Posts by Doctor Syntax 42400 publicly visible posts • joined 16 Jun 2014
"the Attorney General's advice was very clear. It would be totally irresponsible of government to allow the legal system to dictate to us on matters as important as terrorism. Not only would they tie things in knots very quickly, but they are not elected and answerable to nobody."
Translation: "We're above the law"
"> But the question was about Win10, not Windows Phone.
The question was about phones."
The question was about Windows 10 on phones.
And MS is positioning W10 as being the same on all its platforms so the question was a good one.
Of course in practical terms running Windows on different PC hardware often requires the hardware manufacturers to ensure drivers are available so the same thing would apply with phones so such an idea would still require MS & Sammy to cooperate.
"> Is there any practical reason why Microsoft can't do a deal with all of the major phone suppliers to allow Win10 to be installed as an alternative to Android?
Yes. Each model of phone is unique in having one of a large variety of SoCs complemented by different system components such as screens, audio, buttons, etc. This is not a problem for Android because the source code is available and the integrator can modify as required to suit.
Windows Phone is built by Microsoft to suit a limited set of SoCs"
But the question was about Win10, not Windows Phone. And Windows 10, like their other desk top OSs runs an a wide range of hardware by having installable drivers. If they are really set on providing this platform agnostic user experience than Win10 should surely work the same way. In fact it should be a test case for how well they've done that or whether they've simply applied the same interface over different foundations.
"Why not? It's been working well with Linux for years."
The interfaces differ and that's the layer which needs to respond to form factor. My laptop runs KDE4 with keyboard & mouse. My MythTV box interface is menu based with a remote control. My router has a web interface or alternatively a command line for better customisation.
First there's an assumption that computing is now in a post-PC phase. This is the view from people who sell stuff as opposed to people who use stuff. If you've got a PC that works you use it but tough for the people who want to sell you another. The market is more or less saturated so people flogging PCs and their bundled software have either got to put up with it or offer something new and desirable. In order for it to be desirable they really need to pay attention to the users and I'm not convinced they're doing that.
As to the idea of a unified experience that reminds me of icons on a lot of consumer hardware - designed to be equally incomprehensible in all languages.
There's an implicit assumption here is that if you want to build expertise in a big company you buy in a company that already has that expertise. What about just going out and recruiting people? apart from anything else the people you recruit must have at least a vague preference for working for you. The people you buy in? not necessarily.
"But base 10 is a dreadful system"
Quite true. The metric enthusiasts mock our old ponds and ounces. But given a pair of scales (just scales, no weights) would you prefer the task of dividing a pound of sugar into 16 ounces or a kilo of sugar into 10 lots of 100gm?
Metric is so nineteenth century.
"We removed all illegally uploaded pages as soon as we became aware of the breach. Next, we changed all the passwords and increased their encryption to avoid such mishaps in the future. A thorough investigation to make sure the breach does not exist anymore is in progress."
Translation: we bolted the stable door.
"Well, I'm not sure it's tactful for a minister to say that it was actually his prime minister who was responsible for the said misinformation, which is probably why he did not elaborate further."
There you are, you see. You've been misinformed. The Prime Minister never said such a thing. On the contrary he's been following the TalkTalk saga and is quite adamant that if his strong recommendation for encryption had been followed it wouldn't have happened. And anybody who said anything different has been spreading misinformation.
Now do you understand?
"A kitemark says that way back when it was awarded, no obvious security holes were found. It does not mean that the site is secure."
Could it be made meaningful?
1. Requires regular 3rd party checking to a given standard, preferably including pen testing. Regular as at mandated intervals, say 6 monthly.
2. Date of last test shown on site.
3. Covered by insurance. Preferably no limit to amount insured.
4. Expiry date of current insurance shown on site. If the amount of insurance is limited this should also be shown.
This would mean that there would be at least two parties, the testing company and the insurers and maybe also the testing company's insurers standing behind the site's certification.
It could work, it wouldn't be cheap but it would mean that you'd be able to identify a site that took security seriously.
Self-certification? ROFLMAO
"I'd have more sympathy if she'd had to explain to a group of idiots (as I'm sure we've all had to, even if only hypothetically) that the data was encrypted, but they got the keys because the web service needs to be able to decrypt the data to use it."
Maybe that's how someone explained it to her.
'Dido Harding goes on record stating two interesting things: firstly, that their security is apparently "head and shoulders" above competitors.'
Unless by "head and shoulders" she was referring to the shampoo this seems an ill-advised thing to say. How many other ISPs can she name who've been popped more times this year?
The technical means of how data was protected is secondary. The main issue is that whatever measures they did take were inadequate.
A precedent set in the US wouldn't be binding elsewhere. In any event I'd guess that Apple will push this to the Supremes.
If the judgement stays I'd also guess that it will provoke some changes to EULAs to make them more customer friendly which might not be a bad outcome in the long run.
"I suspect what the Feds are saying is, you control what software runs on the device, so push software to the device that allows us to get unfettered access; i.e. you have the capability to backdoor the device so we are ordering you to do it."
It's not what the Feds are saying. From the article: "the device in question is an iPhone 5s running iOS 7 – one of the devices that Apple can unlock" (my emphasis).
However, it's worth looking at the point you make. If the device isn't unlockable by Apple the likelihood is that it requires key input by the user. In the absence of such input it would make no difference what S/W Apple were to push on to it it would stay locked so no amount of huffing & puffing by the Feds would help them in the least.
'I think that Apple is saying, "This is not *our* information to hand over, it's his or hers," and pointing the feds at that individual.'
However, the point is that there is a search warrant. Due process of law is being followed. We complain when the authorities don't follow due procedure. When they do we should acknowledge the fact.
"I used to be a Tiscali customer, and was swept up in the takeover."
I used to be a Nildram customer. Nildram was taken over by Pipex which was taken over by Tiscali but the email address remained Nildram. After the TalkTalk takeover I also bailed out. As a matter of curiosity I just tried a test post to my old Nildram address. It bounced but a quick whois indicates the domain expired yesterday. Deliberate, coincidence or have they just been too distracted to renew it?
That efficiency thing that Tim's kept mentioning has a lot to do with the fact that we spend relatively little on food. Selective breeding has given is more productive varieties of plant and animal. Artificial fertilisers have artificially increased the fertility of the ground. Mechanisation has reduced the need for labour. Chemicals have improved the health of both plant and animal crops.
On the other hand financial services seem to be costing us more. Why? There have been technical inputs which should increase efficiency there, just as in farming.
I suspect the reason is similar to why bank robbers rob banks - it's where the money is. Ultimately it's the money men who largely decide prices (including screwing the farmers) because they can. It's not surprising if they receive an increasing share of it. When we discuss adding value I think we often confuse it with adding cost. The actual value of the added cost can be extremely dubious.
"the elasticity of demand for food is lower. If the price halved, or doubled, we wouldn't eat twice, or half as much, we'd eat roughly the same"
Unfortunately the daft pillocks with their nudge theory are trying to do just this with sugar. However I have about 100sq metres I can devote to beet cultivation.
"The problem is that the Constitution recognizes political speech as the most important form of free speech"
The odd thing about this is that the politicians don't see this as freedom to lose votes. Or maybe they run robocall campaigns impersonating their rivals?
"How do you deal with international robocallers who basically operate outside of the law?"
Your phone company knows where they got the call from so they can bill for it. They log the callback code against it and so on back up the line. If the callback reaches somebody who didn't keep track they become liable. PDQ they'll also be keeping track until it hits source.
"I of course don't follow the argument 'Nothing to hide. Nothing to fear'."
You don't? OK, if you've nothing to hide then why not unhide all your logon & security answers for banking, eBay, Amazon or whatever? You could just post them here*.
As to resources, go back up the thread & read some of the other posts. The significance of this discovery is that once you've done a humungous amount of computation for a commonly used prime it becomes relatively cheap to attack any connection using it so the more that are attacked the cheaper the cost of each. So yes, if you've done the initial work why not look at what that webcam's seeing, what that VOIP call's about, what that person's bank account has in it? It's so easy to just ignore due process of law. But due process of law is the basis of a free country.
*Or rather, don't. You almost certainly not only have stuff to hide, you also have contractual obligations to hide it.
John,
There are some flaws in your argument.
Just consider the consequences of adding the word "yet" into some of your sentences. How do you stop that "yet" happening?
Apart from the potential damage to your own society (I conclude from your arguments that you're a US citizen) you need to realise that the rest of the world doesn't trust the US. We don't trust it on a personal level and we don't trust it on a commercial level if a non-US corporation is competing with a US corporation for a sufficiently large chunk of business. The reason we don't trust it is because of its behaviour.
Finally we don't necessarily trust non-US governments either because this surveillance is usually done without any regard to anything that might pass reasonable scrutiny as due process of law. It's odd that this year your country and mine have both been celebrating the 800th anniversary of Magna Carta at the same time as our governments have been doing their best to ditch its most significant clause.
The argument put forward in the paper is that the processing for a single prime is mathematically feasible but computationally very expensive. But what the researchers realised was that once you'd done it the additional work to crack any eavesdropped exchange was trivial and that as the same prime was being used by a large number of sites for a long period the cost could be spread out over an enormous amount of traffic. It was this which made it economically feasible.
If the a larger number of primes were used for shorter periods the economics would work against it and only a small proportion of the traffic would ever be decrypted. As to being concerned about future computer power, you have to remember that in order to make decryption worthwhile you have to do it whilst the messages are still relevant.
Nevertheless, a switch needs to be made to better algorithms or much longer primes.
