I've been working with smart card tech for almost 20 years now. I've seen the breaks and countermeasures, and am fully aware that the technology can be broken given enough effort. That's why good security designers arrange to limit the damage possible, to a value which is less than that which can be obtained by breaking it -- and we have pretty good estimates of break cost. Off-device countermeasures are critical, too, such as the risk engines already implemented by all of the credit card issuers. ID-related data should be authenticated with off-device keys, similar to the way the authentication data in passports is already secured.
Obviously nothing is perfect, which is why the security engineers who design this stuff spread the risk. But that risk spreading doesn't mean you can't put everything in one device. In fact, it really doesn't even help to have a wallet full of separate cards, because they're all in one place. And having all of your credit cards in your phone is vastly more secure than having them all in your wallet, because your wallet has no locks and the cards in it have their whole frigging card numbers printed right on their face. It's hard to get much worse security than that (because, fundamentally, credit cards are horribly insecure -- the identifier and the authenticator are the same value? Really?)
You can certainly feel free to avoid putting everything in your phone if you like. But the vast majority of people who are willing to trust the security designers will not be disappointed in the results. Not that there won't be occasional problems, there are problems with anything, but they will be less common than the ID and payment fraud we have today.
Bottom line: It will be better security, not worse. I challenge you to find a serious security researcher who knows anything about the technology and disagrees.
nice post! This is interesting stuff, I can really visualise them being a major force in retail banking? Would you trust them? You already kinda do... They win instant points for not being a bank as anyone understands it these days. And the benefit to everyone having the mark of the be... sorry - a smartphone as their wallet / purse / bag - would be cool tech for magazine covers. It will be a smash. I'm pretty convinced google are on track in the thinking displayed. And yes, I agree it is more secure than existing bank cards. Massively, I wouldn't be accepting your challenge in a hurry pal, your thinking is rock solid on this. And everyone here is petrified of their smart phone becoming a SPOF of life threatening proportions, one word - backup. Doesn't take a leap of the imagination to see this being fluid, real and useful tech, and indispensable to money as a medium at all levels of the global economy. If Google can walk "don't be evil' and unleash a bit of people power in their offering too, then they're as smart as everyone says they are...
Just to add, majority of phones can be tricked into dropping down to GSM from 3G. All phones (bar the BB) should be treated as untrusted devices. Tunnel everything, encrypt everything, store nothing and you're part way there:-)
They could be but I'd say that's a bad bet - trying to "out Apple" Apple.
Microsoft has always had advantages in existing software compatibility and enterprise security features (say what you will - Windows Mobile had many more security features than Android or iOS for a long time). They seem to be casting off their only real differentiators in an attempt to copy the success of the iPad. This will fail spectacularly.
What nonsense. There are a whole host of Windows x86 tablets coming with full touch support and with new form factors which will be fully compatible with existing software and enterprise features of PCs.
And the submitter is CWMike, from Computer World. They know that Slashdot laps up anti-MSFT FUD and thus they use it to write drivel and get page hits from Slashdot. And judging from the comments, they're very successful in manipulating Slashdot for their own gains as they've historically with the fake benchmarks.
That's right - I need to look at this more, but you people should give MS a HELL of a lot more credit for what they are doing here. BYOD is the security nightmare du jour, ever since the iPad came out. Our security team have spent huge resources, and are still woefully under-resourced to make managing these devices day in day out remotely safe enough. The last thing you'd want to see, and the first thing you'd demand - from an info sec perspective - is that AD not be baked into this consumer oriented OS.
Until Win RT is a couple years old every security team worth their salt would nix any directory / infrastructure tie up with a device which is easily lost, unhardened (at least through painful experience) and virtually an Alpha product.Yes it can be done, but the overhead is massive and most people wont have the headcount to secure bridging the two safely - and KEEPING THEM SAFE.
Releasing in this form provides entry to a consumer market, and a platform which has a lot of the headache of apps installed from Lines of Business fixed through the separate publishing infrastructure (which the original article is ignorant of, or lying). Staff get their tablets.
It sounds to me that MS are getting a head start on Android and iOS. Read the link the guy above posted. They have provided a tiered, clean way of getting business apps to a consumer device. It still requires security risk assessments and penetration testing of the apps (which would need hella strong authentication / 2FA for anything which holds sensitive or above data, but the lack of the 'generic' client for the enterprise directory will make this much easier to deploy and work with than if they had tied things together with AD.
It means more work - but thats what it takes, unless you want your firm to get owned.
Re:Talk about getting your facts right!
on
Tetraktys
·
· Score: 1
God I love Stephenson. Just finishing Quicksilver now. And I have to say, as an inhabitant of London, his accuracy on detail and facts is astonishing. I only spotted one potential error, where he seems to infer that the Thames is not tidal, but even that was a stretch and is plausibly deniable by way of the wording used. I may just be a pedant. On Slashdot, natch!
The guy blows me away, definitely should have had a major, major bestseller by now, and am convinced that, if he can keep something down to a reasonable size, he has a mainstream success due to him some time soon.
Very much in agreement.
I spent some time in IT audit for one of the Big 4, and it's always puzzled me that they can issue a draft audit point which if challenged is just taken away. If accepted, lots of monkeys have to run around at great expense clearing it. It seems a bit rich to me that there is no penalty on the auditor for this. effectively they can just rain paper with little consequence, and at potentially huge cost to the client.
Having said that, these firms are partnerships, there is always a partner very close to the work being undertaken, and it's their ass and their money and as a consequence the QA at these firms on their deliverables was exceptional in my experience.
But this is an issue, and I think that legal redress is deperately needed.
To illustrate this, I recall one audit I had to do. It was a follow on from the previous years IT audit a colleague had done for one of the two biggest banks in the country in question. One of the previous years recommendations, signed off on by the business, was the need for Network Intrusion Detection to be put in place. This was actioned, and when I got there they had had an expert working day in day out for months, with a huge budget for some very expensive network taps and headcount for monitoring. I reviewed the point, determined that they hadnt yet implemented the control as of that date, recommending that they proceed and introduce it within the coming year.
At the close out meeting one of the commercial directors ate us alive. The original point should never have been accepted. The banking industry, at that time, hadnt settled on NIDS as a requirement and host based should have been fine. Effectively our sloppy report made them piss millions up the wall for little reason.
Audit reports are clear documents, beautifully built, well evidenced. They always have work papers and test papers behind them. They are perfect candidates for for further inspection in a court of law and I have seen, first hand, instances where they have been harmful and inaccurate and should be subject to this scrutiny. If a process or test was missed off, it will show. Every time.
Yes, it's true that senior management at the bank signed off on the previous years report, but this was in good faith that my firm knew what they were talking about. They didnt, and should have been liable. Why not? Currently they get out of jail if they're right, and they get out of jail if they're wrong.
And dont even get my started on the conflicts of interests I saw!
Not everything has a literal connection with Australia, that was very much last weeks story, I hate to break it to you but, as you suspected, the world cares as much for Aus as Aus does for the world. What the hell have bushfires got to do with slave labour, you bibble?
I think PoP is anodyne, and the handholding took away any feeling of risk.
FC2 I love. Played on hard, just getting to the required map point is brutal but always interesting due to the savagely smart, hard to see soldiers at checkpoints, road patrols, etc. It forces you to think, proceed with caution, and engage the enemy in a real seeming way. If you get gunned down, you are going to retry, and that half hour of terrain doesnt seem boring, none of it does, because the scenery, enemies, and weaponry, are just fun to hang with.
Yep,
'Experts' barely exist. I am one. And I'm not that good at all to be honest, I can barely code a 'hello world' but I've still been wheeled out countless times to point out password lengths arent up to snuff etc.
But I've got seven years experience and I know quite a lot of other things worth knowing, and I've seen some pretty sloppy practice and kicked it into touch.
Still, this book sounds cock. I mean utter cock. The review makes it sound like it is equally as worthless as me, on a bad day, trying to risk assess a three tiered app running on Websphere. They appear not to have a point, and to focus on the now dead legend of management buying the silver bullet / marketing / one stop shop is well out of date. There isn't a manager out there who is dumb enough to believe that you pay money and this crap goes away. They know it's a combination of process, people, and systems in concert that gets you out of the shit, because it's true, and because it is their language, that of business. The book sounds like a squint-eyed techie moan, from people who don't get let out of the back room to talk to the execs very much. This book sounds so far out from reality it may as well be set on the moon, and populated by Sea Monkeys. If they want to sell a new school, they could at least take the trouble to learn the 'old ' one first, instead of passing off vacuous soundbites about China and Hedgehogs or something.
Yep, I went off-piste for the heck and all.
Although I think most 'agreements' for home broadband have a caveat along the lines that if they think your unlimited broadband usage is not consistent with that of a home user, then they can still turn the screws by capping your speed or what-have-you. But on balance, you'd have to be caning it like a hoodie on skunk to get into all that.
"If the BBC is paying for the data that it is uploading, then it is paying its fair share. The rest of the bandwidth use is customers uploading and downloading data with each other, which they also pay for via their ISP fees. If those fees don't cover the cost of the bandwidth, then that is the fault of the ISP, not the BBC."
It was a rebuttal to the above, and although I appreciate that wasn't your main point, you made it nonetheless, and that's what I was responding to, not the overall post, which I didn't really get in to, as I was too busy getting the red mist for the beeb, who seem to not be drawing too much flak. Actually, they have their supporters on this which is interesting. Yours was the first post I read which specifically said the BBC are not culpable in the current barney about bandwidth. All I'm saying is that from where I'm standing, they are, because they've let millions of noobies install a peer-to-peer network which is always seeding by default. I think it's important that we all keep sight of that is all...
"Fact is, your a sad old man, who can't accept that TV has always been shit, the country has always been shit, and you have always been a dickless looser. Now get over it and stop crying like a baby."
What precisely would you know, you're in your teens? You have no frame of reference for anything, except maybe Leeds in the late nineties or something.
Look, I can't help you, you come on Slashdot spoiling for a fight, not able to understand what's being said, the buzzing in your ears, the confusion, the why oh why of being born in a place where no-one respects you for your wayward, haycart genius, your silly little joke of a moustache, your child-molesting uncles, your ego pulsing erratically like your little mouse of a dick every time you manage to get MTV on, or do you just bully your mum relentlessly by turning it on anyway? Nice place you've got is it? You get rid of that Transformers duvet yet?
And as for this country always being shit, well you know what you can do don't you? If you're not happy, leave. Fact is, you can't make it anywhere, which brings you... here
Or is it just that you really, really like Chris Moyles?
Kontiki? Sounds shite to me, I use Azureus, and ABC. And what the fuck is your problem? Are you getting wound up at everyone who is going to get stiffed on their broadband bill this month because of the BBC, because if that's true, you're an even bigger wanker than you sound. Read the post first next time, you scarey little gimp.
True enough, but, y'know, why spend all this money on lawyers just to make this thing happen just to have a bit of a limp struggle against the google-constrictor. What's the point? The three of them are screwed as an entity. They could no more pull a decent web presence out of this than I could pull a flaming, banjo-playing clown out of my ass.
Anyway, google as a monopoly for a few years sounds quite nice. I like monopolies. Aren't monopolies what gave us all that stuff that isn't MS, that has allowed MS to degenerate quietly into the laughable junk it is, you know, things like Linux, and google?
I keep trying to peer into my crystal ball to work out what it would be like to have these three monsters pawing each other while lurching towards my pocket, and it just sounds like a great big clusterfuck of 2nd grade mediocrity, failing to win any of my hard earned cash. This story is salutory in that it has more to do with the way all 3 (I'm including Yahoo!) companies perceive their daily grind, than it has to do with how good product is delivered to the masses, either in terms of software, media, or connectivity.
This will be them, now, and for the next year, dissolving into an orgy of well-lubed management meetings, focussed entirely on how to do business in the post Reagan world. I'm sorry guys, but aren't you all supposed to be DELIVERING services in a competitive marketplace Isn't THAT your raison d'etre? You see this is it, the three of them have proven they have nothing worth having, and this story, unless it involves somebody small, smart and scary (like google) is just a complete non-event for all of us. Although I think it would be interesting to stack up News Corps other online holdings against this deal. Haven't they already bought Myspace. Oh, yeah....
No Mate, It's the BBC's fault here.
I've just changed ISP in the UK, and I had to look long and hard to find a provider that gave good service. Most ISP's in the UK are bucket-shops, offering insanely cheap broadband, but with the very clear T&C that they nearly ALL have small monthly bandwidth limits. ALL of them, more or less. The amount of people in the UK who don't understand anything about this is obviously in the millions, and until iPlayer turned up, nearly none of them were involved in p2p networks, none of them!
Now, thanks to the Beeb, there are suddenly millions of grannies / football fans / Little Britainers who have no idea that their broadband connection is calmly sitting there chewing up all of their (typically miniscule) bandwidth allowance. A month later, their Broadband bill arrives, and it's tripled. Did the ISP warn them about their bandwidth? Yes! Does the beeb warn you when you install IPlayer? No! I mean, I uninstalled it yesterday, mainly because I just didn't like it sitting there eating resources. In the space of a month I downloaded one episode of Mitchell & Web, and didn't bother watching it. I cannot remember IPlayer making it clear that the software would sit there eating bandwidth willy nilly during the install. I read all the bad press about Iplayer on/. when it was released, but that was all discussing the question of DRM. I had no bloody idea it was a p2p client! None! And I'm not bad with this stuff, I'm a torrent - fricking - master otherwise. I only found out about it when my wife read out that iPlayer is in this weeks "What's Not Hot!" list in the Sunday Times style supplement, because "It clogs up your Internet connection."
Now, I can't see why the ISP's would complain, they get to legitimately charge their punters penalty fees that are worth a bomb cumulatively.
Also, the BBC stink, they used to be the best tv company in the world, but are now groaning, zombie like with no talent analysts and and marteting scum. The four beeb channels in the UK are running endless little blips after programmes, reminding everyone out there that they can use iPlayer now. And I have heard the biggest Radio DJ in the UK (Chris Moyles, who is wierdly an odious sack of flatulent vomit) and he was ejaculating that he'd missed a favourite show but he "caught it on the iPlayer" really mate? And what corporate quota did you meet by spinning that little advert, you lying Jabba Shaped chew toy?
No, the beeb have released a dog in iPlayer, an absolute dog, and the word is out among the semi-hip that there is no good reason for having it installed on your system. The BBC should, really really should, stick to their threat and print warnings or disclaimers saying that you may not be able to afford to run their silly little app on certain connections, because in the UK, the list would be longer than every MS EULA ever stapled together, and it would include pretty much every broadband service on the island, because that is the model in play and you better believe the beeb have some responsibility for understanding that and launching THEIR product with that and their licence fee paying public in mind.
BBC, you listening? Don't get ahead of yourselves. Without Dr Who you are the 21st centuries ITV waiting to happen. Take the licence fee millions you get from every adult in Britain, and invest it in the cultural enrichment of what is now a bitter, prostituted, soulless glob of a country, not some half-baked nu-media nonsense like this...
Interesting discussion, thanks for all the comments. I'd like to give Kubuntu a whirl soon enough.
I still think there is room for one major Linux distro to take chunks from MS's desktop monopoly, and based on what I've seen it would be Debian based, and have Gnome as the front end. I'm basing that on there being more software native to Gnome than KDE, and all the other stuff I've mentioned above. I've googled (not very hard) but I haven't found any useful info out there about running Gnome apps on KDE and vice versa, I'm guessing it's not advisable, if not impossible?
Freedom for the MASSES.
Mmmm...
Choice is good, for people of a certain technical ability, but I want Linux to break through on the desktop, so I don't have to use Windows any more, and you have to admit that the introduction of so many choices of Vista (what was it 7?) was one of the key reasons people did not upgrade. Linux is being hurt badly by this business of two main desktop flavours. Looking on from the outside, it bothers me immensely. I'm ignorant, but again that's the point. If there is any uncertainty about GUI based apps on Linux being able to run on the desktop each and every time, as they do with Mac and Windows, then it holds back adoption.
There is not a standard for the Linux desktop, and that's terrible. The question of which is the better GUI is almost academic.
And Gnome, for a desktop which is just being polished, blows Vista out of the water in terms of user experience and sophistication, KDE is richer, but it doesn't need to be. All we need is something that takes away MS market share, and Gnome is capable of that. I showed Gnome to my wife a few months ago, and her response was a very genuine "wow!", and this is someone who isn't normally impressed by IT in any form.
I appreciate your comments, but I have to re-iterate, KDE, installed during install, made Linux unusable for me each time. Gnome and Ubuntu is the first Linux distro I've used regularly for more than a fortnight. I'm keen to give KDE another try, because it looks amazing but I'm worried it will be bad again. The most important feature of a UI is that it does everything it can to not get in your way surely?
It's bad because Microsoft will now clearly not be using the better ODF within Office, which would have given users the choice to move away from Office for their productivity suites to other suites, based upon their needs. It means that a billion odd business users will be strapped to Office whether they like it or not, because OOXML is a losing proposition for anyone else to implement, based upon it's complexity and use of proprietary MS technology.
Seriously, mate, it took a while for this to sink in with me as well, but it will, and you're going to be pretty angry about this soon enough, believe me. Just read all the other comments.
I was really looking forward to April Fools Day on Slashdot this year, for some OMGPonies fun, and this has been the most sobering and depressing news. A compete slap in the face...
OH, BTW, I know RPM is in no way part of KDE, so don't bother pointing that one out. Just thought I'd take a sideswipe at RPM too while I was at the keyboard.
As a Windows gimp, I have been trying to install and use Linux for ten years. I always used KDE and it was always the same two things that killed it as an experience for me:
1. RPM (What is up with that, way to go to differentiate your product for Enterprise, make all software pretty much uninstallable and unmanageable) 2. KDE, I installed it each time, and each time, the desktop was great for a day, then slipped irreversibly into a quagmire of wierd bugs, or horrible configurations I couldn't rescue.
OK, I'm noob. But that's my point. Ever since I first installed Ubuntu a year ago, I have been thrilled by the stability of the Gnome Desktop, and the reliability of apt-get. There is no comparison. I'm really stoked about what has happened with KDE4, but I'm also depressed, it's just more of the same, it's a UI that is virtually promising that it will be horribly unstable, on account of it's bleeding edge. I wish KDE would just get out of the marketplace altogether, and stop scaring people away from Linux, which is, from my experience, exactly what they have been doing for years now.
Isn't this how things are done in Radio, more or less? It's all out in the open. The music, and it's success is tracked, so the artists get a fair proportion of whetever revenues are generated by their songs. The ISP's pay the recording artists (or more specifically their robot overlord management) for the provision of the indexed catalogue of media, and you and I download songs, non-DRM'ed at a whim. I Love it, provided the cost is nominal. The big difference is, radio does songs, and that's it, the Internet does video too, and does it well, so any effort would have to be undertaken across the arts, not just music. Seriously, for my money, this is the best idea ever. Advertising is an absolute fact of life in the modern, capitalist world. And we know, because WE forced their hand on this, and away from DRM, by being very demanding consumers, who are always one step ahead of them, WE KNOW, that if they screw it up, we'll just start hacking the system until it works. Count me in, as a long-standing conmsumer of the BBC's television, this can work.
I thought the same, but there is a school of thought, backed up historically, that any kind of government sanction, expenditure, funding and protection of science is worthless, and that the real great leaps forward in science (Industrial revolution, rennaisance) took place at a time when it was absent.
I don't want to put on my laissez faire capitalist hat here, but you only have to look at what is happening in the area of patents lately, to wonder what good the policing and management of science serves. And MIT must get nearly all their money from the private sector, like a good many universities surely. Should government be involved at all? For me, all I want is for them to make sure my bins get emptied, the streets are lit, and there are emergency services and schools etc. And also, that they are able to rain clinical death on anyone who disagrees with us...:-)
Yep, tfa is focused on trojans and phishing, which have had a great year, both in increased sophistication and effectiveness.
However, I suspect that a fairly large number of these SARs would be from people who have purposely infected their systems / defrauded themselves to get money. I wonder how easy would this be? You'd need to have an extra account to which you cannot be tied, or an accomplice in a different country... Fact is, most people expect to be re-imbursed by their banks when their account is defrauded, provided the bank cant prove complicity, and what bank is going to spend timely expert resources on uncovering a 25,000 fraud. Provided the numbers stay low (compared to mortgages and cheque fraud they are a drop in the ocean) then the banks wont aggressively investigate. When the numbers get high, I imagine they will get a few instances in the press where they successfully identify complicity on the part of the account holder, and use this to justify a change in terms and conditions on their accounts which will shift the responsibility massively on to the customer. What I don't see is them investing more in security (bar a bit more 2 factor auth when it gets dirt cheap)
Mate,
You have just gone so far off topic, you've done a slingshot around the sun, and have returned in a parallel discussion about wanking for coins.
I'll applaud you for one thing, passion counts.
And on the topic of redundant skills: There are no redundant skills, not really, what is really redundant and dead scary, is any computer book over five years old that doesn't deal in pure theory.
I'm torn here. Should I be happy I can now install and activate the ISO of Ultimate I've had for the last six months, or be sad that Microsoft haven't played their usual PR ace and made about a quarter of a million legit systems go 640 x 480 x 16 colours?
Slashdot Mirror
I've been working with smart card tech for almost 20 years now. I've seen the breaks and countermeasures, and am fully aware that the technology can be broken given enough effort. That's why good security designers arrange to limit the damage possible, to a value which is less than that which can be obtained by breaking it -- and we have pretty good estimates of break cost. Off-device countermeasures are critical, too, such as the risk engines already implemented by all of the credit card issuers. ID-related data should be authenticated with off-device keys, similar to the way the authentication data in passports is already secured.
Obviously nothing is perfect, which is why the security engineers who design this stuff spread the risk. But that risk spreading doesn't mean you can't put everything in one device. In fact, it really doesn't even help to have a wallet full of separate cards, because they're all in one place. And having all of your credit cards in your phone is vastly more secure than having them all in your wallet, because your wallet has no locks and the cards in it have their whole frigging card numbers printed right on their face. It's hard to get much worse security than that (because, fundamentally, credit cards are horribly insecure -- the identifier and the authenticator are the same value? Really?)
You can certainly feel free to avoid putting everything in your phone if you like. But the vast majority of people who are willing to trust the security designers will not be disappointed in the results. Not that there won't be occasional problems, there are problems with anything, but they will be less common than the ID and payment fraud we have today.
Bottom line: It will be better security, not worse. I challenge you to find a serious security researcher who knows anything about the technology and disagrees.
nice post! This is interesting stuff, I can really visualise them being a major force in retail banking? Would you trust them? You already kinda do... They win instant points for not being a bank as anyone understands it these days. And the benefit to everyone having the mark of the be... sorry - a smartphone as their wallet / purse / bag - would be cool tech for magazine covers. It will be a smash. I'm pretty convinced google are on track in the thinking displayed. And yes, I agree it is more secure than existing bank cards. Massively, I wouldn't be accepting your challenge in a hurry pal, your thinking is rock solid on this. And everyone here is petrified of their smart phone becoming a SPOF of life threatening proportions, one word - backup. Doesn't take a leap of the imagination to see this being fluid, real and useful tech, and indispensable to money as a medium at all levels of the global economy. If Google can walk "don't be evil' and unleash a bit of people power in their offering too, then they're as smart as everyone says they are...
Just to add, majority of phones can be tricked into dropping down to GSM from 3G. All phones (bar the BB) should be treated as untrusted devices. Tunnel everything, encrypt everything, store nothing and you're part way there :-)
They could be but I'd say that's a bad bet - trying to "out Apple" Apple.
Microsoft has always had advantages in existing software compatibility and enterprise security features (say what you will - Windows Mobile had many more security features than Android or iOS for a long time). They seem to be casting off their only real differentiators in an attempt to copy the success of the iPad. This will fail spectacularly.
What nonsense. There are a whole host of Windows x86 tablets coming with full touch support and with new form factors which will be fully compatible with existing software and enterprise features of PCs.
And not to mention the fact that the author doesn't mention the enterprise features that Windows RT has. http://blogs.msdn.com/b/b8/archive/2012/04/19/managing-quot-byo-quot-pcs-in-the-enterprise-including-woa.aspx
Very telling that the author is Gregg Keizer, who was involved in the scandals with faking Windows benchmarks to drive page hits. http://www.zdnet.com/blog/btl/why-we-dont-trust-devil-mountain-software-and-neither-should-you/31024
And the submitter is CWMike, from Computer World. They know that Slashdot laps up anti-MSFT FUD and thus they use it to write drivel and get page hits from Slashdot. And judging from the comments, they're very successful in manipulating Slashdot for their own gains as they've historically with the fake benchmarks.
That's right - I need to look at this more, but you people should give MS a HELL of a lot more credit for what they are doing here. BYOD is the security nightmare du jour, ever since the iPad came out. Our security team have spent huge resources, and are still woefully under-resourced to make managing these devices day in day out remotely safe enough. The last thing you'd want to see, and the first thing you'd demand - from an info sec perspective - is that AD not be baked into this consumer oriented OS. Until Win RT is a couple years old every security team worth their salt would nix any directory / infrastructure tie up with a device which is easily lost, unhardened (at least through painful experience) and virtually an Alpha product.Yes it can be done, but the overhead is massive and most people wont have the headcount to secure bridging the two safely - and KEEPING THEM SAFE. Releasing in this form provides entry to a consumer market, and a platform which has a lot of the headache of apps installed from Lines of Business fixed through the separate publishing infrastructure (which the original article is ignorant of, or lying). Staff get their tablets. It sounds to me that MS are getting a head start on Android and iOS. Read the link the guy above posted. They have provided a tiered, clean way of getting business apps to a consumer device. It still requires security risk assessments and penetration testing of the apps (which would need hella strong authentication / 2FA for anything which holds sensitive or above data, but the lack of the 'generic' client for the enterprise directory will make this much easier to deploy and work with than if they had tied things together with AD. It means more work - but thats what it takes, unless you want your firm to get owned.
God I love Stephenson. Just finishing Quicksilver now. And I have to say, as an inhabitant of London, his accuracy on detail and facts is astonishing. I only spotted one potential error, where he seems to infer that the Thames is not tidal, but even that was a stretch and is plausibly deniable by way of the wording used. I may just be a pedant. On Slashdot, natch!
The guy blows me away, definitely should have had a major, major bestseller by now, and am convinced that, if he can keep something down to a reasonable size, he has a mainstream success due to him some time soon.
Very much in agreement.
I spent some time in IT audit for one of the Big 4, and it's always puzzled me that they can issue a draft audit point which if challenged is just taken away. If accepted, lots of monkeys have to run around at great expense clearing it. It seems a bit rich to me that there is no penalty on the auditor for this. effectively they can just rain paper with little consequence, and at potentially huge cost to the client.
Having said that, these firms are partnerships, there is always a partner very close to the work being undertaken, and it's their ass and their money and as a consequence the QA at these firms on their deliverables was exceptional in my experience.
But this is an issue, and I think that legal redress is deperately needed.
To illustrate this, I recall one audit I had to do. It was a follow on from the previous years IT audit a colleague had done for one of the two biggest banks in the country in question. One of the previous years recommendations, signed off on by the business, was the need for Network Intrusion Detection to be put in place. This was actioned, and when I got there they had had an expert working day in day out for months, with a huge budget for some very expensive network taps and headcount for monitoring. I reviewed the point, determined that they hadnt yet implemented the control as of that date, recommending that they proceed and introduce it within the coming year.
At the close out meeting one of the commercial directors ate us alive. The original point should never have been accepted. The banking industry, at that time, hadnt settled on NIDS as a requirement and host based should have been fine. Effectively our sloppy report made them piss millions up the wall for little reason.
Audit reports are clear documents, beautifully built, well evidenced. They always have work papers and test papers behind them. They are perfect candidates for for further inspection in a court of law and I have seen, first hand, instances where they have been harmful and inaccurate and should be subject to this scrutiny. If a process or test was missed off, it will show. Every time.
Yes, it's true that senior management at the bank signed off on the previous years report, but this was in good faith that my firm knew what they were talking about. They didnt, and should have been liable. Why not? Currently they get out of jail if they're right, and they get out of jail if they're wrong. And dont even get my started on the conflicts of interests I saw!
er, you're like Walter in Lebowski Dude.
Not everything has a literal connection with Australia, that was very much last weeks story, I hate to break it to you but, as you suspected, the world cares as much for Aus as Aus does for the world. What the hell have bushfires got to do with slave labour, you bibble?
Get a job sir.
I think PoP is anodyne, and the handholding took away any feeling of risk. FC2 I love. Played on hard, just getting to the required map point is brutal but always interesting due to the savagely smart, hard to see soldiers at checkpoints, road patrols, etc. It forces you to think, proceed with caution, and engage the enemy in a real seeming way. If you get gunned down, you are going to retry, and that half hour of terrain doesnt seem boring, none of it does, because the scenery, enemies, and weaponry, are just fun to hang with.
Yep,
'Experts' barely exist. I am one. And I'm not that good at all to be honest, I can barely code a 'hello world' but I've still been wheeled out countless times to point out password lengths arent up to snuff etc.
But I've got seven years experience and I know quite a lot of other things worth knowing, and I've seen some pretty sloppy practice and kicked it into touch.
Still, this book sounds cock. I mean utter cock. The review makes it sound like it is equally as worthless as me, on a bad day, trying to risk assess a three tiered app running on Websphere. They appear not to have a point, and to focus on the now dead legend of management buying the silver bullet / marketing / one stop shop is well out of date. There isn't a manager out there who is dumb enough to believe that you pay money and this crap goes away. They know it's a combination of process, people, and systems in concert that gets you out of the shit, because it's true, and because it is their language, that of business. The book sounds like a squint-eyed techie moan, from people who don't get let out of the back room to talk to the execs very much. This book sounds so far out from reality it may as well be set on the moon, and populated by Sea Monkeys. If they want to sell a new school, they could at least take the trouble to learn the 'old ' one first, instead of passing off vacuous soundbites about China and Hedgehogs or something.
Yep, I went off-piste for the heck and all. Although I think most 'agreements' for home broadband have a caveat along the lines that if they think your unlimited broadband usage is not consistent with that of a home user, then they can still turn the screws by capping your speed or what-have-you. But on balance, you'd have to be caning it like a hoodie on skunk to get into all that.
"If the BBC is paying for the data that it is uploading, then it is paying its fair share. The rest of the bandwidth use is customers uploading and downloading data with each other, which they also pay for via their ISP fees. If those fees don't cover the cost of the bandwidth, then that is the fault of the ISP, not the BBC."
It was a rebuttal to the above, and although I appreciate that wasn't your main point, you made it nonetheless, and that's what I was responding to, not the overall post, which I didn't really get in to, as I was too busy getting the red mist for the beeb, who seem to not be drawing too much flak. Actually, they have their supporters on this which is interesting. Yours was the first post I read which specifically said the BBC are not culpable in the current barney about bandwidth. All I'm saying is that from where I'm standing, they are, because they've let millions of noobies install a peer-to-peer network which is always seeding by default. I think it's important that we all keep sight of that is all...
"Fact is, your a sad old man, who can't accept that TV has always been shit, the country has always been shit, and you have always been a dickless looser. Now get over it and stop crying like a baby."
What precisely would you know, you're in your teens? You have no frame of reference for anything, except maybe Leeds in the late nineties or something.
Look, I can't help you, you come on Slashdot spoiling for a fight, not able to understand what's being said, the buzzing in your ears, the confusion, the why oh why of being born in a place where no-one respects you for your wayward, haycart genius, your silly little joke of a moustache, your child-molesting uncles, your ego pulsing erratically like your little mouse of a dick every time you manage to get MTV on, or do you just bully your mum relentlessly by turning it on anyway? Nice place you've got is it? You get rid of that Transformers duvet yet?
And as for this country always being shit, well you know what you can do don't you? If you're not happy, leave. Fact is, you can't make it anywhere, which brings you... here
Or is it just that you really, really like Chris Moyles?
Kontiki? Sounds shite to me, I use Azureus, and ABC. And what the fuck is your problem? Are you getting wound up at everyone who is going to get stiffed on their broadband bill this month because of the BBC, because if that's true, you're an even bigger wanker than you sound. Read the post first next time, you scarey little gimp.
True enough, but, y'know, why spend all this money on lawyers just to make this thing happen just to have a bit of a limp struggle against the google-constrictor. What's the point? The three of them are screwed as an entity. They could no more pull a decent web presence out of this than I could pull a flaming, banjo-playing clown out of my ass.
Anyway, google as a monopoly for a few years sounds quite nice. I like monopolies. Aren't monopolies what gave us all that stuff that isn't MS, that has allowed MS to degenerate quietly into the laughable junk it is, you know, things like Linux, and google?
"I can assure you Lord Vader, this Microsoft Powered Website will be fully operation...oh...er...mouse doesn't seem to be moving..."
News Corp & Microsoft & Yahoo!
I keep trying to peer into my crystal ball to work out what it would be like to have these three monsters pawing each other while lurching towards my pocket, and it just sounds like a great big clusterfuck of 2nd grade mediocrity, failing to win any of my hard earned cash. This story is salutory in that it has more to do with the way all 3 (I'm including Yahoo!) companies perceive their daily grind, than it has to do with how good product is delivered to the masses, either in terms of software, media, or connectivity.
This will be them, now, and for the next year, dissolving into an orgy of well-lubed management meetings, focussed entirely on how to do business in the post Reagan world. I'm sorry guys, but aren't you all supposed to be DELIVERING services in a competitive marketplace Isn't THAT your raison d'etre? You see this is it, the three of them have proven they have nothing worth having, and this story, unless it involves somebody small, smart and scary (like google) is just a complete non-event for all of us. Although I think it would be interesting to stack up News Corps other online holdings against this deal. Haven't they already bought Myspace. Oh, yeah....
No Mate, It's the BBC's fault here. I've just changed ISP in the UK, and I had to look long and hard to find a provider that gave good service. Most ISP's in the UK are bucket-shops, offering insanely cheap broadband, but with the very clear T&C that they nearly ALL have small monthly bandwidth limits. ALL of them, more or less. The amount of people in the UK who don't understand anything about this is obviously in the millions, and until iPlayer turned up, nearly none of them were involved in p2p networks, none of them!
/. when it was released, but that was all discussing the question of DRM. I had no bloody idea it was a p2p client! None! And I'm not bad with this stuff, I'm a torrent - fricking - master otherwise. I only found out about it when my wife read out that iPlayer is in this weeks "What's Not Hot!" list in the Sunday Times style supplement, because "It clogs up your Internet connection."
Now, thanks to the Beeb, there are suddenly millions of grannies / football fans / Little Britainers who have no idea that their broadband connection is calmly sitting there chewing up all of their (typically miniscule) bandwidth allowance. A month later, their Broadband bill arrives, and it's tripled. Did the ISP warn them about their bandwidth? Yes! Does the beeb warn you when you install IPlayer? No!
I mean, I uninstalled it yesterday, mainly because I just didn't like it sitting there eating resources. In the space of a month I downloaded one episode of Mitchell & Web, and didn't bother watching it. I cannot remember IPlayer making it clear that the software would sit there eating bandwidth willy nilly during the install. I read all the bad press about Iplayer on
Now, I can't see why the ISP's would complain, they get to legitimately charge their punters penalty fees that are worth a bomb cumulatively.
Also, the BBC stink, they used to be the best tv company in the world, but are now groaning, zombie like with no talent analysts and and marteting scum. The four beeb channels in the UK are running endless little blips after programmes, reminding everyone out there that they can use iPlayer now. And I have heard the biggest Radio DJ in the UK (Chris Moyles, who is wierdly an odious sack of flatulent vomit) and he was ejaculating that he'd missed a favourite show but he "caught it on the iPlayer" really mate? And what corporate quota did you meet by spinning that little advert, you lying Jabba Shaped chew toy?
No, the beeb have released a dog in iPlayer, an absolute dog, and the word is out among the semi-hip that there is no good reason for having it installed on your system. The BBC should, really really should, stick to their threat and print warnings or disclaimers saying that you may not be able to afford to run their silly little app on certain connections, because in the UK, the list would be longer than every MS EULA ever stapled together, and it would include pretty much every broadband service on the island, because that is the model in play and you better believe the beeb have some responsibility for understanding that and launching THEIR product with that and their licence fee paying public in mind.
BBC, you listening? Don't get ahead of yourselves. Without Dr Who you are the 21st centuries ITV waiting to happen. Take the licence fee millions you get from every adult in Britain, and invest it in the cultural enrichment of what is now a bitter, prostituted, soulless glob of a country, not some half-baked nu-media nonsense like this...
Interesting discussion, thanks for all the comments. I'd like to give Kubuntu a whirl soon enough. I still think there is room for one major Linux distro to take chunks from MS's desktop monopoly, and based on what I've seen it would be Debian based, and have Gnome as the front end. I'm basing that on there being more software native to Gnome than KDE, and all the other stuff I've mentioned above. I've googled (not very hard) but I haven't found any useful info out there about running Gnome apps on KDE and vice versa, I'm guessing it's not advisable, if not impossible? Freedom for the MASSES.
Mmmm... Choice is good, for people of a certain technical ability, but I want Linux to break through on the desktop, so I don't have to use Windows any more, and you have to admit that the introduction of so many choices of Vista (what was it 7?) was one of the key reasons people did not upgrade. Linux is being hurt badly by this business of two main desktop flavours. Looking on from the outside, it bothers me immensely. I'm ignorant, but again that's the point. If there is any uncertainty about GUI based apps on Linux being able to run on the desktop each and every time, as they do with Mac and Windows, then it holds back adoption. There is not a standard for the Linux desktop, and that's terrible. The question of which is the better GUI is almost academic. And Gnome, for a desktop which is just being polished, blows Vista out of the water in terms of user experience and sophistication, KDE is richer, but it doesn't need to be. All we need is something that takes away MS market share, and Gnome is capable of that. I showed Gnome to my wife a few months ago, and her response was a very genuine "wow!", and this is someone who isn't normally impressed by IT in any form. I appreciate your comments, but I have to re-iterate, KDE, installed during install, made Linux unusable for me each time. Gnome and Ubuntu is the first Linux distro I've used regularly for more than a fortnight. I'm keen to give KDE another try, because it looks amazing but I'm worried it will be bad again. The most important feature of a UI is that it does everything it can to not get in your way surely?
It's bad because Microsoft will now clearly not be using the better ODF within Office, which would have given users the choice to move away from Office for their productivity suites to other suites, based upon their needs. It means that a billion odd business users will be strapped to Office whether they like it or not, because OOXML is a losing proposition for anyone else to implement, based upon it's complexity and use of proprietary MS technology. Seriously, mate, it took a while for this to sink in with me as well, but it will, and you're going to be pretty angry about this soon enough, believe me. Just read all the other comments. I was really looking forward to April Fools Day on Slashdot this year, for some OMGPonies fun, and this has been the most sobering and depressing news. A compete slap in the face...
OH, BTW, I know RPM is in no way part of KDE, so don't bother pointing that one out. Just thought I'd take a sideswipe at RPM too while I was at the keyboard.
As a Windows gimp, I have been trying to install and use Linux for ten years. I always used KDE and it was always the same two things that killed it as an experience for me:
1. RPM (What is up with that, way to go to differentiate your product for Enterprise, make all software pretty much uninstallable and unmanageable)
2. KDE, I installed it each time, and each time, the desktop was great for a day, then slipped irreversibly into a quagmire of wierd bugs, or horrible configurations I couldn't rescue.
OK, I'm noob. But that's my point. Ever since I first installed Ubuntu a year ago, I have been thrilled by the stability of the Gnome Desktop, and the reliability of apt-get. There is no comparison.
I'm really stoked about what has happened with KDE4, but I'm also depressed, it's just more of the same, it's a UI that is virtually promising that it will be horribly unstable, on account of it's bleeding edge. I wish KDE would just get out of the marketplace altogether, and stop scaring people away from Linux, which is, from my experience, exactly what they have been doing for years now.
Isn't this how things are done in Radio, more or less? It's all out in the open. The music, and it's success is tracked, so the artists get a fair proportion of whetever revenues are generated by their songs. The ISP's pay the recording artists (or more specifically their robot overlord management) for the provision of the indexed catalogue of media, and you and I download songs, non-DRM'ed at a whim. I Love it, provided the cost is nominal.
The big difference is, radio does songs, and that's it, the Internet does video too, and does it well, so any effort would have to be undertaken across the arts, not just music.
Seriously, for my money, this is the best idea ever. Advertising is an absolute fact of life in the modern, capitalist world. And we know, because WE forced their hand on this, and away from DRM, by being very demanding consumers, who are always one step ahead of them, WE KNOW, that if they screw it up, we'll just start hacking the system until it works.
Count me in, as a long-standing conmsumer of the BBC's television, this can work.
I thought the same, but there is a school of thought, backed up historically, that any kind of government sanction, expenditure, funding and protection of science is worthless, and that the real great leaps forward in science (Industrial revolution, rennaisance) took place at a time when it was absent. I don't want to put on my laissez faire capitalist hat here, but you only have to look at what is happening in the area of patents lately, to wonder what good the policing and management of science serves. And MIT must get nearly all their money from the private sector, like a good many universities surely. Should government be involved at all? For me, all I want is for them to make sure my bins get emptied, the streets are lit, and there are emergency services and schools etc. And also, that they are able to rain clinical death on anyone who disagrees with us... :-)
Yep, tfa is focused on trojans and phishing, which have had a great year, both in increased sophistication and effectiveness. However, I suspect that a fairly large number of these SARs would be from people who have purposely infected their systems / defrauded themselves to get money. I wonder how easy would this be? You'd need to have an extra account to which you cannot be tied, or an accomplice in a different country... Fact is, most people expect to be re-imbursed by their banks when their account is defrauded, provided the bank cant prove complicity, and what bank is going to spend timely expert resources on uncovering a 25,000 fraud. Provided the numbers stay low (compared to mortgages and cheque fraud they are a drop in the ocean) then the banks wont aggressively investigate. When the numbers get high, I imagine they will get a few instances in the press where they successfully identify complicity on the part of the account holder, and use this to justify a change in terms and conditions on their accounts which will shift the responsibility massively on to the customer. What I don't see is them investing more in security (bar a bit more 2 factor auth when it gets dirt cheap)
Mate, You have just gone so far off topic, you've done a slingshot around the sun, and have returned in a parallel discussion about wanking for coins. I'll applaud you for one thing, passion counts. And on the topic of redundant skills: There are no redundant skills, not really, what is really redundant and dead scary, is any computer book over five years old that doesn't deal in pure theory.
I'm torn here. Should I be happy I can now install and activate the ISO of Ultimate I've had for the last six months, or be sad that Microsoft haven't played their usual PR ace and made about a quarter of a million legit systems go 640 x 480 x 16 colours?