As can be nicely seen, not only do back-doors allow people in that you do not really want to let in (Intel, the NSA), they often have serious flaws that let everybody else into your machines as well. The only sane and secure design is not to have any back-doors in the first place.
Since Intel now has a ton of egg on their faces after their announcement, I expect we have a really, really serious problem now as long as the ME stays active in any significant number of computers. Otherwise they would just have tried to sweep this under the rug, but it seems to be that the insecurity of the ME is far, far too bad for that.
The problem here is that writing simple, clean and obviously secure code (which usually is also much more compact) is really hard and most people cannot do it. The most universal principle for secure, reliable and maintainable code is KISS. Yet we see evermore bloated abominations performing security critical functions, because the people creating them have huge egos and small skills.
Which is reasonable. Only if this is the only way to prevent major attack activity going on is it the right thing to start killing processes. The update in the article by Errata Security is spot on though: Most security people are not developers and that severely limits their perspective. Personally, as security person that is also an (occasional) developer, I cannot imagine how you actually can do good things in the security space without at least some real hands-on experience of software development. Yet I encounter security people that cannot code or cannot code well all the time professionally and they suck at their job as a consequence.
Indeed. I know one large financial institution that is moving to Linux and another one that is planning it. They both also have a small number of Windows application servers, and these cause a large part of the problems with the software-landscape.
Nobody serious runs anything mission-critical on Windows. It is either Linux, one of the free BSDs or a commercial Unix. Even on the mainframe it becomes more and more Linux, because it is easier to get developers for that than for traditional mainframe coding.
Intel will not even dream of making use of Linux hard on the server. They will make very sure that at least their server offerings are as compatible as possible.
It is. You do not have to cut through the BS as with so many other people. Without that, Linux would never have grown to the quality-level it currently is at. While not perfect, it is pretty good, provided competent system administration and good competent coding.
There is also a 3rd class of coders, which one of my Application Security students pointed out last year: Those that do not really understand security, but know it is difficult and that get help from an expert when they need it. While this may be a bit underwhelming as result of my teaching efforts, I have to say he really got it.
So? Why would "100% secure programs" be desirable? This is the thinking of a complete amateur in the security-space. Security is risk management. You never do risk mitigation to "100%" in reality. It is stupid.
And "OS and languages that have security built-in"? Have you completely ignored all attempts and all research on that for the, oh, last 40 years or so? It cannot be done and asking for it is, again, stupid.
At least when you take into account that people should design security in today. So from the coding angle, pretty much "just bugs". From the testing angle often vastly different, as in functionality testing you check for the presence of functionality, but in security testing you check for the absence of functionality. Individual tests are still pretty similar, but getting test-coverage is very different and a lot more difficult.
Of course, the "just bugs" view also requires that the developers actually understand security. That is far more often not the case as with functionality bugs. Although even with functionality, quite a few coders do not really know what they are doing. So again, not quite the same thing, but also not quite different either.
He did not present research and an actual scientist would have noted that. He presented conclusions based on research not on "opinions". That you call published and reviewed research "opinions" already shows you are discussing in bad faith, and are far more interested in pushing your own opinion (which is not at all proven or peer-reviewed) instead of discussing facts.
Fascinating. I am an actual scientist with a lot of experience reviewing papers and spotting bullshit in them, quite a few of them with statistical arguments. Apparently, I do not qualify as "having half a brain", because my finely tuned bullshit detector did not even ping once in reading his text. Sure, there were areas of uncertainty where more research was needed, but he clearly marked them. And there were some opinions, also clearly marked.
So no, anybody that immediately recognized it as what you would like it to be is full of it. Same as you.
Oh, there will be survivors. One reason bio-weapons are not used in practice (other then chemical ones) is that they are really hard to deliver, i.e. you usually hit only a small number of people. The other is that many people will survive or even not get sick. But a few million dead if something like this goes bad in a larger city are a real possibility. Most will actually not die from the pathogen though, but from the panic.
You commented on the writing. The viewpoint is something expressed in the writing, it does not necessarily coincide with what the person thinks. You can express viewpoints in writing that are not your own. In other words, you did exactly what you later claimed you did not. And then you add statements claiming you try to be "fair" or "honest". You should urgently look up what a "hypocrite" is, because you are an extreme instance of that idea.
Indeed. While there is nothing wrong with his facts, what he completely missed what that there was absolutely no chance for a positive change stemming from it. Smart people already know that most people are idiots and do not care about facts. Hence smart people have stopped trying to change things for the better, unless it is with an organization with significant power behind them. So instead of publishing the memo, he should have donated money to an organization that sees actual reality and tries to do some changes based on that. Sure, it does not look like that is going to work and it looks very much like humanity is doomed because of a really unfortunate idiot/non-idiot ratio, but what he did just makes him a target and serves for the idiots to easier focus their hatred, i.e. makes things worse.
Yes, it is hard to understand that often you should not speak up when being right. It is however the smart thing in this society.
you cannot say that that is a misogynistic viewpoint.
Fortunately I didn't.
Please, and this goes for everyone, please carefully read my posts and don't assume I said things that I didn't actually say.
Well, you came close enough that the difference is irrelevant. You said "He ended up sounding like a typical "rational" misogynist, and didn't make any effort (even to this day) to clarify." as a simple text-search above shows. If you really think that there is a difference that matters between "sounding like a typical xyz" and "an xyz viewpoint", then I think you have a problem.
Thanks for continuing to prove to everyone you didn't read a damn thing for yourself and have no clue what you're talking about.
That is continuing to fascinate me. Back when this shit storm started up, I went and read the original memo and I had serious trouble finding real connection between what was claimed about it and what was there. It went way beyond functional illiteracy, most people just never did read it and made claims about knowing the truth about it without even having seen the words that he wrote and they just unquestioningly believed very, very skewed reports on the content.
And that is the real issue here: People are not even a bit rational anymore, they immediately want a crusade and a burning-at-the-stake when anybody is rumored to have disagreed with how they see things, no matter the actual facts. That is a sure sign of a society in decline, a society that rapidly approaches the point where it cannot even solve tiny problems because it cannot see what is. That is not good at all.
If you have access to actual facts, you will always offend many people, because they do not. They do not in the sense that they cannot recognize and understand facts. Telling people with access to facts to "shut up" in order to not offend anybody is really the road to hell.
Well, men and women are different, because they have, by having in some respects very different bodies (in ways hard to ignore) a different interface to the world. Anybody that denies that is already deep into fantasy and propaganda-land. And of course, those deep into a fantasy about how things must actually be start to howl and be aggressive when their failure to see reality is pointed out to them. The more solid the evidence, the more outraged and violent the response. This reaction can be regularly observed in small children, but it seems more and more people do not outgrow that phase.
The sad thing is that this anti-rational behavior also stands in the way of actually removing remaining injustices in how the genders are treated. Fortunately, "equal opportunity" is mostly implemented. Equally fortunately, "equal outcome" will likely never be reached, as that one would involve forcing many people to do things they actually do not want to do.
That idea is too complicated for most people. It requires one step of indirection, and that flies right over most peoples heads, as can be nicely seen in the example at hand.
The first guy is just as full of shit as he claims the "liberals" are. (Did not watch the second one, my quota of stupidity for today was amply filled bu the first guy.)
The sad fact of the matter is that there are people that try to see what is actual truth (a minority, that typically coincides with the 10-15% independent thinkers) and that there is a vast majority that will do and say anything to justify their misconceptions and will make zero effort to find out what is actually going on, as they themselves are "obviously" right. Sure, you find the anti-fact, anti-reason people in large numbers on the political right and the political left in the US. Whether you are a tree-hugger or a climate-change denier does make little difference in the end: You are a person that denies rationality. In the end, the problem is people that go with emotion and ego over ratio and facts. They are a vast majority and they think they are doing it right. And they are basically the source of all evil in the world.
Slashdot Mirror
As can be nicely seen, not only do back-doors allow people in that you do not really want to let in (Intel, the NSA), they often have serious flaws that let everybody else into your machines as well. The only sane and secure design is not to have any back-doors in the first place.
Since Intel now has a ton of egg on their faces after their announcement, I expect we have a really, really serious problem now as long as the ME stays active in any significant number of computers. Otherwise they would just have tried to sweep this under the rug, but it seems to be that the insecurity of the ME is far, far too bad for that.
That is not a coding problem. That is a problem with lack of management liability.
The problem here is that writing simple, clean and obviously secure code (which usually is also much more compact) is really hard and most people cannot do it. The most universal principle for secure, reliable and maintainable code is KISS. Yet we see evermore bloated abominations performing security critical functions, because the people creating them have huge egos and small skills.
Which is reasonable. Only if this is the only way to prevent major attack activity going on is it the right thing to start killing processes. The update in the article by Errata Security is spot on though: Most security people are not developers and that severely limits their perspective. Personally, as security person that is also an (occasional) developer, I cannot imagine how you actually can do good things in the security space without at least some real hands-on experience of software development. Yet I encounter security people that cannot code or cannot code well all the time professionally and they suck at their job as a consequence.
Indeed. I know one large financial institution that is moving to Linux and another one that is planning it. They both also have a small number of Windows application servers, and these cause a large part of the problems with the software-landscape.
Nobody serious runs anything mission-critical on Windows. It is either Linux, one of the free BSDs or a commercial Unix. Even on the mainframe it becomes more and more Linux, because it is easier to get developers for that than for traditional mainframe coding.
Intel will not even dream of making use of Linux hard on the server. They will make very sure that at least their server offerings are as compatible as possible.
It is. You do not have to cut through the BS as with so many other people. Without that, Linux would never have grown to the quality-level it currently is at. While not perfect, it is pretty good, provided competent system administration and good competent coding.
There is also a 3rd class of coders, which one of my Application Security students pointed out last year: Those that do not really understand security, but know it is difficult and that get help from an expert when they need it. While this may be a bit underwhelming as result of my teaching efforts, I have to say he really got it.
So? Why would "100% secure programs" be desirable? This is the thinking of a complete amateur in the security-space. Security is risk management. You never do risk mitigation to "100%" in reality. It is stupid.
And "OS and languages that have security built-in"? Have you completely ignored all attempts and all research on that for the, oh, last 40 years or so? It cannot be done and asking for it is, again, stupid.
At least when you take into account that people should design security in today. So from the coding angle, pretty much "just bugs". From the testing angle often vastly different, as in functionality testing you check for the presence of functionality, but in security testing you check for the absence of functionality. Individual tests are still pretty similar, but getting test-coverage is very different and a lot more difficult.
Of course, the "just bugs" view also requires that the developers actually understand security. That is far more often not the case as with functionality bugs. Although even with functionality, quite a few coders do not really know what they are doing. So again, not quite the same thing, but also not quite different either.
He did not present research and an actual scientist would have noted that. He presented conclusions based on research not on "opinions". That you call published and reviewed research "opinions" already shows you are discussing in bad faith, and are far more interested in pushing your own opinion (which is not at all proven or peer-reviewed) instead of discussing facts.
Fascinating. I am an actual scientist with a lot of experience reviewing papers and spotting bullshit in them, quite a few of them with statistical arguments. Apparently, I do not qualify as "having half a brain", because my finely tuned bullshit detector did not even ping once in reading his text. Sure, there were areas of uncertainty where more research was needed, but he clearly marked them. And there were some opinions, also clearly marked.
So no, anybody that immediately recognized it as what you would like it to be is full of it. Same as you.
Oh, there will be survivors. One reason bio-weapons are not used in practice (other then chemical ones) is that they are really hard to deliver, i.e. you usually hit only a small number of people. The other is that many people will survive or even not get sick. But a few million dead if something like this goes bad in a larger city are a real possibility. Most will actually not die from the pathogen though, but from the panic.
You commented on the writing. The viewpoint is something expressed in the writing, it does not necessarily coincide with what the person thinks. You can express viewpoints in writing that are not your own. In other words, you did exactly what you later claimed you did not. And then you add statements claiming you try to be "fair" or "honest". You should urgently look up what a "hypocrite" is, because you are an extreme instance of that idea.
I see you do not understand at all what is going on. But that is fine, most people are on your side in that. "Safety in numbers" and all that...
The thing I was calling "manipulative writing" was the slashdot article.
You make this far too easy for yourself. Hence you are very obvious for others. My advice is to try harder.
Makes sense to me.
Indeed. While there is nothing wrong with his facts, what he completely missed what that there was absolutely no chance for a positive change stemming from it. Smart people already know that most people are idiots and do not care about facts. Hence smart people have stopped trying to change things for the better, unless it is with an organization with significant power behind them. So instead of publishing the memo, he should have donated money to an organization that sees actual reality and tries to do some changes based on that. Sure, it does not look like that is going to work and it looks very much like humanity is doomed because of a really unfortunate idiot/non-idiot ratio, but what he did just makes him a target and serves for the idiots to easier focus their hatred, i.e. makes things worse.
Yes, it is hard to understand that often you should not speak up when being right. It is however the smart thing in this society.
you cannot say that that is a misogynistic viewpoint.
Fortunately I didn't.
Please, and this goes for everyone, please carefully read my posts and don't assume I said things that I didn't actually say.
Well, you came close enough that the difference is irrelevant. You said "He ended up sounding like a typical "rational" misogynist, and didn't make any effort (even to this day) to clarify." as a simple text-search above shows. If you really think that there is a difference that matters between "sounding like a typical xyz" and "an xyz viewpoint", then I think you have a problem.
Thanks for continuing to prove to everyone you didn't read a damn thing for yourself and have no clue what you're talking about.
That is continuing to fascinate me. Back when this shit storm started up, I went and read the original memo and I had serious trouble finding real connection between what was claimed about it and what was there. It went way beyond functional illiteracy, most people just never did read it and made claims about knowing the truth about it without even having seen the words that he wrote and they just unquestioningly believed very, very skewed reports on the content.
And that is the real issue here: People are not even a bit rational anymore, they immediately want a crusade and a burning-at-the-stake when anybody is rumored to have disagreed with how they see things, no matter the actual facts. That is a sure sign of a society in decline, a society that rapidly approaches the point where it cannot even solve tiny problems because it cannot see what is. That is not good at all.
If you have access to actual facts, you will always offend many people, because they do not. They do not in the sense that they cannot recognize and understand facts. Telling people with access to facts to "shut up" in order to not offend anybody is really the road to hell.
Well, men and women are different, because they have, by having in some respects very different bodies (in ways hard to ignore) a different interface to the world. Anybody that denies that is already deep into fantasy and propaganda-land. And of course, those deep into a fantasy about how things must actually be start to howl and be aggressive when their failure to see reality is pointed out to them. The more solid the evidence, the more outraged and violent the response. This reaction can be regularly observed in small children, but it seems more and more people do not outgrow that phase.
The sad thing is that this anti-rational behavior also stands in the way of actually removing remaining injustices in how the genders are treated. Fortunately, "equal opportunity" is mostly implemented. Equally fortunately, "equal outcome" will likely never be reached, as that one would involve forcing many people to do things they actually do not want to do.
That idea is too complicated for most people. It requires one step of indirection, and that flies right over most peoples heads, as can be nicely seen in the example at hand.
The first guy is just as full of shit as he claims the "liberals" are. (Did not watch the second one, my quota of stupidity for today was amply filled bu the first guy.)
The sad fact of the matter is that there are people that try to see what is actual truth (a minority, that typically coincides with the 10-15% independent thinkers) and that there is a vast majority that will do and say anything to justify their misconceptions and will make zero effort to find out what is actually going on, as they themselves are "obviously" right. Sure, you find the anti-fact, anti-reason people in large numbers on the political right and the political left in the US. Whether you are a tree-hugger or a climate-change denier does make little difference in the end: You are a person that denies rationality. In the end, the problem is people that go with emotion and ego over ratio and facts. They are a vast majority and they think they are doing it right. And they are basically the source of all evil in the world.
Simple: There is no mod option for "malicious propaganda lies"