Without FIPS certification system engineers won't be able to include BoringSSL in US-government facing applications, since doing so will disqualify them from procurement lists. Since US gov't is largest consumer of cryptographic products in the North American market, BoringSSL must certify or stay irrelevant.
Very interesting post, thank you for writing it up.
I have a question. Are there guard bands in biological computation (e.g. our brains) ? I was under impression that our cognitive processes (software) are optimized for speed and designed to work with massively parallel but highly unreliable neural hardware.
What I am trying to say is that nature performed optimization decided that it is better to be very efficient all the time, and correct some of the time, but also be very good at error checking. While our CPU and OS designers decided that computing devices must be correct all the time, efficient some of the time, and poor at error checking.
If you are attempting being rational, then you need to reevaluate your decision making process. With rational approach, cost of ownership paired to a list of features is all you should consider. Optimizing the curve, you eliminate initial depreciation by buying used, and high repair/maintenance by selling the car before it gets too expensive to maintain. The optimum ends up being 2-8 years old car of any reliable car. Why reliable? First, it impacts resale value at 8 years old. Second, it allows it to make it to 8 years old without incurring major repair costs. You can't get any newer than 2 years, there isn't reliable supply of these, and selling before 8 years old leaves you with too short of an ownership to flatten the depreciation curve.
In closing, you might not want to drive that hypothetical lasts-50-years car in 49th year, but it makes cost of year 1 to year 5 cheaper.
Very few people outright buy the car and use it until junk yard. For people that lease resale value directly impacts their payment, less it worth at the end of leas term higher the monthly payment. For people that finance, trade-in value of their last car impacts their payments. In almost all cases original buyer and second-hand buyer are financially tied via 'cost of ownership' concept.
The car is not a software product, and obsolescence is not clear-cut or binary. Nearly all car features, including safety, are tied to original car budget. For example, luxury 5 year old car will likely still have more safety features than 0 year old econobox. That is, you are A LOT more likely to survive a crash in 2009 Mercedes S500 than 2014 Chevy Spark. I can find many examples of 10 year old cars that are still 'feature-complete' with anything that can be found on the road today. Your "obsolete after 5 years" is way, way off and suggests to me you are trying to rationalize your leasing habit.
If you ever visit automotive junk yard you will see that write-off accidents are minority and mechanical failure is majority of causes that lead cars to end up there.
Mechanical failure could be further categorized to catastrophic failure (e.g. timing belt in interference engine) and multiple minor concurrent issues that exceed replacement value. While I don't have hard data on this, I believe that leading cause of why cars end up in junk yards is transmission failure. Still, most of the cars that make to the junk yard could be made run or are still running.
Therefore, it is safe to conclude that car with higher degree of mechanical reliability, and cars that are cheaper to repair will be used for longer time.
>>> A car that falls apart after 5 years isn't any higher quality than a car that runs for 50 years, if you're going to replace either in 5 years anyway.
Faulty thinking. While you might get tired and replace car in 5 years, a car that runs for 50 years will have multiple owners. Its residual value will be higher. Environmental impact of manufacturing and then recycling it will be lessened due to getting spread over many more years.
Car that runs for 50 years is always higher quality that on that falls apart after 5 years no matter how you use it.
Chinese-branded cars make early KIAs look like a paragon of quality. The tradeoff of lack of quality for lower price might be acceptable in consumer goods, but in North American automotive world where baseline costs is dictated by regulations this simply won't work. Add on top of that economic drag off mandatory dealership sales model and you can't really cut the costs and overhead to create cheaper offerings.
As to Chinese-made Volvos - unless they are offering 10 year bumper-to-bumper warranty you will not see many of these of the road.
No, what I am saying is that most people can't be trusted to elect their representatives when someone tries to actively manipulate them. Since political speech is protected, and TV spots are political speech, there is no way to even hold any of it to "mostly true" standard.
For most people it is very difficult to determine when you are being lied to, when politicians do so under protection of freedom of political speech and then use anonymous money to hammer constituents with it then you have democratic process failing. Voters should be a given a chance to make informed decisions, and Citizens United make informed decision less likely.
I personally don't see "tangible difference" you mentioned, and harm of increasingly corrupt political system is not in any way abstract. Encouraging and providing anonymous means for politicians to partake at the trough is rather direct harm to democratic process. While we might disagree on "who has rights" issue, we ought not to disagree that Citizens United should fall under "most egregious situations". While both are important, for me democratic process (e.g. voting) is higher order of importance than freedom of speech.
Half of Americans are below average intelligence, by definition. I think that typical American is low-information, one-issue voter that can and does get disproportionally swayed by TV spots. We understand that marketing for unhealthy product works, why do you think that marketing for constituent-unfriendly politicians would not?
Do you think that if you keep slandering someone, armed men from the government would not censor you in a violent manner? (Libertarian-to-English translation: If you keep slandering someone you will go to jail and get censored that way).
Whatever your approach to categorizing speech, all approaches lead to restricting outright harmful speech. Classical example of shouting "Fire!" in a crowded theater is not protected, should not be protected because minute gain in liberties by far outweigh massive and tangible damage it would cause.
The same approach should be used in Citizens United case. Even if you treat money as speech, even if you view all speech in absolute terms, even if you see corporations as persons, you still should realize that whatever gain in liberties there to be had by far offset by massive corrupting effect of unaccountable money in politics.
We all understand that all forms of "government sucks!" speech are protected. What if I start engaging in similar speech acts targeted at a private citizen, is this type of speech protected? Well, that depends. Statements of opinion are generally fine. Now, if it turns out to be slander, harassment and so on government can and does step to censor me. So we can see there are some protections of private citizen vs. private citizen speech, but they are nowhere near absolute and government could get involved in censoring some of it. Then there are other protected categories of speech, for example religious, that does not require "targeted at some aspect of government" qualifier. Plus there is whole separate issue of social consequences of speech that in turn can be highly censorious.
With that said, I personally detest all forms of censorship and would like to see speech protections broadened. I still stand by my original definition.
You fail to understand my "Free Speech Protections have very specific applicability." For example, I as a private citizen, can limit your free speech as long as I have standing. You would be very effectively censored if I were to kick you off my property for expressing opinions. I could also attempt to censor you with other speech (e.g. heckling) in public spaces. None of this would be illegal, because I am not part of the government.
On top of the above freedom of speech is not absolute. False statements of fact, obscenity, fighting words, threats are under various circumstances and conditions excepted.
I understand and even agree with your point that data-mining by private companies is nearly as dangerous as when government is involved, but in this specific case what would the Big Data do with information that some dude uploaded bunch of pedobear content? Show him more targeted ads for hand lotion?
I don't accept your definition. Your argument could only be true if you consider spending money on politicians as a free speech. Money is property for all definitions of money.
Even if I accept your flawed definition, Free Speech Protections have very specific applicability - it only protect citizens against government limiting their speech targeted at some aspect of government. Strict equivalency to money would be government unable to limit money paid by private citizens to the government. Clearly, we don't have such problem.
You still failed to demonstrate how "we, the people" benefit from allowing anonymous and corporate money influence politics. How is our democratic process is strengthened by SuperPACs trying to buy elections? Sure, at least once it was show to fail. The question is why was this allowed in the first place?
>>>The only way to do that is to elect corrupt politicians. In fact, politicians never have to make that choice, because it's called bribery, quid-pro-quo, and corruption, and it's 100% illegal. As we have shown, many more times than this, the money does not help if you don't have support of the people. Buy all the votes you want, we'll make more.
I am always surprised when faced with cognitive dissonance of this magnitude. In one instance you recognize that "bribery, quid-pro-quo, and corruption" are bad, and in other instance you fail to apply this in coherent manner to the situation we describe.
What do you think happens when bill affecting ABC Inc. that donated substantial amount to a politician's election fund comes on the floor? Conflict of interest happens, where this politician has to potentially choose between representing campaign donors or representing constituents. Sure, some politicians would act honorably and do the right thing, but you can be sure that some will fail. So why create this issue at all? What do, we, the people, gain from allowing anonymous and corporate money into politics? Are we any freer as a result?
Clearly, you can extrapolate from a single data point.
For every Cantor that deservingly got tossed out, there are many that managed to outspend and keep their seats.
What more concerning is that unlimited money could buy unlimited influence. When average candidate has to spend this kind of crazy money to get elected, then donors are in position to dictate policy. Damage of Citizen's United is not money flowing into politics, but giving more opportunities for money to corrupt politics. Why create a situation where politician has to make a choice between voting in the best interest of constituents and keeping re-election funding?
In their defense, Bush Jr. didn't run on the platform of increasing surveillance and decreasing government transparency. For the second term he run on a solid platform of FUD and even many non-GOP voters bought into it.
Further in their defense, TP is a delayed reaction to Bush actions. Sure, it is largely counter-productive, ineffective, lacking concrete goals and so on, but if you are objective you can't claim they are not trying to do something about this.
Would you give AT&T signed blank check if they promised they would keep it for you "for security purposes"? Most people would hesitate to do so, but having one of your checks compromised is a lot less damaging that having your identity stolen via SSN compromise.
Slashdot Mirror
Without FIPS certification system engineers won't be able to include BoringSSL in US-government facing applications, since doing so will disqualify them from procurement lists. Since US gov't is largest consumer of cryptographic products in the North American market, BoringSSL must certify or stay irrelevant.
Make sure to run it on DVL distro
Very interesting post, thank you for writing it up.
I have a question. Are there guard bands in biological computation (e.g. our brains) ? I was under impression that our cognitive processes (software) are optimized for speed and designed to work with massively parallel but highly unreliable neural hardware.
What I am trying to say is that nature performed optimization decided that it is better to be very efficient all the time, and correct some of the time, but also be very good at error checking. While our CPU and OS designers decided that computing devices must be correct all the time, efficient some of the time, and poor at error checking.
Could someone explain to me why further refinement of fabrication process is the only way to progress? With a car analogy?
If you are attempting being rational, then you need to reevaluate your decision making process. With rational approach, cost of ownership paired to a list of features is all you should consider. Optimizing the curve, you eliminate initial depreciation by buying used, and high repair/maintenance by selling the car before it gets too expensive to maintain. The optimum ends up being 2-8 years old car of any reliable car. Why reliable? First, it impacts resale value at 8 years old. Second, it allows it to make it to 8 years old without incurring major repair costs. You can't get any newer than 2 years, there isn't reliable supply of these, and selling before 8 years old leaves you with too short of an ownership to flatten the depreciation curve.
In closing, you might not want to drive that hypothetical lasts-50-years car in 49th year, but it makes cost of year 1 to year 5 cheaper.
Again, I disagree.
Very few people outright buy the car and use it until junk yard. For people that lease resale value directly impacts their payment, less it worth at the end of leas term higher the monthly payment. For people that finance, trade-in value of their last car impacts their payments. In almost all cases original buyer and second-hand buyer are financially tied via 'cost of ownership' concept.
The car is not a software product, and obsolescence is not clear-cut or binary. Nearly all car features, including safety, are tied to original car budget. For example, luxury 5 year old car will likely still have more safety features than 0 year old econobox. That is, you are A LOT more likely to survive a crash in 2009 Mercedes S500 than 2014 Chevy Spark. I can find many examples of 10 year old cars that are still 'feature-complete' with anything that can be found on the road today. Your "obsolete after 5 years" is way, way off and suggests to me you are trying to rationalize your leasing habit.
What is the issue and why is it not covered under 10 year / 100K warranty?
If you ever visit automotive junk yard you will see that write-off accidents are minority and mechanical failure is majority of causes that lead cars to end up there.
Mechanical failure could be further categorized to catastrophic failure (e.g. timing belt in interference engine) and multiple minor concurrent issues that exceed replacement value. While I don't have hard data on this, I believe that leading cause of why cars end up in junk yards is transmission failure. Still, most of the cars that make to the junk yard could be made run or are still running.
Therefore, it is safe to conclude that car with higher degree of mechanical reliability, and cars that are cheaper to repair will be used for longer time.
>>> A car that falls apart after 5 years isn't any higher quality than a car that runs for 50 years, if you're going to replace either in 5 years anyway.
Faulty thinking. While you might get tired and replace car in 5 years, a car that runs for 50 years will have multiple owners. Its residual value will be higher. Environmental impact of manufacturing and then recycling it will be lessened due to getting spread over many more years.
Car that runs for 50 years is always higher quality that on that falls apart after 5 years no matter how you use it.
Chinese-branded cars make early KIAs look like a paragon of quality. The tradeoff of lack of quality for lower price might be acceptable in consumer goods, but in North American automotive world where baseline costs is dictated by regulations this simply won't work. Add on top of that economic drag off mandatory dealership sales model and you can't really cut the costs and overhead to create cheaper offerings.
As to Chinese-made Volvos - unless they are offering 10 year bumper-to-bumper warranty you will not see many of these of the road.
No, what I am saying is that most people can't be trusted to elect their representatives when someone tries to actively manipulate them. Since political speech is protected, and TV spots are political speech, there is no way to even hold any of it to "mostly true" standard.
For most people it is very difficult to determine when you are being lied to, when politicians do so under protection of freedom of political speech and then use anonymous money to hammer constituents with it then you have democratic process failing. Voters should be a given a chance to make informed decisions, and Citizens United make informed decision less likely.
US is a Republic for this very reason.
I personally don't see "tangible difference" you mentioned, and harm of increasingly corrupt political system is not in any way abstract. Encouraging and providing anonymous means for politicians to partake at the trough is rather direct harm to democratic process. While we might disagree on "who has rights" issue, we ought not to disagree that Citizens United should fall under "most egregious situations". While both are important, for me democratic process (e.g. voting) is higher order of importance than freedom of speech.
Half of Americans are below average intelligence, by definition. I think that typical American is low-information, one-issue voter that can and does get disproportionally swayed by TV spots. We understand that marketing for unhealthy product works, why do you think that marketing for constituent-unfriendly politicians would not?
Do you think that if you keep slandering someone, armed men from the government would not censor you in a violent manner? (Libertarian-to-English translation: If you keep slandering someone you will go to jail and get censored that way).
Whatever your approach to categorizing speech, all approaches lead to restricting outright harmful speech. Classical example of shouting "Fire!" in a crowded theater is not protected, should not be protected because minute gain in liberties by far outweigh massive and tangible damage it would cause.
The same approach should be used in Citizens United case. Even if you treat money as speech, even if you view all speech in absolute terms, even if you see corporations as persons, you still should realize that whatever gain in liberties there to be had by far offset by massive corrupting effect of unaccountable money in politics.
I will bite, because topic is interesting.
We all understand that all forms of "government sucks!" speech are protected. What if I start engaging in similar speech acts targeted at a private citizen, is this type of speech protected? Well, that depends. Statements of opinion are generally fine. Now, if it turns out to be slander, harassment and so on government can and does step to censor me. So we can see there are some protections of private citizen vs. private citizen speech, but they are nowhere near absolute and government could get involved in censoring some of it. Then there are other protected categories of speech, for example religious, that does not require "targeted at some aspect of government" qualifier. Plus there is whole separate issue of social consequences of speech that in turn can be highly censorious.
With that said, I personally detest all forms of censorship and would like to see speech protections broadened. I still stand by my original definition.
This is open-and-shut case, and the only question is what the settlement and payout to Jonathan Daniel would be.
You fail to understand my "Free Speech Protections have very specific applicability." For example, I as a private citizen, can limit your free speech as long as I have standing. You would be very effectively censored if I were to kick you off my property for expressing opinions. I could also attempt to censor you with other speech (e.g. heckling) in public spaces. None of this would be illegal, because I am not part of the government.
On top of the above freedom of speech is not absolute. False statements of fact, obscenity, fighting words, threats are under various circumstances and conditions excepted.
Oh, just noticed... happy Godwin's law.
I understand and even agree with your point that data-mining by private companies is nearly as dangerous as when government is involved, but in this specific case what would the Big Data do with information that some dude uploaded bunch of pedobear content? Show him more targeted ads for hand lotion?
I don't accept your definition. Your argument could only be true if you consider spending money on politicians as a free speech. Money is property for all definitions of money.
Even if I accept your flawed definition, Free Speech Protections have very specific applicability - it only protect citizens against government limiting their speech targeted at some aspect of government. Strict equivalency to money would be government unable to limit money paid by private citizens to the government. Clearly, we don't have such problem.
You still failed to demonstrate how "we, the people" benefit from allowing anonymous and corporate money influence politics. How is our democratic process is strengthened by SuperPACs trying to buy elections? Sure, at least once it was show to fail. The question is why was this allowed in the first place?
>>>The only way to do that is to elect corrupt politicians. In fact, politicians never have to make that choice, because it's called bribery, quid-pro-quo, and corruption, and it's 100% illegal. As we have shown, many more times than this, the money does not help if you don't have support of the people. Buy all the votes you want, we'll make more.
I am always surprised when faced with cognitive dissonance of this magnitude. In one instance you recognize that "bribery, quid-pro-quo, and corruption" are bad, and in other instance you fail to apply this in coherent manner to the situation we describe.
What do you think happens when bill affecting ABC Inc. that donated substantial amount to a politician's election fund comes on the floor? Conflict of interest happens, where this politician has to potentially choose between representing campaign donors or representing constituents. Sure, some politicians would act honorably and do the right thing, but you can be sure that some will fail. So why create this issue at all? What do, we, the people, gain from allowing anonymous and corporate money into politics? Are we any freer as a result?
Clearly, you can extrapolate from a single data point.
For every Cantor that deservingly got tossed out, there are many that managed to outspend and keep their seats.
What more concerning is that unlimited money could buy unlimited influence. When average candidate has to spend this kind of crazy money to get elected, then donors are in position to dictate policy. Damage of Citizen's United is not money flowing into politics, but giving more opportunities for money to corrupt politics. Why create a situation where politician has to make a choice between voting in the best interest of constituents and keeping re-election funding?
Yes, the are mostly the same voters.
In their defense, Bush Jr. didn't run on the platform of increasing surveillance and decreasing government transparency. For the second term he run on a solid platform of FUD and even many non-GOP voters bought into it.
Further in their defense, TP is a delayed reaction to Bush actions. Sure, it is largely counter-productive, ineffective, lacking concrete goals and so on, but if you are objective you can't claim they are not trying to do something about this.
Human irrationality.
Would you give AT&T signed blank check if they promised they would keep it for you "for security purposes"? Most people would hesitate to do so, but having one of your checks compromised is a lot less damaging that having your identity stolen via SSN compromise.
You average GOP voter strongly values privacy and will not look kindly at this kind of targeted approach.