Posts by tom dial

Silicon Valley's oligarchs got a punch in the head – and that's actually good thing

Re: Question?

The fact the US has two major parties results from a number of factors.

1. The habit of electing from single member districts by plurality or majority for such offices as the legislature (whether state or federal) makes it difficult for third parties to establish themselves, especially as the existing parties steal their ideas, and with them their supporters.

2. The need to organize legislatures to function adequately tends to force coalitions at state or federal government levels that incorporate locally or regionally successful third parties.

3. Third parties often are forced out by legal manipulations by better established parties. Examples include onerous signature requirements for small party ballot inclusion as opposed to automatic inclusion for "major" parties, something that typically means the top two by voting numbers in the previous election.

4. Party affiliation tends to be passed down within families. Although that gets muddled due to "mixed marriages" and internal family dynamics, there remains a tendency for individuals to associate themselves with one of the national parties, maintaining their stability over time.

5. Population mobility lead spread of the main political parties during the rapid expansion that occurred in the 19th century. People took the names and general leanings with them to new places and adapted them to their new environment. One consequence of that was to give the national parties a broad population base.

6. The population expansion and diversification that came with immigration in the last half of the 19th and first quarter of the 20th century, along with a combination of party organization recruitment of and takeover by new Americans operated to inhibit growth of minor parties. Ethnic diversity also discouraged narrow ideologically based programs. This and the previous factor go quite a way to explaining the nearly total lack of meaningful content in US party platforms.

The interactive map at

https://www.washingtonpost.com/2016-election-results/us-presidential-race/

Suggests remarkable stability over a period of 12 years, and it probably extends further back.

As an aside, I know of no evidence that third party vote totals, in most places under 5%, had a meaningful impact on this election, although they likely did in 2000. Jill Stein probably drew around half of her roughly 1% share from Clinton, and Gary Johnson a similar fraction of his 3% - 5% from Trump. In Utah and Idaho, Evan McMullin collected most or all of his votes from Mormon coreligionists opposed to Trump, who still beat Clinton by 19%; the total of Trump and McMullin votes in Utah is similar to Republican votes in other statewide contests.

Re: it wasn't much of a choice

Additional note: the "State Department IT employee" who maintained her private (illegal and insecure) server was a Schedule C political appointee hired at her behest, who had been her go-to guy for her unsuccessful 2008 presidential primary run. It is far from certain that he knew anything about the FOIA and fairly certain he knew little or nothing about federal information assurance requirements, as shown by exposure of RDP and VNC for systems in the clintonemail.com domain on the public internet.

Entirely predictable?

I ask then, with due respect, why did hardly anyone, including Trump's political and polling staff, actually predict it?

Predicting something after it happens does not count.

Computer forensics defuses FBI's Clinton email 'bombshell'

There certainly is blame to be shared with the permanent civil and diplomatic service people at the State Department who were, to put it gently, a bit slack. However Secretary Clinton brought in her own personal staff, including Brian Pagliano. Pagliano was hired in as a Schedule C political appointee for IT special projects, did part time work for the Clintons as administrator for clintonemail.com, and probably found RDP access from the public internet quite useful for that. The State Department IG report issued earlier this year described one such use in connection with attempts by unknown individuals, unsuccessful at the time, to gain access to the system, leading to temporary shutdowns.

It is not clear that even a reasonably alert IT staff would necessarily have detected that, but there probably were quite a few people at State who knew that Secretary Clinton had a non-government email address, and those who didn't sleep through their annual Information Assurance training would have known this was out of order and should have reported it to the CIO chain. Maybe some of them did, as some of the IT staff raised the question and were told to back off and not speak of it again (Also in the IG report). Arguably, they were remiss in not reporting the matter then to the government's whistleblower phone number that most federal offices posted on physical bulletin boards and printed on earning statements several times a year.

The notion that this came up out of ignorance or naiveté is rubbish. Any employee cleared for access to classified material has training, and signs documents that attest to that and to agreement to the rules governing classified material handling.

Secretary Clinton, in addition to being the President's principal foreign policy advisor and representative (and fourth in line for the presidency), was responsible for legal and orderly operation of the State Department. She could, and presumably did, delegate the details, and the permanent diplomatic service staff would perform many of the duties, she remained responsible to the President for it, and failed in that responsibility. She also failed in the implicit responsibility to not put the department employees in the bind she did, where to carry out their duties they had to violate established department instructions and the law.

Re: @bombasticbob, Big John etc.

The article cited,

http://www.vox.com/policy-and-politics/2016/11/4/13500018/clinton-email-scandal-bullshit,

is a combination of bullshit and whitwash.

Re: @bombasticbob, Big John etc.

The two cases are considerably different. Colin Powell used a personal email account maintained by a commercial service provider. He did so at a time (2001 - 2005) when email was much less widely used than during Clinton's tenure (2009 - 2013). During at least part of that time, too, it was not possible to send or receive email between the State Department non-classified network and other government agencies or the public. General Powell expended significant effort to improving that situation, unlike Hillary Clinton, who chose to not use the upgraded State Department system, which by then was connected to the public internet and usable for all purposes. She chose instead to use, not a commercial service, but an insecure personally owned* system located in her New York residence.

* Or possibly owned by or with her husband.

Re: So Comey must be arrested.

Please cite a source to confirm that Comey (or any FBI agent) revealed the name of the victim in Weiner's alleged crime. Please note that on September 21 the Daily Mail published a lengthy article, with numerous redacted text messages between Weiner and the girl, based on an interview with the girl and her father. The article, however, did not reveal the Mail's sources.

Re: Here's the math that does not add up

Having a private server is perfectly legal. Using one to conduct federal business generally is not. The exception would be systems that are certified and accredited by the appropriate federal official who, in the case of the State Department, was the CIO. Lest anyone raise the question, that has been the law since 2002 or before. According to the DoS Inspector General's report earlier this year, the CIO stated he was unaware of Clinton's use of the private server (which seems depressingly like he was on what we used to call "indoor annual leave") and that he had not and would not have approved it if he knew. Relevant citation: FISMA (2002_ - 44 U.S.C. § 3551, et seq. along with Chapter 35 generally.

Influence peddling may or may not be illegal. Done by an official in exchange for cash or objects of more than nominal value, it generally is illegal. For the federal civil service, the usual limit was set at $10 - anything of greater value might be considered a bribe. Jimmy Dimora, former Cuyahoga County (OH) commissioner, is working on a 28 year sentence at the Beckley federal prison in Beaver, WV. In many cases, Clinton's probably included, the normal favor granting activities, such as arranging for access, are legal, but those who exceed limits, or who come to be seen as deplorable human beings, as Dimora did, can be prosecuted. As in most such things, prosecutors have a lot of discretion.

Re: Here's the math that does not add up

Lying to the US population in a political context isn't criminal, and because of the first amendment it would be impossible to make it so. Lying to the FBI, which Ms. Clinton apparently avoided, would be criminal.

Re: Comey was trapped either way.

Is there a reliable source for the 650,000 number? In a moderate amount of web searching, I have not found it. And in view of that, is not the 5% simply a made up number derived from the quotient of ~30,000 by 650,000?

If there are, indeed, 650,000 State Departmente emails on Weiner's laptop, the relevant number can be found by eliminating duplicates and matches to already known email messages from Clinton's illegal server. The first, as the article states, can be done partly by use of hash comparisons, but that still may leave semantic duplicates that give different hash values as a result of forwarding or inclusion in forwarded messages. The notion that hash comparison with emails that Clinton turned over is rubbish, since those were printed and if available in hashable form almost will give a different hash value than their original form. The "expert" opinions reported seem to have been based on assumptions that are known to be incorrect, and can be discounted heavily.

Re: Just let Obama continue while they sort this out

President Obama can pardon Clinton (or anyone else) for a federal crime for which they have been convicted or charged. He cannot pardon anyone convicted or charged by a state government, and more significantly in this case probably cannot give a pardon for any crime not (yet) charged. I stand ready to be corrected by anyone offering proper citations to statutory or case law.

Re: I sense political meddling.

The servers she used were not certified and accredited as data systems for processing the type of material for which they were used. That was not legal, as I believe the State Department inspector general stated in his report about the emails.

This is not about Trump, who certainly is ill qualified for the presidency and probably is unfit. It is about Clinton, who probably is qualified for the job, but certainly has given us plenty of reason to consider her unfit. In either case, we can be pretty sure of one thing: the people's business will be secondary to the incumbent's.

Coding will win you the election, narcissistic techies boasted to Hillary

Re: Coding doesn't win elections

As a minor election functionary some years ago (something I undertook precisely because of the risk of monkey business) I concluded that the best solution is what we used before there were voting machines: hand marked printed ballots, hand counted and tallied by a group of people not all of whom belonged to the same political party.

A machine that operates in ways that cannot be observed directly during operation introduces doubt; and that doubt, manipulated by those interested in the outcome, undermines the perceived legitimacy of the result, and of the official ultimately elected.

As a polling place official I could ensure that nobody accessed the various ports in a way that might be seen as possible cheating; anything like that had to be witnessed by at least two officials of different (claimed) party affiliation. There was, and is, no effective way to guarantee that the vote by the citizen, displayed on the screen and printed on the visible tape, was correctly written to the memory card used to accumulated results. As far as anyone associated with election operations or voting was concerned, the process involved a lot that was the functional equivalent of magic. The public announcement of support for Republicans by the manufacturer's CEO, and the fact that the Secretary of State who oversaw elections was a Republican led some Democrats to question the results openly well before the election. With any kind of voting machine, or even electromechanical computer driven ballot counting, he chain of required trust in faceless people, some of whom may have (or be perceived to have) an interest in biasing the outcome, simply is too long.

Re: It's all PR

This is an excellent post, deserving of far more upvotes than it has (3 as of mid-afternoon UTC). I do think it leans to overstating the money thing, but still puts most of the emphasis where it belongs - the parents and home environment (para 4), good school managers, not merely teachers (para 6), and focus on the basics (para 7). [I did not count the isolated sentence at the top.]

Over some 40 years in IT I met quite a few excellent programmers and system designers. Almost none were CS graduates, and few were from "STEM" fields, especially if you take "S" in the older sense of physical sciences. As a Math undergraduate major I was a distinct outlier. Among the best that I recall were a number of musicians, a German major, a History major and one with a PhD in Classics. I suspect things have changed some, but programming is not so hard to learn that intelligent and inquisitive people cannot, and have not, done so when the need or opportunity arises.

Lad cuffed after iOS call exploit knocks out Arizona 911 center

A search warrant, solidly based on probable cause, probably describing computer equipment containing the computer code, and possibly documentation of that code. In a case like this, at least, there is no reasonable basis to question a search warrant as such. If there is evidence that the warrant was unreasonable in its extent, the defense attorney can raise the issue in court and conceivably get the warrant quashed, along with any evidence it yielded.

Re: Dumb mistake

There were numerous ways Desai could have disclosed the vulnerability that would not have executed a DDOS on a critical government service. He knew it was wrong, and according to his statement he knew that it was illegal, and and yet he created it and, again according to his statement, released it accidentally to the world. Also by his statement (reported in Forbes) he “developed these malicious bugs and viruses to be recognized in the hacker and programming community as someone who was very skilled.” He should not get a pass on this.

A five hundred hours or so of community service seems in the ballpark for a reasonable sentence, and one he might reasonably be grateful for. He should be grateful, too, for being charged under Arizona law. Technically, he probably violated the CFAA, which in the hands of an ambitious US Attorney, which Arizona seems to have, could have brought charges of hundreds of counts, each carrying a potential sentence of up to 10 years.

EU announces common corporate tax plan

Re: I guess this explains why we are leaving.

"Trump has somehow convinced ..."

Maybe. But it is useful, and probably necessary, to remember that they already were angry (as were quite a few others than this year's chosen targets of ridicule and disparagement. Trump did not make the sad situation into which he stepped, but was chosen because he articulated what they already were thinking. His off-the-wall and often ill-considered statements resonated with enough Republican primary voters to gain him the nomination over a number of candidates who were better qualified and more fit for the office, by far. And I fear that in the likely event that Clinton is elected, she probably cannot do anything, and almost certainly will do nothing, to resolve the underlying problems, so they will continue to fester for another four years or more.

For the record, I do not consider either one of them fit to hold any office of public trust and will not be voting for either of them. I have given up casting votes for lesser evils.

Re: finally a brexit benefit (for EU)

The proper word(s) might be "representative democracy," in which representatives are elected by largely democratic procedures and then rule by majority (or sometimes supermajority) consent of the representatives, who can do pretty much what they want, subject only to the remote possibility of recall (in some arrangements) or removal at the next election.

That is quite different from democracy in the old sense, where the demos is consulted directly. Perhaps the difference is less important in the EU than in the US, where a rather large fraction of the population expresses belief that their legislative representatives actually are on the payroll of various corporations or rich benefactors.

Como–D'oh! Infosec duo exploits OCR flaw to nab a website's HTTPS cert

The obvious replacement of the OCR by humans seems likely to bring a positive error rate as well, quite possibly in the same range as the OCR system. It is not even unlikely that the human error rate would be larger as they get fatigued, unlike the OCR software.

Meanwhile, in America: Half of adults' faces are in police databases

Re: And when it seriously goes wrong?

Those who bothered to follow the link (and the further link to The Intercept) and actually read either article will have found that Talley's ex-wife, three acquaintances, and the teller he was accused of robbing in the second case identified him, presumably based on bank surveillance photographs. They also would have noticed that the FBI facial recognition specialist, based on personal examination of photographs found a likely match between the surveillance photos and others probably taken under better conditions. Those certainly would have been enough to justify an arrest, and quite possibly and indictment and trial. The fact that the only witness changed and augmented her statements during trial testimony does not alter that.

Talley may well have a good case against the arresting police for grossly excessive force, and possibly also for later procedural errors. He might also have cause for action against his public defender in the first case for slackness in checking with his employer as to his stated alibi, which brought him a two month jail stay.

What the articles do not do is implicate machine facial recognition, which was not used. Indeed, the Intercept article suggests, with reservations, that it is likely to improve the results that can be obtained by human analysts alone.

Re: Only half?

I wonder, if the US and UK are not "even remotely democratic" which nation states are. That is a fairly strong statement that runs contrary to conventional understanding and warrants a bit of substantiating evidence.

I stipulate that the US federal government is not a democracy, and was not intended to be; the authors of the Constitution took considerable care to prevent that, for reasons discussed at some length in the Federalist Papers. They did not, however, constrain state government in any way to prevent them from establishing democratic regimes of their own.

Ecuador admits it cut Assange's internet to stop WikiLeaks' US election 'interference'

Re: Trump supporter

Corrupt != criminal:

cor·rupt

kəˈrəpt/

adjective

adjective: corrupt

1.

having or showing a willingness to act dishonestly in return for money or personal gain.

"unscrupulous logging companies assisted by corrupt officials"

synonyms: dishonest, unscrupulous, dishonorable, unprincipled, unethical, amoral, untrustworthy, venal, underhanded, double-dealing, fraudulent, bribable, criminal, illegal, unlawful, nefarious; informalcrooked, shady, dirty, sleazy

"a corrupt official"

Whether Wikileaks, or Assange, committed a US crime would depend a lot on the exact text of any exchanges between them and Manning, as well as who initiated any exchange between them. So far, the only evidence for US extradition efforts seems to come from Julian Assange, who is unlikely to have reliable information. In any case, once the transfer was completed, it is unlikely that the publishing could be prosecuted successfully.

It may be worth mentioning that while whoever obtained the emails from the source probably* committed a crime under US Law, it is all but certain that publishing in the US is fully protected by the first amendment and did not violate any US laws**. In addition to the fact that cutting Assange's internet service will have no affect on Wikileaks' ability to continue stirring the pot, they have not violated the law unless they obtained the messages from the DNC and other servers themselves.

In the same way, they did not violate US law by publishing the material Bradley Manning gave them (despite the fact that Manning violated a number of laws), somewhat undermining Assange's claim of a secret plan to extradite him for US trial. That is possible, but it would be necessary to prove that he conspired in some way with Manning to break the laws, something I suspect he, and others associated with Wikileaks, would have been quite careful to avoid..

* Unless they were turned over by the author or one of the addressees.

** Except possibly those dealing with criminal libel or which on examination will be found inconsistent with the first amendment..

It's finally happened: Hackers are coming for home routers en masse

Re: Beware "Enable remote management" checkbox

Access to a network is not the same as control of any machine in it. Control of one or more of the networked systems, including the router, is the intruder's next logical step. Making it more difficult is a wise move.

IBM: Yes, it's true. We leaned on researchers to censor exploit info

Wait

From Agazzini's public announcement:

"6. Timeline

20/08/2016 - First communication sent to IBM PSIRT (psirt at us.ibm.com)

22/08/2016 - IBM Response, PSIRT Advisory 6345 assigned to the bug

05/10/2016 - Communication from IBM with fix information (PI62375)

07/10/2016 - Security Advisory released

Copyright (c) 2016 @ Mediaservice.net Srl. All rights reserved."

Maurizio Agazzini CISSP, CSSLP, OPST"

So IBM received notice on August 20, developed and tested a correction by October 5, and released the advisory on October 7, whereupon Agazzini immediately announced the details to the world.

Many shops have a regular patch cycle that varies in length, but would be unlikely to be less than a couple of weeks except for tiny organizations or very easily exploited patches with very high impact. Most have internal requirements for testing, even of security changes, and a patch cycle of a month probably is fairly common. Publicly releasing details of a major commercial product vulnerability on the same day that the fix is released falls well short of my idea of responsibility unless the vulnerability already is known and being exploited or a trivial mitigation can be applied until the full correction can be tested and installed.

There may be mitigating circumstances like vendor foot dragging, but this case does not show it. IBM moved from notification to correction release in seven weeks, which is not necessarily unreasonable.

Oracle DB admins urged to swap their gas guzzler for an electric car

Oracle's databases don't pollute

That depends on your definition of "pollute," which in an Oracle context is spelled "PL/SQL."

I made a pitch a few years back for PostGres as a partial substitute for Oracle. We had the rather bad habit of making a new database for nearly every application and PostGres would have done for 90 or 95% of the databases we were running or planning, but for our other nasty habit of using PL/SQL for a lot of the application code. The savings from replacing Oracle would have been large, probably enough to recover in a couple of years the cost of translating the PL/SQL to PL/pgSQL or redoing the necessary code in another language, even taking account of the need to reanalyze some and retest it all. But it was a government agency with no tolerance for risk, where C-level management had come through a couple of years earlier and in "all-hands" meetings had informed IT personnel that IT was not a part of their core (finance and accounting) business. Rejection was almost instantaneous despite the fact that the agency was under considerable pressure to reduce operating costs.

French programmers haul Apple into court over developer rules

Re: Alternative solution

It still is Nexedi's choice. They can comply with the same rules as other developers and have their apps in the iStore, or not.

The lawsuit is rent seeking at its most obvious.

US govt straight up accuses Russia of hacking prez election

I hesitated between the downvote and the upvote I finally registered, mainly because the problem is a bit more complex and involves more slackness by the Senate and House of Representatives than the post suggests.

The President appoints judges and justices with the advice and consent of the Senate, which does not have to approve the nominee. The Senate and House together have passed laws that delivered a lot of power to the executive branch, irrespective of the President who heads it, and the presidents have welcomed it and run with it. The Congress does not have to do that (on paper) but over time have allowed the federal government to take on so many things that their failure to act creates deafening uproar and great indignation that uniformly has caused them to back down. Worse, they have passed laws that delegate to the executive branch legislative powers that, if they were doing their jobs, they would have guarded jealously. They even have allowed, and funded wars, for most of the last 70 years without the constitutionally required declaration of war. As a group they are feckless and spineless.

The expansive responsibility and power of the federal government does not go unchallenged, and the ensuing litigation dramatically increases the importance of judges at all levels, but most importantly the Supreme Court, and requires increasing politicization of judicial appointments to ensure "correct" decisions. It also explains much about why lefties are so fearful of a President Trump with the capability and presumable willingness to use that power "wrongly" and the Trump supporters are similarly fearful of a Clinton win. The truth is that if either one of them is elected, we are in deep trouble.

My neighbor has the short version on a yard sign:

Everybody

Sucks

We're Screwed

2016

Feds collar chap who allegedly sneaked home US hacking blueprints

Re: Coincidence or something serously wrong here...

Have an upvote for general correctness. However, I will make a few additional observations.

Federal government agencies like NSA are constrained by both staffing limits and general schedule compensation limits. The first may keep them from hiring enough people to accomplish their mission, and the second may reduce their ability to hire enough people in technical specialties that are especially well compensated in the private sector. It is very likely that both of these constraints bear on the NSA, as well as some other agencies; the National Geospatial-Intelligence Agency seems likely to be another example.

This situation is not the fault of the Obama administration alone. The Congress, in its sometimes misguided effort to (appear to) reduce the size of the federal government, is fully complicit. Furthermore, it certainly extends at least two administrations back, to the Clinton administration, and probably back further to that of Reagan. Democrats and Republicans are about equally culpable.

The solution is, and always has been, to increase appropriations without increasing staffing limits, ignoring the fact that, as another poster noted, that it increases the cost of federal government operations quite substantially. As this post notes, it also allows agencies to hire people to critical positions at rates above what the general schedule will allow. According to his claims, Edward Snowden was paid far more than the GS-12 or 13 rate that would be the range for his job, based on his known CV. More often, however, contractor employees receive less, and sometimes much less, than the GS rate for their positions. The contractor firm bills substantially more than they pay the employee (they are in business to make money, and actually incur expenses for management, payroll, and sometimes fringe benefits). It is not uncommon for them to bill more than the fully burdened cost of a civil service employee in a position.

I've worked on both sides. As a manager, I found the ease of filling vacancies under an existing contract extremely helpful, but the low rate paid in some cases was quite distasteful, and I encouraged contractor employees to apply for civil service vacancies that came up. The contractor employees we got, though, were as good on average as the civil servants. Later, as a contractor employee (under the same contract) I was paid on a par with my civil service counterparts. My employer was a subcontractor to the primary, whose contract limited them to a rate that may well not have allowed both them and my employer a profit. That probably did not bother either of them, as they supplied quite a few others at lower rates and could make their contracts profitable as a whole.

EU turns screws on Android – report

Re: does size matter?

This comes close to saying that a company that becomes successful to the degree that its product exceeds 50% (or some other, possibly larger market penetration) is, for that reason, to be subjected to a different set of rules, better described as constraints, to inhibit their growth. That to prevent them from abusing their dominance.

Without further qualification, that condenses down to "punish market success." I suspect EU competition law is intended to be a bit more nuanced, perhaps to requiring that the market dominance actually be exploited in a way that constitutes abuse. Has Google actually done that, say by first giving away the Android OS and then, once it has gained dominance, changing the contracts to require the App store and other pieces at issue? Or did they, beginning when they first entered the smart phone OS market, offer a bundle of the OS, App store, etc., preconfigured and immutable by contract, to phone manufacturers and carriers? And on the basis of that did they then become dominant without changing the bundle other than upgrading components? Or was it, as seems likely, somewhere between, with new components added, arguably to foreclose competition.

In the first two cases, Google probably have done nothing either wrong or illegal; they simply offered a product that helped the manufacturers and carriers succeed in collectively dominating the market for smart phones. They may have been somewhat high-handed, but they did not, after all have to offer the product at all. The third case is more interesting, arguably wrong, quite possibly illegal, and highly beneficial to the attorney class.

But is it safe? Uncork a bottle of vintage open-source FUD

Re: You can not be more wrong

Nothing about "open source" (even the GPL) requires that those who use it distribute what they use it for or any code that they modify, or that they develop based on the open source. The fact that some of them may not share their modifications or extensions to open source code does not refute the claim that they have built infrastructure or applications on it.

FCC death vote looms for the Golden Age of American TV

Re: $20B/year

I was trying to maintain civility in hope (dashed) that they could provide a decent workaround for accessing the new browser version of their scheduling and TV management application which, as of Tuesday, September 27, depends on installing the current version of Flash. The prior version did not require flash at all. I am more than a little unhappy with them and would drop their service in a heartbeat if there were a decent alternative.

Re: $20B/year

This estimate clearly must be in error. I know this because a Comcast CSR told me just yesterday with a perfectly straight face that the STB the rent me for $20 a month costs them $1600. The notion that they could find a lower cost supplier of a box with the capacity of a couple of Raspberry Pi s, a terabyte disk and an OTS tuner, together with a hand held controller with the capacity of another Raspberry Pi, more or less, and a handful of control buttons, apparently escaped them completly.

$100 probably isn't quite enough, but $200 - 250 should be possible for a large run and allow for the power brick and decent profit. Two sanity checks: first, their assertion that they will provide a piece of computer equipment at a rent so small as to take nearly 7 years to recover the cost, and second, that the power brick for the STB is rated at 36 Watts.

US Labor Dept accuses CIA-backed Palantir of discriminating against Asian engineers

Re: I can understand a little bit of bias

There should be no discrimination as such between "natural born" US citizens and naturalized citizens however recent. A citizen is a citizen. If that is a requirement for hire, as often is the case where defense or national security is involved it should be enough at the first pass. If the applicant is seeking a position that requres a security clearance, any relevant questions about when an applicant became a citizen, or how, can be answered connection with necessary background investigation.

And! it! begins! Yahoo! sued! over! ultra-hack! of! 500m! accounts!

Re: An interesting legal question...

It is legal in the US for the US government to conduct such activities in other countries with which the US government does not have treaties that govern them; otherwise not.

It is legal in the US for a foreign government to conduct such activities in the US if a treaty approved by the US Senate authorizes them; otherwise not.

I am not aware of any treaties that allow such activities in the US by any other government (or, for that matter, any laws that would allow it by either the government or private sector actors. The hack was illegal whether done by a foreign government, foreigners, or US residents. Blaming it on a "state actor" is misdirection that one supposes is intended to increase the scariness and reduce Yahoo!'s perceived culpability in the matter.

Re: Dar Yahoo Customer:

And roughly $320 Million (at 30% of the total settlement) to be shared out among the plaintiff class attorneys.

Is Tesla telling us the truth over autopilot spat?

Re: It is all in a name...

An autopilot would not have to be all that good to be better (and safer) than a great many human drivers I have observed over 50 years or so. Come to think of it, I can recall some occasions when I have to admit that a relatively simple machine might have driven more safely than I.

FBI overpaid $999,900 to crack San Bernardino iPhone 5c password

I think we can assume that Skorobogatov was not represented in the market as seen by US federal agencies, and that those who were charged a good deal. $1MM still seems high, but four months of part time work clearly understated the overall cost to him, as it skips by the fact that as a senior research associate he undoubtedly had considerable relevant background knowledge before starting. And in any case, four months of part time work for hire by anyone certainly would be much costlier than the $100 stated in the article as the cost of the hardware Skorobogatov used.

The drift of the article seems to be that the cost of developing the attack, which evidently took Skorobogatov quite a few man hours of what seems to be highly skilled analysis and electronic technician work should be ignored because the result can be replicated for a small amount going forward. That is somewhat like saying the design, development, engineering, and testing investment in a SOC should be ignored when setting a sale price for the end product, even if the projected demand is for only a few thousand units.

ICANN latest: Will the internet be owned by Ted Cruz or Vladimir Putin in October?

Re: Just a "clerical function"

Ignoring the clerical class can be and often is a great mistake. Josef Djugashvili, for example, later and better know as Stalin, arranged his rise to the top of the USSR hierarchy from his position as General Secretary of the Central Committee of Communist Party of the USSR.

Wait, wait – I got it this time, says FCC as it swings again at rip-off US TV cable boxes

Re: ...expose customer data

Like many issues, this one actually is not plain and simple, and in many locations not a monopoly either. Where I live, everyone has the option of either Comcast or CenturyLink, and a large and growing number not far away have the additional option of Google Fiber for cable TV. Nearly everyone also has good visibility of a number of OTA transmitting towers and could access broadcast material for the one time $20-30 cost of an antenna. Finally, anyone with broadband internet service from one of the above cable providers can access Netflix, Amazon, Hulu, or Acorn at fairly reasonable rates.

Brit spies and chums slurped 750k+ bits of info on you last year

Have an upvote, and thanks for pointing me to the standard that justifies my habit for quite a few years.

Maybe because some of the national security collection requests (roughly 1/3 of the total) arise out of US referrals?

Florida Man's prized jeep cremated by exploding Samsung Galaxy Note 7

I am a bit skeptical about this report. It is my impression that auxiliary power ports in automotive vehicles provided power only with the ignition on or in the auxiliary position, and I confirmed that toe be true of my two - a Honda and a Toyota. The Jeep Grand Cherokee might be different, of course, but if not it appears we are asked to believe the owner left the key in the ignition lock and the car running or on auxiliary. That seems a bit unusual, and very likely to risk theft of the vehicle.

Tesla driver dies after Model S hits tree

Re: standard operating procedures

Judging by the easily available pictures at

http://bgr.com/2016/09/07/fatal-tesla-accident-netherlands/,

https://electrek.co/2016/09/07/tesla-driver-dies-burning-model-s-hitting-tree-tesla-investigation/,

and especially

http://www.dutchnews.nl/news/archives/2016/09/mystery-surrounds-tesla-car-crash-which-killed-one-man/

It seem plausible that the tesla's crash speed was considerably greater than the maximum speed attainable by a Prius or similar car.

Re: If this wasn't a Tesla, it wouldn't be a story

Bursting into flames is fairly common among automobiles that crash into solid objects at speeds that, in this case, appear likely to be over 100 mi/hr - irrespective of their energy source. This is news notable only because it is a Tesla and the attendant possibility the driver was going at such a speed "no hands."

FBI Clinton email dossier

I've been out of touch with federal data security standards for a few years, but as of 2011, BleachBit would not have met the standard for handling disks containing Sensitive but Uncalssified data such as Social Security Number, let alone disks that ever had held any data with a secret or higher classification. The agency for which I worked handled no data classified higher than SBU, but the disposal requirement was degaussing followed by physical destruction (the agency had a shredder for the purpose. This despite the hefty additional charge for failure to return dead disks to the vendor, which we mitigated by purchasing new disks at retail to hand the CE instead of the failed disk. I an fairly sure the standard has not been relaxed.

Also heavily implicated are both Security and IT staff at State. The FBI report makes it quite clear that they knew pretty well what was going on and did nothing to stop it and forcefully discouraged those who questioned it (described more fully in the State IG report a few months back). It also makes clear the general sloppiness at State, and to a somewhat smaller degree at some other government agencies, in handling classified material. The DoD component that employed me for a number of years handled only sensitive-but-unclassified data (Personally Identifiable Information) yet was far better by about 2004 than State five full years later, both in technical protection and employee behavior. They clearly could use a good purge, although if, as many suppose, Clinton is elected President we might expect to see distribution of performance awards instead.

Re: FBI records

My cursory and as yet incomplete read of the FBI report has it that (a) she (through her minion) applied for the clintonemail.com domain about the time the Senate was interviewing her for the position, and (b) she did, in fact, change her email address to use the new domain very shortly after confirmation to the position. Couple that with the fact that there aren't a lot of email addresses that would be cooler than, e. g., [e-mail], "cool address," "used for a while and don't want to give it up,'" or "didn't want to change email addresses" simply won't do.

Add the fact that the servers were seriously non-compliant with longstanding federal law, and with FIPS and State Department standards; apparently were quite insecure in their configuration; and were known within the first two years to hackers and probably foreign intelligence services, and you get quite a mess.

i put it down to a sense of personal entitlement, combined with a disturbing casualness about following established laws and rules, that we should be very leery of in choosing a President, even if, should she be elected, she chooses "[e-mail]" for her email address.