Maybe if you consider that they are not only looking for "criminal activity", but also for any expression "critical of the US" (or what they think is), things look different? On may even argue that they are primarily looking for the second...
Very old, very well known to anybody that bothered to find out. Yet these clueless morons that are claiming differently crop up time and again. It is a disgrace and just shows that some people are utterly disconnected from reality.
Because these morons do not actually want to do anything about the problem, they are just looking for excuses for MS. How somebody can be this stupid is beyond me, but "happy slaves" are apparently a reality.
Incidentally, for serious security vulnerabilities, the Linux kernel has time-to-fix considerably less than 90 days. Times of below 12h after reporting have been observed. There is no issue to be fixed here, the Linux folks are doing their job. The problem is that MS is not doing theirs and are endangering hundreds of millions of people in the process.
First, MS did actually get something like a year here. And second: The policy is simple: Get 90 days unless there are some special circumstances. There were none (except gross incompetence by MS), hence the bug got published after they failed again (!) to fix it and it was already being exploited.
If you do software security this way, then you are unfit to provide software with any security criticality. 90 days is already stretching it considerably. 2-4 weeks would be reasonable.
MS is blatantly riding their exception from liability for what in all other tech products would be called gross negligence and would make the manufacture criminally and civilly liable. Until they do get that liability, like they should, nothing is going to change.
MS needs to be either kicked hard until they get that they have a responsibility, or they need to be made completely obsolete. 90 days is plenty. I say we call not fixing reported security-bugs in 90 days gross negligence and make them per default liable for all hacks of their "OS" that happen afterwards until they patch and with no possibility to prevent that liability in the TOU.
Why are we are trusting these people to provide widely-used software, again?
A reasonable time-frame to patch security vulnerabilities is like 2...4 weeks. 90 days is already stretching it considerably and they still are too incompetent or uncaring to make that long deadline. Google is doing the right thing here. If incompetent and lazy vendors are not forced to fix security vulnerabilities, they will never do it. It is just utterly pathetic that we allow MS to be one of these worst offenders.
In Germany, covert listening devices are illegal to operate and own (exceptions for law-enforcement apply). That is why these dolls were illegal all along, because it is not readily obvious what they do. The "Bundesnetzagentur" has just pointed that out.
Use a VPN, use SSH for remote logins and you basically do not care about the security of the access-point. If it wants a browser-based sign-up, just do that from a VM. You would think that you can find people that know how to do that at the RSA conference....
And I predict this will be of negative worth. The only thing it will do is piss them off when they notice.
Incidentally, "destruction of evidence" can land you in prison for a few decades. Face it, the US is a police-state by now and unless that changes, you can do nothing to protect yourself besides not carrying information you do not want exposed. That does not only apply tho border-crossing.
That utterly stupid idea always comes up in these discussions. IT DOES NOT WORK. Either they are not really looking, in that case you do not need this, or they are really looking in which case they will find that mechanism and you will be fucked. This is not a problem technology can solve.
Works the same with a laptop image (and that one could include the phone-image). I have started doing this a long time ago: Go over the border wit a clean, mostly empty installation, download anything else later. I don't even do it to protect my privacy, just to prevent them misinterpreting something ironic or sarcastic I may have said in an email and prevent me from having something encrypted in there that I cannot open (happens all the time from experiments).
Idiots always think other people are even bigger idiots, even when there is ample evidence to the contrary. The worst are the violent and destructive idiots. This is a case in point.
No, it is not, because there is no device type for "keyboard". It can tell the other side that it is a HID (Human Interface Device) though and that class includes keyboards.
Slashdot Mirror
Maybe I will in the future directly go to the second and not even check the first page at all...
Maybe if you consider that they are not only looking for "criminal activity", but also for any expression "critical of the US" (or what they think is), things look different? On may even argue that they are primarily looking for the second...
In particular, unicorns nobody needs like their progressive destruction of a reasonable GUI.
Very old, very well known to anybody that bothered to find out. Yet these clueless morons that are claiming differently crop up time and again. It is a disgrace and just shows that some people are utterly disconnected from reality.
Indeed. MS did not even manage to ask for an extension. Apparently they are now completely dysfunctional when it comes to security.
Because these morons do not actually want to do anything about the problem, they are just looking for excuses for MS. How somebody can be this stupid is beyond me, but "happy slaves" are apparently a reality.
Incidentally, for serious security vulnerabilities, the Linux kernel has time-to-fix considerably less than 90 days. Times of below 12h after reporting have been observed. There is no issue to be fixed here, the Linux folks are doing their job. The problem is that MS is not doing theirs and are endangering hundreds of millions of people in the process.
You are either stupid or trolling.
First, MS did actually get something like a year here. And second: The policy is simple: Get 90 days unless there are some special circumstances. There were none (except gross incompetence by MS), hence the bug got published after they failed again (!) to fix it and it was already being exploited.
Funny. Not even remotely true, of course. It is just a dishonest excuse for not caring about their customers at all.
More like greed and stupidity. Both qualities MS has amply demonstrated in the past and is continuing to push as core values.
If you do software security this way, then you are unfit to provide software with any security criticality. 90 days is already stretching it considerably. 2-4 weeks would be reasonable.
Indeed. And add to that "which was already being exploited".
MS is blatantly riding their exception from liability for what in all other tech products would be called gross negligence and would make the manufacture criminally and civilly liable. Until they do get that liability, like they should, nothing is going to change.
So you are advocating that because one house is burning to ignore the other one that is also burning? Sounds stupid.
MS needs to be either kicked hard until they get that they have a responsibility, or they need to be made completely obsolete. 90 days is plenty. I say we call not fixing reported security-bugs in 90 days gross negligence and make them per default liable for all hacks of their "OS" that happen afterwards until they patch and with no possibility to prevent that liability in the TOU.
Why are we are trusting these people to provide widely-used software, again?
A reasonable time-frame to patch security vulnerabilities is like 2...4 weeks. 90 days is already stretching it considerably and they still are too incompetent or uncaring to make that long deadline. Google is doing the right thing here. If incompetent and lazy vendors are not forced to fix security vulnerabilities, they will never do it. It is just utterly pathetic that we allow MS to be one of these worst offenders.
In Germany, covert listening devices are illegal to operate and own (exceptions for law-enforcement apply). That is why these dolls were illegal all along, because it is not readily obvious what they do. The "Bundesnetzagentur" has just pointed that out.
And if the actual security experts were just using secure VPN, then the wannabes from "Pownie Express" have about a bucket of egg on their faces....
Use a VPN, use SSH for remote logins and you basically do not care about the security of the access-point. If it wants a browser-based sign-up, just do that from a VM. You would think that you can find people that know how to do that at the RSA conference....
People are stupid and kidding themselves about how bad things have gotten. US citizens more so than others.
And I predict this will be of negative worth. The only thing it will do is piss them off when they notice.
Incidentally, "destruction of evidence" can land you in prison for a few decades. Face it, the US is a police-state by now and unless that changes, you can do nothing to protect yourself besides not carrying information you do not want exposed. That does not only apply tho border-crossing.
That utterly stupid idea always comes up in these discussions. IT DOES NOT WORK. Either they are not really looking, in that case you do not need this, or they are really looking in which case they will find that mechanism and you will be fucked. This is not a problem technology can solve.
That may come right back at you. If you raise suspicion in any other way (easy to do by accident), you have just fucked yourself. Stupid.
Works the same with a laptop image (and that one could include the phone-image). I have started doing this a long time ago: Go over the border wit a clean, mostly empty installation, download anything else later. I don't even do it to protect my privacy, just to prevent them misinterpreting something ironic or sarcastic I may have said in an email and prevent me from having something encrypted in there that I cannot open (happens all the time from experiments).
Idiots always think other people are even bigger idiots, even when there is ample evidence to the contrary. The worst are the violent and destructive idiots. This is a case in point.
No, it is not, because there is no device type for "keyboard". It can tell the other side that it is a HID (Human Interface Device) though and that class includes keyboards.