Really depends how you define 'win'. If by win you mean, effectively kill the players on the other team, then no, its not pay to win.
But what if you define 'winning' in terms of unlocking everything the game has to offer? Because after a short period of time, every match is much the same as the previous one... the players are different but they behave much the same. The matches are short... and winning a match is pretty meaningless; other than the enjoyment of playing the game. And that's fine... that describes most multiplayer games.
But Dirty bomb has this other little counter, and once you've gotten 20 or 30 hours in, you've still got these cosmetic unlocks... its the skinner box that still pays out new shiny. And lots of people are addicted to the rush of getting new shiny... they don't even care about winning or losing a match... the next match will be much the same... but they'll start to get agitated if they don't get a cobalt.
I watched my son play that game. Before he finally rage quit, all he cared about after the first month or two was getting cobalt. Its the only reason he played.... and he played long after he stopped really enjoying the actual game because he wanted cobalt stuff.
"but you don't need them unless you just want some variety"
Yes, god forbid you want 'variety'.
Dirty Bomb is free to play, so paying for 'some variety' is not unreasonable per se. The game needs some income stream. But I'd rather it just be $X up front.
I discourage my son from playing F2P games that are like this, but his friends get hooked in too, and he wants to play with his friends, and I can understand that.
The new stars wars game is $60... and all the cosmetic stuff is already in the game... the idea that anyone should have to grind thousands of hours to get everything is insane, especially when the only reason they have to grind thousands of hours instead of it just being a mix of in the menu on day one, unlocked after completing a few challenges, etc is precisely because EA wanted to milk people for all they were worth. The 'in game' path to the unlocks was so obnoxious it existed just so that people couldn't call them out it being over priced horse armor... because hey 'you can earn it game'.
Fuck that. It's still horse armor. If anything its worse than horse armor, because its even less honest about it.
The counter-issue is that since lefties excel in these sorts of competitions they are attracted to them, so they are over represented even at lower levels of competition.
Perhaps not quite as over-represented as at the highest levels, but still. That's been my experience at least, as a left hander.
I was encouraged to try fencing, I was encouraged to try baseball, specifically because i was left handed, specifically because I was told it would give me an edge.
Really? I fenced for a few years, and even at the very beginner amateur hobby level I was at -- we had a disproportionate representation of lefties. Probably 20%+ at least.
And likewise, even the junior baseball league I was in when I was around 12 already had coaches eager for left hand pitchers. (I only played for one year, and although I was a lefty, I was lousy at baseball. I'd played soccer for years prior and wanted a change... maybe if I'd played baseball all the way up it would have been different but... who knows.)
I stopped playing baseball before high school, but I've got to beleive with the way varsity and college sports gets that they'd be scouring the student rolls for lefties to take those positions.
" They are an oddity and uncomfortable to compete against even in sports where they are in significant numbers at the top."
Even if that were true, as you get closer to the top... they are no longer an oddity, and I can't see why you wouldn't get comfortable with it.
Its not really an "oddity" when every 3rd starting pitcher is left handed. After a few years in the major leagues... it shouldn't be the least bit 'odd and uncomfortable' any more. And like I said I wouldn't be surprised if that's already trending in bush leagues too, given I saw coaches seeking left handed pitchers in middle school...
I disagree. I mean the theory is sound, but it somewhat falls apart because even though only 10% of people are left handed, because they do so well and are so desirable in these positions / sports they are heavily over represented in them, and the overrepresentation is going to dilute the effectiveness.
I mean around 30%+ of baseball pitchers are left handed. Half of the top fencers in the world are left handed.
The 'unfamiliarity' advantage of being left handed might be high when its a 90/10 split... but when every other match up is vs a lefty its not a 'mirror image of what you are used to' it becomes 'what you are used to'.
There's a difference between a race to the bottom, and having a good quality desirable entry level product.
For example, I bought my kids laptops for christmas last year. I went with dell education series latitude 13s. They're well built, they're pretty rugged, and the specs have been more than sufficient.
The screen certainly isn't amazing, but it gets the job done. It's got 4GB ram, and 128GB SSD... battery life is great and gets them through the day. And they were under $700, that's not race to the bottom cheap... but its almost half the price of anything I can buy with an apple logo on it.
The macbook starts at 1300, macbook starts at 1000. For working on homework, they bring nothing to the table. The apples have markedly nicer screens, they're a bit faster, and they're thinner and lighter.
My kids are kids... not hipster graphic artists. They need to view lecture notes, write English essays and science lab reports, lookup marks, do basic research, etc.
The 13" dell is bulkier, but is still light. It's also a lot more rugged. And its about half the cost to replace in the event of loss / breakage / or theft.
The dell also has ethernet, HDMI and USB-A ports, all of which have already come in handy at school. The mac's mostly need dongles for any of that; which is additional cost, and more stuff to carry around, forget and lose -- I just spent $40 bucks on yet another stupid thunderbolt to ethernet adapter for my macbook pro after my last one went missing...
"What's the world coming to when people are just too fucking lazy to put the dishes in the dishwasher and turn it on?"
The dishwasher won't clean all the dishes. We don't put our crystal in it because it doesn't get it clean enough (spots and such) and its chipped / broken some of our stemware in the past; so our best wine glasses etc we do by hand. Its also not effective on some of our taller glasses -- if the kids made chocolate milk in a tall glass, and it sits long enough for the 'chocolatey sludge left at bottom to dry a bit into a crust, the dishwasher's splashing around doesn't get far enough up to get that out.
It doesn't scrub pots and pans. It doesn't do a good job with a lot of baking dishes (a measuring cup used for peanut butter for example), it can't handle if the kids let some oatmeal harden in a bowl, and if rice is on anything that goes in, odds are there will be rice stuck to everything else when its "done". Its getting on 10 years old now; but it works fine on reasonable dishwashing tasks, and I doubt even a brand new one would be significantly better.
It certainly doesn't wipe the counters down, clean the stove top, and sweep the floor. It doesn't clean any drips that land on the cupboards beneath the counters. It doesn't clean out the sink. And deal with the garbage.
That is all part of the task of 'doing the dishes' around here. Loading the dishwasher and turning it on is just one small part.
Maybe I don't know enough about US markets. Did this ever happen ?
Nike. (they weren't destroyed... they reacted)
Two decades ago, the company was under major fire for abusive labor practices after outsourcing labor overseas because it was cheaper.
The public was shocked by reports of Indonesian Nike workers earning as little as 14 cents an hour. Disturbing allegations of abuse included stories that a Vietnamese sub-contractor ran women outside until they collapsed for failing to wear regulation shoes.
Customers staged embarrassing public protests at the Olympics and at Nike stores. People began boycotting the brand in droves....
By 1998, Nike had to lay off staff amid declining sales.
Yeah... that's how Apple got where it is. But now that its there, and the light is shining on it, it might bite them in the ass.
Making clothes in sweatshops for pennies is a great strategy too, until you get big and profitable and someone shines a light onto it... then it is still a great strategy from a purely bean counting point of view... but it could destroy the company if the customers decide its a reason for them not to buy your clothes.
I think when you are the 'world's largest company' additional scrutiny makes a certain level of sense. They have immense economic power now, and are ridiculously profitable.
It's not an unfair question to ask, "why does the worlds largest corporation not make products for less wealthy people" ? When you get that big, you invite scrutiny and regulation.
Is apple a monopoly? No. But its hardly a free market. The "thriving android community" is at best a duopoly. And there are a lot of issues right now with Apple's lock in... why is facetime still not available on other platforms, or airplay... why can't i sell an app for an iphone without paying apple 30%... this kind of nonsense can only persist in oligoloply conditions.
I don't for a second think apple is 'racist' in terms of where they put their stores.
But its valid to question why the largest corporation in the world doesn't have more affordable products. Should we FORCE them to? No I don't think so. But there is nothing wrong with raising the issue, and putting some publicity behind it. That is one of the ways the market provides feedback to the companies in the market place.
Corporations have accounts for recording 'goodwill' and 'brand name value' etc; they are just entries in the ledger. And some business decisions are made based on creating value in those categories.
Some of their existing customers would feel better about apple if they had more products for poorer people. Just like some people feel better about apple if they hear the factories aren't sweatshops, or that they recycle etc. Maybe its a reason that factors into whether or not they buy an apple.
Even if Apple doesn't make a pile of money serving poorer communities, maybe they'll make it back in goodwill, etc. Articles like this aresigns that there are consumers who are starting to think of apple this way.
Apple has been a 'premium lifestyle brand' lately, but as largest corporation in the world, some of their customers are starting to think they should do more. Maybe nothing comes of it, or maybe enough of a backlash builds that Apple needs to respond somehow.
That really just a combination of freedom of speech, and the free market at work
Yes its defective by desgin. I made the same comment when it was announced. Apple claimed a pretty tiny false positive rate, but if you think about it, it is not a random sampling, it is heavily biased toward people close to you.
Lets say there was a 1 in a billion false positive rate. That's not so bad, maybe 7 people in the world could unlock your phone right?
But where do people look the most like you?
Unless you've recently immigrated, statistically the odds are the people in living on the same continent look more like you on average than the people on other continents, statistically the people in your country look more like you than people in other countries, the people in your town look more like you than people in other towns... and statistically the people in the bedrooms down the hall in the same house look more like you than anyone else in the world.
So yeah... statistically 7 people in the world can unlock your phone... 4 of them are related to you, and probably live within 100 miles of you, and 1 or 2 of them live in your house; and are most likely the people who would try and unlock your phone.
Over a network biometrics have to be converted to digital data, basically a key or a hash which can be attacked in the normal ways.
Yes. That's why I wrote there were implementation and other problems.
Also once compromised, biometrics remain compromised forever...
That's only a problem if you use it as a 'secret password'. Its more like your username. And its value is not that it is a secret but that it is (ideally) difficult to forge.
"2) Social Engineering - the answer to this is a two factor token system, preferably a key fob rather than just using the phone which is easily lost, stolen, or compromised. Can easily be combined with the increasing time method above."
According to my password safe I have over 100 passwords. Are you really advocating I cart around a wheelbarrow full of key fobs as the solution?
Never going to happen. NEVER.
And the worst part is that a fob doesn't even stop social engineering attacks.
"Hi Alice I'm Bob from IT, we're just just troubleshooting your login. Ok, I need your password, and ok, the 2 factor password as well. Perfect, that appears to working. Have a great day."
or a phishing attack... that likewise grabs both.
The only thing the use of the fob does is that I have to login in real-time to get into your account. And then once in I use some exploit to escalate, i set up my backdoor, or do my evil thing, or whatever. But I have to do it in real-time, since I won't be able to get in later with the original credentials. However, if I know you are using a fob, I design the attack for that.
So fobs do add some security but they don't "solve" the problem.
biometrics can in theory solve the problem (becoming your 'username'); alongside a password, but the devil is in the implementation, and biometrics suffer from other problems too.
Just google for 'marshmallow fruit salad' and you should start finding piles of options; most recipes are a bit fancied up... replacing the can of fruit cocktail with fresh fruit, adding nuts...
"How does combining canned fruit cocktail, mayonnaise, and mini-marshmallows sound to you? I can tell you how it sounded back then, it sounded exciting."
How dare you mock my inner childs beloved "marshmallow salad"; I still make it from time to time, and I still like it.
" It was the Age of the Casserole, because the food industry was spending huge bucks in training people to dump cans of cream of mushroom soup "
Along with a can of tuna, noodles.... bake for a bit... and 'tuna casserole'. I actually had that for lunch today... leftovers.
Nothing wrong with a few 10 minute to prepare meals in your arsenal that are throw backs to the 60s and 70s. Plus all the essential ingredients keep well for months.
On a cold fall day between school, the kids extracurricular activities, and both of us working... Plus its a kind of nostalgic comfort food. We make it about once a year so its hardly like we live on it.
"Occasionally there is actually some technical backing for said reason, more often than not that reason is more directly related to you vendor bank account."
I think you are being overly cynical.
I have released software. And I have supported that released software. And I don't have the resources or inclination to support each individual point release. If you aren't running the current release, you need to update to get support.
A large percentage of reported issues with older versions are fixed in the current release; so right out of the gate its a waste of resources to investigate and document incidents that were already corrected.
In some cases of course the bug or issue still exists, but in many cases the precise error message etc that the newer version reports is slightly different, or the bug manifests slightly differently due to other changes. In this case, again, its more efficient to get bug reports that apply to the current release.
Heh, ok. I like f-droid too, and I agree this is the best technical solution.
I'm not sure its a practical solution, in that, if you are blind and need a text reader, limiting yourself to f-droid may not really be a viable solution.
(And of course there is the catch-22 that a blind person can't audit the source without first obtaining a good text reader. But hopefully we can rely on some sighted friends or security researchers.)
"1. Do the text to speech directly on the pocket computer rather than relying on a service on the other side of the Internet that won't be available on an offline tablet anyway. Pocket computers nowadays are over a thousand times faster than the 8-bit MOS 6502 clocked at 1.02 MHz on which SAM (Software Automatic Mouth) ran."
Sure I could do it directly on the device, and will even fall back to that, but I can do it better in the cloud.
"2. Sync the settings only when the settings activity is frontmost. Open no sockets when the settings activity is not frontmost."
My malicious app just stores the data it wants to send out and it goes out 'when the settings activity is frontmost'. I don't know why you thought this was a solution.
"3. Seek Google's permission to whitelist the "remote assist feature" for your Google Play Store publishing account."
Precisely. This is basically what google has done, you need to ask google to whitelist your use of the accessibility feature. You have to justify it, and it still comes down to trust. My app could still be malicious.
But at least I have to put in the work of making a useful TTS app to get whitelisted. I can't just clone some popular game, and include some accessibility malware to rip off your passwords, without so much as a by-your-leave.
Why does a screen reader for the blind needs network access?
Because - it uses a cloud service to assist with text to speech. - it uses a cloud service to sync your settings and preferences between other instances of the screen reader you have on other devices. - it has a remote assist feature you can invoke to manually send a screenshot to our support team and a human will verify / correct the machine interpretation -- super handy if the screenreader is reading out gibberish and you need help!....
I'm unimpressed at Google trying to weed out "casual" users of their accessibility in order to minimize a security issue that's their problem.
How is the security issue 'their problem' ?
Its a catch-22. If I give a screen-reader app access to read my screen when using other apps, then it can read the text my screen... even when I'm looking at my saved passwords in my password app.
If you write an app that asks for accessibility permissions, how do i know it isn't scraping my screen and sending my passwords to your mothership?
You can't 'fix' that. That's the nature of the accessibility functionality. The only thing that is reasonable is what they are doing... looking at the apps that are asking for accessibility permission and verifying that they need it.
At least that way I can't write a flashlight / fart app... give it accessibility support, and rip off your passwords. I'm going to at least have to come up with some actual utility for the accessibility API to justify using those APIs.
If anything, it needs to go further, more granular access to the API, and deeper audits of any programs using them.
Slashdot Mirror
"Dirty Bomb isn't "pay to win"
Really depends how you define 'win'. If by win you mean, effectively kill the players on the other team, then no, its not pay to win.
But what if you define 'winning' in terms of unlocking everything the game has to offer? Because after a short period of time, every match is much the same as the previous one... the players are different but they behave much the same. The matches are short... and winning a match is pretty meaningless; other than the enjoyment of playing the game. And that's fine... that describes most multiplayer games.
But Dirty bomb has this other little counter, and once you've gotten 20 or 30 hours in, you've still got these cosmetic unlocks... its the skinner box that still pays out new shiny. And lots of people are addicted to the rush of getting new shiny... they don't even care about winning or losing a match... the next match will be much the same... but they'll start to get agitated if they don't get a cobalt.
I watched my son play that game. Before he finally rage quit, all he cared about after the first month or two was getting cobalt. Its the only reason he played.... and he played long after he stopped really enjoying the actual game because he wanted cobalt stuff.
"but you don't need them unless you just want some variety"
Yes, god forbid you want 'variety'.
Dirty Bomb is free to play, so paying for 'some variety' is not unreasonable per se. The game needs some income stream. But I'd rather it just be $X up front.
I discourage my son from playing F2P games that are like this, but his friends get hooked in too, and he wants to play with his friends, and I can understand that.
The new stars wars game is $60 ... and all the cosmetic stuff is already in the game... the idea that anyone should have to grind thousands of hours to get everything is insane, especially when the only reason they have to grind thousands of hours instead of it just being a mix of in the menu on day one, unlocked after completing a few challenges, etc is precisely because EA wanted to milk people for all they were worth. The 'in game' path to the unlocks was so obnoxious it existed just so that people couldn't call them out it being over priced horse armor... because hey 'you can earn it game'.
Fuck that. It's still horse armor. If anything its worse than horse armor, because its even less honest about it.
Alternate conclusion -- the market as implemented is not really capitalism.
Not that this gets us any closer to an actual working solution.
The counter-issue is that since lefties excel in these sorts of competitions they are attracted to them, so they are over represented even at lower levels of competition.
Perhaps not quite as over-represented as at the highest levels, but still. That's been my experience at least, as a left hander.
I was encouraged to try fencing, I was encouraged to try baseball, specifically because i was left handed, specifically because I was told it would give me an edge.
Really? I fenced for a few years, and even at the very beginner amateur hobby level I was at -- we had a disproportionate representation of lefties. Probably 20%+ at least.
And likewise, even the junior baseball league I was in when I was around 12 already had coaches eager for left hand pitchers. (I only played for one year, and although I was a lefty, I was lousy at baseball. I'd played soccer for years prior and wanted a change... maybe if I'd played baseball all the way up it would have been different but... who knows.)
I stopped playing baseball before high school, but I've got to beleive with the way varsity and college sports gets that they'd be scouring the student rolls for lefties to take those positions.
" They are an oddity and uncomfortable to compete against even in sports where they are in significant numbers at the top."
Even if that were true, as you get closer to the top... they are no longer an oddity, and I can't see why you wouldn't get comfortable with it.
Its not really an "oddity" when every 3rd starting pitcher is left handed. After a few years in the major leagues... it shouldn't be the least bit 'odd and uncomfortable' any more. And like I said I wouldn't be surprised if that's already trending in bush leagues too, given I saw coaches seeking left handed pitchers in middle school...
Why? So you can be ignored by someone else?
(That was his whole point.)
I disagree. I mean the theory is sound, but it somewhat falls apart because even though only 10% of people are left handed, because they do so well and are so desirable in these positions / sports they are heavily over represented in them, and the overrepresentation is going to dilute the effectiveness.
I mean around 30%+ of baseball pitchers are left handed.
Half of the top fencers in the world are left handed.
The 'unfamiliarity' advantage of being left handed might be high when its a 90/10 split... but when every other match up is vs a lefty its not a 'mirror image of what you are used to' it becomes 'what you are used to'.
There's a difference between a race to the bottom, and having a good quality desirable entry level product.
For example, I bought my kids laptops for christmas last year. I went with dell education series latitude 13s. They're well built, they're pretty rugged, and the specs have been more than sufficient.
The screen certainly isn't amazing, but it gets the job done. It's got 4GB ram, and 128GB SSD... battery life is great and gets them through the day. And they were under $700, that's not race to the bottom cheap... but its almost half the price of anything I can buy with an apple logo on it.
The macbook starts at 1300, macbook starts at 1000. For working on homework, they bring nothing to the table. The apples have markedly nicer screens, they're a bit faster, and they're thinner and lighter.
My kids are kids... not hipster graphic artists. They need to view lecture notes, write English essays and science lab reports, lookup marks, do basic research, etc.
The 13" dell is bulkier, but is still light. It's also a lot more rugged. And its about half the cost to replace in the event of loss / breakage / or theft.
The dell also has ethernet, HDMI and USB-A ports, all of which have already come in handy at school. The mac's mostly need dongles for any of that; which is additional cost, and more stuff to carry around, forget and lose -- I just spent $40 bucks on yet another stupid thunderbolt to ethernet adapter for my macbook pro after my last one went missing...
"What's the world coming to when people are just too fucking lazy to put the dishes in the dishwasher and turn it on?"
The dishwasher won't clean all the dishes. We don't put our crystal in it because it doesn't get it clean enough (spots and such) and its chipped / broken some of our stemware in the past; so our best wine glasses etc we do by hand. Its also not effective on some of our taller glasses -- if the kids made chocolate milk in a tall glass, and it sits long enough for the 'chocolatey sludge left at bottom to dry a bit into a crust, the dishwasher's splashing around doesn't get far enough up to get that out.
It doesn't scrub pots and pans. It doesn't do a good job with a lot of baking dishes (a measuring cup used for peanut butter for example), it can't handle if the kids let some oatmeal harden in a bowl, and if rice is on anything that goes in, odds are there will be rice stuck to everything else when its "done". Its getting on 10 years old now; but it works fine on reasonable dishwashing tasks, and I doubt even a brand new one would be significantly better.
It certainly doesn't wipe the counters down, clean the stove top, and sweep the floor. It doesn't clean any drips that land on the cupboards beneath the counters. It doesn't clean out the sink. And deal with the garbage.
That is all part of the task of 'doing the dishes' around here. Loading the dishwasher and turning it on is just one small part.
Maybe I don't know enough about US markets. Did this ever happen ?
Nike. (they weren't destroyed ... they reacted)
Two decades ago, the company was under major fire for abusive labor practices after outsourcing labor overseas because it was cheaper.
The public was shocked by reports of Indonesian Nike workers earning as little as 14 cents an hour. Disturbing allegations of abuse included stories that a Vietnamese sub-contractor ran women outside until they collapsed for failing to wear regulation shoes.
Customers staged embarrassing public protests at the Olympics and at Nike stores. People began boycotting the brand in droves. ...
By 1998, Nike had to lay off staff amid declining sales.
http://www.businessinsider.com...
No, I'd much rather a dish washing robot.
I've never found anyone interested in doing the dishes...
Yeah... that's how Apple got where it is. But now that its there, and the light is shining on it, it might bite them in the ass.
Making clothes in sweatshops for pennies is a great strategy too, until you get big and profitable and someone shines a light onto it... then it is still a great strategy from a purely bean counting point of view... but it could destroy the company if the customers decide its a reason for them not to buy your clothes.
I think when you are the 'world's largest company' additional scrutiny makes a certain level of sense. They have immense economic power now, and are ridiculously profitable.
It's not an unfair question to ask, "why does the worlds largest corporation not make products for less wealthy people" ? When you get that big, you invite scrutiny and regulation.
Is apple a monopoly? No. But its hardly a free market. The "thriving android community" is at best a duopoly. And there are a lot of issues right now with Apple's lock in... why is facetime still not available on other platforms, or airplay... why can't i sell an app for an iphone without paying apple 30% ... this kind of nonsense can only persist in oligoloply conditions.
I don't for a second think apple is 'racist' in terms of where they put their stores.
But its valid to question why the largest corporation in the world doesn't have more affordable products. Should we FORCE them to? No I don't think so. But there is nothing wrong with raising the issue, and putting some publicity behind it. That is one of the ways the market provides feedback to the companies in the market place.
Corporations have accounts for recording 'goodwill' and 'brand name value' etc; they are just entries in the ledger. And some business decisions are made based on creating value in those categories.
Some of their existing customers would feel better about apple if they had more products for poorer people. Just like some people feel better about apple if they hear the factories aren't sweatshops, or that they recycle etc. Maybe its a reason that factors into whether or not they buy an apple.
Even if Apple doesn't make a pile of money serving poorer communities, maybe they'll make it back in goodwill, etc. Articles like this aresigns that there are consumers who are starting to think of apple this way.
Apple has been a 'premium lifestyle brand' lately, but as largest corporation in the world, some of their customers are starting to think they should do more. Maybe nothing comes of it, or maybe enough of a backlash builds that Apple needs to respond somehow.
That really just a combination of freedom of speech, and the free market at work
Yeah, the tipoff was the "I make 50,000 in IT in Silicon valley" which is a bit of a meme around here...
Yes its defective by desgin. I made the same comment when it was announced. Apple claimed a pretty tiny false positive rate, but if you think about it, it is not a random sampling, it is heavily biased toward people close to you.
Lets say there was a 1 in a billion false positive rate. That's not so bad, maybe 7 people in the world could unlock your phone right?
But where do people look the most like you?
Unless you've recently immigrated, statistically the odds are the people in living on the same continent look more like you on average than the people on other continents, statistically the people in your country look more like you than people in other countries, the people in your town look more like you than people in other towns... and statistically the people in the bedrooms down the hall in the same house look more like you than anyone else in the world.
So yeah... statistically 7 people in the world can unlock your phone... 4 of them are related to you, and probably live within 100 miles of you, and 1 or 2 of them live in your house; and are most likely the people who would try and unlock your phone.
Defective by design.
Over a network biometrics have to be converted to digital data, basically a key or a hash which can be attacked in the normal ways.
Yes. That's why I wrote there were implementation and other problems.
Also once compromised, biometrics remain compromised forever...
That's only a problem if you use it as a 'secret password'. Its more like your username. And its value is not that it is a secret but that it is (ideally) difficult to forge.
"2) Social Engineering - the answer to this is a two factor token system, preferably a key fob rather than just using the phone which is easily lost, stolen, or compromised. Can easily be combined with the increasing time method above."
According to my password safe I have over 100 passwords. Are you really advocating I cart around a wheelbarrow full of key fobs as the solution?
Never going to happen. NEVER.
And the worst part is that a fob doesn't even stop social engineering attacks.
"Hi Alice I'm Bob from IT, we're just just troubleshooting your login. Ok, I need your password, and ok, the 2 factor password as well. Perfect, that appears to working. Have a great day."
or a phishing attack... that likewise grabs both.
The only thing the use of the fob does is that I have to login in real-time to get into your account. And then once in I use some exploit to escalate, i set up my backdoor, or do my evil thing, or whatever. But I have to do it in real-time, since I won't be able to get in later with the original credentials. However, if I know you are using a fob, I design the attack for that.
So fobs do add some security but they don't "solve" the problem.
biometrics can in theory solve the problem (becoming your 'username'); alongside a password, but the devil is in the implementation, and biometrics suffer from other problems too.
https://www.youtube.com/watch?...
Just google for 'marshmallow fruit salad' and you should start finding piles of options; most recipes are a bit fancied up... replacing the can of fruit cocktail with fresh fruit, adding nuts...
This one is pretty much it:
http://www.geniuskitchen.com/r...
This one has a sour cream base...
https://www.tasteofhome.com/re...
This one is mayo and cool whip...
http://www.cooks.com/recipe/t6...
This one is may and cream...
http://allrecipes.com/recipe/1...
"How does combining canned fruit cocktail, mayonnaise, and mini-marshmallows sound to you? I can tell you how it sounded back then, it sounded exciting."
How dare you mock my inner childs beloved "marshmallow salad"; I still make it from time to time, and I still like it.
" It was the Age of the Casserole, because the food industry was spending huge bucks in training people to dump cans of cream of mushroom soup "
Along with a can of tuna, noodles.... bake for a bit... and 'tuna casserole'. I actually had that for lunch today... leftovers.
Nothing wrong with a few 10 minute to prepare meals in your arsenal that are throw backs to the 60s and 70s. Plus all the essential ingredients keep well for months.
On a cold fall day between school, the kids extracurricular activities, and both of us working... Plus its a kind of nostalgic comfort food. We make it about once a year so its hardly like we live on it.
"Occasionally there is actually some technical backing for said reason, more often than not that reason is more directly related to you vendor bank account."
I think you are being overly cynical.
I have released software. And I have supported that released software. And I don't have the resources or inclination to support each individual point release. If you aren't running the current release, you need to update to get support.
A large percentage of reported issues with older versions are fixed in the current release; so right out of the gate its a waste of resources to investigate and document incidents that were already corrected.
In some cases of course the bug or issue still exists, but in many cases the precise error message etc that the newer version reports is slightly different, or the bug manifests slightly differently due to other changes. In this case, again, its more efficient to get bug reports that apply to the current release.
Heh, ok. I like f-droid too, and I agree this is the best technical solution.
I'm not sure its a practical solution, in that, if you are blind and need a text reader, limiting yourself to f-droid may not really be a viable solution.
(And of course there is the catch-22 that a blind person can't audit the source without first obtaining a good text reader. But hopefully we can rely on some sighted friends or security researchers.)
"1. Do the text to speech directly on the pocket computer rather than relying on a service on the other side of the Internet that won't be available on an offline tablet anyway. Pocket computers nowadays are over a thousand times faster than the 8-bit MOS 6502 clocked at 1.02 MHz on which SAM (Software Automatic Mouth) ran."
Sure I could do it directly on the device, and will even fall back to that, but I can do it better in the cloud.
"2. Sync the settings only when the settings activity is frontmost. Open no sockets when the settings activity is not frontmost."
My malicious app just stores the data it wants to send out and it goes out 'when the settings activity is frontmost'. I don't know why you thought this was a solution.
"3. Seek Google's permission to whitelist the "remote assist feature" for your Google Play Store publishing account."
Precisely. This is basically what google has done, you need to ask google to whitelist your use of the accessibility feature. You have to justify it, and it still comes down to trust. My app could still be malicious.
But at least I have to put in the work of making a useful TTS app to get whitelisted. I can't just clone some popular game, and include some accessibility malware to rip off your passwords, without so much as a by-your-leave.
Its not fool proof... but its progress.
Why does a screen reader for the blind needs network access?
Because ....
- it uses a cloud service to assist with text to speech.
- it uses a cloud service to sync your settings and preferences between other instances of the screen reader you have on other devices.
- it has a remote assist feature you can invoke to manually send a screenshot to our support team and a human will verify / correct the machine interpretation -- super handy if the screenreader is reading out gibberish and you need help!
- I could go on...
I'm unimpressed at Google trying to weed out "casual" users of their accessibility in order to minimize a security issue that's their problem.
How is the security issue 'their problem' ?
Its a catch-22. If I give a screen-reader app access to read my screen when using other apps, then it can read the text my screen... even when I'm looking at my saved passwords in my password app.
If you write an app that asks for accessibility permissions, how do i know it isn't scraping my screen and sending my passwords to your mothership?
You can't 'fix' that. That's the nature of the accessibility functionality. The only thing that is reasonable is what they are doing... looking at the apps that are asking for accessibility permission and verifying that they need it.
At least that way I can't write a flashlight / fart app... give it accessibility support, and rip off your passwords. I'm going to at least have to come up with some actual utility for the accessibility API to justify using those APIs.
If anything, it needs to go further, more granular access to the API, and deeper audits of any programs using them.
No. Like the Samsung Galaxy series since this is what this actually *IS*.