Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…
John Naughton, *The Guardian*, Feb 21 2015 (via Dave Farber) The gap between the richly rewarded few of tech firms and banks and the rest of us is growing wider. Blame the digital revolution http://www.theguardian.com/commentisfree/2015/feb/22/google-tech-elite-living-in-a-parallel-universe-john-naughton Someone once observed that the difference between Tony Blair and Margaret Thatcher was that whereas Thatcher believed that she was always right, Blair believed not only that he was right but also that he was good. Visitors to the big technology companies in California come away with the feeling that they have been talking to tech-savvy analogues of Blair. They are fired with a zealous conviction that they are doing great stuff for the world, and proud of the fact that they work insanely hard in the furtherance of that goal. The fact that they are richly rewarded for their dedication is, one is given to believe, incidental. The guys (and they are mostly guys) who manage these good folk are properly respectful of their high-IQ charges. Chief among them is Eric Schmidt, the executive chairman of Google, and a man who takes his responsibilities seriously. So seriously, in fact, that he co-authored a book with his colleague Jonathan Rosenberg on the care and maintenance of these precious beings. Dr Schmidt objects to the demeaning term `knowledge workers' that economists have devised for them. Google employees, he tells us, are much, much more impressive than mere knowledge workers: they are `smart creatives'. In the opinion of their chairman, these Wunderkinder are very special indeed. They are “not averse to taking risks.'' Nor are they “punished or held back when those risky initiatives fail, ... not hemmed in by role definitions or organisational structures, .. don't keep quiet when they disagree with something.'' [...]
Stephen Balkam, *The Guardian*, 20 Feb 2015 - From Stephen Hawking to Spike Jonze, the existential threat posed by the onset of the `conscious web' is fueling much debate—but should we be afraid? http://www.theguardian.com/technology/2015/feb/20/internet-of-things-artificially-intelligent-stephen-hawking-spike-jonze When Stephen Hawking, Bill Gates and Elon Musk all agree on something, it's worth paying attention. All three have warned of the potential dangers that artificial intelligence or AI can bring. The world's foremost physicist, Hawking said that the full development of artificial intelligence (AI) could `spell the end of the human race'. Musk, the tech entrepreneur who brought us PayPal, Tesla and SpaceX described artificial intelligence as our “biggest existential threat,'' and said that playing around with AI was like “summoning the demon.'' Gates, who knows a thing or two about tech, puts himself in the `concerned' camp when it comes to machines becoming too intelligent for us humans to control. What are these wise souls afraid of? AI is broadly described as the ability of computer systems to ape or mimic human intelligent behavior. This could be anything from recognizing speech, to visual perception, making decisions and translating languages. Examples run from Deep Blue who beat chess champion Garry Kasparov to supercomputer Watson who outguessed the world's best Jeopardy player. Fictionally, we have Her, Spike Jonze's movie that depicts the protagonist, played by Joaquin Phoenix, falling in love with his operating system, seductively voiced by Scarlet Johansson. And coming soon, Chappie stars a stolen police robot who is reprogrammed to make conscious choices and to feel emotions. An important component of AI, and a key element in the fears it engenders, is the ability of machines to take action on their own without human intervention. This could take the form of a computer reprogramming itself in the face of an obstacle or restriction. In other words, to think for itself and to take action accordingly. Needless to say, there are those in the tech world who have a more sanguine view of AI and what it could bring. Kevin Kelly, the founding editor of Wired magazine, does not see the future inhabited by HALs—the homicidal computer on board the spaceship in 2001: A Space Odyssey. Kelly sees a more prosaic world that looks more like Amazon Web Services: a cheap, smart, utility which is also exceedingly boring simply because it will run in the background of our lives. He says AI will enliven inert objects in the way that electricity did over 100 years ago. “Everything that we formerly electrified, we will now cognitize.'' And he sees the business plans of the next 10,000 startups as easy to predict: “Take X and add AI.'' [...]
Aliya Sternstein, NextGov.com, 23 Feb 2015, via ACM TechNews The U.S. Intelligence Advanced Research Projects Activity (IARPA) is working on a new contest that will challenge government and private-sector entities to create a system for analyzing numerous streams of data from social media to black market malware storefronts to create predictions of what cyberthreats a given network may face ahead of time. The Cyber-Attack Automated Unconventional Sensor Environment (CAUSE) project is envisioned as a cybersecurity equivalent of systems that have been able to analyze various data streams to successfully predict political uprisings and the spread of diseases such as Ebola. IARPA's Rob Rahmer, who is leading the CAUSE project, says the competition is meant to help move the cybersecurity field from a reactive to a proactive posture. Such a system would not be perfect and would make mistakes, but Rahmer says it would help agencies and businesses spend their cybersecurity resources proactively. CAUSE is envisioned as a four-year race and IARPA currently is developing guidelines and determining what the prize for the competition will be. There already is strong interest in the project; about 150 would-be participants from the private sector and academia attended a recent informational workshop about CAUSE. One issue that needs addressing is what computing resources competitors will need to use; CAUSE would likely require supercomputer-level computing power. http://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_5-d684x2c74fx065558&
The Stack via NNSquad http://thestack.com/iarpa-cause-ibm-precrime-threat-prediction-240215 "The USA's Office of the Director of National Intelligence (ODNI) is soliciting the involvement of the private and academic sectors in developing a new 'precrime' computer system capable of predicting cyber-incursions before they happen, based on the processing of 'massive data streams from diverse data sets'—including social media and possibly deanonymised Bitcoin transactions. In January the Intelligence Advanced Research Projects Activity (IARPA), administrated by ODNI, held a Proposers' Day Conference for the Cyber-attack Automated Unconventional Sensor Environment (CAUSE) initiative, inviting interest from IBM and other cyber-security companies including Battelle, RepKnight, the Florida Center for Cybersecurity (FC2), Galois Inc., SoarTech, SRA International Inc. [PGN-NOTE: SRA, *not* SRI!], Vion ... and, of course, IBM, which produces technologies used and cited by some of the other vendors in their own proposals. Dr. Peter Highnam presented the overview on January 21st, initially drawing attention to the interests in the project of no less than 16 major government departments, including the CIA, the Defense Intelligence Agency, the Department of State, the FBI, the Department of Homeland Security and all branches of the US military." Looks like a giant trolling target. There will be folks who would like nothing more than to trigger false alarms for such a system, just for funsies.
The Stack via NNSquad http://thestack.com/belarus-bans-tor-250215 "In the wake of Russia's announcement that it intends to ban Tor, VPNs and all other technologies that permit users to hide their identities on the Internet, the neighbouring Republic of Belarus has announced [Russian language] that it will enable legislation to bring these restrictions into effect. The ban was announced in the official national portal of Belarus. The edict declares that any service which provides access to anonymising facilities such as Tor and Virtual Private Networks must be entered onto a national blacklist, and that Internet service providers will be obliged to check state inspectorate lists daily for new banned services and sites, and to implement blocks accordingly."
The digital security company said it believed attacks by the N.S.A. and its British counterpart occurred over two years, starting in 2010. http://www.nytimes.com/2015/02/26/business/international/gemalto-says-nsa-tried-to-take-sim-encryption-codes.html
The breach may have revealed the names and identification numbers of up to 50,000 drivers, but so far there are no reports that stolen information has been misused. http://bits.blogs.nytimes.com/2015/02/27/uber-driver-database-breached-by-someone-outside-company/
Another single point of failure? http://www.usatoday.com/story/news/nation/2015/02/26/poliice-probe-arizona-outage/24043367/ Mike Stayton, 106 Miss Georgia Court, Cary, NC 27511 919 460-0561
Under the proposed legislation, called the Consumer Privacy Bill of Rights Act, industries would draw up their own codes of conduct on handling customer data, which regulators would enforce. http://www.nytimes.com/2015/02/28/business/white-house-proposes-broad-consumer-data-privacy-bill.html
Celebrating the beginning of March by starting to work on my taxes, I bought the CD from H&R Block. (I've used their software for at least 10 years - while not perfect, it can do trust returns, unlike the consumer-grade Quicken product.) Anyway, I got an error when I tried to install on my Windows 8.1 system. Some Googling reveals that this is a known problem: The software is fully compatible with Windows 8.1, however, as many users have discovered, the user's rights are somewhat restricted even on an Administrator account, since Windows Vista. It turns out that since then, Microsoft's operating systems have had a true administrator account that is hidden by default. You can search for the simple instructions to enable this account, however in support we have had success by simply creating a new account with Administrator rights and leave the Administrator account disabled. One very simple trick that has worked for me personally is to right button click the installer file, and choose "Run as Administrator". Sometimes that is all that is needed! - - - - So let's see, the software needs *something* that only a "true" administrator account can do, and they never tested it on the latest version of Microsoft's operating system before release??? Will we never learn, either about security or testing? http://community.hrblock.com/t5/DIY-Products/HR-BLOCK-PREMIUM-2014-TAX-CD-WILL-NOT-INSTALL/td-p/55443
Daily Dot via NNSquad http://www.dailydot.com/politics/iran-censorship-circumvention-tech/ "While the Iranian government spends millions of dollars to build and maintain one of the strictest censorship regimes on the planet, its citizens spend their own millions on anti-censorship software that allows them to see the Internet more freely. Anti-censorship is so much money, in fact, that many of the same government authorities that do the censoring then turn around and allow the sale of censorship-beating software--in order to line their pockets, offer a false sense of security to Iranians, and even to make their surveillance jobs that much easier."
The PKDick excerpt cited about a shakedown by a door lock is, I fear, more prescient than it first appears. I very much doubt that any "Internet of Things" will become Artificially Impudent because long before that happens, all the devices will be co-opted by The Bad Guys who will proceed to pursue shakedowns, extortion, and "protection" rackets on a coherent global scale. Whether it is even possible to "secure" such a collection of devices empowered with such direct control over physical reality is a profound and, I believe, completely open theoretical question. (We don't even have a strong definition of what that would mean.) Even if it is theoretically possible, it has been demonstrated in the most compelling possible terms that it will not be done for a host of reasons. The most benign fall under the rubric of "Never ascribe to malice what is adequately explained by stupidity" while others will be aggressively malicious. First and foremost, however, is the attitude that "security" can be added-on in a piecemeal fashion to a fundamentally insecure system in retrospect. This is patently false and has been known to be the case for many decades. A close second, however, is a definition of "security" that reads, approximately, "Do what I should have meant." Eg, the rate of technology churn cannot be reduced just because we haven't figured out what we need it to do (or not do) - we'll just "iterate" every time Something Bad(tm) happens. An even deeper concern, however, is that the entire concept of "security" as naively held may be fundamentally unachievable, that phrases like "This must not happen again" are simply irrational because the underlying theoretical foundations cannot produce it. The problem with pursuing such a goal is that it has led us down a path of "brittle failure" where things work right up until they fail, and then they fail catastrophically. The outcome is forced to be binary. In most of Computer Science, there have been only relatively modest efforts directed at building systems which fail gracefully, or partially. Certainly some sub-specialties have spent a lot of effort on this notion, but it is not the norm in the education of a journeyman system builder. If it is the case that we are unlikely to build any large system which is fail-proof, and that certainly seems to be the situation, we need to focus on building systems which can tolerate, isolate, and survive local failures. As it has been so ably demonstrated, it is now possible to steal from a million people with the same effort as one person (approximately). That is a great example of a "brittle failure" and could well be a great place to start rethinking protocols and algorithms so that a big failure may produce a million opportunities to steal, but that executing any one theft produces no advantage to executing the next. This is not a panacea, but is a useful direction to pursue if we are to be overrun with Artificially Impudent light switches, toasters, and toilet seats. I *really* don't want someone playing games with the temperature of my shower, to pick one at random.
*Inside Science* (02/26/15) Joel N. Shurkin via ACM TechNews, 2 Mar 2015 If automated automobiles become practical and widely adopted, then car accidents will be the result of programming errors instead of driver errors, which makes the assignment of responsibility in litigation a challenge. At a recent meeting of the American Association for the Advancement of Science, Stanford University researchers announced the production of an automated vehicle that can compete with champion amateur drivers on a racetrack. The car uses global-positioning systems, computer-driven controls, and programmed rules to drive and navigate. Stanford professor Chris Gerdes says its computerized thinking process raises important concerns. For example, because such a car is programmed to obey all traffic rules and not violate laws, there may be limitations to its usefulness. One example is a programmed vehicle's inability to cross double lines to get around an illegally parked car, because such a maneuver would technically break the rules. University of South Carolina in Columbia professor Bryant Walker Smith thinks with the advent of automated cars, the onus of liability will shift more to manufacturers than consumers, with the costs ultimately passed on to consumers. He also notes if the cars improve safety, it is likely the number of accident-related lawsuits will decline. http://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_5-d6b9x2c76cx057431&
Alyssa Goard, NBC Bay Area, 27 Feb 2015 Thief Steals $15,000 Bike in Sausalito With Tap of Hand: Police http://www.nbcbayarea.com/news/local/Thief-Steals-15000-Bike-in-Sausalito-With-Tap-of-Hand-294430531.html A thief in Sausalito stole a bike valued at $15,000 from an Audi on Thursday, all with a tap of his hand. The man made off with the Cervelo P5 bicycle and other valuables on Central Avenue in Sausalito during the afternoon on Feb. 19, much of which was captured on surveillance video. As police described it, the man was on Central Avenue driving a black vehicle, possibly a a 2011-2014 Volkswagen Golf TDI Diesel, when he drove past the Audi. It was then when police say he reached out, tapping the Audi with his hand as he passed by. He parked his Volkswagen close to the Audi, walked up to it and touched the vehicle's door handles. After he did that, somehow the doors unlocked. Police believe the thief unlocked the Audi using an electronic device or remote. Sausalito police warn residents that even advanced, high tech locks and security systems can be outsmarted. Police say the suspect in this crime appears to be about 25 to 35 years old and was wearing black clothing. Anyone with information on the suspect or this crime should contact Detective Ryan McMahon at 415-289-4118. [Fascinating. an Audi master key, used by dealers and locksmiths presumably? Good reminder that having trapdoors, backdoors, and frontdoors is NOT A GOOD IDEA. PGN]
http://lauren.vortex.com/archive/001087.html
You can almost physically hear the drumbeat getting louder. It's almost
impossible to read a news site or watch cable news without seeing some
political, religious, or "whomever we could get on the air just now"
spokesperson bemoaning and/or expressing anger about free speech on the
Internet.
Their claims are quite explicit. "Almost a hundred thousand social media
messages sent by ISIL a day!" "Internet is the most powerful tool of
extremists." On and on.
Now, most of these proponents of "controlling" free speech aren't
dummies. They don't usually come right out and say they want censorship. In
fact, they frequently claim to be big supporters of free speech on the Net
-- they only want to shut down "extremist" speech, you see. And don't worry,
they all seem to claim they're up to the task of defining which speech would
be so classified as verboten. "Trust us," they plead with big puppy dog
eyes.
But blaming the Net for terrorism—which is the underlying story behind
their arguments—actually has all the logical and scientific rigor of
blaming elemental uranium for atomic bombs.
Speaking of which, I'd personally be much more concerned about terrorist
groups getting hold of loose fissile material than Facebook accounts. And
I'm pretty curious about how that 100K a day social media messages stat is
derived. Hell, if you multiply the number of social media messages I
typically send per day times the number of ostensible followers I have, it
would total in the millions—every day. And you know what? That plus one
dollar will buy you a cup of crummy coffee.
Proponents of controls on Internet speech are often pretty expert at
conflating and confusing different aspects of speech, with a definite
emphasis on expanding the already controversial meanings of "hate speech"
and similar terms.
They also note—accurately in this respect—that social media firms
aren't required to make publicly available all materials that are submitted
to them. Yep, this is certainly true, and an important consideration. But
what speech control advocates seem to conveniently downplay is that the
major social media firms already have significant staffs devoted to removing
materials from their sites that violate their associated Terms of Service
related to hate speech and other content, and what's more this is an
incredibly difficult and emotionally challenging task, calling on the Wisdom
of Solomon as but one prerequisite.
The complexities in this area are many. The technology of the Net makes true
elimination of any given material essentially impossible. Attempts to
remove "terrorist-related" items from public view often draw more attention
to them via the notorious "Streisand Effect"—and/or push them into
underground, so-called "darknets" where they are still available but harder
to monitor towards public safety tracking of their activities.
"Out of sight, out of mind" might work for a cartoon ostrich with its head
stuck into the ground, but it's a recipe for disaster in the real world of
the Internet.
There are of course differences between "public" and "publicized."
Sometimes it seems like cable news has become the paid publicity partner of
ISIL and other terrorist groups, merrily spending hours promoting the latest
videotaped missive from every wannabe terrorist criminal wearing a hood and
standing in front of an ISIL flag fresh from their $50 inkjet printer.
But that sort of publicity in the name of ratings is very far indeed from
attempting to control the dissemination of information on the Net, where
information once disseminated can receive almost limitless signal boosts
from every attempt made to remove it.
This is not to say that social media firms shouldn't enforce their own
standards. But the subtext of information control proponents—and their
attempts to blame the Internet for terrorism—is the implicit or explicit
implication that ultimately governments will need to step in and enforce
their own censorship regimes.
We're well down that path already in some ways, of course.
Government-mandated ISP block lists replete with errors blocking innocent
sites, yet still rapidly expanding beyond their sometimes relatively narrow
original mandates.
And whether we're talking about massive, pervasive censorship systems like
in China or Iran, or the immense censorship pressures applied in countries
like Russia, or even the theoretically optional systems like in the U.K, the
underlying mindsets are very much the same, and very much to the liking of
political leaders who would censor the Internet not just on the basis of
"stopping terrorism," but for their own political, financial, religious or
other essentially power hungry reasons as well.
In this respect, it's almost as if terrorists were partnering with these
political leaders, so convenient are the excuses for trying to crush free
speech, to control that "damned Internet"—provided to the latter by the
former.
Which brings us to perhaps the ultimate irony in this spectacle, the sad
truth that by trying to restrict information on the Internet in the name of
limiting the dissemination of "terrorist" materials on the Net, even the
honest advocates of this stance—those devoid of ulterior motives for
broader information control—are actually advancing the cause of terrorism
by drawing more attention to those very items they'd declare "forbidden,"
even while it will be technologically impossible to actually remove those
materials from public view.
It's very much a lose-lose situation of the highest order, with potentially
devastating consequences far beyond the realm of battling terrorists.
For if these proponents of Internet information control—ultimately of
Internet censorship—are successful in their quest, they will have handed
terrorists, totalitarian governments, and other evil forces a propaganda and
operational prize more valuable to the cause of repression than all the ISIL
social media postings and videos made to date or yet to be posted.
And then, dear friends, as the saying goes, the terrorists really would have
won, after all.
Be seeing you.
We recently fell victim to a clever phishing attack targeted directly at our mobile application. The email received looked exactly like a correspondence from Google App Store and contained a deep link obfuscated in an HTML email pointing to a 3rd party malicious site in guise of the Developer Console. The subject was "3-Day Notification of Google Play Developer Term Violation" which certainly got our attention. One of our harried developers clicked on the link and logged into a site http://accounts.gooogle.com.de/ providing hackers with our credentials. The takeaway here is obvious. Enforce multi-factor authentication on all email accounts linked to app store logins. I don't understand how this is even optional anymore. https://guardianproject.info/2015/02/24/phishing-for-developers/
Howard Solomon, *IT Business*, 20 Feb 2015 http://www.itbusiness.ca/news/hackers-force-death-of-canadian-bitcoin-exchange/53891 Digital currencies hold appeal to some enterprises, but the security of exchanges is a weak point. The latest to fall is Canadian exchange CaVirtex over what it says is a possible breach. [..]
I, like many careful people, run either with active scripting fully disabled or with the Noscript plugin of Firefox set to disallow scripts from any site I don't exempt. "Noscript" is one of the most popular Firefox plugins for a good reason. As Ron put it a while back, "I always thought of JavaScript as the browser's malware injection facility." The problem is that almost all reports of browser exploits follow the same template: First they name the exploit. Then they explain, in gory detail, the horrible nasty things the exploit can do. Finally they say that, until a fix can be written and applied, your best method of safety is to disable scripts or to run with Noscript. Sometimes they leave that last bit off even though the exploit requires active scripting. The risk is that people who browse safely, without scripting, may ignore browser exploit reports. If or when one such comes along which does not rely on scripting, those people will be vulnerable longer. (By the way, does anyone have statistics on browser exploits broken down by scripting required for the vulnerability versus everything else?) It would be nice if the reporting template were instead more along these lines: Name the exploit; state who is and isn't vulnerable; detail the exploit type (evil script, buffer overrun, SQL injection, etc.); tell the extent of the exploit; and explain how who those who are vulnerable can fix or mitigate the problem.
Lucian Constantin, InfoWorld, 25 Feb 2015 Attackers can easily crack cryptographic keys used by the WP-Slimstat plug-in and use them to read information from a site's database http://www.infoworld.com/article/2888878/security/flaw-in-popular-web-analytics-plugin-exposes-wordpress-sites-to-hacking.html
Minor fun, from National Park Service, DEath VAlley, one of my favorite places. This was sent to about 256 people; presumably (like me) they had once contacted NPS. Nice to note that NPS doesn't worry about keeping E-addresses confidential. Note "there" for their. Begin forwarded message: > Date: March 2, 2015 12:25:08 PM EST > From: "DEVA Information, NPS" <deva_information@nps.gov> > To: [MONSTER LIST OF E-MAIL ADDRESSES DELETED BY PGN FOR RISKS] > Subject: Morning Report 03/02/2015 > Good Luck, to all those who are making plans for there [sic] summer > season and moving on. May you find your way back soon! The subsequent e-mail after that provided a correction, but again included the entire list of addresses. > Subject: Error while sending Morning Report 03/02/2015 > Please disregard last message morning report is meant for selected contact > stations in error it was sent to all contacts. Please do not respond just > delete message. Document resent to stations, and thank you for your > understanding. [If you were French, you might ask PARK-WHA? (pourqua?)... PGN]
Stephen Luntz, IFL Science, 23 Nov 2014 http://www.iflscience.com/technology/journal-accepts-paper-reading-get-me-your-fucking-mailing-list A paper that largely consists of the words "Get me off your f***ing mailing list" repeated 863 times has been accepted by a journal that claims to be peer reviewed. The move might appear to offer hope to scientists struggling to get marginal work published, but really just exposes the extent of scam publications pretending to be contributing to science. [...]
A few days after the news of the NSA's hard-disk infections came out, I
spoke to a high-level manager at Seagate about the attack. He told me a
couple of interesting things:
1. Although all drives have a "download new firmware" command, the firmware
has to be signed. Ten years ago that wasn't true. So although the NSA
might have previously succeeded with this attack, today they would have
to beg, borrow, or steal the signing key. That's not to say they haven't
(after all, sneakiness is their stock in trade), but it makes things more
difficult.
2. An unrelated but interesting point is that at least at Seagate (and
presumably elsewhere) all on-drive information is *always* encrypted
using a random key (and the drive itself is a superb source of
randomness). There's an "erase drive" command that simply forgets the
key. No, I don't know how to issue it; it doesn't seem to be in hdparm's
list of options.
Geoff Kuenning geoff@cs.hmc.edu http://www.cs.hmc.edu/~geoff/
Paymasters come in only two sizes: one sort shows you where the book
says that you can't have what you've got coming to you; the second
sort digs through the book until he finds a paragraph that lets you
have what you need even if you don't rate it. Doughty was the second
sort. Robert A. Heinlein, "The Door Into Summer"
Copyright law is more complicated than that. The U.S. law has broad rules for a fair use defense to claims of copyright infringement, based on: The purpose and character of the use, including whether such use is of commercial nature or is for nonprofit educational purposes The nature of the copyrighted work The amount and substantiality of the portion used in relation to the copyrighted work as a whole The effect of the use upon the potential market for, or value of, the copyrighted work Since the use was non-commercial, the public has a clear interest in Bush's correspondence since he was a government official at the time and a likely candidate for US President, and the commercial market of the e-mail is negligible, the argument for fair use in this case is very small. In Europe or Canada, privacy laws would likely forbid publication of people's personal details, but other than a few narrow cases that don't apply here, the US has no privacy laws.
NOT! As a first order WAG, I would assume that the TOS involved in emailing the governor *in his official capacity as an elected public figure, cover that. And the FOIA would cover the publication. R. Geoffrey Newbury, Barrister and Solicitor, newbury@mandamus.org Mississauga, Ontario, L5H 3R2 905-271-9600
No one seems to have remarked on what happens if you shoot one of these drones down when it's buzzing around you back yard. Have you committed multiple serious felonies related to aircraft? Or have you wrecked somebody's expensive toy that was intruding on your privacy?
The Guardian's article demonstrates yet again the "Barbra Streisand effect"; as John Oliver had said about the Spaniard who had started this round "the only fact I know about him is the very fact he wanted to be forgotten"....
RISKS-28.51 pointed us to an article that concluded the use of GOTOs is not harmful in practice. A quick glance through the paper looks good, but it may seriously mislead readers who aren't aware of Dijkstra's context. He did not "fear" that the use of gotos "would" obscure the code but observed that it *did*. For example, when he wrote, Fortran was one of the dominant languages. It had no "while" or "switch"/"case" statements and even no "if" statement as we currently understand it. COBOL 61 was not much better. IBM had introduced PL/I, but it still no "switch"/"case" statement. If developers are now using gotos responsibly, Dijkstra deserves a lot of the credit, because before he wrote, a lot of programmers didn't. The people who designed programming languages where you *could* write serious code with few if any gotos also deserve a lot of credit. Fortran 90 (and later) and COBOL 85 (and later) support precisely the kind of structured programming that Dijkstra and others were advocating. The difficulty of trying to understand how a program got to where it is has other guises these days. JavaScript has no 'goto' statement; that does not make understanding Node.js code easy!
Back in the late 1970's, I was involved in the launch of the first European meteorological satellite METEOSAT-1. A couple of days before the launch date, the launcher, sitting on the launch pad, received a telecommand to self-destruct. Fortunately, the execution of this command was disabled while on the ground, so nothing happened. But the launch was delayed by about 2 weeks to find the source of the telecommand. It turned out that a tracking station had been doing simulations of contingency operations, and had accidentally transmitted the command to the antenna rather than to the "dummy load" that is supposed to be used for training and tests. (To make the training as realistic as possible, everything in the Earth station is typically fully configured, except that the final output signal is routed to a load resistor rather than to the transmit antenna).
If you cannot trust your operating system, you cannot trust anything, and no encryption, no certificate, no algorithm is going to allow you to trust anything. The problem is not SSL security, the problem is not being able to trust your OS. --scott [Of course, PGN agrees—having maintained that position throughout the history of RISKS and long before.]
Here's hoping! Part 1
Bill Snyder, InfoWorld, 26 Feb 2015
Strong legislation that will weaken the ability of the trolls to
shake down innovators is likely to pass Congress, but more should be done
Tech's Bottom Line
http://www.infoworld.com/article/2889194/patents/patent-trolls-are-on-the-run-but-not-vanquished-yet.html
selected text:
There's finally light at the end of the dark, troll-invested tunnel, and it
isn't an oncoming train. Congress is likely to pass a bill that will take
money out of the pockets of innovation-sucking patent trolls (aka
"nonpracticing entities") despite opposition from lawyers, the
pharmaceutical industry, and a few tech companies that hold large numbers of
patents.
That study, titled "Does Patent Licensing Promote Innovation?," ...
"We find that very few patent licenses from assertion result in any
innovation, whether we measure that directly by looking for new products and
features, or indirectly by looking for proxies such as the transfer of
technology, sharing of personnel, or the development of joint ventures,"
they wrote. Patent licensing, they say, "seems to be an activity almost
entirely divorced from innovation."
Here's hoping, Part 2. Paul Venezia, InfoWorld, 26 Feb 2015 The public interest has prevailed and the FCC has voted to reclassify ISPs as common carriers. At last we have the means to control our Internet future http://www.infoworld.com/article/2888962/net-neutrality/net-neutrality-triumphs-as-isps-weep.html
Ars via NNSquad http://arstechnica.com/business/2015/02/fcc-votes-for-net-neutrality-a-ban-on-paid-fast-lanes-and-title-ii/ "The Federal Communications Commission today voted to enforce net neutrality rules that prevent Internet providers--including cellular carriers--from blocking or throttling traffic or giving priority to Web services in exchange for payment. The most controversial part of the FCC's decision reclassifies fixed and mobile broadband as a telecommunications service, with providers to be regulated as common carriers under Title II of the Communications Act. This brings Internet service under the same type of regulatory regime faced by wireline telephone service and mobile voice, though the FCC is forbearing from stricter utility-style rules that it could also apply under Title II." BOOM! As the moderator of the Network Neutrality Squad now reaching back for so many years, I must say I am quite pleased overall with this decision. There will be lawsuits, and threats from Congress relating to this vote, and the risk of reversals with new Commissioners later always will exist, but today is a really good day for the Internet.
Bruce Schneier, How to Mess With Surveillance: Why you should search for random people on Facebook, and other tips. This essay is excerpted from Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World by Bruce Schneier, published by W. W. Norton & Co. Inc., 2015. Surveillance is both a technological and a legal problem. Technological solutions are often things we can do ourselves. We can use various privacy and anonymity technologies to protect our data and identities. These are effective but can be thwarted by secret government orders. We need to fight the political battle as well. Political solutions require group effort but are generally limited to specific countries. Technological solutions have the potential to be global. If Microsoft designs its Windows operating system with ubiquitous file encryption, or if the Internet Engineering Task Force decides that all Internet traffic will be encrypted by default, then those changes will affect everyone in the world who uses those products and protocols. The point is that politics can undermine technology, and also that technology can undermine politics. Neither trumps the other. If we are going to fix things, we need to fight on both the technological and political fronts. And it's not just up to governments and corporations. We the people have a lot of work to do here. [... Long item PGN-truncated for RISKS] Excerpted from Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World by Bruce Schneier. Copyright 2015 by Bruce Schneier. With permission of the publisher, W. W. Norton & Co. Inc. All= rights reserved.
Please report problems with the web pages to the maintainer