Slashdot Mirror


User: Peter+Eckersley

Peter+Eckersley's activity in the archive.

Stories
0
Comments
165
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 165

  1. Re:I can summarize on EFF Launches New AI Progress Measurement Project (eff.org) · · Score: 2

    That was true in the past, but it just isn't true of the recent progress in machine learning. Take a look at the data we've collected on problems like visual question answering, reading comprehension or learning to play Atari just by watching the screen, and you'll see that progress is happening in domains that either lack rigid rules, or where the rigid rules are non-trivial to discover.

  2. Re:interesting on EFF Launches Panopticlick 2.0 (eff.org) · · Score: 3, Informative

    Well, our source code is available so you can check that we do not monitor what you do with your privacy :). But if you don't like Privacy Badger, try Disconnect, ublock, AdAway, AdBlock or Adblock Plus(though you'll need to manually subscribe to Easy Privacy for AB and ABP)!

  3. Re:doesn't work without javascript on EFF Launches Panopticlick 2.0 (eff.org) · · Score: 3, Informative

    Yes our simulation of third party tracking involves visiting three synthetic first party domains that share a third party tracker. That works if you have various types of blockers installed, or if JavaScript is disabled. But if you have a browser that both blocks JS and blocks redirects or blocks absolutely all loads of tracking domains (eg via an /etc/hosts blacklister like AdAway), the test won't work. Congratulations, you have pretty good protections in place :)

    We're going to provide a fingerprinting-only URL for Panopticlick 2 that works even for people with a NoScript + AdAway or NoScript + redirect blocking, will post a link on the site when it's ready.

  4. Re:Shared hosting... on Launching 2015: a New Certificate Authority To Encrypt the Entire Web · · Score: 1

    We'll try to give site operators a configurable choice of multiple solutions -- certificates with multiple Subject Alternative Names (SANs); per-site certificates deployed using Server Name Indication (SNI); IPv4 addresses per site if you have enough; or IPv6 addresses per site.

    All of these solutions have different problems and limitations:

    • If mutliple-SAN certs get too large, they cause performance problems, and some clients may not be able to handle them
    • SNI isn't supported by Safari and older IE on Windows XP, or more alarmingly by Android below 4.x
    • IPv4 addresses are scarce and costly
    • Many clients still can't route IPv6

      Sophisticated hosting platforms may want to use all of these methods in combination.

  5. Re:quick question on Launching 2015: a New Certificate Authority To Encrypt the Entire Web · · Score: 5, Informative

    Actually the US Department of Defense and dozens of other governments have their own CAs with which they could issue a certificate for your domain, if they wished to. Here's a map we made of them using our SSL Observatory datasets.

    Nonetheless we should be able to use publication mechanisms such as Certificate Transparency to ensure that any compromise or compulsion of the Let's Encrypt CA could be quickly detected.

  6. Re:does it keep track.. ? on EFF's HTTPS Everywhere Detects and Warns About Cryptographic Vulnerabilities · · Score: 5, Informative

    you know who's connected where?

    Great question. If you have Torbutton installed, the Decentralized SSL Observatory will use Tor to submit the certs via an anonymized HTTPS POST, and warnings (if there are any) are sent back through the Tor network in response.

    If you don't have Torbutton, you can still turn on the SSL Observatory, in which case the submission is direct. The server does not keep logs of which IPs certs are submitted from, though this is of course less secure than using Tor.

    Before you can turn the Observatory on, we have a UI that tries to explain all of this elegantly and succinctly, in language that even not-super-technical users can understand.

    The original design document is here: https://trac.torproject.org/projects/tor/wiki/doc/HTTPSEverywhere/SSLObservatorySubmission

  7. Re:I'm confused... on EFF Asks Verizon Whether Etisalat Deserves CA Trust · · Score: 1

    Is it possible for me to reject the Etisalat subCA cert without ever seeing it?

    With Chrome/IE/Safari on OS X and Windows only, there is a way to block the Etisalat subordinate CA certs. First you have to fetch a copy (see for instance this site). Note that the Etisalat cert is also labelled "Comtrust". Then export the cert. Then on Windows, reimport them into "untrustuted certificates" store. On OS X, import the cert using the Keychain Application into "My Certificates", and disable it.

  8. Re:Dictionary words make bad project names on EFF Releases Tool For Testing ISP Interference · · Score: 1

    It is often a bad idea to select a project name that is a common dictionary word. It makes the project almost ungooglable and also dilutes the original meaning of the name -- I wonder if the nation of Switzerland wants to be associated with this piece of software. The global English dictionary namespace isn't running out yet, so we don't need to start reusing words.

    Yes, this is a fair point and we talked about changing the name before launch for this reason. But despite a lot of brainstorming, we couldn't think of a better name. If you want to search for Switzerland, add a word like "eff" or "isp" or "packet" or "network" to your google search. Maybe if we're successful enough we'll end up on the first page of results for a simple "switzerland" search at some point.

  9. Re:Barrier to Ownership on Blu-ray BD+ Cracked · · Score: 1
    Now that that's been handled, looks like it's time to start shopping for a BD player.


    This crack is at best temporary. AACS and BD+ are renewable DRM schemes and future discs will make existing techniques for backup, playback with free software, and format conversion obsolete at least once every few months. Sadly, consumers would be better off avoiding high definition discs altogether.

  10. Re:Archaic Cable shared node topology is to blame on Comcast Continues to Block Peer to Peer Traffic · · Score: 1
    Oh, I see what you're saying. There's no problem with inbound SYNs, of course, because a calculated proportion of those can be dropped before they get to the collision domain if there are too many of them arriving per second. But too many outbound SYNs per second is bad, because they fill up the DOCSIS contention-based upstream request-to-send channel and there's no way to drop them in time.

    But it isn't clear that Comcast's actions are going to decrease the number of outbound SYNs. Consider gnutella, for instance. When gnutella nodes start up, they send in the order of 10 SYNs per second looking for other gnutella peers to establish connections with. Once they have a certain number of healthy connections, they stop searching for new peers.

    Comcast jams some of these connection establishment attempts (the inbound ones, which on a large scale amounts to about half of gnutella's connection attempts and results in certain odd partitionings of the gnutella network). One of the effects of this intervention is to prolong the period during which a newly launched gnutella client is going to be sending lots of outbound SYNs. So at least when it comes to gnutella, Comcast's actions may actually produce more of the one kind of traffic that they can't sensibly shape.

    In any case, as we've been saying, if there is really a specific DOCSIS related technical problem that is motivating Comcast's actions, they need to come out and explain it. That way, the community can verify whether their reasoning holds water. If the problem were really related to outbound SYNs, Comcast and/or P2P protocol designers could propose a standardised notification mechanism for controlling outbound SYN transmission rates. P2P devs would have plenty of incentives to implement it, if the alternative is having forged RSTs injected into their traffic.

    One could just as easily speculate that Comcast has tried several other options, and Sandvine's product, bugs and all, has turned out to be the best solution yet. That is also possible, especially for some definitions of "best solution" that discount the interests of some users and of developers working on innovative protocols. But we've never seen, or heard any reports of, Comcast performing any dynamic rate limiting, which at least makes that theory less likely.
  11. Re:Archaic Cable shared node topology is to blame on Comcast Continues to Block Peer to Peer Traffic · · Score: 1

    Hi toadlife,

    we are aware of Richard Bennett's theories about why Comcast is doing this. As we said in our report, it's true that there are lots of problems with the DOCSIS cable modem protocol, and they certainly make congestion from P2P traffic worse for Comcast.

    Bennett has some interesting theories, but none of them convinced us that Comcast's RST forgery would prevent congestion problems where dynamic traffic shaping couldn't. It's more likely that Comcast just bought this product from Sandvine without having examined its necessity carefully from an engineering perspective. The blocking of Lotus Notes, Windows Remote Desktop, and the strange impact on the Gnutella network all point in this direction.

  12. Re:Do not rely on the current version!!! on Privatunes Anonymizes iTunes Plus · · Score: 1

    Ooops... when I said chtb, I meant stco.

  13. Re:Do not rely on the current version!!! on Privatunes Anonymizes iTunes Plus · · Score: 1

    One other small point...

    Privatunes overwrites the name and email fields using blank space characters (0x20), but the field that contains the name is 0x00s. So it's still possible to see the length of the name and email fields.

    I don't think they'll be able to fix the email length leak without re-calculating the offsets in the chtb table.

  14. Do not rely on the current version!!! on Privatunes Anonymizes iTunes Plus · · Score: 3, Informative

    The current version of Privatunes blanks out the name and Apple ID/email fields from iTunes Plus files, but it doesn't remove all of the fields that Apple, or a litigant subpoenaing Apple, could use to identify a user. There are two of those, marked sign and chtb, which I posted about here.

    There are some other differences between copies of a track purchased by different users, but they're only a byte or three here and there. Probably still worth blanking. vbindiff on *nix (or a similar hexdiff program for other platforms) will show you these fields.

  15. Re:I've got it made on Don't Google "How To Commit Murder" Before Killing · · Score: 1

    According to the article, they got the search results from her computer. Not Google nor MSN.

    Well, that's the easier way to do it if they're there (as URLs in a browser history). If not, they can get them from Google or MSN by subpoena. It's quite hard to prevent your search engine from having these records, though we've produced a guide at EFF explaining how to do it.

  16. Re:*CLICK* on Male Blood Elves Get Pumped Up · · Score: 1
    This post (and the others I have seen complaining about it) just came off as silly. I decided to poke around and found some screen caps of old vs new and the new basicly just looks like a Night Elf male body. This isn't a "bad" thing. This is a "so friken what" thing.


    Actually, I thought these complaints (and your dismissive response to them) were pretty interesting. But I'm not a gamer.

  17. Re:I somehow doubt it on Root Exploit For NVIDIA Closed-Source Linux Driver · · Score: 1

    If you gross misconception of economics was taught to you by your ECON 101 teacher, he/she should be fired! It is a poor and amateur model of economics that cannot account for charity, donations, bequeaths, and other forms of giving/sharing.

    Of course there are economic models that can account for these behaviours. They tend not to be econ 101 though. The mathematics gets fairly complicated long before the models start to take on the complexity of real life...

  18. Re:Really questioning my libertarian streak nowada on Big Tobacco Funded Anti-Global Warming Messages · · Score: 1

    We also hold that because human beings are imperfect, we really can't trust anyone to tell us what to do.

    But if you thought about the first post in this thread, you'd realise it was discussing a specific kind of imperfection: the fact that, as we walk down a supermarket aisle, we are incapable of discerning important underlying properties of the things we might buy. Most people buy Phillip Morris food products without realising that they are paying for environmental astroturf.

    This specific kind of imperfection requires collective action to solve. Voluntary "ethical labelling" is pretty ineffective, because it is easy for firms to invent easy-to-obtain certifications of environmental- or health-friendliness or decent labour conditions.

    The collectivist solution is to prohibit products with dubious environmental, health or labour credentials. An intermediate solution is to use mandatory labelling requirements. It's hard to get those solutions right, but they're still far better than any liberatrian options.

  19. Public funding! on A Working Economy Without DRM? · · Score: 1

    Having written a PhD thesis on the subject, my conlcusion was: use public funding. Collect levies on blank media/internet connections, or just plain old income tax, or some combination of the two. Pay it out to authors/artists/web publishers according to the amount of use that their works get. Do not give the government any control over this process: run it like a big online election.

    Other solutions which people have discussed, such as getting people to pay in advance, don't work very well.

  20. Re:Conspiracy theory on Air Marshals Place Innocents on Secret Watch List · · Score: 1

    I suspect that there are those in the government (probably career military or intelligence) that really wants to see an Executive dictatorship arise in this country.

    If you believe the investigative reporting in the New Yorker, it's civilians in the administration who are driving the campaign. Lots of them cut their teeth in the Nixon administration and are still pissed off about the restraints that Congress imposed on the Executive back then. It sounds surreal to me, but that's what the New Yorker has been printing. The military and intelligence people are freaked out by their extremism. The dispute over bunker-busting nukes was a nice illustration.

  21. Less drastic but equally effective on Republicans Defeat Net Neutrality Proposal · · Score: 1

    Just block all google access at Verizon's corporate headquaters. They'll need to pay a fee to have those services re-instated. I wonder how much google could charge?

  22. Re:That's a lot of nonsense on France Moving Forward on Legalized P2P · · Score: 1

    It's not clear that any VMRS could ever be efficient enough to interoperate with the creation of this kind of content without necessarily impeding it. I'm not sure it would be worth my trouble to register as an author for the kind of financial return a VMRS would offer to mere slashdot posters, unless it were necessary to keep Delilah from registering in my stead to game the system. I'd probably just exit the market instead.

    I agree that there are interesting kinds of material which couldn't/shouldn't be funded by a virtual market type system (or by ordinary markets either). Usually these things require much less concentrated effort than (say) writing a book or producing a Britney Spears track, so there may be little or no need for funding anyway. I'm not sure, to follow your example, whether it would be a good idea to pay people for posting slashdot replies. Even small payments could be bad :).

    Perhaps a good threshold way of dealing with this would be to say that, if web-only material is going to be registered, the poster and the site owner have to agree on it. So you could have slashdots with a policy of registering replies for remuneration, and slashdots that don't register. The lower-hassle non-registering sites might produce better results, so people end up reading those. Perhaps there'd also be some highly moderated, well researched discussion sites with professional participants.

    Demand does not always equal value, (2.A.1, pp96-97) unless defined as such. While I'm unable to offer an alternative, I think you underestimate the detrimental effect a VMRS might suffer from inappropriately compensating popular but not particularly valuable content. (think: kiddee porn.)

    That's exchange value; you're worried about ethical value and I agree there is difference. Extreme cases like child pornography are dealt with by making them illegal. In more moderate cases, I personally don't think this is enough of a problem to not fund copyright works, or even particular classes of works (like ordinary porn and/or/eg trashy pop music). However, I do think that a voting-type system could deal with these issues better than existing markets (see part III C 5 and especially pp 147--149 of the article).

    Additionally, there are vast classes of Internet traffic which should not be considered digital content artifacts (think routing table updates, ICMP queries, etc) and that which straddles the line (RTP snippets of a VoIP conversation, etc).

    But are you saying that there are so many people who use internet connections (maybe even just residential internet connections) for exclusively non-copyright-related purposes that the levy would be a net-negative for society? Note that the net social cost of taxing person A $100 and spending it to benefit person B is not fixed at $100; it would often be $5-20, though it could be over $100 if the money was wasted or negative if person B was poor and benefitted greatly (though dollars become a bad measure at that point).

    I do like your proposal of allowing consumers to "vote" their content preferences, but without further analysis, it seems impossibly flawed. I can provide further analysis to your email-address-of-record, if you'd like, but I believe it's beyond the scope for this thread.

    Sure! I'd like to hear what you have to say.

    Your point is taken. My point still stands. We may not like the current situation concerning copyright on the Internet, but (to the extent we live in a Democracy) we did create it, and if it's going to get changed, it's up to us to change it. The actions of such "pirates" serves to strengthen the position of the entrenched interests like the RIAA, and I find it difficult to view anyone acting in that manner as an ally.

    Your view of the democratic nature of western societies is more optimistic than mine. I know a bit about the political processes that lead to copyright laws being

  23. Re:That's a lot of nonsense on France Moving Forward on Legalized P2P · · Score: 1

    Damn trolls. Must not reply. Must not feed them. Must not reply. Replying...

    Like people who only use the Internet for email and instant messaging. For buying and selling on Ebay, or through other sites. For blogging. Or the proverbial Web-cam-to-the-grandkids. Or catching up on the news. Or discussing technology, cooking, politics, or shoelaces. Or software development.

    There's no reason why high quality blogs and news sources, or even political and cooking websites, shouldn't be funded under the same system, in proportion to the amount they get used/appreciated. Those services are just as vulnerable to the economic "free rider problem" that motivates copyright, as musicians or authors are. Software development is a hard case -- it'd be easy to fund proprietary software using some kind of levy, but it's hard to say who should get the money for a cool free software app.

    Or are you one of those (perhaps rightly called) pirates who only sees the Internet as your personal source for stolen music and movies. It might surprise you to learn it wasn't actually built for that reason.

    Actually, I prefer to think that the Internet might become the greatest public library that humans have ever built. And of course I'm a pirate. It's the only responsible thing to be. But it's not "stolen music". The idea that people are "stealing" music is RIAA propaganda. Stealing royalities, maybe, sometimes. But not music.

    There is no discussion of any mechanism to assess which works are being shared, assign popularity, allow artists to register, collect fees, etc. You're not thinking straight. You're just dreaming. Heck, you're not even dreaming straight.

    I don't know what the French are discussing, but read the link in my sig.

    USA_Uber_Hacker develops a new web app, publishes it under GPL.

    The French subsidiary (only one employee) of StolenSoftware, Inc strips the attribution and license language re-publishes it as Public Domain on p2p.

    StolenSoftware, Inc (Global) grabs the (now public domain) source, and off we go.


    That isn't how copyright law works. A blanket license or private copying exception in French law wouldn't put works in the public domain. Even if France did withdraw from the Berne Convention, TRIPs, etc and declare all such works to be in the public domain, it would have no effect on those works outside of France (exept possibly works by French authors -- it would depend on each country's law).

  24. Relationship between film cost and quality on France Moving Forward on Legalized P2P · · Score: 1

    Actually, I saw an interview in which Phillip Noyce said that it's much harder to make a good film when there is more money involved. His main claim was that the huge amount of financial risk involved makes investors averse to anything artistically adventurous. Maybe also that the logistic complexity of shooting expensive scenes can distract from the stuff that makes a film great (although I'm not sure if I'm recalling that second point correctly).

    The fact that cinema tickets are all essentially the same price also skews financial incentives towards "lowest common denomniator" markets. A carefully designed taxation-funded system that based remmuneration on how much people like a film after they saw it, could improve the situation for material that has a smaller but more appreciative audience.

  25. Re:Fee? on France Moving Forward on Legalized P2P · · Score: 2

    I get my music and movies for free right now. Why would anyone support this?

    Because they're one of the thousand-or-so Americans getting taken to the cleaners each month for file sharing? Or because they're in the huge percentage of the population who aren't computer literate enough to find a good new p2p app whenever the previous one they were using is sunk? Or because they're in the 10-20% who refuse to download stuff because they think it's immoral?

    So that you can have an index of high quality versions of files (perhaps something like AudioGalaxy was, perhaps something better) and not have to spend your time trying to recognise fakes? So you can find rare files faster from all those computer-illiterate users?

    Because if you like video clips or films or expensively produced audio, it's in your interest that there be incentives for people to invest cash in making the kinds of stuff that you like?

    Think, my boy! (I'm going to go out on a limb and assume that you're male).