sony also for caring more about DRM and security of their intellectual property than the security of personal critical consumer information.
What? Is your private information not as important or as valuable as theirs? I wonder how many celebrities and powerful families got their personal information compromised over this...
And not protecting customer information is the single worst thing they could do to harm their image.
I'm not even a Sony customer, and I don't own a PS3, but now that I see how lax their security is with such critical personal information, I will not be buying Sony products in the future. Sony is going to lose customers due to their obsession about profits and making money even at the expense of consumer information security.
I agree with the one time tokens. That would be a good start.
I think we have to consider that even if we did secure financial information, and we definitely should, what about the address and other information? The company has to have that unless we can find a way to secure it offsite and add it to the one time token concept. This way the entire token expires immediately after payment, including the real name and address which could be within the token.
And once the information is out there its out there. And this is the sort of information which will lead to identity theft, blackmail, extortion, social engineering and other schemes which will only be revealed into the distant future.
This means there will be more than 70 million people affected by this. Anyone who got compromised, now their names, addresses, and personal information and passwords are free for all the hackers all around the world to access. Hackers in foreign countries, will be able to buy this information and wreak havoc and there is very little the authorities in this country will be able to do once hackers in China or Iran have access to this.
So why would this data be valuable to hackers? Two reasons I can think of.
1. It's a password gold mine. Since most customers reuse passwords knowing one set of irrelevant passwords can give clues or even directly produce another set of more valuable passwords.
2. If it's information such as full name and address, and other personal information, this information can be sold on the underground black market or in the regular market. Hackers can use the personal information to commit crimes against these people, to intimidate, or to socially engineer. And if any Sony employees also had accounts it's possible they could have been compromised as well.
So the way to protect against this is simple. Never reuse passwords. Encrypt the names and addresses so that it's only accessible from inside the building. This wont prevent hacking, but it will make it hard enough so that only an insider can hack. Something as simple as a smart card ID for all employees accessing the personal information would be enough to create an audit trail, make it harder to access remotely, and to provide the decryption key in an easy to use intuitive format. You scan your ID into the computer when you get to work and it can decrypt. You remove the ID and it's encrypted. Someone hacks into it, unless they have an idea card it should be encrypted.
They have the money now to open their own online school. They can select the best coders and pay them to create valuable code under the GPL, they can also allow coders to contribute code in exchange for further education.
Sometimes its better to sense and discover, and not communicate. Communication with an advanced alien lifeforn can lead to us being infected by deadly memes/ideas.
Genetically engineer them to assist with terraforming and use robotic fake insects to probe the planet and look for signs of life.
The point is if there is intelligent life, they'll probably be less evolved than insects and certainly wont be able to kill them without us finding out.
And if the planet is so far away that we cannot put probes or genetically engineered insects on that planet then finding life on that planet would be irrelevant since we can't reach that planet physically. So even if we could remotely detect life with some advanced telescope it wont really help if it's across the galaxy.
It's like how the federal government wont admit that they tap all our phones, they just want us to think they tap the terrorists phones but of course wont say exactly who the terrorists are.
It's very likely that Apple receives government contracts. If Apple receives government contracts, typically when the government gives out contracts they own you. So yes if you do your research and find Apple has received government contract of any kind for any reason then it's a very high probability that they'd track us for the government. Only in this instance they finally got caught, they probably have been doing it all along.
Slashdot Mirror
because somehow, someone in government believes that watching violence makes you violent. You are what you watch?
Even though there is no evidence of this. Our society isn't less violent than it was when people were watching people being hung, lynched, fed to lions, beat to death, burned, impaled, crucified and beheaded.
We just want to pretend the Disney universe exists because some rich snobby sheltered families want to raise their children according to that standard which is impossible for the vast majority of the world or even the USA in 2011. Most children in the USA experience violence IRL not on TV. Only the upper class suburban type kids are protected from all the violence.
And when the kids who do experience violence talk about how the real world is, whether in music, or through movies, or books, then people want to ban it so they can't even express what goes on. And of course authorities want to ban the guns, or the drugs, because it just can't be that human nature is naturally violent.
When we accept that humans are always going to have a violent nature then we can do something about it. We wont need to worry about what people watch or who has a gun because nobody will have the instinct to want to be violent. But we are a long way from that, and the desire to domesticate the sheep comes from the top not from the bottom. They might disguise gun control as coming from the bottom by talking to victims of gun violence who happen to be living in ghettos or slums, and act like this violence happened to them because of the gun, but I could just as easily say lets ban bullets or steel, because steel can be used to make swords to behead people, and I could say ban rocks because rocks are used to stone people to death in some places.
It's one thing if you are 30 or 40 sleeping with teenagers. It's another if you are 20. What is the age difference? Is it realistic that they could be in love, or is it just sex?
That being said, teen porn and shows like MTV skin or whatever it was called only exacerbate the situation. Also it's not really pedophillia, it's normal to be attracted to post puberty teens. It's not normal to be attracted to pre-puberty teens. And I think this is the defining difference between pedophiles and normal people.
Then I have little to no confidence in the FBI. Look it's not hard to set up honeypots. The FBI should set up it's own USPS style bit torrent site. Want to make it even more believable? Set up a VPN service too and a web forum. Let all the child porn addicts upload stuff on there, and only through uploading can there be downloading.
Now instantly the FBI would have an army of informants and others. You are right most of them probably are nerds with no history of violence or sex offenses. These are the ones who can help catch USPS. It's not hard to take a midget adult, or use CGI to make it look like an actual child, to take a childs face and put it on an adult body, virtual child pornography should be used to get into these sorts of organizations. And once in, thats all it would take.
And if they can't get in by virtual child porn they just catch one person who is in, they turn that person into an informant, pay that person or threaten that person with life in prison or death even if they aren't an American citizen. That person can be used to infiltrate the group and destroy it from within.
It's really simple. The FBI should host the child porn. This way they know all the IP addresses. They should approach the ones who are the most addicted to viewing it, and rather than calling them sick or calling them pedophiles, the FBI should let them help investigate. Of course it would have to be only certain types of individuals who are sane, with a conscience, who have no history of harming children. The sort of person who looks but doesn't actually do anything more. This sort of person would be perfect to track down the source.
And this is really the only way to ever solve these sorts of crimes. You can't use people who hate pedophiles to go undercover and catch pedophiles. And FBI agents investigating pedophiles shouldn't hate pedophiles. So you need an unusual type person who would want to keep children from being harmed but at the same time a person who can work with others. The child porn laws could be used as a way to actually keep children safe or it could be a witch hunt. If it's about keeping children safe then the FBI shouldn't be concerned at who views what or who downloads what, but the source of the images, which camera did it come from and where was the photo taken, and who is the child in the photo, and this can only be found if you track it all the way back to the source from the viewers, to the distributors who post it on the site, to the individuals who gave it to them, all the way down, IP address to IP address, screen name to screen name, until you get to that one guy or that one IRC chatroom or that one forum where it's all coming from.
And if the FBI really wants to get it right they'd buy out the owner of that forum, and host the forum themselves and the moment someone uploads something, they get put under surveillance and then just wait, weeks or months, collect as much evidence from the honeypot as possible, and then arrest everyone who uploaded.
And let the child porn addicts watch as many images as they want on a 4chan like site. Capture their IP addresses over time, and if a child goes missing then question the people known to frequent these sorts of sites. Maybe turn some of them into informants, maybe use some of them to help catch the producers.
A honeypot is smarter than mass arrests when trying to find the producers.
If the FBI were to focus almost entirely on national security issues, most Americans would support the FBI. When the FBI is more concerned about what pornography people are watching, and what drugs people are using, then people wont support the FBI. This is not rocket science.
The FBI needs to focus on foreign enemies and on actual domestic terrorists. Actual pedophiles who actually molest children and film it. Not tracking and chasing pornography through the internet. Not going after downloaders and shutting down torrent sites. These activities were never popular, and while there are a lot of parents in this country, there is no scientific evidence that proves watching child pornography causes child molestation.
If 40% or whatever the ridiculous number was, were focused on child pornography maybe that and all the focus on arresting small time drug dealers are the source of discontent. Obscenity crimes are a complete waste of money and the drug laws make sense if the drug money is being shipped overseas to fund terrorist networks, but if it's a local drug dealer trying to survive the recession this does not make sense.
5 years to learn to reconfigure a linux kernel?! By reconfigure you mean compile? It shouldn't take more than a week to learn to compile a linux kernel if that.
Also wouldn't they need to focus more on forensics than compiling linux kernels?
And why would anyone take a job at the FBI if they can work in the private sector?
Yeah, so, they'll get a fine to offer affected customers a free downloadable game right? So what, they're just Custopeons.
But if you copy their game first, you're going DOWN terrorist!!
And it's this profit over customers attitude that has turned customers against Sony. I'm sure many of these hackers like games and probably were fans of Sony before the boycott and protesting.
Now we see Sony doesn't care about customers at all beyond using them as a type of cattle to profit from.
I'm furious for the same reason. There is no reasonable excuse for being that ignorant when they have billions of dollars. They could have hired you, they could have hired me, and either of us could have secured their network better than that.
Do they even have an audit trail? What is the name of the man who was the Administrator? Or did they just root the Administrator computer and find a text file with everything on it?
Side channel attacks can work even when everything is right meaning implementation of a cipher is often a lot harder than the actual security mathematically. It's actually fairly easy to code or even design (theory) a cipher which cannot be cracked on paper, but then when you try to implement it that is a different story. If the cipher is symmetric then its very easy to make it uncrackable and it wouldn't require a difficult design, but then the user has to memorize an extremely long password. This wouldn't work unless the user has a smart card with a smart card reader, or is some sort of rainman genius who can remember all the digits of pi.
Security has to be strong and simple. Simple enough that a child can use, strong enough that a PHD student would have to crack it. Passwords no longer are simple enough, and they never were strong enough when the websites limit password length to 12 characters. So truthfully we need to move away from passwords and move toward symmetric encryption. A smart card and a reader with hardware encryption, hardware generated entropy, hardware is harder to hack than software. And on the other end the company or bank has hardware, and a smart card reader. It's just not going to be cracked period, you can use symmetric AES256 and guarantee it.
But someone can steal the smart card and open it.
For one, you don't make getting in as simple as cracking one password from one computer which just happens to be connected to the internet and sending and receiving emails, running and downloading files, etc.
Malware is easy to protect a network from. Just don't let the network run anything it's not supposed to be running. Check files on the computer for changes once a day, basic stuff.
On top of all this, use encryption, and don't rely on passwords. Rely on something more secure than something which can be cracked by a dictionary or standard password cracker. Make the hackers crack the hardware and actually have to write code to hack the network.
It's always going to be possible with social engineering and unknown exploits or bugs in code, but you can audit code, you can use hardware to secure things that software can't, and you don't have to trust your employees.
They could have warned you but they didn't. They knew it would cause panic and this panic could cause them to lose some customers.
Now we know 77 million customers are owned by hackers. We can thank Sony for waiting so long to tell us, and we can thank Sony also for caring more about DRM and security of their intellectual property than the security of personal critical consumer information.
What? Is your private information not as important or as valuable as theirs? I wonder how many celebrities and powerful families got their personal information compromised over this...
And not protecting customer information is the single worst thing they could do to harm their image.
I'm not even a Sony customer, and I don't own a PS3, but now that I see how lax their security is with such critical personal information, I will not be buying Sony products in the future. Sony is going to lose customers due to their obsession about profits and making money even at the expense of consumer information security.
I agree with the one time tokens. That would be a good start.
I think we have to consider that even if we did secure financial information, and we definitely should, what about the address and other information? The company has to have that unless we can find a way to secure it offsite and add it to the one time token concept. This way the entire token expires immediately after payment, including the real name and address which could be within the token.
And once the information is out there its out there. And this is the sort of information which will lead to identity theft, blackmail, extortion, social engineering and other schemes which will only be revealed into the distant future.
This means there will be more than 70 million people affected by this. Anyone who got compromised, now their names, addresses, and personal information and passwords are free for all the hackers all around the world to access. Hackers in foreign countries, will be able to buy this information and wreak havoc and there is very little the authorities in this country will be able to do once hackers in China or Iran have access to this.
So why would this data be valuable to hackers? Two reasons I can think of.
1. It's a password gold mine. Since most customers reuse passwords knowing one set of irrelevant passwords can give clues or even directly produce another set of more valuable passwords.
2. If it's information such as full name and address, and other personal information, this information can be sold on the underground black market or in the regular market. Hackers can use the personal information to commit crimes against these people, to intimidate, or to socially engineer. And if any Sony employees also had accounts it's possible they could have been compromised as well.
So the way to protect against this is simple. Never reuse passwords. Encrypt the names and addresses so that it's only accessible from inside the building. This wont prevent hacking, but it will make it hard enough so that only an insider can hack. Something as simple as
a smart card ID for all employees accessing the personal information would be enough to create an audit trail, make it harder to access remotely, and to provide the decryption key in an easy to use intuitive format. You scan your ID into the computer when you get to work and it can decrypt. You remove the ID and it's encrypted. Someone hacks into it, unless they have an idea card it should be encrypted.
They have the money now to open their own online school. They can select the best coders and pay them to create valuable code under the GPL, they can also allow coders to contribute code in exchange for further education.
It's what they always do to neutralize opposition in politics. They'll find dirt and they'll use it.
Sometimes its better to sense and discover, and not communicate. Communication with an advanced alien lifeforn can lead to us being infected by deadly memes/ideas.
Genetically engineer them to assist with terraforming and use robotic fake insects to probe the planet and look for signs of life.
The point is if there is intelligent life, they'll probably be less evolved than insects and certainly wont be able to kill them without us finding out.
And if the planet is so far away that we cannot put probes or genetically engineered insects on that planet then finding life on that planet would be irrelevant since we can't reach that planet physically. So even if we could remotely detect life with some advanced telescope it wont really help if it's across the galaxy.
'there's no other product that is sold by weight that evaporates, dehydrates and [turns into] shake.
This rhymes. Maybe it's time to for a nickel or a dime. Brother, can you spare a dime?
It's like how the federal government wont admit that they tap all our phones, they just want us to think they tap the terrorists phones but of course wont say exactly who the terrorists are.
If you look up the history of certain organizations you'll find many interesting connections.
Why did Facebook grow so fast? What and who originally funded Facebook? You can find the connection to the CIA via http://www.youtube.com/watch?v=ZMWz3G_gPhU In-Q-Tel. What about Disney? Walt Disney was an FBI informant and you can find that here http://www.straightdope.com/columns/read/1623/was-walt-disney-a-fascist
It's very likely that Apple receives government contracts. If Apple receives government contracts, typically when the government gives out contracts they own you. So yes if you do your research and find Apple has received government contract of any kind for any reason then it's a very high probability that they'd track us for the government. Only in this instance they finally got caught, they probably have been doing it all along.
And how is freedom on the net even measured without a subjective component?