The solution is not to have satellite TV -- it is an inherently flawed business model. True, it is great for people in remote areas where cable TV is difficult to subscribe to, but that in and of itself does not justify satellite TV, and it certainly does not justify the government propping up an inherently flawed business plan. People in remote areas should just deal with broadcast TV -- digital broadcasts can fill the gap left by satellite TV, and broadcast TV is much cheaper to implement.
Of course, that would mean losing a multi-million dollar business (albeit one that was artificially propped up from its inception), and it would mean that people in remote areas would have to go back to accepting that the nature of being in a remote area is decreased access to the forms of entertainment that are available in less remote regions.
You are supposed to be outraged because this is the government propping up bad security tactics to help a greedy corporation. Reverse engineering was once legal, so long as you were not violating anyone's patent; security through obscurity is a massive fail when millions of people have access to the system, unless you make it illegal to reverse engineer. So what did our government do? They declared, "you can reverse engineer, but you cannot let anyone know what you discovered, because it might be used to break the system, since the security of the system depends on more than the security of the keys).
Basically, the DMCA is meant to create a legal override to the classic problem of an secure device in an insecure environment. You cannot put the entire security system into the hands of someone who wants to break the security, and expect them not to break the security; the DMCA is meant to allow you to throw people in jail for exploiting this basic facet of security engineering. It is US tax dollars being spent to prop up a flawed business strategy.
Security through obscurity always fails, even on embedded systems. If satellite TV companies want to use crypto, they should start buying hardware crypto modules, not resorting to legal threats against people who crack their poor security tactics. Perhaps the boxes will be more expensive, but these guys are going around claiming that they are losing a lot of money to satellite TV cracking, so a decent security system should pay for itself (which speaks to why these companies should not be believed -- and begs the question of why our government is helping them).
Also, not to nitpick, but ElGamal is based on the discrete logarithm problem, not the factoring problem.
A mathematical theorem that combines several lemmas in a non-obvious and novel way is still not patentable. Combinations of abstract mathematical concepts leave you with another abstract mathematical concept -- a combination of algorithms is no less abstract or mathematical than a single algorithm.
I do not think it is too weak in the case of a celebrity. Celebrities constantly have to worry about the press spying on their private lives; that is the nature of being a celebrity. If they do not draw their curtains when they do something private, a photographer with a long-distance lens will be able to record it; likewise, if they do not change their voicemail password, a reporter with a telephone will record their voicemails.
According to the media, you are a hacker if you are even aware that default passwords can be used to bypass a security system. You are a hacker if you are capable of doing anything with a computer without a big corporation babying you along.
The media has no clue about hackers. The New York Times is the same paper that has articles about "cool new software" to do things like digital post-it notes -- in the year 2009. Do you really expect them to differentiate between hacking and simply using a default password?
Your assumption is that everyone will suddenly have an HTML5 compliant browser. Just because something is standardized does not mean that it will suddenly be widely used -- I would not be surprised if it took 10 years before HTML5 worked reliably across all browsers.
Applets certainly do have strength. Applets can guarantee a consistent experience for your users (and you can always point the blame at third party runtimes if they cause a problem). Applets can be signed when users want a higher level of security. Applets add support for unusual codecs or features that are not envisioned by a standards committee (features that can be implemented by a web developer instead if a browser developer).
Oh it will still be worth winning. Even if HTML5 provides a "rich web experience," applet based approaches like Flash are already very well established and will not go away overnight. The desktop application market never vanished even after web apps became popular, so why assume that plugins and applets will not be worth fighting for?
Security Engineering: A Guide to Building Distributed Systems by Ross Anderson. It is actually an enjoyable textbook to read, and Anderson provides many insights into security that are easy to overlook, miss, or are highly counter-intuitive.
This seems to be common on commuter railroads and subways. In New York City, the MTA has an entire "discipline department," whose job is the creation and enforcement of rules -- the rulebook is as thick as several of my engineering textbooks stacked on top of each other, and concerns everything from legitimate safety issues (employees cannot be intoxicated while on the job) to absurdities (procedures and times allotted for bathroom breaks, approved travel times when summoned for random drug tests, approved procedures for filing reports on infractions committed by other employees, etc.). It is also impossible for an employee to break any single rule, as one of the rules is "employees shall follow all the rules" and another is "employees shall be aware of all the rules." I am told that a typical disciplinary hearing involves 4-6 infractions, each of which is listed separately in the employee's work history if they are found to be in violation of the rules.
Seriously, why are people so paranoid about the formula for these things? Most nerve gases are very similar to industrial pesticides (in fact, VX gas was originally intended to be a pesticide), and if we kept the knowledge of how to synthesize nerve agents top secret then we could not educate chemists or chemical engineers.
The fact of the matter is that in a free society, information should flow freely. Wikileaks is not posting the personal information of the average citizen, they are posting information about the misconduct of governments, government officials, and corporations -- information which the average citizen has a right to know. There is a huge difference between a defense contractor conspiring with a national government to start a war and some guy who is having an affair with his neighbor's wife.
"No, the fact of the matter is that open standards and this anti-commercialism that you speak of is really just a geeks way of saying that they are self indulgent and want to create for themselves."
No, it is our way of saying that we are tired of being made into cash cows, and even more to the point, tired of being called communists, criminals, and terrorists just because we have a decent understanding of how computers work. We are sick of living in a society where everyone is trying to monetize everything -- now they even want to monetize our friendships with other people.
"It's the guys at Microsoft and Apple that have to sweat deadlines, do focus groups, sift through the complaints of millions of users, the genuinely work for everyone else. They get paid for it."
I am a Fedora contributor, and yet I get complains from Ubuntu, Debian, and Gentoo users all the time. Millions of bugzilla entries have been filed in various open source projects over the past year. The Fedora development list receives hundreds of messages a day discussing how to solve end user problems. We are not getting paid for it, but we still do it.
"Windows is for the people that use it. Mac is for the people that use it. But, Linux is for the people that write it."
No, Windows is for Microsoft and their investors. Mac is for Apple their investors. The fact that they have users is secondary to the fact that they can turn a profit. Linux is for anyone who wants it, for whatever they want to do with it. That is why we give it away, and grant everyone the right to use, study, modify, and share it.
"You can rip me all you want, but just look at all the project managers of various Linux things, and their postings, and the things that strike you is that they are all about 'me' first."
That would explain why the swfdec developers were so busy getting Youtube to work correctly with swfdec back when Torvalds sent them a message about how his wife was having trouble. That would explain why the Fedora developers took the time to create graphical configuration utilities even though we could configure our systems using ed as a text editor. That would explain why the Ubuntu developers bothered with creating an easy to use system. Yes, you certainly know what you are talking about.
"Stallman, Torvalds, etc, are all pretty self-centered people. Me. Me. Me."
Oh yes, that is why Torvalds had it out with Stallman over whether or not it is better for Linux users to deal with GPLv2 or GPLv3.
"This solution is evil, that technology is terrible."
Which is why the NSA uses it for mission critical systems.
"Everything to them is black and white."
Which is exactly why Stallman admitted that not everyone is going to take free software to the extreme that he takes it, and why Torvalds rejected GPLv3 for Linux because he wanted to leave open the option of using Linux for TiVo and similarly locked-down platforms. Yup, real black and white there.
"If you people actually paid for stuff, you might have an economy."
Yes, because America's economy is doing so well, and it is because we pay for things like the birthday song. Yeah, the reason the third world is so poor is that they are busy sharing books and music instead of paying for individual copies. You should probably go ahead and apply to be chairman of the world bank, since you seem to have all the answers for the world's economic problems.
You would still turn a profit even if you were using an open standard. You would just have to charge for things like printed copies -- I paid for a printed copy of a book recently, simply because a printed copy is easier to read than a digitized copy. No need for batteries, charges, or whatnot -- just an easy way to access information.
Seriously, why are you so worried about people who trade files? This is a minority of people, and they are probably people who would not have purchased your book anyway, had the content not been available on some file sharing network. Seriously, the publishing industry is not threatened by people downloading books, it is threatened by people not bothering to read in the first place.
I live in New York City; a nice hike or picnic in a public park is not an escape from advertising, although the ads tend to be less annoying -- more of the billboard or posted variety. I guess things are different in suburban and rural areas?
I did not realize that YouTube and Hulu count as "DRM free." There is no "obvious" way to download the videos (last I checked) and the ToS forbids any attempt to download the video. It is not DRM of the form that Apple uses, but it is most certainly still a digital restriction on your use of the video, and it still prevents you from viewing the video in the event that YouTube or Hulu go out of business.
"I wouldn't mind a tasteful, text-only add in its own table that doesn't interrupt the flow of the text I'm reading."
I would. Books are the last advertisement-free stronghold, the last place we can turn for entertainment that does not come loaded with advertisements. There is no possible way to place a tasteful ad in a book, and the concept should be immediately dropped. Honestly, how greedy can these publishers get?
I will not buy a single book from any publisher that engages in this practice (unless it is a used copy without ads).
"one can not expect Microsoft to distribute drivers for every device on Earth."
Sure they can. They expect us in the Linux world to do that. They also expect us to ship support for every video format in the world, and to magically support every program written for any platform, etc. Why put those demands on Linux if it is not fair to make similar demands out of Windows? "Linux doesn't support this," "Linux doesn't support that." "You cannot expect Windows to support this or that."
I know people who sometimes engage in that. Some people enjoy that sort of thing. As long as they are not going out and actually raping people, it is really not a problem. Are we now going to declare it to be illegal to role play certain sexual acts? Bestiality is also illegal, but there are plenty of people who engage in "pony play" -- is that going to be made illegal in porn as well?
Before you go ahead and note that nobody is trying to invade the bedroom here...keep in mind that these pornos were not being publicly displayed. They were privately distributed to private households for personal, private use.
This is an attack on key schedules; the key schedule of AES-128 is different from that of AES-192 and AES-256, thus rendering it impervious to this particular attack. As the authors note, this sheds new light on key schedule design, much in the same way that differential cryptanalysis shed light on S-box design.
Slashdot Mirror
The solution is not to have satellite TV -- it is an inherently flawed business model. True, it is great for people in remote areas where cable TV is difficult to subscribe to, but that in and of itself does not justify satellite TV, and it certainly does not justify the government propping up an inherently flawed business plan. People in remote areas should just deal with broadcast TV -- digital broadcasts can fill the gap left by satellite TV, and broadcast TV is much cheaper to implement.
Of course, that would mean losing a multi-million dollar business (albeit one that was artificially propped up from its inception), and it would mean that people in remote areas would have to go back to accepting that the nature of being in a remote area is decreased access to the forms of entertainment that are available in less remote regions.
You are supposed to be outraged because this is the government propping up bad security tactics to help a greedy corporation. Reverse engineering was once legal, so long as you were not violating anyone's patent; security through obscurity is a massive fail when millions of people have access to the system, unless you make it illegal to reverse engineer. So what did our government do? They declared, "you can reverse engineer, but you cannot let anyone know what you discovered, because it might be used to break the system, since the security of the system depends on more than the security of the keys).
Basically, the DMCA is meant to create a legal override to the classic problem of an secure device in an insecure environment. You cannot put the entire security system into the hands of someone who wants to break the security, and expect them not to break the security; the DMCA is meant to allow you to throw people in jail for exploiting this basic facet of security engineering. It is US tax dollars being spent to prop up a flawed business strategy.
Security through obscurity always fails, even on embedded systems. If satellite TV companies want to use crypto, they should start buying hardware crypto modules, not resorting to legal threats against people who crack their poor security tactics. Perhaps the boxes will be more expensive, but these guys are going around claiming that they are losing a lot of money to satellite TV cracking, so a decent security system should pay for itself (which speaks to why these companies should not be believed -- and begs the question of why our government is helping them).
Also, not to nitpick, but ElGamal is based on the discrete logarithm problem, not the factoring problem.
A mathematical theorem that combines several lemmas in a non-obvious and novel way is still not patentable. Combinations of abstract mathematical concepts leave you with another abstract mathematical concept -- a combination of algorithms is no less abstract or mathematical than a single algorithm.
I do not think it is too weak in the case of a celebrity. Celebrities constantly have to worry about the press spying on their private lives; that is the nature of being a celebrity. If they do not draw their curtains when they do something private, a photographer with a long-distance lens will be able to record it; likewise, if they do not change their voicemail password, a reporter with a telephone will record their voicemails.
What, exactly, was stolen in this case? Perhaps a better analogy would be, "If you do not draw the curtains, everyone will see what you are doing."
According to the media, you are a hacker if you are even aware that default passwords can be used to bypass a security system. You are a hacker if you are capable of doing anything with a computer without a big corporation babying you along.
The media has no clue about hackers. The New York Times is the same paper that has articles about "cool new software" to do things like digital post-it notes -- in the year 2009. Do you really expect them to differentiate between hacking and simply using a default password?
Your assumption is that everyone will suddenly have an HTML5 compliant browser. Just because something is standardized does not mean that it will suddenly be widely used -- I would not be surprised if it took 10 years before HTML5 worked reliably across all browsers.
Applets certainly do have strength. Applets can guarantee a consistent experience for your users (and you can always point the blame at third party runtimes if they cause a problem). Applets can be signed when users want a higher level of security. Applets add support for unusual codecs or features that are not envisioned by a standards committee (features that can be implemented by a web developer instead if a browser developer).
s/addition/edition/
I agree, although the first addition is free (in all sense of the term) on Anderson's website.
Oh it will still be worth winning. Even if HTML5 provides a "rich web experience," applet based approaches like Flash are already very well established and will not go away overnight. The desktop application market never vanished even after web apps became popular, so why assume that plugins and applets will not be worth fighting for?
Security Engineering: A Guide to Building Distributed Systems by Ross Anderson. It is actually an enjoyable textbook to read, and Anderson provides many insights into security that are easy to overlook, miss, or are highly counter-intuitive.
This seems to be common on commuter railroads and subways. In New York City, the MTA has an entire "discipline department," whose job is the creation and enforcement of rules -- the rulebook is as thick as several of my engineering textbooks stacked on top of each other, and concerns everything from legitimate safety issues (employees cannot be intoxicated while on the job) to absurdities (procedures and times allotted for bathroom breaks, approved travel times when summoned for random drug tests, approved procedures for filing reports on infractions committed by other employees, etc.). It is also impossible for an employee to break any single rule, as one of the rules is "employees shall follow all the rules" and another is "employees shall be aware of all the rules." I am told that a typical disciplinary hearing involves 4-6 infractions, each of which is listed separately in the employee's work history if they are found to be in violation of the rules.
"How about detailed descriptions of the making and distribution of nerve gas in a military manner?"
http://en.wikipedia.org/wiki/VX_gas#Synthesis
Seriously, why are people so paranoid about the formula for these things? Most nerve gases are very similar to industrial pesticides (in fact, VX gas was originally intended to be a pesticide), and if we kept the knowledge of how to synthesize nerve agents top secret then we could not educate chemists or chemical engineers.
The fact of the matter is that in a free society, information should flow freely. Wikileaks is not posting the personal information of the average citizen, they are posting information about the misconduct of governments, government officials, and corporations -- information which the average citizen has a right to know. There is a huge difference between a defense contractor conspiring with a national government to start a war and some guy who is having an affair with his neighbor's wife.
"No, the fact of the matter is that open standards and this anti-commercialism that you speak of is really just a geeks way of saying that they are self indulgent and want to create for themselves."
No, it is our way of saying that we are tired of being made into cash cows, and even more to the point, tired of being called communists, criminals, and terrorists just because we have a decent understanding of how computers work. We are sick of living in a society where everyone is trying to monetize everything -- now they even want to monetize our friendships with other people.
"It's the guys at Microsoft and Apple that have to sweat deadlines, do focus groups, sift through the complaints of millions of users, the genuinely work for everyone else. They get paid for it."
I am a Fedora contributor, and yet I get complains from Ubuntu, Debian, and Gentoo users all the time. Millions of bugzilla entries have been filed in various open source projects over the past year. The Fedora development list receives hundreds of messages a day discussing how to solve end user problems. We are not getting paid for it, but we still do it.
"Windows is for the people that use it. Mac is for the people that use it. But, Linux is for the people that write it."
No, Windows is for Microsoft and their investors. Mac is for Apple their investors. The fact that they have users is secondary to the fact that they can turn a profit. Linux is for anyone who wants it, for whatever they want to do with it. That is why we give it away, and grant everyone the right to use, study, modify, and share it.
"You can rip me all you want, but just look at all the project managers of various Linux things, and their postings, and the things that strike you is that they are all about 'me' first."
That would explain why the swfdec developers were so busy getting Youtube to work correctly with swfdec back when Torvalds sent them a message about how his wife was having trouble. That would explain why the Fedora developers took the time to create graphical configuration utilities even though we could configure our systems using ed as a text editor. That would explain why the Ubuntu developers bothered with creating an easy to use system. Yes, you certainly know what you are talking about.
"Stallman, Torvalds, etc, are all pretty self-centered people. Me. Me. Me."
Oh yes, that is why Torvalds had it out with Stallman over whether or not it is better for Linux users to deal with GPLv2 or GPLv3.
"This solution is evil, that technology is terrible."
Which is why the NSA uses it for mission critical systems.
"Everything to them is black and white."
Which is exactly why Stallman admitted that not everyone is going to take free software to the extreme that he takes it, and why Torvalds rejected GPLv3 for Linux because he wanted to leave open the option of using Linux for TiVo and similarly locked-down platforms. Yup, real black and white there.
"If you people actually paid for stuff, you might have an economy."
Yes, because America's economy is doing so well, and it is because we pay for things like the birthday song. Yeah, the reason the third world is so poor is that they are busy sharing books and music instead of paying for individual copies. You should probably go ahead and apply to be chairman of the world bank, since you seem to have all the answers for the world's economic problems.
You would still turn a profit even if you were using an open standard. You would just have to charge for things like printed copies -- I paid for a printed copy of a book recently, simply because a printed copy is easier to read than a digitized copy. No need for batteries, charges, or whatnot -- just an easy way to access information.
Seriously, why are you so worried about people who trade files? This is a minority of people, and they are probably people who would not have purchased your book anyway, had the content not been available on some file sharing network. Seriously, the publishing industry is not threatened by people downloading books, it is threatened by people not bothering to read in the first place.
People have found ways to crack other DRM systems...
I live in New York City; a nice hike or picnic in a public park is not an escape from advertising, although the ads tend to be less annoying -- more of the billboard or posted variety. I guess things are different in suburban and rural areas?
I did not realize that YouTube and Hulu count as "DRM free." There is no "obvious" way to download the videos (last I checked) and the ToS forbids any attempt to download the video. It is not DRM of the form that Apple uses, but it is most certainly still a digital restriction on your use of the video, and it still prevents you from viewing the video in the event that YouTube or Hulu go out of business.
"I wouldn't mind a tasteful, text-only add in its own table that doesn't interrupt the flow of the text I'm reading."
I would. Books are the last advertisement-free stronghold, the last place we can turn for entertainment that does not come loaded with advertisements. There is no possible way to place a tasteful ad in a book, and the concept should be immediately dropped. Honestly, how greedy can these publishers get?
I will not buy a single book from any publisher that engages in this practice (unless it is a used copy without ads).
"one can not expect Microsoft to distribute drivers for every device on Earth."
Sure they can. They expect us in the Linux world to do that. They also expect us to ship support for every video format in the world, and to magically support every program written for any platform, etc. Why put those demands on Linux if it is not fair to make similar demands out of Windows? "Linux doesn't support this," "Linux doesn't support that." "You cannot expect Windows to support this or that."
I know people who sometimes engage in that. Some people enjoy that sort of thing. As long as they are not going out and actually raping people, it is really not a problem. Are we now going to declare it to be illegal to role play certain sexual acts? Bestiality is also illegal, but there are plenty of people who engage in "pony play" -- is that going to be made illegal in porn as well?
Before you go ahead and note that nobody is trying to invade the bedroom here...keep in mind that these pornos were not being publicly displayed. They were privately distributed to private households for personal, private use.
This is an attack on key schedules; the key schedule of AES-128 is different from that of AES-192 and AES-256, thus rendering it impervious to this particular attack. As the authors note, this sheds new light on key schedule design, much in the same way that differential cryptanalysis shed light on S-box design.