The biggest danger to DRM is exactly the user changing code. Ever heard, for example, of people that crack DRM of games? With binary-only, this is however massively more difficult, so DRM has some chance in the real world as long as no source code is available.
The problem here is knowing who does it. When you know that, more sane measures (a year or two in prison and having to pay for the damage done in full) is entirely sufficient, no need to be a cave-man. Of course, as all resources are currently tied up in "The War on Terror", "The War on Drugs", and some other wars against mostly imaginary problems and problems that cannot be solved by a "War", DDoS attackers, being a real problem, have to take the back-seat and will likely not be identified anytime soon.
What, you thought law enforcement and all that spying was for the benefit of the people? Seriously?
That is actually wrong. As the software is per design under attacker (= user) control, you need to keep far more secret than the keys. Kerckhoffs's principle does not apply to this situation.
The problem is that currently, the wealth a society produces gets distributed according to perceived usefulness by paying wages that people then can use to buy stuff. The wages are often grossly out of proportion with the actual usefulness of people (as for example in the cases of some CEOs, I could name) , but this approach is generally used. This system needs to be replaced with something else. That is the only real problem here. Other than that, I fully agree with you.
This does not require AI. Automation is quite enough. As we still do not have anything that deserves the name AI (or true/strong AI if you prefer) and may never have it, that would be a major flaw in this prediction. The sad fact of the matter is that in order to replace the work-skills of a rather large part of the human race, AI is not needed and the problem will very likely come to be.
The real challenge is however not what people so replaced will do with their time. Human beings are good at killing time. The real challenge is how to distribute wealth, when money assigned via wages does not cut it anymore because there is a large class of people that cannot do any work machines cannot do better and cheaper. If that problem is not satisfactorily solved, things will get rally ugly.
There is really no way he can come to this conclusion otherwise. It is a bit like praising the Nazis for mostly restricting themselves to killing Jews. And they were well-intentioned in that as well, if you take into account their entirely perverted world view. (No, I am not arguing they were anything but utterly evil. I am arguing that they thought they were doing good.)
The road to hell is paved with good intentions and loss of common sense.
Indeed. In the US, you have no reasonable expectation of the rule of law being applied to your case. This is what a budding police-state looks like and the future direction this is going is pretty clear.
My take also. It could also be pressure or a court order that forces her to keep vulnerabilities she finds secret and only tell the FBI about them.
What you are seeing here, folks, is history in the making. Not quite like the Jews fleeing Nazi Germany, but the fundamental principle is not so different. It is ironic though, that people are fleeing in the opposite direction these days.
I beg to disagree. This shows that the scanning engines are of low(est) quality and run in places they should not. While this particular bug is now fixed, the underlying problem is very much not so.
You would think that of all things, scanning engines of AV products would have buffer-overflow protection in place. But apparently, these are the same bad 3rd-rated coders that are responsible for the problem in the first place. And doing this in kernel-space? How insane can you get?
Unfortunately, you are right on the mark. The problem is indeed far too many users that have no clue what they could get in quality and performance and hence being satisfied with Microsoft. And then they drag the rest of us down to their level.
While you may not like the Chinese, their concerns are entirely valid. They want to know what amount of US backdoors and spying capabilities they buy with the devices and expose their people to. Sure, the Chinese do this themselves, but it is their country, so they rightfully wonder about foreign spying, regardless of what they do themselves.
Nonces do not need to be random or unpredictable. A counter produces perfectly acceptable nonces, see, for example, the counter-mode for block ciphers. The defining characteristic of a nonce is that it gets used only once with respect to a given larger context.
This is not it. In crypto, you need "secrets" that an attacker cannot easily guess. These need to be "unpredictable" for the attacker, they do not need to be "random" or even "unpredictable" for the defender. (They can then, for example, be fed into a prime-number generator, but there are numerous other uses.) For simplicity, "unpredictable" is usually called "random", but that is not strictly true. Most "random" numbers for crypto are generated using CPRNGs (Cryptographic-PSEUDO-Random-Number-Generators). These have the property that they have a state (say 256 bits) that is necessary to predict their output, and that state is kept secret. The actual bits produced are not random at all, but they are unpredictable without that state.
Now, where to get those 256 seeding-bits? The usual way is to put in a lot of bits into the CPRNG and the CPRNG distills out the entropy (for simplicity you can think of "entropy" as "amount of randomness"). If the overall entropy in what was put in is larger than 256 bits, you end up with a well-seeded CPRNG that can then produce gigabytes of unpredictable data completely suitable for crypto use.
Slashdot Mirror
It would be done because it would be so damn satisfying.
Sometimes, that's enough.
If you are an immoral cave-man then yes. If you actually qualify as a modern human being, then no. Or to put it otherwise: You are a problem.
Yes, clearly you have no real clue how DRM works.
The biggest danger to DRM is exactly the user changing code. Ever heard, for example, of people that crack DRM of games? With binary-only, this is however massively more difficult, so DRM has some chance in the real world as long as no source code is available.
The problem here is knowing who does it. When you know that, more sane measures (a year or two in prison and having to pay for the damage done in full) is entirely sufficient, no need to be a cave-man. Of course, as all resources are currently tied up in "The War on Terror", "The War on Drugs", and some other wars against mostly imaginary problems and problems that cannot be solved by a "War", DDoS attackers, being a real problem, have to take the back-seat and will likely not be identified anytime soon.
What, you thought law enforcement and all that spying was for the benefit of the people? Seriously?
So that is the root-cause of the problem of the recent influx of stupid stories on /.
That is actually wrong. As the software is per design under attacker (= user) control, you need to keep far more secret than the keys. Kerckhoffs's principle does not apply to this situation.
And I agree to that too. Eventually this may lead to money being abandoned altogether, but not anytime soon.
The problem is that currently, the wealth a society produces gets distributed according to perceived usefulness by paying wages that people then can use to buy stuff. The wages are often grossly out of proportion with the actual usefulness of people (as for example in the cases of some CEOs, I could name) , but this approach is generally used. This system needs to be replaced with something else. That is the only real problem here. Other than that, I fully agree with you.
This does not require AI. Automation is quite enough. As we still do not have anything that deserves the name AI (or true/strong AI if you prefer) and may never have it, that would be a major flaw in this prediction. The sad fact of the matter is that in order to replace the work-skills of a rather large part of the human race, AI is not needed and the problem will very likely come to be.
The real challenge is however not what people so replaced will do with their time. Human beings are good at killing time. The real challenge is how to distribute wealth, when money assigned via wages does not cut it anymore because there is a large class of people that cannot do any work machines cannot do better and cheaper. If that problem is not satisfactorily solved, things will get rally ugly.
There is really no way he can come to this conclusion otherwise. It is a bit like praising the Nazis for mostly restricting themselves to killing Jews. And they were well-intentioned in that as well, if you take into account their entirely perverted world view. (No, I am not arguing they were anything but utterly evil. I am arguing that they thought they were doing good.)
The road to hell is paved with good intentions and loss of common sense.
Good to know. If I run into content that I care about enough, I will have a look.
I just move on in that case. I need their content less than they seem to need me.
Not at all. Just an AC throwing FUD.
Any good code review flags obfuscated code as even more red (if that were possible) than an obvious backdoor.
Indeed. In the US, you have no reasonable expectation of the rule of law being applied to your case. This is what a budding police-state looks like and the future direction this is going is pretty clear.
My take also. It could also be pressure or a court order that forces her to keep vulnerabilities she finds secret and only tell the FBI about them.
What you are seeing here, folks, is history in the making. Not quite like the Jews fleeing Nazi Germany, but the fundamental principle is not so different. It is ironic though, that people are fleeing in the opposite direction these days.
Of course, once these minds are corrupted, they do not care about getting un-corrupted and think things are fine as they are.
You are seriously claiming that a file-scan engine needs to be in the kernel? You are even more stupid that the average AC moron.
You are kidding yourself. These two may look better at the moment, but they have the same problems. AV has become a massive security risk.
I beg to disagree. This shows that the scanning engines are of low(est) quality and run in places they should not. While this particular bug is now fixed, the underlying problem is very much not so.
You would think that of all things, scanning engines of AV products would have buffer-overflow protection in place. But apparently, these are the same bad 3rd-rated coders that are responsible for the problem in the first place. And doing this in kernel-space? How insane can you get?
Unfortunately, you are right on the mark. The problem is indeed far too many users that have no clue what they could get in quality and performance and hence being satisfied with Microsoft. And then they drag the rest of us down to their level.
Hahahahaha, and how are you going to do that without bankrupting most of the US IT industry?
While you may not like the Chinese, their concerns are entirely valid. They want to know what amount of US backdoors and spying capabilities they buy with the devices and expose their people to. Sure, the Chinese do this themselves, but it is their country, so they rightfully wonder about foreign spying, regardless of what they do themselves.
Nonces do not need to be random or unpredictable. A counter produces perfectly acceptable nonces, see, for example, the counter-mode for block ciphers. The defining characteristic of a nonce is that it gets used only once with respect to a given larger context.
This is not it. In crypto, you need "secrets" that an attacker cannot easily guess. These need to be "unpredictable" for the attacker, they do not need to be "random" or even "unpredictable" for the defender. (They can then, for example, be fed into a prime-number generator, but there are numerous other uses.) For simplicity, "unpredictable" is usually called "random", but that is not strictly true. Most "random" numbers for crypto are generated using CPRNGs (Cryptographic-PSEUDO-Random-Number-Generators). These have the property that they have a state (say 256 bits) that is necessary to predict their output, and that state is kept secret. The actual bits produced are not random at all, but they are unpredictable without that state.
Now, where to get those 256 seeding-bits? The usual way is to put in a lot of bits into the CPRNG and the CPRNG distills out the entropy (for simplicity you can think of "entropy" as "amount of randomness"). If the overall entropy in what was put in is larger than 256 bits, you end up with a well-seeded CPRNG that can then produce gigabytes of unpredictable data completely suitable for crypto use.