"(1) "Subversive organization" means every corporation, society, association, camp, group, bund, political party, assembly, body or organization, composed of two or more persons, which directly or indirectly advocates, advises, teaches or practices the duty, necessity or propriety of ...

• controlling - lobbyists, right?
• conducting - lobbyists and defense contractors
• seizing - either party in an election year, year before an election year ... or these days, the day after the election we just had.
• overthrowing the government of the United States - what the hell does that mean!?!?!?!?

...

But in the end ... I think this (bolded) is the important part:
... of this State or of any political subdivision thereof by force or violence or other unlawful means

So .. in the end, it's just a virtual turing stupidity test; An easy way to round up the bottom feeder idiot anarchists/communists/whatever-ists.

Doesn't it seem just a LITTLE odd that the Chinese government would want this information, Google knows someone wants this information, and the attack originated in China?

Malevolent/Corrupt/Evil ... yet. Odd ... no.

And to make waters muddier ... how about throwing this in the mix ... to whom is the 'responsible' part of responsible disclosure? If I paid for software (.e.g IBM DB2 and other commercial vendors are on the list), the company needs to be responsible and disclose the issue to me if it was disclosed to them (... IMO). How many vendors do that when a security researcher/firm 'responsibly' discloses a vulnerability/exploit to them (with or without embargo date)?

There's more than one angle for responsibility in the debate.

I think there's validity to that ... for most semi-responsible developers.

However, if you are programming with security exceptions, you are likely to develop things that have/require more security exceptions (e.g. you must be admin/dbo/superuser/root to run it). It's not going to happen just because you're running as admin ... but it becomes much easier to do so ... unless you have pretty rigorous testing specifically targeting other user types. My team all has regular user accounts on their desktops and we do just fine. A couple of us (me as lead) have admin rights to maintain the system (we have a duplicated network/environment to do our work), install stuff etc.

Why propagate the Microsoft development model of must-be-admin-to-run-the-software?>

One way is to buy-and-shelf. There's also flooding the market with a free-but-inferior product ... that didn't quite work with Money against Quicken though

and made contractual obligations with their resellers. *gasp*

Some would say that's where they used thugs and tommy guns ... or some modern equivalent, like lawyers who can manipulate 'immoral laws'. Yes ... if OEMs and other companies had more cojones to tell M$ to screw off, some of this would have taken care of itself. Of course, we're in the US ... we use legislators and lawyers to solve that stuff.

YOW ... I think I just heard a rhino choking on buzzwords! He was saved only by the lack of 'win-win'. ;-)

Granted, some of you are concerned about people finding out the sites you visit, but what about a real world problem (or two)?

Some time back, there was an attack that threw a phony dialog pop-up saying that your timeout had been expired at your bank site. Combine that with being able to see *what* bank's site (and whether or not you have been at it recently). This could even be injected through a compromised ad-server system or the like. Maybe you don't even have to visit my site. There's some moving parts in there, but things like this, combined with click-happy-and-fill-in-personal-data user syndrome could make for some pretty sophisticated attacks.

From a private organization's perspective (many of whom have private systems, blocked off from the outer world) ... this can also be used to help map their internal network from the outside (just by one of their users visiting a site). Think about that after you visit your interal cisco web interface and then merrily tab into some other site.

I am particular about who I allow to set cookies, but not so much about my history (except that I do wipe it .. and other 'private data' when FF closes). don't know that I'll change that behavior yet, but will probably modify the config on visited site styles as some have suggested here.