Re: Publishers could simply
"Dude, I was so with you until that last paragraph."
To what were you objecting - that he was a publisher or that he had a safe ads policy? Should he have had an unsafe ads policy?
40557 publicly visible posts • joined 16 Jun 2014
If the ads are hosted by the site the ad-blocker would be a no-op unless it blocked the entire site so the first part of your comment would be irrelevant. It would also enable the site would have to take responsibility for what it showed so there would be an incentive to filter out attempts at malvertising and a disincentive to repel viewers with ads that offensively attempt to stick their fingers into visitors' eyes and ears.
@Adam 1. Could you explain your second point a little more clearly.
However, I think you've missed something from the article. It would require the site to ask every visitor to ask permission for their browser to be probed. In the interim either the ad-blocking visitor gets to read the page or, if the page is obscured my any means nobody, ad-blocking or not, probe-consenting or nor, gets to read the contents. This means that the site manages to piss off everyone, including those of whom the site might approve.
It also has an interesting side effect. It would present the page authors the problem of explaining why it wishes to probe the user's browser. If they don't give a clear explanation then it will look a little sinister to naive users and if they do it alerts such users to the existence of these things called ad-blockers which they might then investigate and find to be a good idea.
'"It was in my view worth it," he added. Of course, nothing useful was found on the iThing.'
And we're not even told what was found that wasn't useful. So what evidence do we have, other than Comey's own statement, that the phone was broken at all?
From his point of view, of course, it was worth it as a face-saving way to climb down from a position he thought he could win and then found he couldn't.
"the ICO blatantly trying to save Police face"
How do you make that out?
The ICO has said there was a serious breach. It's imposed a fine. It's done what it's enabled to do by law.
We complain when public bodies act beyond the law. That can't be squared with complaining when they don't.
"Exactly, the person that 'lifted' (actually stole) the additional data from the phone should be charged with theft"
How many times do we have to go over this? It's just like the unending "copyright violation is theft" crap.
Theft is taking with intent to permanently deprive the owner. Copying isn't theft, it's copying. The two are not the same thing.
"It's one of the ICO's few tools in these circumstances"
It really ought to have been considered at the time the DPA was drawn up. Fines are inappropriate for a public body. There seems to be an assumption that public bodies wouldn't breach the provisions. We now realise that they're one of the categories of data managers who present most problems. In the absence of any other more appropriate provision there needs to be a mandatory requirement for personal responsibility.
But I still can't get my head round the notion that this was supposed to have been carried out in accordance with the force's procedures. Are the procedures really so stupid as to mandate this or are they so vague that anything would be in accordance?
"The force has not responded to questions from The Register as to whether it anticipated allegations of corruption as a result of a victim's private data being passed to a suspect employed by it."
Did you ask whether disciplinary action had been taken? It's one thing to have procedures, it's another to follow those procedures without engaging brain. There should have been a "this doesn't seem right" moment.
"Have you tried removing data, such as records of dead people from a CRM system?"
Removing data should be a design requirement. If it was and the implementation was competent then removal shouldn't be difficult.
In this case we're dealing with public servants who in positions of trust. That means they should be able to show that they deserve our trust. If it's difficult or impossible to remove the data of innocent people then we can reasonably infer that they didn't include that in the design, that they didn't intend such data should be removed and that maybe we can't trust them.
"Sadly some may break the rules, that is what supervision, management, the police and other agencies are supposed to be there to control"
True. And those who break the rules, at least those rules which are part of legislation, can be prosecuted. But are those who break this set of rules prosecuted? If not why not? People have been asking "Quis custodiet ipsos custodes?" for a very long time and with very good reason.
'Listed companies are obliged by law to release "price sensitive" information to the markets in a controlled manner'
It depends when the last meeting with the council was but it seems dubious whether 'at the last meeting between Kildare County councillors and Intel, the company claimed things were picking up' is a controlled manner.
"The FBI clearly messed up and need a telling off, but it can't be in the public interest for this many convictions to go down on a technicality."
That technicality might one day protect you against a false accusation.
Along with "if you've nothing to hide"* we keep hearing "nobody is above the law". Well, that one is right, nobody should be above the law and that includes the law enforcers.
*Which is too close to abandoning the presumption of innocence and should be treated with the contempt it deserves.
"Neither the article author nor the EU have come up with any solid proposals as to how their idea of a mix-and-match phone would actually work."
If the finding goes against Google that's Google's problem. But one solution seems clear enough from reading the article - remove the restrictive terms on licensing the APIs.
"Google is trying to control the Android stack, that much is undeniable, so the question is whether that control is ultimately harmful to such an extent that it is illegal"
And determining whether it's illegal is the outcome of legal processes such as that which the EU is launching. If they're doing that they must have a basis for believing it to be so and the present article presents informed opinion that supports such belief.
As you say, it's a question. Don't you agree that it should be answered by the appropriate mechanism?
"The problem is that they can't .. at least not without falling foul of US law when the feds come a-knocking."
There are ways. Microsoft think they've got one with the data trustee set-up they're putting together in Germany. An alternative would be to have EU nationals set up an EU corporation to run the operation in the EU in data centres owned by the EU corporation under EU law as a franchise with the terms of the franchise specifically preventing the US parent from accessing the data.
I can't think why they haven't done this already - I'm sure there's no shortage of legal expertise in setting up franchises when it comes to tax arrangements - unless they don't want to share the money with their franchisees.
"or US companies operating in the EU the solution is simply making a sincere effort to abide by the law there."
No. The solution is simply to abide by the law. Sincere efforts are not enough. It will take a serious reorganisation of how they do business. If the Microsoft data trustee scheme proves effective then that sort of solution would suffice. If not then they'll have to resort to a franchise operation where the entire operation is hands off for the US parent.
I don't know the ins & outs of this particular site* but I suspect in a lot of cases the business has no IT knowledge whatsoever. They found somebody local who could "do" them a website for some amount of money. The somebody has then arranged to host the site and moved onto the next client. The client may not even have seen the T&Cs, much less read them, much less understood them. It wouldn't surprise me if there were e-commerce sites there where the business's only copy if its entire transactional history is the website's database complete with customers' credit card details.
*It's football - my personal view is that anything involving 22 men chasing a bag of wind up and down a field could be removed from the planet with no loss whatsoever.
' people doing things that they know in their real heart of hearts is a "bit dodgy" need to bear this in mind'
Do you, in your real heart of hearts, know that it's a "bit dodgy" to order you groceries online and pay through online banking? If not then, by your own arguments as far as I can follow them, you are entitled to best security to protect that transaction and your bank account.
Your phone, tablet, laptop or whatever can't have two automatically selected encryption modes, one for dodgy and one for not dodgy.
"you should assume that when the Feds arrive with the proper papers they'll be given what they ask for."
Barry, sit down before you read the next bit, it might shock you.
Sitting comfortably? OK.
There are other governments in this world besides the US.
Some of them might not have human rights policies that you agree with. Who makes the call when one of those rocks up to $vendor with proper papers? Does $vendor let them all in? Or none? Or should they call you with your great powers of judgement of who's right and who's wrong?
Stay sitting down because the next bit might shock as well.
In addition to governments there are also criminals who might want to break encryption.
If you've given out the keys to legitimate requests (whatever those might be) how do you control them so that the criminals don't get them? Or if you tackle the issue by installing back doors you do you prevent the criminals from discovering them?
"Probably by way of skimming only a low bit count out of the generator"
You still have the problem of ensuring that the low bit count numbers repeat any patterns in the high bit count. To take an extreme example you take the low 8 bits, they look random but the top 8 bits are cycling through a short repeated sequence.