Slashdot Mirror


User: nahdude812

nahdude812's activity in the archive.

Stories
0
Comments
1,564
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,564

  1. Re:Patenting.. on Antibiotic Resistant Staph Antibiotic Discovered · · Score: 2, Informative

    I'd sincerely like to know what your source for this is, and what you classify as a cost of research, and what you classify as a cost of marketing. I've worked in pharmaceuticals for years in many different areas, from a janitor right out of high school, to accounting, to marketing, and now I work for a marketing firm that specializes in pharmaceuticals. My mom and both of my brothers have worked in pharmaceuticals for many more cumulative years than me, in numerous areas of research.

    Let me tell you what I observe being the case, and what I suspect is the basis of your claim.

    Pharmaceutical A spends $X billion on marketing. This covers TV and print ads, direct marketing materials, product literature, product packaging, etc. For the things that are done in-house by employees, we only collect information on the costs of the tangible things, and ignore wage costs. For things that are outsourced (there's *lots* of this), we look only at the final pricetag. For a successfully run national campaign, we may be talking about $3-4 million dollars. This would, of course, include the salaries of the people working for the outsourced company, as their salaries are part of the pricetag. In marketing at a pharmaceutical, usually many more man hours go in from outside companies than inside companies. It's easy to inflate the pricetag like this (which perhaps you should as their salaries are being marked up for profit). The staff of marketing individuals at the pharmaceutical are paid a range of $50,000 to $150,000 for the execs. On average though, they probably make $60-70,000.

    When it comes to research, statistics are collected regarding, again, all of the tangibles, which are things like cages for animals, food for animals, wholesale chemicals to make drugs and test compounds, etc. This figure may only make it to several million dollars, perhaps a billion for a research intensive company.

    What isn't considered is the salaries of the individuals running that research. This is *not* outsourced ever, aside from consultants, but money to pay consultants comes from the same place as the money to pay employees, and so isn't probably wrapped up in the final figures. Consultants in the research area maybe make up 25% of the total research employee base, and usually in the lower down jobs.

    The non-technical jobs here go for $40-50,000, and the technical jobs here start at $70,000 and run well in to half a million dollars for ONE person. Yes, that's right, pathologists (who is to a doctor what a doctor is to a highschool dropout, usually requiring 16-20 years of education) frequently make more than some very big wigs on the corporate side. Then there are bonuses *required* to be paid to the managing pathologist for a drug. This is the guy or girl who in the end reviews all the available data and puts his or her signature on the final research report and says "This is safe for human use, and all these data are accurate." That comes at a very high risk, there is no real way this person can verify that numbers weren't fudged, and if something goes wrong with the drug after it hits clinical, *they* are very liable to be sued for many millions of dollars.

    The mean salary of technical persons in a research division is probably close to $100,000; there are many doctors involved in this process.

    The payroll for a moderate research division of a medium to medium-large pharmaceutical is probably on the order $12-15 billion dollars. I very much doubt that many pharmaceuticals are spending as much on marketing, including salaries, than they are spending on only salaries of personnel in research.

    Plus, have you considered the cost of insurance when a drug goes clinical? Insurance premiums for pharmaceuticals tend to be on the order of several billion dollars a year.

    Again, I'd truly like to see your source, and to verify their data on my own.

  2. Re:Patenting.. on Antibiotic Resistant Staph Antibiotic Discovered · · Score: 5, Insightful

    One of the major misconceptions about pharmaceuticals is that "To make this pill costs about $0.12, why are they $15 each?" The problem is that this stuff requires years of research.

    This stuff isn't like coming up with an idea in computer technology where it mostly requires a lightbulb to appear over your head for a really good product to be invented, you see, in medical research, it's not about being able to come up with good ideas, those are easy, such as "AIDS cure" and "Cancer cure," it's trying mostly random things, fueled by only minor insight, and many years of trial and error to come upon something truly useful.

    I'm not sure what the regulatory process is behind something like a bacterial antibody is, but if it's anything like drug research, once it's discovered, you're looking at another 10+ years of preclinical and clinical trials. Literally billions of dollars must be invested before joe consumer can use it. And that's for a successful run. There are drugs that make it to the end of 10 year trials, and fail, with billions going down the drain.

    *THIS* is what you pay for, not the manufacturing cost.

  3. Re:Another upgrade on Office 2003 Beta 2 Screen Shots · · Score: 4, Funny

    yeah, I doubt that they're worth $100. Frankly, they're the sort of thing one might expect to be released in a service pack.

    And I friggin hate that multiple clipboard thing. No matter how many times I've tried to get used to it, I'm always less efficient with it getting in my way.

    I'd *love* to be able to turn it off. But each time I copy something, realize I didn't get the period in the selection, grab the period, and copy again, it pops up. The stupid paperclip I repeatedly ask to go away then comes up and says "Would you like me to turn this feature off?" To which, of course, I reply, "yes," which he pretends to do until the next time I miss a period. Then I right click on him and hide him. He asks if I'd like to disable him. I say, "yes," and he goes away until the next time he thinks I might actually want him back again.

    A feature in Office that I'd pay for is the ability to disable new features, for good and truly, to never be bothered by them again unless I completed some mystic Zennish quest to reenable the feature, wherein I need to become one with my software, and utter the mantra, "clippy, clippy, clippy."

  4. Re:My unbreakable encryption scheme! on Israeli Firm Claims Unbreakable Encryption · · Score: 1

    I know this was posted in the rhetoric, but,

    if you have a finite message, is there a finite or infinite number of typos you can make?

    If we place certain limitations on what we consider to be a "type-oh" of another message, then we're more than likely going to see a finite number of type-oh's for any given finite length message (unless there was no limitation on the length necessary for one message to be considered a type-oh'd version of the other, in which case, yes, there are an infinite number of possibilities).

    or is every message simply a typo of the *one great universal message*

    Now this is an interesting thought. Let's assume that the one great universal message comes from God. That means that things I write should be accepted as divine truth, or at least almost. Bow down and worship me, my utterings are encoded messages from God!

  5. Re:My unbreakable encryption scheme! on Israeli Firm Claims Unbreakable Encryption · · Score: 3, Funny
    that's still technically brute-forceable. We can do the infinite monkeys at an infinite number of typewriters thing, and at some point a monkey would have typed your original message. We may not know he did, but it would have happened. Lets take an example from my fortune file:

    The saying goes: if an infinite number of monkeys typed on an infinite number of typewriters, eventually
    all the great works of mankind would emerge. Now, with today's high speed computers, we can finally test
    this theory...

    Lzskd jfy 92y;ho4 th;qlh sd 6yty;q2 hnlj 8sdf. Djfy 92y;ho4, th;qxhz d7yty;
    Q0hnlj 23&^ (# ljask djf y92y; fy92y; Sd6y ty;q2h nl jk la gfa harvin garvel
    lasdfsd a83sl la8z ks8l 92y;ho4 th;qlh sd 6yty;q2 hnlj 8sdf. Djfy 92y;ho4,
    th;qxhz d7yty; Q0hnlj 23&^ nknod mrs88 jsd79lfm#%$JLaoz6df lso7dj f2 jfls
    67d9ol1@2fou99s 1lkj2 @l.k1 2; a89o7aljf 1l3i7ou8 d8l3 lqwerty0092 #1!
    ja9o do8lkjj139rojsd9**!l6*hd # ljasd78 l2awkjad78 3ol7asljf 3 ldif & l.js
    Ll ls ewan la8uj 23lll7u 8l 3h hhxx8 8d lsd fixx 891lkjno99sl d8l@@@!!8#8
    dfoil jarooda mklaoorj nowai the smisthliylka jkdlfjiw ladajadra lthhheeejfjl
    dkddooolda bub mirznod of the koojgaf!! But 2 be or not to be... that is the
    question. Then when shall we three meet again In thunder, lightning, or in
    rain? When the hurlyburly's done, When the battle's lost and won. That will
    be ere the set of sun. Where the place? Upon the heath. There to meet with
    Macbeth. But hath forth not to want..... a banana, or to be.... a banana.
    Banana, I knew him banana. Banana banana. Banana banana banana banana.

    Well... hmm.... it seemed like a good idea...
  6. Re:Wake up movie people on Rick Berman Doesn't Know Why Nemesis Tanked · · Score: 1

    Right, during the initial encounter with the borg on a science station, Data got extremely angry, killed a Borg, and felt pleasure at it, which was derived from an emotional broadcast (whether one of the Borg was relaying it or had its own device, is not said). They either later captured a Borg, or captured one during the same skirmish (I forget which it was, I've been burning through the DVD's recently, so although it was only a few weeks ago that I watched this, it was probably a few seasons worth of episodes ago), who either rebroadcast the signal from Lor, or else had his own device (the capture was then thought to perhaps be a ruse). Data freed that Borg from the Enterprise brig and ran off with him to Lor.

  7. Re:Wake up movie people on Rick Berman Doesn't Know Why Nemesis Tanked · · Score: 1

    How did Lor lure Data/E to the planet?

    There had been a series of attacks on Starfleet colonies/science stations/other somesuch. When the Enterprise was investigating it, it turned out to have been attacks from these new Borg. At the time, the Enterprise crew didn't realize they were "individuals" but assumed it was a new Borg threat. They began actively investigating, including bringing in numerous StarFleet ships. The renegade Borg only ever attacked places that the Enterprise was near, and used some sort of triggered worm hole or quantum slipstream or something to escape, eventually luring the Enterprise through to their secret base of operations. In some encounter, they had captured a Borg which, unbeknownst to them, was using an emotional broadcast similar to the one Lor used in order to re-evoke those emotions in Data (he had experienced them in an earlier Borg skirmish). Through the influence of that, Data released that borg and escaped to the planet the Borg were living on.

    Either way, Lor isn't comming back. I can't imagine anyone in starfleet [putting him completly back together and then saying "There you go Mr. Lor. Have a nice day pillaging the countryside!" :)

    Agreed :-)

    First: Are we told that the chip is damaged? If not, it's not. If it is, well then Data (or maybe even Geordi) repairs it.

    Yes, they do say that it is damaged, beyond repair as Data puts it. In ST:Generations, Data has used it as a prototype for his new emotion chip. The fact that it wasn't Soong's chip helps explain why he was debilitated with fear, as Data didn't have the same experience with creating these things that Soong would have, and so may not have fully calculated the level of emotion he'd receive from it.

  8. Re:Wake up movie people on Rick Berman Doesn't Know Why Nemesis Tanked · · Score: 1

    A couple of nitpicks (and only minor trivial things) having watched this episode only a few weeks ago on DVD:

    Lor used the renegade Borg as his army, and used knowledge gained in the emotion chip that Soong had mistakenly implanted in to Lor (thinking that Lor was Data in an earlier episode) to evoke simultaneous murderous and pleasureable emotions in Data in order to control him, nothing to do with Soong's homing beacon (which if you'll recall left both Data and Lor in a sleep-walking style state where they had no idea of their actions, and had to be reactivated by Soong).

    At the end of the episode, they did deactivate Lor, but I don't recall them beaming him out in to space, or otherwise stating what they did with him, including whether he actually got disassembled, or merely left on a shelf someplace safe.

    Data does keep the emotion chip, but it is noticably damaged. He is about to destroy it with his phaser (right on his computer console too, which seemed like a rather illogical location for an android to be pointing a phaser at). Geordi stops him from doing so, as he explains that simply because Lor used the chip to evoke very negative aspects of Data, that emotions are not inherrently evil. The implication is that Data may be able to study and learn from the chip, and perhaps some day recreate his own (which we see occur in Star Trek: Generations, I believe, only Data becomes paralyzed with fear on his first away mission). /end comic book store guy personality

  9. Re:Ah, yes on Slashback: Slammer, Frames, Pop-Ups · · Score: 2, Informative

    That's a neat but very dangerous way to manage that. The danger is that you have to be very careful what zone of security you're executing in, it's very easy to run that in the "Local Computer" zone, which opens you up to countless highly dangerous attacks. So if you play with IE as an ActiveX, and spoon feed it HTML at all, be very very careful!

  10. Re:security on Why IE Is So Fast ... Sometimes · · Score: 2

    No, IE never acts any differently toward any server over another. It tries the "fast connect" method, if that fails, it goes for a regular connect. It has no idea what the remote server is, but the fast connection either works, or it doesn't. This is no more exploitable than any standard connection process, in that this provides no more ability for a 3rd party to intercept or interfere with the connection, nor any more ability for the actual server to send back malicious data. Either the server responded to the fast connection (success) or it didn't (IE will try standard connections)

  11. Re:security on Why IE Is So Fast ... Sometimes · · Score: 2

    The server makes no explicit claim to be IIS. Instead it takes steps on its end to enable users to take advantage of half-open connections to avoid the normal handshake. IE tries the non-handshake connection, if it works, super, if it either gets rejected, or times out, then it tries the traditional method.

    There is no explicit claim being made, rather it's more like walking up to a bank teller and saying "I'd like $100 please." If s/he then says "I'm sorry, first I'll need your account number," or stares back at you blankly, then you'll give her/him your account number, and proceed with the transaction as you were intended to do from the start. Perhaps she recognized you though (half-open connection), and was able to allow you to get by with out the handshake of account information. Bank policy (RFC's) requires her to ask your account number, but she sidestepped that.

  12. Re:What A Joke on EverQuest: What You Really Get From an Online Game · · Score: 2

    Wow, I hope you never try to hold an intercession for someone.

    This kind of attitude is actually very harmful. The attitude of "the addiction is your fault," is horrible.

    Psychochemically there is actually little difference between what you dub chemical addiction, and addiction to joy. Stimulate the pleasure centers in your brain and it wants more.

    Now it's been a couple of years since I had psych, but let me see if I still have this right. A dopamine reaction occurs to supress the stimulation (which is what happens with all nervous stimulus). The dopamines are designed to terminate the stimulation, and are quite necessary in a healthy brain because otherwise you'd still be laughing from when you were tickled at birth.

    Some people's brains are a bit over-zealous at producing dopamines, and so produce a glut of them after an intense stimulation. That means that later stimulations are absorbed in to the dopamine glut before any measurable stimulation can occur. This is a state, when applied to pleasure and self-worth centers, known as depression. I speak here specifically about pleasure center depression.

    In order to rise out of this depression, one must stimulate the pleasure center, and in classic Pavlovian learned style, when one has separated themselves from the particular stimulus that sparked the initial pleasure and subsequent depression, they learn, largely subconsciously, that when one is engaging in this activity, they experience pleasure, and when not engaging in the activity, they experience depression.

    Therefore, to the subconscious logic processors, there can be only one reaction: something that this activity provides is essential to existance, it's time to stimulate the desire centers for more of this.

    Those who exercise this activity in moderation at all times, even if susceptible to addiction of this sort, due to highly zealous dopamine output, will not have induced high enough pleasure from it to really suffer from the later depression. In fact, the over abundance of dopamines is far easier to experience given long periods of moderate pleasure, rather than short bursts of intense pleasure.

    Those who can successfully always practice in moderation minimise their susceptibility toward addiction of this sort. It's those who cannot or do not do this that become addicted.

    For those who suffer badly from this, they can no more easily separate themselves from this activity than you could voluntarily stop eating. Their body has identified the activity as necessary toward proper functioning, when the activity is absent, deep depression and longing occurs. This now frequently translates to a state commonly known as "obsessive compulsive behavior," where yes, a person "can" prevent themselves from engaging in a behavior, but in actuality, they cannot, no matter how hard they try, their psyche is simply too dependant on the behavior, in a very chemical way.

    Whether or not the person becomes physically ill, instead of merely mentally ill, is irrelevant toward the conclusion of whether or not the activity is addictive, there are merely different symptoms depending on which chemicals are present or over present in the body.

    "If you can't quit its because you made it so, because you are a weak person." That is a horrible horrible statement designed to demean those who actually have a problem with this.

    Now for a little exercise to help you understand the compulsion. Stop breathing. That's right, hold your breath until you pass out. Don't worry, it's quite safe, when you pass out, you will begin breathing again. You "can" do this, it's physically and mentally possible. I defy you to. In the same way that breathing has been determined by your subconscious to be a positive behavior that removes unwanted carbon dioxide from your system, and supplies wanted oxygen, these addictive activities remove unwanted dopamines and supply wanted stimulus to one's pleasure centers. Breathing is based in your brain stem, it's why you can continue to do this while sleeping or not thinking about it, but it is also a voluntary and motor-simple behavior, while engaging in addictive activities are voluntary and motor-complex behaviors, thus not capable of being managed in your brain stem, and therefore being voluntary yet unconscious behaviors.

    Let me know when you've successfully passed the breathing test. If you can't do this, then it's "because you are a weak person," "it's your own fault, no matter what, there is no one to blame but yourself, you are defective." Your addiction to conscious breathing is because "you blessed it" and were too weak to prevent yourself from doing so. And even if you do successfully force yourself to pass out, wasn't it horribly difficult? Many other people cannot do this no matter how hard they tried... they are defective.

    One final note, not all diseases are viral or bacterial based. That's a flawed assumption. Alzheimer's is a disease. Cancer is a disease. Downs Syndrome is a disease. Arterial plaque is a disease (heart disease). Addiction is a disease. They are all disorders of the body, therefore a disease. The final two are even environmental, and frequently cancer also, all with out requiring dead rats (unless you got high cholestorol from eating dead fatty rats, or cancer from hanging out with dead radioactive rats, in which case you have a bigger problem, I think, than your heart disease).

  13. Re:Pennsylvania's list on FTC Moves Forward With National Do-Not-Call List · · Score: 2

    I also am on PA's do not call list. It's sweet, 3-4 calls a night has turned in to ~1 a week. Those tend to be from charities (the guy who had our number before us must have been quite the philanthropist, two years later and we still get fairly regular charity calls for him). Actually since the list became active, we haven't had a single non-charity, non-fraternal phone call (both of which are legal under the PA law). The silence is golden. No more annoying hang-up calls from predictive dialers, and honestly, I really am happy with my rug shampooer, thank you very much.

  14. Re:This book is great on Professional PHP4 · · Score: 2

    I should state that this is ASP as it pertains to VBScript, not Javascript, in ASP 3.0. Split() and Join() don't exist in ASP 3.0. In fact, inherrently, associative arrays don't exist, you actually have to create Scripting.Dictionary objects, which afford a lot of the same control ultimately, but with more legwork.

    Also, my original quote was,
    How about regular expressions? Searching, replacing, replacing with code execution?

    You answered with instr() and replace(). The equivalents of PHP's strpos and str_replace.

    I meant, how about PHP's preg_replace, preg_grep, preg_match, preg_match_all, preg_quote, preg_replace_callback, preg_split, just to look at the perl compatible functions, let alone all the ereg_* (POSIX compatible) functions.

    With the preg_replace function, your replacement can actually be executable code that is executed run-time.

    For example,
    echo preg_replace("'&#([[:digit:]]+);'e","chr(\\1)",$in put);
    will output the original string with every digit escaping re-translated to the character code that it would represent. Again, yes, you can do this with your examples, instr(), and replace(), but it won't be one line of code.

    The above example is an example of a search and replace with code execution. It locates every &#[any_number_of_digits]; and executes PHP code to decide how it should be output.

    Also, PHP is just easier to code in. I can't tell you how annoying it is to have to do this:
    response.write "Coordinates: x:" & xCoord & " y:" & yCoord & " z:" & zCoord & "
    " & vbcrlf
    when in PHP I can write
    echo "Coordinates: x:$xCoord y:$yCoord z:$zCoord
    \n";

    Want to author a PDF from an ASP page? Good luck. How about authoring a SWF from an ASP page, or a GIF or JPEG? I count 93 functions for image authoring/editing/manipulation. Access to POP3/IMAP? LDAP? SNMP? Non-Application-scoped semaphores? Non-Application-scoped shared memory? For goodness sake, receive an uploaded file with out a 3rd party purchased plugin??? How about retrieving a file from another website, or opening a socket? Write a custom class? Spellcheck?

    The list goes on and on and on. I'm sure ASP.Net has breached this gap in leaps and bounds. I can't answer to that, as most places are still out-of-the-box setups and don't have that option, so I haven't gotten to play with it. The previous version of ASP though, has a long ways to go to play catchup.

  15. Re:PHP Website on Professional PHP4 · · Score: 1

    No, I suppose you're right, there's no option to download source and documentation as one archive. Instead you have to do them individually, which is how I'd prefer it, when I'm doing a minor version upgrade, I don't need a new copy of the documentation to prolong the download, and if I do want a new copy of the documentation, then I can have it on the download queue before the previous download has completed even with a very fat pipe.

    Out of curiosity, your final sentence implies that although this method is good enough for most people, that it's not good enough for you, what would you consider good enough?

  16. Re:PHP Website on Professional PHP4 · · Score: 2

    yes it does. Check it out, there are a wide variety of options on how to receive your documentation. You can search it on their website, complete with user comments (which are frequently very helpful), you can download a Windows CHM help file (I think that's the extension) to search against it locally, you can download PDF, and HTML versions, and in a lot of different languages.

    Pretty much any help format you might want is available.

  17. Re:This book is great on Professional PHP4 · · Score: 5, Informative

    I can weigh in on that a little, having first learned and worked with ASP for 2 years before I got in to PHP, and having now been active in ASP and PHP both for that past two years.

    ASP vs PHP there is so completely no comparison. There is only one single thing that ASP does that is easier than in PHP, and that is application-scoped variables with out a database. I've written my own PHP classes to facilitate this, and although they may not be as efficient as ASP's memory resident access, they are just as useful.

    The hugely wide variety of functions PHP provides make programming a delight where you work more on your programming concepts and code flow than on authoring code. There are simply hundreds of functions available in PHP that I use on almost every page, that would require custom-written functions (that thus run as script, at lower performance than the precompiled PHP functions) that are simply not available in ASP. Try to do a join() or split() in ASP. Yes, it's doable, but with quite a lot of legwork. How about regular expressions? Searching, replacing, replacing with code execution, and more? Not gonna happen in ASP, nope.

    Then there are SIMPLE things that are HTTP standards that are simply lacking in ASP. For example, uploading a file. Gotta buy a plugin in ASP to do that. Or uploading creating an array of elements on a form. If you want to have an unknown number of entries in a form, in PHP, you can name the input fields, "field[0]","field[1]","field[2]" and they come in as an array. Or you can even name them "field[]","field[]","field[]", and they will come in as an automatically indexed array. Useful when you want to do things like add rows of input to a table with javascript, and have a script that easily handles the collection. Try to upload an array in ASP, and you have to write code that breaks down the field names to your liking.

    There are so many functions that I take for granted in PHP that I now have my own library of PHP functions rewritten in ASP so that when I am authoring in ASP, I'm not as limited by the language. Just try to do an md5 in ASP, or any other cryptographic operation though, I dare you.

    Ok, sorry, rant over, been working on an ASP for the past month solid, and I think I'm going through PHP withdrawl.

  18. Re:This book is great on Professional PHP4 · · Score: 3, Informative

    With permissions set in /dev, you can't access and control system devices such as serial ports? Are you running PHP in safe mode? If so, you'll probably have to disable that.

    I've had only a little experience using PHP to talk directly to devices, but it's been successful experience. I should think you'd be able to pop open the cash drawer and stuff like that on the server with PHP using filesystem functions on /dev entries. Unless of course you're using PHP on Windows, then I'm sorry, but you bear the burden of a lower OSform.

  19. Re:PHP Website on Professional PHP4 · · Score: 3, Insightful

    Then they should download the downloadable documentation.

    Having never previously used PHP, the documentation here was actually more useful to me than the previous Wrox book, "Professional PHP Programming." But it's best as a reference, if you haven't done dynamic web programming before, you'd do quite well to invest in a wrox book, as I find them to be well geared at bringing you up to speed on a subject, and then serving as a good reference book.

  20. Re:scary side effect on Updating Quickbooks Forces Online Membership? · · Score: 2
    Unless you pay by cash, online bill payment adds nothing on top of the federal reserve system through which all checks are processed already


    But the FRS isn't a commercial entity who could (and would) sell marketing information about you. It's also a terribly ominous system to try to hack, it would take a lot more balls than most hackers have to try to do that, versus a corporate network. Also, it represents a duplication of information at the FRS, and at the software vendor, representing two independant points of failure for the same information.

  21. Re:/mnt/win not found on Microsoft Antitrust Judgement · · Score: 1

    yeah :P I changed my profile the other day and it got truncated, I've just been too lazy to fix it :P

  22. Re:the replies to this post on Microsoft Antitrust Judgement · · Score: 5, Funny

    OMG, you predicted your own rating! ;-)

  23. And in other news... on Reuters Accused Of Hacking For Typing In URL · · Score: 2

    Thousands of readers of a popular, yet poorly designed open source friendly news relay site are being sued by the OSN for directly typing in the web server's domain, with out instead following a link to it.

  24. Re:There are technical solutions on Reuters Accused Of Hacking For Typing In URL · · Score: 3, Insightful

    I'd like to draw an analogy here.

    Some might say that a server is like a house, a proper house has a security system and locks. People are free to stand around on the sidewalk, and have a look at your lawn flamingo's, but they may not try to enter the house unless they have been given specific permission to do so, which would be implied with the giving of the security code and a key to the front door.

    I prefer to think of a server as more of candy at someone's desk. Some candy may be sitting in a bowl on the edge of the desk where all may freely partake of it. Other candy may be locked up in their drawer, or failing drawers, at least hidden from view. Unless you've been given specific permission to have candy locked up in someone's drawer, you may not have any. Someone wishing to protect their candy needs to do this. Simly placing a blank sheet of paper over the "protected" candy bowl is *not* sufficient to indicate that you don't want people to partake of that candy.

    What that breaks down to is that having an easily guessed URL as the only obscurity to protect sensitive information (eg, http://server/2001-report/ with the sensitive one at http://server/2002-report/) is only a blank sheet of paper, it does not indicate that the information in 2002-report is sensitive. If they wished to protect their information, they should use whatever security means are at their disposal, which you're right, may not include technical know-how, but it *does* include the common sense know-how of at least making the URL http://server/randomstring/.

    In my mind, the real issue here is that the "attacked" company failed to sufficiently indicate that the information was sensitive. It's very easy to imagine that Reuters was browsing for the report, couldn't find the link, so did what I myself have done countless times, assume that the information is intended to be public, but that some error has prevented it from being displayed that way (a sheet of paper fell off the shelf on top of the candy bowl), and so simply changed a 2001 to a 2002, and removed the sheet of paper.

  25. Re:Do what I do... on Registrar Told To Stop Direct-Mail Scare-Tactics · · Score: 5, Informative

    As learned in the AOL CD story a few days ago (so don't blame me if it's inaccurate, /me points at everyone else), anything that comes bulk mail doesn't have any return to sender fees associated with it, so the post office throws it out if you send it return to sender. Meaning that all you do then is increase the load on the postal service, with out inconveniencing the sender at all, and subsequently increasing postal rates.