Posts by Pascal Monett 19430 publicly visible posts • joined 10 Apr 2007
Well that was interesting. I got a bit scared reading about this Shodan portal. I went off to find it, read the Ts & Cs, went about checking it out. As a search portal, it does not seem dangerous (meaning it doesn't look like a blackhat is on the other side, waiting to infect me with malware).
So I signed in, authenticated my account, and went about discovering how to use it. At first, I was a bit unprepared - I'm not used to searching for IoT stuff, I usually google normal stuff. I used the Explore button and got page upon page of TCP IP addresses. Clicked on one, got a login page. Didn't want to go there.
Then I got an idea : I would search my own IP address. If I discover a problem, all I have to do is shut down my router for a minute and I'll get a new IP, so not much risk there. I dared it, wondering if the security cameras installed by the firm I subscribed to would show up.
Relief, they do not. On top of that, when the result page displayed it showed a city location that has nothing to do with where I live, but is most likely the local ISP hub for my connection. So not only can no one find me like that, but it would appear that my ISP is on the ball concerning security, because there was nothing else on the page besides the TCP address and the city name.
I actually feel a bit safer now.
And the system is regularly maintained and upgraded ?
How regularly ? Every ten years ?
It's easy to bash failure, but something in the official statements does not compute. If you are regularly upgrading your system, then an increase in demand should be a short-term problem, not a system-level failure.
Once again we have a bad Real-World metaphor.
I don't care about car parking. When I take a parking space, nobody else can have that one. That is not the case with software. Everyone can download the app once I have it.
The issue with EULAs is not that the vendor will have trouble if it accepts responsibility, it is that the vendor accepts NO responsibility, although you pay full price. Thus shoddy programming practices are the norm. We're over 30 years into the IT industry, and we're still subject to bugs that are due to the absence of data control or validation. This is not acceptable.
There is a middle ground to be found, is what I'm saying, and if we end up with less software developers because of risks, it means that those that still develop will be better, because they will have learned to write better code.
What I have trouble accepting is that on the one hand, the software I buy is under license, but on the other, software makers generally absolve themselves of all fault in case of trouble.
This one-way deal has been going on for too long now. I pay for my software, if you don't accept responsibility, then you damn well better not tell me it's not mine to do with as I please.
Really ?
Technology never disappears. When a really good idea surfaces, it doesn't matter that the company that birthed it has gone under, someone will remember it and integrate it in a better product.
VCs need a harsh lesson. There has been too many IPOs for startups that did not actually bring anything of use to the industry. Too many IPOs that have served no other purpose than to line the pockets of a few already very rich men.
As far as I'm concerned, a bit of crash and burn in VC-land will do a world of good and maybe usher an age of you'd-better-have-a-good-idea-if-you-want-my-money before getting funded. That might weed out the toxic Silicon Valley mentality and hopefully give rise to people who can actually innovate, instead of just putting round corners on existing products.
One can only hope that she will not be replaced by some brain-dead, owned-by-the-system moron if progress is to be made.
How on God's green Earth can an administrative body specifically tasked with auditing IT projects not look at the ROI of what was paid for is beyond me. The fact that it took someone with private industry experience to set the administration on the right track speaks volumes.
It seems to me that, however strong you think your webserver security is, there will always be a chink in the armor for the bad guys to slip through.
Especially when you discover that some dormant, unused component you happen to have stored but not activated can actually be used to hack your site even if you've never so much as referenced it.
But I like the idea of a gold reference.
The use of fossil fuels in our civilizations stems directly from the sheer amount of energy they contain. I have always been convinced that, however we get to electric cars, we will never see electric construction vehicles - or planes, for that matter. Fossil fuel is a must when you need 500HP to lug twenty tons of rock around. Or else we've found Star Wars technology, in which case I accept defeat most graciously.
@Jimmy2Cows : after a bit of googling, I must admit that your point is unfortunately quite valid. Kind of puts to rest the entire notion for vehicular transport. Sad.
@Dwarf : the "greenness" of cars would anyways be impacted by the global aversion the human population has for nuclear power. It serves nothing to have electric vehicles if their recharging is done with coal plants. And nobody raises the issue of the toxic components of the batteries themselves.
That said, I doubt "charged" liquids would be any more of a hazard than the current incendiary liquids we use now. Plus, there would likely be less dangerous vapors to content with, so the refilling could be done in an airtight environment without much trouble.
Of course, the idea of plugging in your car and having nano-carbon batteries replenished in mere seconds would be nice, but then we're back at the high power grid connections issue we started with, and no change in the energy generation problem.
It seems to be a big mess in any case.
I believe you've hit the proverbial nail on the head. I agree that electric cars using this kind of liquid battery would be a godsend.
But I do not see that we'll avoid the need for high power grid connections. Solar and all renewables are limited in their production capacity, so a local array of panels is not necessarily going be enough when recharging the used fuel. There would be tankers, obviously, they could take away the used after delivering charged fuel. That way, the tankers would unload the depleted fuel at a recharging station with vast capacity. I guess that could be a solution. Not convinced that it would remove the need for local recharging though.
That the function is the same is not, in itself, an issue for me. That it comes from a group of people not supposed to be under the influence of governments or spooks is a very big plus in my book.
The fact that the NSA could have purchased a board is not a problem either. A proper cryptographic process can be entirely public, it will be no less efficient in keeping data secure because the keys are not public (well, half of them aren't). If the code and hardware of this project are properly thought out and truly secure, there is nothing the NSA can do to it without physical access - and we know the rule on that.
"Many people might not realize that running their own cellular networks is not only possible but also doesn't require substantial technical expertise."
It requires next to no technical expertise to install a Wi-Fi access point : just switch it on. On the other hand, considering the level of complexity simplicity of passwords revealed in reports of user id hacking, the technical expertise to understand how to secure it is beyond a lot of people.
Now you want Joe Schmoe from the deepest parts of Africa to go install an open cellular network node ? Are you working for the NSA ? Because they're gonna be listening in as soon as that thing boots.
And the best case scenario is that they are the only ones listening.
Hang on there, we've been sending rovers with microphones to Mars before and nobody thought of sending back the sounds ?
Why ? How can a microphone be of use to the rover without being used to send back audio data ?
Is there some sort of audio map made of the immediate vicinity, for route planning, perhaps ?
On reading this line, I thought that there are some smart criminals out there. Curious, I looked it up. This fast-flux thingy is basically the botnet being able to rewrite DNS records every minute because the registrar doesn't give a flying monkey's about it.
So these crims are smart, but if every registrar did its job properly, this technique would not survive.
Win7 works fine for me, thank you. I have everything configured the way I like it and no desire to find out how Microsoft will change everything with Win 1 0.
Additionally, I have locked the OS down as far as I can, no remote access of any sort, no telemetry, nothing. Windows Update is disabled until I reactivate it.
In short, I am using a personal computer and I have no desire to hop on to the slurp bandwagon.
When I do change OS, it'll be for some version of Linux because I won't be needing Windows anymore.
Creating a metaphor is not given to everyone. Creating a proper metaphor on a topic concerning the virtual zeros and ones of the Internet is particularly difficult, because there are many cases when reality simply does not apply (e.g. the eternal copyright infringement/theft debate).
Politicians, on the other hand, are supposed to be adept at that, since they're business is mostly speaking and making verbal connections to win over public support. But it is easy to see that some politicians are much, much better than others in that domain.
For the existence of "self-driving" cars to not end in a nightmare of civilization collapse, the whole industry needs to be handled in the same way airline planes are.
In other words, we need a Car Transport Authority just like we have an Air Transport Authority, with the same process and the same clout when it comes to immobilizing a car series that is not up to snuff.
Until we have that, the whole situation will be an unending game of chaotic security whack-a-mole, and insurers will run for the hills.
The PC is indeed obsolete - in its current form.
People like tablets and smartphones and, for what most people do, the PC is an over-complicated, prone-to-getting-hacked, clunky piece of kit - even if it's a laptop.
Joe User does not need a PC anymore.
People who do still need PCs are content creators, anyone wanting to dabble in photo/film modification or creation, programmers and, of course, gamers. Outside of that, why burden yourself with a PC ? A tablet for surfing, social nonsense, light gaming and film viewing on the go and you're good.
A promise is a promise. That fact that the price was zero does not change the fact that people were promised something, got used to using it in the given parameters, and now are being deprived of the usage they were promised.
Boiling it down to a "free" thingy change is you missing the point.
"I should be entitled to continue paying for that amount at the "contracted" rate"
Yes, you should, but you don't actually have a "contract". What you have is Ts & Cs that can be changed anytime by the provider, in other words, you've got an empty promise.
A contract is a binding agreement between two parties, agreement that cannot be changed without the consent of both parties. It was decided, somewhere at the beginning of the IT industry, that this model did not correspond to the Internet, and now here we are : companies are all-powerful, can change offers at a whim, and the only thing you can do is lose and go somewhere else if you don't accept the new terms.
One of these days, Joe Public is going to have to wake up and realize that he's being taken for a fool. That day, somebody might think of doing away with the EULA nonsense and Ts & Cs that only the paying customer cannot change. That day, the law will once again enforce the proper idea of "contract".
In the mean time, bend over and try to enjoy it, because that's the choice we have.
Stop right there : Cloud is not backup.
Not when the providers can authorize themselves to delete your files without your permission.
A backup is supposed to be reliable : the Cloud is not. At this point in time, there is not a single cloud storage provider that can be trusted to not lose your files, delete your files or not hand your files to any TLA that mentions your name in passing.
Yes, the Cloud could be a perfect backup service, but relying on it today is just putting your data on a straw rowboat and hoping it won't sink before you need it.
That is certainly a worst-case scenario : just having the module on the server can get you hosed. The high profile of this issue just makes things worse. I'm thinking of porting my company's web site to a CMS like Drupal - now I'll be waiting for the correction before going further.
Local carriers need to adapt to new conditions. The Internet is not going away, even if its future is somewhat uncertain due to privacy concerns and indiscriminate data hoovering.
It will take the time it has to, but any local carrier that wants to survive will have to get on the ball. Any regulation removing the need to do that is simply a temporary stopgap measure.
Given that said visitors pay over $100 million to get there, I don't think that'll be happening all that often.
On top of that, using a firearm in the ISS would be suicidal, since the bullets would go right through the hull, thus depressurizing the station. The takeover attempt would stop pretty quickly after that.
Maybe, but it's implementation is stupid.
ContentID does no check that the notice is justified. There is no oversight and no recourse. Thousands of fair use videos have been shot down without any say to the process.
ContentID is just another monopolistic, fascist tool in the hands of the company that cares the least about content.
Can someone say ironic ?
I totally agree with you. In a civilized area of the world, under a proper ozone layer-protected zone, without 99 different venomous species trying to kill you, it wouldn't happen.
But this is Australia.
Let me rephrase that :
THIS. IS. AUSTRALIAAAAAAAHHHHHHH !!!!
And I find laughable the idea of an Ombudsman independent of the US TLAs.
If he is truly independent, he will have no power. If he is not independent, he will be part of the apparatus and his job will specifically be to do nothing, while appearing to do something.
There is no reason for our data to migrate to the US. Each persons' data should be handled in that persons' country. It is the only way local law can apply.
And don't tell me about international treaties : the US has no respect for those anymore within its borders (and sometimes even outside its borders).
Not to disagree with you on a general basis, but personally I have never felt that I had any unused disk capacity before I slotted in my first 3TB disk.
The only reason I now have more than 20% unused space is because time has curtailed my disk needs - and I now have a NAS on which I can store over 5TB of data I was previously sticking in 3 different PCs over 14 (comparatively) tiny HDDs.
Before that, I was continually having to free space up by destroying existing data (sometimes said data was given the luxury of a backup before deletion if it was important enough to me). It was a major nuisance, and the space-shuffling always annoyed me until I found a new, temporarily stable situation.
Now I revel in seeing over 50% empty space in my partitions. I install new things without even thinking about disk space for a nanosecond. I am finally constraint-free. I am content.
Good point. I think a bit of Internet balkanization wouldn't be such a bad thing.
Pushing the point further, I feel it perfectly justified that a person's data is held solely in that person's country of residence, because an individual has no practical possibility of legal recourse outside of his own country anyway.
There was a film (with Sean Connery and Nick Cage) in which a general was prepared to turn traitor to get the men who died in his platoon proper care and recognition.
If I cite that film (the Rock), it is because said general gave a speech to his men promising them a million dollars each for their services, because, in his words, they would never again be able to set feet on any soil that had an extradition agreement with the US. In essence, they were traitors going into exile and they knew it.
It seems to me that if you are setting yourself up to be such a traitor purely for monetary purposes, as apparently in this case, you should be smart enough to realize that you're in the same spot. You should therefor make sure that each transaction has the possibility of giving you the means to vacate the country ASAP and, at the very least, set yourself up to get some form of revenue somewhere else. $1,000 is not going to do that.
So this guy sells state secrets at a thousand a pop. He must have thought himself very smart and able to do so for years without getting caught. He apparently thought he was just supplementing his income or something.
Smacks of unbelievable stupidity to me.
