Personally I wish MS would grow a pair like Apple has over the years and build a new OS from scratch and not worry about backward compatibility. Apple has done it what three times since the beginning. They give developers and users a couple years of warning and move forward. MS talks about it but never does it, they definitely have the deep pockets to do it.
Apple isn't entrenched in the enterprises like Microsoft is. Home users don't REALLY care, they get whatever comes with the new OS. They piss and moan a bit about backwards compatibility, but they suck it up.
Enterprises on the other hand are much more invested in their infrastructures and much more resistant to change. Many of them still use software written for MSDOS, or NT3, etc. And they have NO intention of rewriting it or abandoning it. So if MS says they're leaving back-compat behind, these guys come out of the woodwork and raise a stink unlike anything Apple has ever had to deal with... governments, banks, megacorps, etc.
Microsoft's Vista is actually the closest they've ever come to doing a clean break, and honestly, on suitable hardware there is nothing really wrong with Vista, we should be applauding them for the changes they tried pushing through (running as a standard user, etc) yet instead moaning on about how awful it is almost a religion here.
If all else fails, they can use Bittorrent. It only takes a couple of hours, and the distribution is already self-sufficient.
I was actually referring to people, not technology.
Up until the moment they are bankrupt or bought out they are still a going concern, and wouldn't give away the farm because they might still pull something out of their hat. The moment after they are bankrupt or bought out, they are no longer authorized to do so. -- Either the creditors or the new owners run the show, and neither are going to be into the idea of 'freeing' the software.
And actually the moment they file for bankruptcy, or have a buy out offer, they wouldn't be allowed to deliberately do anything that would significantly devalue the assets.
The odds of them just 'getting old and retiring' and 'winding down the business' where they have full control over everything and how it shuts down right to the end are pretty slim.
Next thing you know, everything will pop up the "This application is unsigned, do you want to sign it?" and users will learn to automatically click "Yes".
The entire point of 'driver signing' is that by default 'normal users' can't run it, can't install it, can't use it. The prompt will say it can't be run because its unsigned. period.
Similar how when logging into a domain without a valid password, it says "No". It doesn't say "Those credentials aren't in the domain, do you want to be added to the domain as administrator?" Yet domain admins can still go in and add/remove users.
I only have an indirect answer: According to the vendors of some of the specialized hardware my clients and I use, the only way to use their hardware under Vista is for them to either get their drivers signed by Microsoft, or for them to rewrite their firmware and DLLs to allow using generic drivers.
Yes, if you want to distribute hardware that 'just works', you *have* to get your drivers signed by MS.
All of them chose to do the rewrite and use the generic driver. For example, several of the devices we use utilize the FT2232 USB microchip in the hardware.
Yes, that was probably the least effort for them, and their customers.
The new DLLs figure out which serial port really are the special devices and implement new device protocols through the virtual serial ports.
Yeah, I deal with a number of h/w vendors who use FTDI chips, and they've all gone the same route. But in cases like this, where its little more than usb-serial bridge, it makes sense that its easier to just use the generic drivers and probe the 'virtual' com ports for a suitable handshake than any other option.
All that said, it doesn't rule out the viability of self-signing. I know upfront that self signing should put some extra burden on end users... after all if you could make self-signing part of a seamless installation process driver signing would be worthless as rootkit writers would use it to get naive users to self-sign during installation...
However, for the open source community, who like to download and modify source, the hassle of self-signing drivers for their own units is probably not that big of a deal.
As I said in another post, I could even see code signing becoming commonplace for linux, as a part of SELinux or AppArmor. An IT admin would install trusted certs on his boxes including a self-made enterprise cert, and then the only stuff that would run in the enterprise would have be signed by one of the trusted certs. (Since the admin can issue and trust his own cert, he still has full control over everything that runs on his network, including allowing some hacked kernel module he modified and signed himself.)
Screw that. Mandatory driver signing is unacceptable, as it's no longer a general purpose computer strictly under my control.
It is if you have a signing key for that computer.
The answer to your question is that NO, you can't sign your own drivers for Vista and/or distribute them to other people to use.
Of course you can sign your own drivers and give them to other people. You have to buy a certificate for that, but lots of companies have manged it, including some very small ones.
The more interesting scenario to me is the 'test signatures' mechanisms, by which you can freely self-sign drivers for use on your own hardware. Designed for driver developers, and drivers signed this way can't be re-distributed, but if it lets you compile a driver from source, or download an unsigned driver, and self-sign it, and run it on your own hardware, then you basically have the tools to run anything you like on your own hardware and your entire rant about the vender keeping the keys is nullified.
My question about self signing isn't 'can you do it'; I already know you can. Its more a case of 'how exactly', and 'can it easily be applied to downloaded source or unsigned binaries acquired over the internet'?
I don't mind jumping through a couple hoops to sign something I've downloaded, if it means stuff I don't jump through hoops for can't attack me.
The day Apple moves to protect the Mac OS from its owner despite their wishes is the day I begin my Linux migration.
There is no reason Linux won't have signed drivers as well one day. There is nothing 'anti-freedom' about driver signing provided the computer owners have the necessary tools to generate keys, sign with them, and revoke them for their own hardware.
Indeed such a thing might protect me from malicious opensource mirrors hosting 'modified' binaries and other such threats. I would setup my system to trust the Ubuntu or Fedora key, the Apache key, the Mozilla Key, and my own key. If I wanted to install a package that wasn't signed by any of the above, as part of the installation I would sign it myself. And of course I could sign my own software.
And if I distributed it and didn't have a widely recognized/trusted signature and/or distributed it unsigned or as source, the recipients could each sign it themselves for their own pc.
hardware-enforced Non-eXecutable memory? Unless you can could turn it off, it just sounds like DRM.
This isn't DRM. This is what prevents a stack overflow or buffer overrun from executing code. There is absolutely nothing evil or even potentially evil about it. Marking your data segments 'NX' means that they can't be executed, even if something 'bad happens'.
mandatory code-signing?
Again this isn't evil. I think it would be great if ALL code always had to be signed. It would pretty much kill morphic virii, and put a real dent in the spread of rootkits etc.
The key to 'good' vs 'evil' with mandatory code-signing is who holds the keys. If I hold the keys to MY computer, then there is NOTHING WRONG with mandatory code-signing, because if there is something I want to run that hasn't been signed by [OS-vender] I can sign it myself to run on my computer, my network, my enterprise...
Won't matter. Most malware is installed via the user while installing the latest screensavers, emoticon packs, and browser toolbars. Nothing will ever be able to defeat the uneducated user.
True enough for the average home user, but the corporate/enterprise/government desktop is a whole other ballpark, and in that environment stuff like sandboxes and driver signing make a lot of sense.
Also as a 'sophisticated' user, using Vista x64, I quite like the driver signing concept.
I think its GREAT that some driver I download, or some source code for a driver I download and compile myself, or even a driver I might write myself from scratch can't by default run on everyone's computers.
That's a good barrier to rootkits etc. Even if a naive user says 'I agree' the driver still won't load. And if a rootkit does get signed, the keys can be revoked at MS, and a gazillion PCs will be immune next time they update.
Its a good system.
Of course, its has its frustrations - oss drivers, home made drivers, etc, etc won't work. And as a result:
Most of the chatter on the net about it, is 'how to disable driver signing', 'how to bypass it', etc. Yet the question people SHOULD be asking is: "How do I sign a driver to run on MY PC?"
THAT WOULD BE FAR MORE USEFUL.
It is after all YOUR PC, and you should be allowed to run any driver you want on it. So there *should* be a way of signing it for your PC. As the owner I should have my own private signing key, and anything I sign should run on any PC that has my public key trusted on it. Obviously stuff I sign with this key won't run on your PC because you won't have my public key trusted on your systems, but that's fine and as it should be.
Of course, this is somewhat at odds with the RIAA/MPAA/DRM objectives with driver signing. But so what, people should be demanding the keys to their computers, and getting them.
Code/Driver signing isn't evil, its on par with putting a lock on your car or home. Not giving the owners the keys is evil.
And with that said, IS it possible to sign your own drivers for your own Vista machine? I'd very much like to know what is involved in doing that.
Should anything 'happen to LGP' there may not be anyone left to distribute said patches. Are the patches already written, are tested? Or are they basically saying that while they are laying off employees and struggling to cover the rent as they file for bankruptcy they'll direct their efforts to writing patches for all their software?
Normally, for this sort of protection, the source / patches is put into escrow to be released when certain conditions are met. So that a 3rd party can act to release the source/patches when something 'happens' to the vendor.
What about other collisions between.com/.org/.net/.edu/.gov/.co.uk/.co.au/.dot.dash-dash.dot.?.com get the TLD.
It may result in some stupid people getting TLDs, but so what? Those stupid people already have the.coms. What I'm proposing just doens't make it any worse..com is already the 'default' domain, and companies and organizations who have a.org or a.co.au or a.ca but not the.com are already.
The only alternative is to send conflicts to arbitration or something, which would be complicated, and expensive, and will affect millions. And in lots of cases BOTH parties have a legitimate claim to the domain, and there is no 'fair' way to decide who should get it.
But the way I see it, giving the TLDs to the.coms amounts to letting users omit '.com' from addresses, with the predicted result that it will go to the.com. This is a simple to understand, and reasonable behaviour, and already happens in some browsers anyway.
...and all the companies that "did the right thing" by registering addresses as xyzz.co.uk because they are based in the UK but operate globally lose out to some guy in his bedroom in some obscure corner of the world who registered xyzz.com just because they thought it was "cool"?
Those companies -ALREADY- lost out.
The current TLD mess is just that - a mess, and it won't be fixed in any way by effectively saying that the only TLD that matters is the.com namespace and grant them some special status in an automatic mapping to remove the.com from the end.
What suggested won't 'fix' the TLD mess. But it does give them a way to commercialize the TLDs without making an even bigger one.
If you want to really fix the naming system, you'll have to start over from scratch, and that's not likely to happen.
They should simply make it a reflection of.com. If you own abcde.com you, and only you, are entitled to abcde TLD. There are couple hiccups with other tlds... but that could be resovlved:
So if you have dotcom, and leaving.com off won't conflict with an existing TLD, you can pay another X$ fee and get it as a TLD. If you don't pay the fee, you don't get it, but nobody else can get it either.
No massive influx of squatter problems, trademark problems, spammer problems etc. PennyArcade.com and only pennyarcade.com can get the PennyArcade TLD, CocaCola.com can get cocacola, microsoft.com can get microsoft... intel.com can get intel, ibm.com can get ibm.
And ca.com, us.com, com.com can't get ca, us, and com respectively. They'll live.
The idea of organizational TLDs was a mistake from the get-go. If we could just get rid of them entirely I'd advocate that. But due to conflicts between legitimate.net /.org /.com sites that's not really practical.
So lets just do second best, and give the vast majority of.com's the option of leaving off the.com.
Same as how much I would, if I owned the original cart and the working system
I could see buying the VC version if you owned the original cart and working system because that it a royal pain to setup.
But if you've already got the game running on the wii in emulation, why would anyone pay $5-$10 to that you can get the game running on the Wii in emulation, except to clear their conscience.
And even to clear one's conscience, if one has "500 NES" ROMS, they aren't going to drop $2500-$5000 into the VC to 'legitimize them' even if Nintendo did make them available.
Please, before you open your mouth understand that not all homebrewers are pirates. We pay for our VC/WiiWare games (or just choose not to use the service). We just want to do MORE then what Nintendo is willing to do, like playing out of region games (Using Gecko Region Free) or other things as people write software, such as a POP3 email client, emulators, Doom, etc.
How likely are you to buy a VC title when you've already got the ROM file and an emulator running?
Funny....most of my married friends say that once that ring goes on, the sex goes down actually. Almost like she had to do that stuff to hook you, and once she knows she has you, she doesn't really have to do that any more.
Yeah, that 'anecdotal' stereotype has been mined by stand up comics forever. I think a lot of married men just play along with the stereo type, and the rest are having other issues that are interfering.
And even so, studies actually show that average frequency for married couples is multiple times per week, far more than singles.
According to one study: # Couples living together report having sex 146 times per year. # Married couples have sex 98 times per year. # Single folks are having sex the least at 49 times a year.
And when you look at those numbers, you have to consider the factors... most 'couples living together' skew younger, while 'married couples' skew older. Both sexes peak relatively young. A 50 year old couple is on average going to have less drive than a 25 year old couple, while the 50 year couple is more likely to be married.
'couples living together' also tend to have little else going on. 'married couples' are far more likely to have kids for example which can interfere with frequency, or even to have drifted apart and just stay together out of momentum, shared debts/finances, etc, while 'couples living together' are far more likely to split when the sexual intimacy breaks down.
I think there is some truth to the idea that getting married decreases frequency, and the numbers bear it out, but I seriously doubt that even if they had just 'stayed living together' instead of 'getting married' that the numbers would declined by the same amount.
Personally...I've thought of it this way: Maybe I should come up with a new version of Playboy for married men........every month....SAME chick.
Another stand up comedian staple.
Let me reply to that this way...
If you find a job you love you can work it every day until you die and look forward to going in the morning each day; you'll never think of quitting. You know you've got it made; its challenging, interesting, fun, and rewarding.
The programming lies deep in the subconscious. It is by design, to maximize mixing of the gene pool.
Many species that care for helpless young are largely monogamous. (Not strictly monogamous, they'll often mate outside the pairing -- but their partner count, while not exactly 1, is still pretty low.)
http://www.physorg.com/news10824.html this ones neat because men claimed an average of 31. but 21% of those admitted to lying, to boost their numbers on the the same survey, and of the group that claimed more than 50 partners over 50% of them also admitted to lying.
http://aspe.hhs.gov/HSP/97trends/sd4-4.htm 69% of sexually active teen males reported http://www.denverpost.com/ci_6204119 "Almost one in three American men say they've had sex with at least 15 partners in their lives, triple the rate of similar behavior found in interviews with women, according to a government survey. "
Meaning 2 in 3 have had less.
"The average number of female sexual partners for men was 6.8, said Kathryn Porter, a medical officer for the CDC's National Center for Health Statistics in Hyattsville, Maryland, and one of the study's co-authors. Women reported an average of 3.7 male sexual partners, she said."
http://www.data360.org/dsg.aspx?Data_Set_Group_Id=1100 This one is neat too, because it breaks down by country, the USA is ~10.5 (it apparently is based on the same data as the durex link.) Turkey ranks highest at 14.5.
The numbers are apparently going up though, when you compare 1960s and 70s surveys to more recent surveys... or maybe people just lie more. After all the sixty's was the era of 'free love'.
Apparently it also varies heavily based on where you live. I think I read somewhere that New York city is apparently double or triple the national average.
Not to be mean, but you wasted your best fuck years in your teens and twenties....
1) Virtually all studies agree conclude that the vast majority of heterosexual males go a lifetime with fewer than 15 partners. And many conclude numbers half that. Look it up. I'm -possibly- slightly below average in partner count, but I doubt it.
2) Its not like a low number of partners predicts a low frequency of sex. In fact, most studies conclude that sexually active couples in their teens and 20s generally have far more sex than 'sexually active singles'.
3) I think most people who've tried both agree that 'one night stand sex', especially while intoxicated, is actually generally pretty lousy.
Thanks for your concern, but I really didn't 'miss out' on all that much.
Or maybe, the women that do end up with nice guys actually stay with them.
This would trivially explain why bad boys get more women. Nice guys get fewer, but keep them longer.
I was rarely single in the 10 years I was dating before marriage. But I can count the women without using up all my fingers. It didn't hurt that I actively avoided brainless sluts, with only one very breif exception.
Can you be convicted of murder without a body? Yes, you can.
Its also fairly unusual, and much harder to prove. Prosecutors REALLY like having a body. Or enough of one to be convincing that the 'victim' is actually deceased.
But wait, how do you do that without proof they died an unnatural death or even died at all? Circumstancial evidence - it's been enough to prove "beyond a reasonable doubt" so certainly it could be enough in a civil case.
Right, but its got to be AWFULLY convincing.
What the RIAA is saying is that they have enough circumstancial evidence. That sharing a file on a public file-sharing network that exists for the very purpose of distributing files, where it's available to anyone that requests means that the network will perform its expected purpose - which for a copyrighted file is to perform unauthorized distribution.
Most people actually use p2p to download files, not distribute them. For your average citizen p2p's 'expected purpose' is to get them a free copy of a britney spears song, not commit unauthorized distribution of a file on a massive scale exposing them to massive damages.
That said I agree with you to a point, but simultaneously think convicting them of 'n-counts of copyright infringment' multiplied by 'statutory damages designed to dissuade organized for profit criminal enterprise' is like penalizing the guy with bag of weed at a party the same as a guy caught with an airplane full of cocaine, half a million in cash, 4 body guards, and weapons cache.
People using p2p to infringe deserve to get busted, they don't deserve fines in the 100s of thousands. They deserve fines, in most cases, for casual p2p use of a few dozens of songs hosted from their home PC of around $500 or less.
Inidivual/personal use copyright infringement via p2p is a misdemeanor on par with a routine traffic violation, watering your grass on the wrong day, or parking in a handicaped spot, and in my opinion is less serious than when someone does a B&E to steal a TV.
At least those, including cashiers and bank tellers, who have to balance the drawer at the end of the day...
Only the truly stupid pilfer straight up. The smart simply ring in a return. Or ring in a transaction, collect, and then void it, etc, etc.
Then the discrepencies don't show up in drawers cash balance but rather show up in month end inventory reconciliation which is virtually impossible to trace back to the cashier.
With more complex businesses there are more complex schemes... coupon tricks, currency rate exchange tricks (living near the Canada/US border had all sorts of games to profit from currency exchange), and so on.
Or they simply shortchange customers and then pilfer a bill. This is shockingly easy to do. Of course it requires that you work in a high volume cash transaction scene like fast food. I was in entry level management in fast-food putting myself through university and in that time I knew of cashiers who'd take 20-40 bucks a night, and their drawers would balance to within a dime simply by shortchanging and keeping track. Say a bill for a combo is 5.17 after tax, change owed from a 20 is 14.83. Hand back 13.53 or 14.58 taking 1$ or.25c respectively. Do that to a 100 customers over an 8 hour shift (in an industry where a lunch/dinner rush might see you do 100+ transactions an hour.)
In the odd case where you get caught by the customer, they'd apologize and cheerfully fix the error.
All that remains is to pilfer a $5 or $10 whenever you've accumulated it. (And this can be stealthed too by getting a partner (conspiring coworker going off shift or going on break maybe) to come in and order a $1 coffee, and then give them 29$ change insted $19 for their $20, and then pick up your cash from them after shift.
$20-40 bucks a night might not seem like much, but it amounts to a $2.50 to $5.00/hour raise (assuming an 8 hour shift) in an industry famous for 5 and 10 cent raises, and ends up amounting to stealing $4k-8k per year.
Worse the effects of this are invisible, because you are stealing from the customers not the employer and is very hard to isolate. And your only shot at catching them is if you are specifically watching for it, and doing random drawer audits midshift and looking for OVERAGES -- something which is very difficult in a busy fast food environment.
Plus its hard to fire someone when you audit their till and find it up $3.00.
Well now that I've educated a whole new generation of crooks... I'll get back to work.
Maybe you could get away with it a few times. The risk and penalties are so extreme I wouldn't chance it for no reason (and there is no rational reason for doing so). Depositing evidence on a government computer is pretty foolish, no matter how incompetent you believe the FBI are.
Firstly this isn't really about 'incompetence'. Its the reality of the internet.
If your hacked US governement computer is being remote controlled by a PC in China which is itself being remote controlled by a PC in England, which is itself being remote controlled by a PC in Mexico which is accepting IRC commands from a channel where they are being put there by a PC in Canada, which is remote controlled by a PC in Cuba. All of these links will be SSL of course.
Seriously, the FBI will be exceedingly lucky if they can push back one hop from China to England without Chinese help in real-time as it is happening. Tracing it back to the guy in Cuba is virtually impossible. And he's probably using his laptop at an internet cafe using a spoofed MAC address.
Secondly, even if he did get caught, he's in Cuba. The US doesn't exactly have full cooperation from Cuba.
At the risk of being labeled a troll, I typically tell colleagues who ask about the Microsoft deal that Apple has numerous patent and other technology licensing agreements with Microsoft, and yet we don't see a groundswell of people on Slashdot calling Apple on the carpet for their Microsoft agreements.
OSX is a proprietary OS that runs on top of a BSD foundation and the fact that it uses OSS parts is irrelevant. Apple can do what it wants with those parts with our blessing. Apple is using them the way they were intended to be used.
The Apple patent agreements are nothing more than regular old patent agreements between corporations.
SuSE is GPL. The contentious Novell-Microsoft patent deal was a blatant attempt to do an end run around the GPL with a 'belt-and-suspenders' FUD attack.
If I wanted to distribute stuff that could get me in jail for years, I think I would find $5 per month to have my own server space in China, say, alongside the spammers.
But that would leave records...
Will the FBI raise an eyebrow? Do that with kiddie porn, expect to be in custody by the end of the day.
You have a much higher opinion of the FBI than is warranted.
Personally, I'm skeptical about the idea of malware that secretly downloads and hides kiddie porn--why would the malware developer do that?
I've actually seen this sort of thing a couple times... not for kiddie porn luckily. Just movies (hollywood) and warez back before p2p.
As you can imagine finding servers to host and distribute this sort of stuff can be difficult. So why not compromise some random persons laptop, setup an ftp server, irc, dynamic dns, and whatever else... and then use it as a free and 'anonymous' remote host and storage.
It wouldn't surprise me in the least that this could be in use for kiddie porn distribution.
I really can't fault the emploeyr for not considering such an idea and investigating it.
When dealing with any case of child abuse including kiddie porn, one should ALWAYS be extremely cautious. Because whether he is innocent or not, people will never look at him the same way again.
Slashdot Mirror
Personally I wish MS would grow a pair like Apple has over the years and build a new OS from scratch and not worry about backward compatibility. Apple has done it what three times since the beginning. They give developers and users a couple years of warning and move forward. MS talks about it but never does it, they definitely have the deep pockets to do it.
Apple isn't entrenched in the enterprises like Microsoft is. Home users don't REALLY care, they get whatever comes with the new OS. They piss and moan a bit about backwards compatibility, but they suck it up.
Enterprises on the other hand are much more invested in their infrastructures and much more resistant to change. Many of them still use software written for MSDOS, or NT3, etc. And they have NO intention of rewriting it or abandoning it. So if MS says they're leaving back-compat behind, these guys come out of the woodwork and raise a stink unlike anything Apple has ever had to deal with... governments, banks, megacorps, etc.
Microsoft's Vista is actually the closest they've ever come to doing a clean break, and honestly, on suitable hardware there is nothing really wrong with Vista, we should be applauding them for the changes they tried pushing through (running as a standard user, etc) yet instead moaning on about how awful it is almost a religion here.
If all else fails, they can use Bittorrent. It only takes a couple of hours, and the distribution is already self-sufficient.
I was actually referring to people, not technology.
Up until the moment they are bankrupt or bought out they are still a going concern, and wouldn't give away the farm because they might still pull something out of their hat. The moment after they are bankrupt or bought out, they are no longer authorized to do so. -- Either the creditors or the new owners run the show, and neither are going to be into the idea of 'freeing' the software.
And actually the moment they file for bankruptcy, or have a buy out offer, they wouldn't be allowed to deliberately do anything that would significantly devalue the assets.
The odds of them just 'getting old and retiring' and 'winding down the business' where they have full control over everything and how it shuts down right to the end are pretty slim.
Next thing you know, everything will pop up the "This application is unsigned, do you want to sign it?" and users will learn to automatically click "Yes".
The entire point of 'driver signing' is that by default 'normal users' can't run it, can't install it, can't use it. The prompt will say it can't be run because its unsigned. period.
Similar how when logging into a domain without a valid password, it says "No". It doesn't say "Those credentials aren't in the domain, do you want to be added to the domain as administrator?" Yet domain admins can still go in and add/remove users.
I only have an indirect answer: According to the vendors of some of the specialized hardware my clients and I use, the only way to use their hardware under Vista is for them to either get their drivers signed by Microsoft, or for them to rewrite their firmware and DLLs to allow using generic drivers.
Yes, if you want to distribute hardware that 'just works', you *have* to get your drivers signed by MS.
All of them chose to do the rewrite and use the generic driver. For example, several of the devices we use utilize the FT2232 USB microchip in the hardware.
Yes, that was probably the least effort for them, and their customers.
The new DLLs figure out which serial port really are the special devices and implement new device protocols through the virtual serial ports.
Yeah, I deal with a number of h/w vendors who use FTDI chips, and they've all gone the same route. But in cases like this, where its little more than usb-serial bridge, it makes sense that its easier to just use the generic drivers and probe the 'virtual' com ports for a suitable handshake than any other option.
All that said, it doesn't rule out the viability of self-signing. I know upfront that self signing should put some extra burden on end users... after all if you could make self-signing part of a seamless installation process driver signing would be worthless as rootkit writers would use it to get naive users to self-sign during installation...
However, for the open source community, who like to download and modify source, the hassle of self-signing drivers for their own units is probably not that big of a deal.
As I said in another post, I could even see code signing becoming commonplace for linux, as a part of SELinux or AppArmor. An IT admin would install trusted certs on his boxes including a self-made enterprise cert, and then the only stuff that would run in the enterprise would have be signed by one of the trusted certs. (Since the admin can issue and trust his own cert, he still has full control over everything that runs on his network, including allowing some hacked kernel module he modified and signed himself.)
Screw that. Mandatory driver signing is unacceptable, as it's no longer a general purpose computer strictly under my control.
It is if you have a signing key for that computer.
The answer to your question is that NO, you can't sign your own drivers for Vista and/or distribute them to other people to use.
Of course you can sign your own drivers and give them to other people. You have to buy a certificate for that, but lots of companies have manged it, including some very small ones.
The more interesting scenario to me is the 'test signatures' mechanisms, by which you can freely self-sign drivers for use on your own hardware. Designed for driver developers, and drivers signed this way can't be re-distributed, but if it lets you compile a driver from source, or download an unsigned driver, and self-sign it, and run it on your own hardware, then you basically have the tools to run anything you like on your own hardware and your entire rant about the vender keeping the keys is nullified.
For more info:
http://msdn.microsoft.com/en-us/library/aa906247.aspx
http://msdn.microsoft.com/en-us/library/aa906249.aspx
My question about self signing isn't 'can you do it'; I already know you can. Its more a case of 'how exactly', and 'can it easily be applied to downloaded source or unsigned binaries acquired over the internet'?
I don't mind jumping through a couple hoops to sign something I've downloaded, if it means stuff I don't jump through hoops for can't attack me.
The day Apple moves to protect the Mac OS from its owner despite their wishes is the day I begin my Linux migration.
There is no reason Linux won't have signed drivers as well one day. There is nothing 'anti-freedom' about driver signing provided the computer owners have the necessary tools to generate keys, sign with them, and revoke them for their own hardware.
Indeed such a thing might protect me from malicious opensource mirrors hosting 'modified' binaries and other such threats. I would setup my system to trust the Ubuntu or Fedora key, the Apache key, the Mozilla Key, and my own key. If I wanted to install a package that wasn't signed by any of the above, as part of the installation I would sign it myself. And of course I could sign my own software.
And if I distributed it and didn't have a widely recognized/trusted signature and/or distributed it unsigned or as source, the recipients could each sign it themselves for their own pc.
Bottom line: Driver Signing isn't inherently evil.
hardware-enforced Non-eXecutable memory?
Unless you can could turn it off, it just sounds like DRM.
This isn't DRM. This is what prevents a stack overflow or buffer overrun from executing code. There is absolutely nothing evil or even potentially evil about it. Marking your data segments 'NX' means that they can't be executed, even if something 'bad happens'.
mandatory code-signing?
Again this isn't evil. I think it would be great if ALL code always had to be signed. It would pretty much kill morphic virii, and put a real dent in the spread of rootkits etc.
The key to 'good' vs 'evil' with mandatory code-signing is who holds the keys. If I hold the keys to MY computer, then there is NOTHING WRONG with mandatory code-signing, because if there is something I want to run that hasn't been signed by [OS-vender] I can sign it myself to run on my computer, my network, my enterprise...
Won't matter. Most malware is installed via the user while installing the latest screensavers, emoticon packs, and browser toolbars. Nothing will ever be able to defeat the uneducated user.
True enough for the average home user, but the corporate/enterprise/government desktop is a whole other ballpark, and in that environment stuff like sandboxes and driver signing make a lot of sense.
Also as a 'sophisticated' user, using Vista x64, I quite like the driver signing concept.
I think its GREAT that some driver I download, or some source code for a driver I download and compile myself, or even a driver I might write myself from scratch can't by default run on everyone's computers.
That's a good barrier to rootkits etc. Even if a naive user says 'I agree' the driver still won't load. And if a rootkit does get signed, the keys can be revoked at MS, and a gazillion PCs will be immune next time they update.
Its a good system.
Of course, its has its frustrations - oss drivers, home made drivers, etc, etc won't work. And as a result:
Most of the chatter on the net about it, is 'how to disable driver signing', 'how to bypass it', etc. Yet the question people SHOULD be asking is: "How do I sign a driver to run on MY PC?"
THAT WOULD BE FAR MORE USEFUL.
It is after all YOUR PC, and you should be allowed to run any driver you want on it. So there *should* be a way of signing it for your PC. As the owner I should have my own private signing key, and anything I sign should run on any PC that has my public key trusted on it. Obviously stuff I sign with this key won't run on your PC because you won't have my public key trusted on your systems, but that's fine and as it should be.
Of course, this is somewhat at odds with the RIAA/MPAA/DRM objectives with driver signing. But so what, people should be demanding the keys to their computers, and getting them.
Code/Driver signing isn't evil, its on par with putting a lock on your car or home. Not giving the owners the keys is evil.
And with that said, IS it possible to sign your own drivers for your own Vista machine? I'd very much like to know what is involved in doing that.
This is virtually irrelevant.
Should anything 'happen to LGP' there may not be anyone left to distribute said patches. Are the patches already written, are tested? Or are they basically saying that while they are laying off employees and struggling to cover the rent as they file for bankruptcy they'll direct their efforts to writing patches for all their software?
Normally, for this sort of protection, the source / patches is put into escrow to be released when certain conditions are met. So that a 3rd party can act to release the source/patches when something 'happens' to the vendor.
So whitehouse.com gets .whitehouse?
yes.
What about other collisions between .com/.org/.net/.edu/.gov/.co.uk/.co.au/.dot.dash-dash.dot.? .com get the TLD.
It may result in some stupid people getting TLDs, but so what? Those stupid people already have the .coms. What I'm proposing just doens't make it any worse. .com is already the 'default' domain, and companies and organizations who have a .org or a .co.au or a .ca but not the .com are already.
The only alternative is to send conflicts to arbitration or something, which would be complicated, and expensive, and will affect millions. And in lots of cases BOTH parties have a legitimate claim to the domain, and there is no 'fair' way to decide who should get it.
But the way I see it, giving the TLDs to the .coms amounts to letting users omit '.com' from addresses, with the predicted result that it will go to the .com. This is a simple to understand, and reasonable behaviour, and already happens in some browsers anyway.
...and all the companies that "did the right thing" by registering addresses as xyzz.co.uk because they are based in the UK but operate globally lose out to some guy in his bedroom in some obscure corner of the world who registered xyzz.com just because they thought it was "cool"?
Those companies -ALREADY- lost out.
The current TLD mess is just that - a mess, and it won't be fixed in any way by effectively saying that the only TLD that matters is the .com namespace and grant them some special status in an automatic mapping to remove the .com from the end.
What suggested won't 'fix' the TLD mess. But it does give them a way to commercialize the TLDs without making an even bigger one.
If you want to really fix the naming system, you'll have to start over from scratch, and that's not likely to happen.
Might make sense, but then how would they charge extra for all that?
1) charge for a .com .com?
2) would you like to add 'TLD service' to your
3) ???
4) profit
Step 3 is pretty easy to figure out in this case: charge for step 2.
They should simply make it a reflection of .com. If you own abcde.com you, and only you, are entitled to abcde TLD. There are couple hiccups with other tlds... but that could be resovlved:
So if you have dotcom, and leaving .com off won't conflict with an existing TLD, you can pay another X$ fee and get it as a TLD. If you don't pay the fee, you don't get it, but nobody else can get it either.
No massive influx of squatter problems, trademark problems, spammer problems etc. PennyArcade.com and only pennyarcade.com can get the PennyArcade TLD, CocaCola.com can get cocacola, microsoft.com can get microsoft... intel.com can get intel, ibm.com can get ibm.
And ca.com, us.com, com.com can't get ca, us, and com respectively. They'll live.
The idea of organizational TLDs was a mistake from the get-go. If we could just get rid of them entirely I'd advocate that. But due to conflicts between legitimate .net / .org / .com sites that's not really practical.
So lets just do second best, and give the vast majority of .com's the option of leaving off the .com.
Same as how much I would, if I owned the original cart and the working system
I could see buying the VC version if you owned the original cart and working system because that it a royal pain to setup.
But if you've already got the game running on the wii in emulation, why would anyone pay $5-$10 to that you can get the game running on the Wii in emulation, except to clear their conscience.
And even to clear one's conscience, if one has "500 NES" ROMS, they aren't going to drop $2500-$5000 into the VC to 'legitimize them' even if Nintendo did make them available.
Please, before you open your mouth understand that not all homebrewers are pirates. We pay for our VC/WiiWare games (or just choose not to use the service). We just want to do MORE then what Nintendo is willing to do, like playing out of region games (Using Gecko Region Free) or other things as people write software, such as a POP3 email client, emulators, Doom, etc.
How likely are you to buy a VC title when you've already got the ROM file and an emulator running?
Funny....most of my married friends say that once that ring goes on, the sex goes down actually. Almost like she had to do that stuff to hook you, and once she knows she has you, she doesn't really have to do that any more.
Yeah, that 'anecdotal' stereotype has been mined by stand up comics forever. I think a lot of married men just play along with the stereo type, and the rest are having other issues that are interfering.
And even so, studies actually show that average frequency for married couples is multiple times per week, far more than singles.
According to one study:
# Couples living together report having sex 146 times per year.
# Married couples have sex 98 times per year.
# Single folks are having sex the least at 49 times a year.
And when you look at those numbers, you have to consider the factors... most 'couples living together' skew younger, while 'married couples' skew older. Both sexes peak relatively young. A 50 year old couple is on average going to have less drive than a 25 year old couple, while the 50 year couple is more likely to be married.
'couples living together' also tend to have little else going on. 'married couples' are far more likely to have kids for example which can interfere with frequency, or even to have drifted apart and just stay together out of momentum, shared debts/finances, etc, while 'couples living together' are far more likely to split when the sexual intimacy breaks down.
I think there is some truth to the idea that getting married decreases frequency, and the numbers bear it out, but I seriously doubt that even if they had just 'stayed living together' instead of 'getting married' that the numbers would declined by the same amount.
Personally...I've thought of it this way: Maybe I should come up with a new version of Playboy for married men..... ...every month....SAME chick.
Another stand up comedian staple.
Let me reply to that this way...
If you find a job you love you can work it every day until you die and look forward to going in the morning each day; you'll never think of quitting. You know you've got it made; its challenging, interesting, fun, and rewarding.
Same goes for friends.
Same goes for women.
Would that exception have been your wife, now ex?
A rebound.
The programming lies deep in the subconscious. It is by design, to maximize mixing of the gene pool.
Many species that care for helpless young are largely monogamous. (Not strictly monogamous, they'll often mate outside the pairing -- but their partner count, while not exactly 1, is still pretty low.)
http://www.msnbc.msn.com/id/19374216/
29% of men 9% of women have had 15 or more partners. (meaning 71% have had less)
http://www.durex.com/cm/gss2004Content.asp?intQid=401
average around the world 10.5
http://www.physorg.com/news10824.html
this ones neat because men claimed an average of 31. but 21% of those admitted to lying, to boost their numbers on the the same survey, and of the group that claimed more than 50 partners over 50% of them also admitted to lying.
http://aspe.hhs.gov/HSP/97trends/sd4-4.htm
69% of sexually active teen males reported http://www.denverpost.com/ci_6204119
"Almost one in three American men say they've had sex with at least 15 partners in their lives, triple the rate of similar behavior found in interviews with women, according to a government survey. "
Meaning 2 in 3 have had less.
"The average number of female sexual partners for men was 6.8, said Kathryn Porter, a medical officer for the CDC's National Center for Health Statistics in Hyattsville, Maryland, and one of the study's co-authors. Women reported an average of 3.7 male sexual partners, she said."
http://www.data360.org/dsg.aspx?Data_Set_Group_Id=1100
This one is neat too, because it breaks down by country, the USA is ~10.5 (it apparently is based on the same data as the durex link.) Turkey ranks highest at 14.5.
The numbers are apparently going up though, when you compare 1960s and 70s surveys to more recent surveys... or maybe people just lie more. After all the sixty's was the era of 'free love'.
Apparently it also varies heavily based on where you live. I think I read somewhere that New York city is apparently double or triple the national average.
Not to be mean, but you wasted your best fuck years in your teens and twenties....
1) Virtually all studies agree conclude that the vast majority of heterosexual males go a lifetime with fewer than 15 partners. And many conclude numbers half that. Look it up. I'm -possibly- slightly below average in partner count, but I doubt it.
2) Its not like a low number of partners predicts a low frequency of sex. In fact, most studies conclude that sexually active couples in their teens and 20s generally have far more sex than 'sexually active singles'.
3) I think most people who've tried both agree that 'one night stand sex', especially while intoxicated, is actually generally pretty lousy.
Thanks for your concern, but I really didn't 'miss out' on all that much.
Or maybe, the women that do end up with nice guys actually stay with them.
This would trivially explain why bad boys get more women. Nice guys get fewer, but keep them longer.
I was rarely single in the 10 years I was dating before marriage. But I can count the women without using up all my fingers. It didn't hurt that I actively avoided brainless sluts, with only one very breif exception.
Can you be convicted of murder without a body? Yes, you can.
Its also fairly unusual, and much harder to prove. Prosecutors REALLY like having a body. Or enough of one to be convincing that the 'victim' is actually deceased.
But wait, how do you do that without proof they died an unnatural death or even died at all? Circumstancial evidence - it's been enough to prove "beyond a reasonable doubt" so certainly it could be enough in a civil case.
Right, but its got to be AWFULLY convincing.
What the RIAA is saying is that they have enough circumstancial evidence. That sharing a file on a public file-sharing network that exists for the very purpose of distributing files, where it's available to anyone that requests means that the network will perform its expected purpose - which for a copyrighted file is to perform unauthorized distribution.
Most people actually use p2p to download files, not distribute them. For your average citizen p2p's 'expected purpose' is to get them a free copy of a britney spears song, not commit unauthorized distribution of a file on a massive scale exposing them to massive damages.
That said I agree with you to a point, but simultaneously think convicting them of 'n-counts of copyright infringment' multiplied by 'statutory damages designed to dissuade organized for profit criminal enterprise' is like penalizing the guy with bag of weed at a party the same as a guy caught with an airplane full of cocaine, half a million in cash, 4 body guards, and weapons cache.
People using p2p to infringe deserve to get busted, they don't deserve fines in the 100s of thousands. They deserve fines, in most cases, for casual p2p use of a few dozens of songs hosted from their home PC of around $500 or less.
Inidivual/personal use copyright infringement via p2p is a misdemeanor on par with a routine traffic violation, watering your grass on the wrong day, or parking in a handicaped spot, and in my opinion is less serious than when someone does a B&E to steal a TV.
At least those, including cashiers and bank tellers, who have to balance the drawer at the end of the day...
.25c respectively. Do that to a 100 customers over an 8 hour shift (in an industry where a lunch/dinner rush might see you do 100+ transactions an hour.)
Only the truly stupid pilfer straight up. The smart simply ring in a return. Or ring in a transaction, collect, and then void it, etc, etc.
Then the discrepencies don't show up in drawers cash balance but rather show up in month end inventory reconciliation which is virtually impossible to trace back to the cashier.
With more complex businesses there are more complex schemes... coupon tricks, currency rate exchange tricks (living near the Canada/US border had all sorts of games to profit from currency exchange), and so on.
Or they simply shortchange customers and then pilfer a bill. This is shockingly easy to do. Of course it requires that you work in a high volume cash transaction scene like fast food. I was in entry level management in fast-food putting myself through university and in that time I knew of cashiers who'd take 20-40 bucks a night, and their drawers would balance to within a dime simply by shortchanging and keeping track. Say a bill for a combo is 5.17 after tax, change owed from a 20 is 14.83. Hand back 13.53 or 14.58 taking 1$ or
In the odd case where you get caught by the customer, they'd apologize and cheerfully fix the error.
All that remains is to pilfer a $5 or $10 whenever you've accumulated it. (And this can be stealthed too by getting a partner (conspiring coworker going off shift or going on break maybe) to come in and order a $1 coffee, and then give them 29$ change insted $19 for their $20, and then pick up your cash from them after shift.
$20-40 bucks a night might not seem like much, but it amounts to a $2.50 to $5.00/hour raise (assuming an 8 hour shift) in an industry famous for 5 and 10 cent raises, and ends up amounting to stealing $4k-8k per year.
Worse the effects of this are invisible, because you are stealing from the customers not the employer and is very hard to isolate. And your only shot at catching them is if you are specifically watching for it, and doing random drawer audits midshift and looking for OVERAGES -- something which is very difficult in a busy fast food environment.
Plus its hard to fire someone when you audit their till and find it up $3.00.
Well now that I've educated a whole new generation of crooks... I'll get back to work.
Maybe you could get away with it a few times. The risk and penalties are so extreme I wouldn't chance it for no reason (and there is no rational reason for doing so). Depositing evidence on a government computer is pretty foolish, no matter how incompetent you believe the FBI are.
Firstly this isn't really about 'incompetence'. Its the reality of the internet.
If your hacked US governement computer is being remote controlled by a PC in China which is itself being remote controlled by a PC in England, which is itself being remote controlled by a PC in Mexico which is accepting IRC commands from a channel where they are being put there by a PC in Canada, which is remote controlled by a PC in Cuba. All of these links will be SSL of course.
Seriously, the FBI will be exceedingly lucky if they can push back one hop from China to England without Chinese help in real-time as it is happening. Tracing it back to the guy in Cuba is virtually impossible. And he's probably using his laptop at an internet cafe using a spoofed MAC address.
Secondly, even if he did get caught, he's in Cuba. The US doesn't exactly have full cooperation from Cuba.
Thirdly he's distributing child porn... clearly he's already accepted extreme risk and penalty.
At the risk of being labeled a troll, I typically tell colleagues who ask about the Microsoft deal that Apple has numerous patent and other technology licensing agreements with Microsoft, and yet we don't see a groundswell of people on Slashdot calling Apple on the carpet for their Microsoft agreements.
OSX is a proprietary OS that runs on top of a BSD foundation and the fact that it uses OSS parts is irrelevant. Apple can do what it wants with those parts with our blessing. Apple is using them the way they were intended to be used.
The Apple patent agreements are nothing more than regular old patent agreements between corporations.
SuSE is GPL. The contentious Novell-Microsoft patent deal was a blatant attempt to do an end run around the GPL with a 'belt-and-suspenders' FUD attack.
There is NO comparison between them.
If I wanted to distribute stuff that could get me in jail for years, I think I would find $5 per month to have my own server space in China, say, alongside the spammers.
But that would leave records...
Will the FBI raise an eyebrow? Do that with kiddie porn, expect to be in custody by the end of the day.
You have a much higher opinion of the FBI than is warranted.
Personally, I'm skeptical about the idea of malware that secretly downloads and hides kiddie porn--why would the malware developer do that?
I've actually seen this sort of thing a couple times... not for kiddie porn luckily. Just movies (hollywood) and warez back before p2p.
As you can imagine finding servers to host and distribute this sort of stuff can be difficult. So why not compromise some random persons laptop, setup an ftp server, irc, dynamic dns, and whatever else... and then use it as a free and 'anonymous' remote host and storage.
It wouldn't surprise me in the least that this could be in use for kiddie porn distribution.
I really can't fault the emploeyr for not considering such an idea and investigating it.
When dealing with any case of child abuse including kiddie porn, one should ALWAYS be extremely cautious. Because whether he is innocent or not, people will never look at him the same way again.