Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Privacy

Former NSA Director: 'We Kill People Based On Metadata' 155

An anonymous reader writes "An article by David Cole at the NY Review of Books lays out why we should care as much about the collection of metadata as we do about the collection of the data itself. At a recent debate, General Michael Hayden, who formerly led both the NSA and the CIA, told Cole, 'we kill people based on metadata.' The statement is stark and descriptive: metadata isn't just part of the investigation. Sometimes it's the entire investigation. Cole talks about the USA Freedom Act, legislation that would limit the NSA's data collection powers if it passes. The bill contains several good steps in securing the privacy of citizens and restoring due process. But Cole says it 'only skims the surface.' He writes, 'It does not address, for example, the NSA's guerilla-like tactics of inserting vulnerabilities into computer software and drivers, to be exploited later to surreptitiously intercept private communications. It also focuses exclusively on reining in the NSA's direct spying on Americans. ... In the Internet era, it is increasingly common that everyone's communications cross national boundaries. That makes all of us vulnerable, for when the government collects data in bulk from people it believes are foreign nationals, it is almost certain to sweep up lots of communications in which Americans are involved.' He concludes, '[T]he biggest mistake any of us could make would be to conclude that this bill solves the problem.'"

Comment Remove computers can be anywhere ... (Score 5, Insightful) 76

including other countries; I did not notice anything in the article restricting this to computers in the USA. Other countries might not agree with the USA DOJ allowing computers in their countries to be cracked -- thus the USA cops/investigators will be conducting criminal acts in other countries -- how does that make them different from what the USA wanted to grab Gary McKinnon for ?

Comment depinit (Score 4, Informative) 533

depinit. written by richard lightman because he too did not trust the overcomplexity of sysv initscripts and wanted parallelism, it was adopted by linux from scratch and seriously considered for adoption in gentoo at the time. richard is extremely reclusive and his web site is now offline: you can get a copy of depinit however using archive.org.

using depinit in 2006 i had a boot to X11 on a 1ghz pentium in 17 seconds, and a shutdown time of under three. depinit has two types of services: one is the "legacy" service (supporting old style /etc/init.d/backgrounddaemon) and the other relied on stdin and stdout redirection. in depinit you can not only chain services together for their dependencies but also chain their *stdin and stout* _and_ stderr together.

that has some very interesting implications. for example: rather than have some stupid system which monitors /var/log/apache2/logfile for security alerts or /var/log/auth.log for sshd attacks, what you do is run sshd or apache2 as a *foreground* service outputting log messages to stderr, chained to a "security analysis" service which then chains to a log file service.

the "security analysis" service could then *immediately* check the output looking for unauthorised logins and *immediately* ban repeat offenders by blocking their IP address, rather than having to either poll the files (with associated delays and/or CPU untilisation) or have some insane complex monitoring of inodes which _still_ has associated delays.

also depinit catches *all* signals - not just a few - and allows services to be activated based on those signals. richard also had a break-in on one system, and they deployed the usual fork-and-continue trick, so he wrote some code which allowed the service-stopping code to up the agressiveness on hunting down and killing child processes. this also turned out to be very useful in cases where services went a bit awry.

basically the list of innovations that richard added to depinit is very very long, in what is actually an extremely small amount of code. i simply haven't the space to list them all, and no, richard was not a fan of network-manager either.

btw you might also want to look at the replacement for /bin/login that richard wrote. it was f****g awesome. basically what he did was use gpg key passphrases as the login credentials.... and ran gpg-agent automatically as part of the *login*. i have never even seen a PAM module which does this trick. it would be awesome to do the same trick for ssh as well.

it's fascinating what someone can get up to when they have the programming skill and the logical reasoning abilities to analyse existing systems that everyone else takes for granted, work out that those sytems are actually not up to scratch and can write their *own* replacements. it's just such a pity that nobody seems to have noticed what he achieved.

The Internet

Why the Sharing Economy Is About Desperation, Not Trust 331

An anonymous reader writes "Wired recently ran a cover story about the sharing economy — shorthand for the rise of peer-to-peer rental services like Lyft and Airbnb — which they call a cultural and economic breakthrough. They say it has ushered in a 'new era of Internet-enabled intimacy.' An article at New York Magazine has another theory: that it arose because of the weakness in the real economy. Quoting: 'A huge precondition for the sharing economy has been a depressed labor market, in which lots of people are trying to fill holes in their income by monetizing their stuff and their labor in creative ways. In many cases, people join the sharing economy because they've recently lost a full-time job and are piecing together income from several part-time gigs to replace it. In a few cases, it's because the pricing structure of the sharing economy made their old jobs less profitable. (Like full-time taxi drivers who have switched to Lyft or Uber.) In almost every case, what compels people to open up their homes and cars to complete strangers is money, not trust.'"

Comment learn how to learn (meta-learning) (Score 1) 247

there is actually something which is far more useful to be able to do, more than any amount of books read, which is only really possible effectively and efficiently now that internet searches are possible (and quick, and accurate), and that is meta-learning. in its crudest most disparaging form one might mistakenly call this cut-and-paste programming but it is actually nothing of the sort.

basically what you do is treat everything as a black box, and use the principles of the 6 different types of knowledge (listed on the wikipedia page for Advaita Vedanta, which is mentioned specifically because the western word Epistemology is woefully inadequate) to basically reverse-engineer the subject matter and in effect teach yourself *on the go* by way of analysing the results achieved, even though you are starting out from quite literally zero knowledge.

it does however take a hell of a lot of balls to do this *whilst being paid* and most employers simply will not believe you when you tell them that this is something that you can do... and be *more effective* at applying this technique than people who have been explicitly trained or quotes have experience quotes in the field.

to be fair to those people who genuinely do have experience, often such people *may* have encountered the circumstances before, such that they *may* have the answer much quicker than you-who-has-no-experience-at-all, *but*, the critical critical thing that you need to tell prospective employers is: what happens when something falls *outside* of the experience of the person who quotes has experience quotes? whom then would the employer rather have (if they had to choose one or the other rather than both people) - the person who will get there in the end, regardless of what they are asked to do, or would they rather have the person who can get there *most* of the time but who does not have the skills or intelligence to work out the all-important remaining last 10% of the job, without which the contract will remain unfulfilled and the company will go bust because of it?

in short: no amount of reading will substitute for learning how to learn and applying that skill *every single moment of your life*. when i hear people say i am too old to learn it makes me cringe, and i feel sad for them - i cannot say anything so i have to remain silent - but i feel sad for them because i know that inside they have given up. the only time to give up learning is when you are actually dead, and not before!!!

Comment cost now (losses) vs cost (funding) (Score 2) 80

ynow... there is a moral to this tale: if businesses and individuals making money from software (libre) had properly funded it, putting some of the money that they saved from not purchasing proprietary software into the hands of those software teams, would we be talking about this now? in all probability, the answer is no. the reason is because those teams would be able to expand, take on more people, pay for security audits and so on which they would otherwise, as we have discovered, not be in a position to do.

so my take on this is that it is really really simple: businesses have received what they paid for, and got what they deserved.

i have been through this experience - directly - a number of times. i worked on samba - quietly - for three years. whilst the other members of the team were receiving shares from the Redhat and VA Linux IPOs, which they were able to sell and receive huge cash sums - i was busy reverse-engineering Windows NT Domains so that businesses world-wide could save billions of dollars.... and not one single one of those businesses called me up to say thank you, have some cash. as a result, about a year after terminating work on samba i was working on a building site as a common labourer.

it was the same story with the Exchange 5 reverse-engineering, which the Open Exchange Team mirrored (copied, minus the Copyright and Credits).

there is a moral to this tale: unlike proprietary software, which has a price tag commensurate with its perceived value, the process of even *offering* payment to individuals working on a software libre project that has been downloaded, usually from a completely different location (via a distro), is completely divorced from the developers actual efforts.

even in shops in rural districts, it is understood that if the door is unlocked and the shopkeeper not there, you help yourself, open the till, sort out your own correct change and walk out. but in the software libre world there is often not even that level of expectation! the software is quotes free quotes therefore it is monetarily zero cost therefore we should not have to pay, right? and businesses are pretty pathological about taking whatever they can get without paying for it.

so the short version is: there is a huge disconnect in software libre between service provision (the software) and paying for that service, and i really cannot see a solution here. perhaps this really should be bigger news: perhaps in this openssl vulnerability we have an opportunity to make that clear.

Comment Re:Careful! (Score 1) 137

Your summary still might help some others.

It's a cable modem and regular Vimeo works just fine. It's only the VOD stuff that shows this off behavior (because it loads the video in 40 MB pieces to circumvent most download tools and fails to stitch them back into seamless output).

Comment Re:Careful! (Score 1) 137

Won't work in this case, but thanks for the good intention.

Unlike regular Vimeo, where it's easy to work around the basic methods, the VOD site loads parts of the video in 40 MB or so pieces, tries to stitch them together again and in my case it failed miserably at doing so (despite a proven and more than sufficient downlink),

Comment Re:Careful! (Score 1) 137

Unless you actually know what was going on, shove your assumptions where the sun don't shine.

This was the first bad HD streaming experience in years and the connection has performed without problems throughout the long easter weekend as well (over here that was an extended weekend from Friday to Monday). HD streams by other sites didn't cause any problems either, the problem was reproducible across tabs and browsers and using the web developer tools you could practically watch the stream arrive too late, piece by piece and with not nearly enough overlap to provide seamless playback.

If it looks like a duck, walks like a duck, quacks like a duck, ...

Comment Careful! (Score 4, Informative) 137

The movie was worth the five bucks to watch it on Vimeo, but their Flash-based player (no quick way to switch to an HTML5 version) resulted in such a choppy playback that the constant pauses and buffer attempts added another half hour to the whole thing.

Since it's a 95 minute movie we're talking about a quarter of the time being spent on just waiting for the fucking site to do its job again.
Before anyone asks: The 100MBit connection has never been a problem before and the necessary software was up to date as well.

Hope you'll have more luck. Except for the predictable end it's quite a nice movie.

Comment Re:Low end can become high end (Score 1) 87

your anaolgy does not work. PCs and mini-computers were fundementally different, applications written for one would, generally, not work on the other. When low end tablets become more powerful: AMD has the products to just slot in and take advantage. AMD has both x86 & ARM chips -- it even has one that does both!

The other thing to worry about is business relationships with the tablet vendors. AMD sells to many of them, so no problem there.

No, AMD is not locking itself out of this market.

Slashdot Top Deals

He who steps on others to reach the top has good balance.

Working...