Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:Roll back surveillance (Score 1) 215

Let me put this file I encrypted with PGP on an anonymous FTP site / dropbox. You can then download it and tell me what's in the file. No wait, you can't, because it's encrypted with an OS-agnostic algorithm and you don't have the key.

I'm not sure you get the point. Are the (private) keys located on the Android device? Do you enter the passphrase to unlock the private keys directly on the Android device? If so, your beloved App's security is toast, because key material is hitting the OS before it even reaches the App.

Comment Re:Roll back surveillance (Score 1) 215

Encryption is out there, and a reality. If the phone manufacturer compromises their full-disk encryption, then app makers start writing un-compromised encryption into their apps.

If it were only so simple! If the underlying OS is compromised and can't be trusted, what's the value of any encryption on top of that?

Let's say Gov't passes an anti-encryption law for smartphones. First thing Apple and Google will (have to) do, is to purge their App Stores from all apps that implement un-snoopable encryption. That's the first step. So no un-compromised encryption in apps for the plebs.

Then, next step, Apple and Google will (have to) remove all encryption libraries and support in the OS (libraries etc.), or cripple them with backdoors, so the Government(s) and other evil-doers can snoop right back in, even if Apps are still allowed to call encryption APIs.

Finally, every I/O in and out of an App has to go through some layer of the OS; and if the OS can't be trusted, what good is solid encryption? You as a user can't listen to encrypted voice, you can't read encrypted messages, you can't watch encrypted photos and videos: you're the analog counterpart that requires decryption, and this is the point where device makers will be compelled by the Gov't to let the snooping start.

Of course, there's still the option of alternative ROMs that you compile yourself out of reliable source code (CyanogenMod et al. come to mind); but here, there are still some binary blobs that are required to drive the modems etc.: same problem as with a regular Linux: do you trust these, if Government were to mandate snooping on a hardware low-level from manufacturers?

Comment Re:Should have stayed with Russia (Score 1) 12

Your politicians took the bribes from the US to part ways with Russia, now you get to enjoy the wonderful world of American IP law.

That's exactly the point. On the other hand, Russia is also cracking down on file sharing sites: remember AllofMP3.{com,ru} folding under US pressure/blackmail, or, more recently, their draconian laws on personal identification for users of Russian-based Internet services?

Comment Slow(er) learning of new application domains (Score 1) 435

As an older programmer (say, 50+), learning new programming paradigms is easy. Hell, absorbing new frameworks, programming languages etc. in a week or two is still a piece of cake. Why? Because that's not too far from the domain you know. BUT, diving into totally new application domains requires a lot more efforts than when you were younger. As an example: if you've never been exposed to an EE education and you suddenly have a project about, say, writing an antennae simulator, you'll have to absorb Maxwell's Equations, and related maths. Even if you've had CS training with maths background in your prime, you'll definitively need a lot more time to wrap your head around this with 50, 60 than if you were in your 30ies. That's not impossible, of course, but the additional time to understand this new domain, and apply it to programming, will slow you down so much that companies will often refrain from hiring you, despite your immense wealth of additional side-knowledge that could be very useful.

Comment Re:What data? (Score 1) 25

You can't be sure if they don't provide the source code. But even if they did... basically, they claim to implement Signal Private Messenger's protocol, which is strong end-to-end encryption. However, even this protocol doesn't hide metadata from WhatsApp's servers. For example, every WhatsApp user needs to keep WhatsApp directory server(s) updated about his/her current IP so she can be found by others WhatsApp users. This alone is already up to a couple of hours pretty accurate meta data that can be invaluable to Facebook... which can target you with better ads, based on your current (network) location.

Comment Explicitly destroying objects (Score 1) 239

I'm working in Unix and Network programming and also Systems programming, and I made an early habit of explicitly destroying / releasing / closing resources that are not needed anymore, even when they are reclaimed by the OS when the program exits. This includes in particular open files, and all kinds of network descriptors. Why? Because most of my code usually ends up repackaged into libraries and reused inside longer running programs (i.e. inside loops); and not being disciplined about releasing resources would result in all kinds of leaks. This is particularly bad when that code gets reused inside device drivers.

Of course, things got a lot easier once I switched from C to C++ and the STL and RAII idiom, but trying to release resources is still ingrained in my muscle memory; it takes a conscious effort in C++ NOT to explicitly release a resource acquired through initialization.

Comment Re:How to escape being compelled to decrypt your d (Score 1) 319

Please help refine this by pointing out shortcomings of this scheme.

The shortcomings is that the encryption is visible to the average guard and unnecessarily raises eyebrows.

How about this (on Android)? You install two operating system images on the phone, say, two instances of CyanogenMod, one encrypted, and the other non-encrypted, and you setup the boot loader TWRP so that it usually boots the unencrypted one. So, if the unsuspecting guard boots the phone, he'll be able to login and see a perfectly regular OS. But if YOU want to access your confidential files, you reboot the phone into TWRP with the usual key combo, and then you boot into the encrypted instance of the OS. Added bonus: you modify TWRP so that it doesn't even display that encrypted OS in the list of available bootable partitions.

Shortcomings: forensics will show that there is an encrypted partition on the phone... if they ghosted it. But if it is just the guard booting up the phone and nosing around a little bit, you're pretty safe.

Comment Always use a "clean" phone when travelling abroad (Score 1) 319

It's worth repeating ad nauseam: when traveling abroad, always use a new clean phone, i.e. another phone with a new SIM card that is not linked to your Google and other accounts... It's not just the US that seizes or snoops on phones at its borders, foreign countries do so as well. Basically, once they got hold of your phone and take it out of your sight for a couple of minutes, you never know if it hasn't been copied, and bugged. And when you're back home, always assume the phone has been physically tampered with, and make sure to throw it away (or sell it e.g. on eBay to some poor unsuspecting buyer, fair warning would be nice though). Sorry, but that's the way it is.

Comment Still waiting for that damn Windows 10 download (Score 1) 151

On one of my Windows 7 machines, I actually reserved the Windows 10 upgrade many months ago, but nothing happens. Clicking on the icon in the task bar always shows "Your upgrade is reserved... blah blah blah". So it's kind of funny to be nagged by GWX, and at the same time to wait in vain for a download that never completes. Not that it matters that much to me, it's just funny. If it doesn't complete by the deadline, that machine will stay on Windows 7 which runs just fine. I got an upgrade on another test machine without any problems; and all this is only to analyze the behavior of Windows 10 w.r.t. security. Real work with sensitive data I do on Linux and FreeBSD anyway.

Comment Re:Different expectations (Score 1) 1592

Indeed. And even if we opt for a USE, there are different models for such a USE: a centralized ideal French-style, a federalized one German-style, ... and economically, a more socialist-authoritarian one French/German-style, a more capitalist-liberal one British/Eastern-European-style. Trying to find a common ground and to converge towards a model that is acceptable by all member states is nearly impossible. Just look at the total fiasco that the single currency Euro turned out to be: due to different financial philosophies between North and South, the whole Euro-Zone is shattered, and their central bank is printing billions of Euros like there's no tomorrow, heading right towards a super crash. Frankly, the anti-USE in the UK have won, and it pains me to say: they were right. I too was hoping for some kind of USE, but I grew disillusioned. I think right now that the EU should be rebooted and rebuilt (much more carefully) from scratch. On the second try, things could improve. As it stands now, keeping working on it will only add more misery to an utterly broken design, IMHO.

Comment Re:Next: France? (Score 1) 1592

Why would France wants to leave the EU? Unlike Britain, they get more from the EU in the form a subsidies than they pay into it. Those wanting to get out of the EU are those people who are feeling that they are constantly paying more than they are getting back, like the Brits (and the Germans, Finns, Dutch...). The financially poorer "Club Med countries" like France would stay as long as they can find financially more stable countries in the EU like Germany, the Netherlands, Finland etc. would will be more or less willingly footing their bills. Greece, Italy, France, Spain, ... would be the last to leave. I'll be more worried about the northerners, and, maybe the easterners at this point in time. What we're seeing right now is an "Who is John Galt?" kind of Ayn Rand-ish moment, Euro-style. Maybe more countries will quietly vanish from the EU as times flies by...

Comment Re:Opting out (Score 1) 85

Actually, very long-term sysadmin here, responsible for huge number of servers and users. Believe it or not, once you're herding a certain threshold of users/machines, you stop being curious about individuals' behaviors, porn, lives, whatever... it becomes totally irrelevant.

Those guys working at 3/4 letter agencies are in the same position: I'll bet what you want that most of them are bored senseless when they are alerted by the algorithms that they have to look into some real-life data, just to find out that it is in 99.9% a false positive, again! Sure, you'll have some rogue PFY in there too with BOFH phantasies doing his or her thing w.r.t. their near relatives, but hey, that's bound to happen anyway, with or without surveillance agencies. That's NOT the rule, that's the tiny exception.

Personally, I'm not worried at all about that kind of surveillance and their personnel; as I've said, I'm more concerned about keeping THEM and their commercial and criminal counterparts out of networks they persistently try to infiltrate for industrial espionage purposes. THAT's where they are a nuisance, not their amateurish-organized mass-surveillance business that is still in its infancy, despite claims to the contrary.

Yes, I'm strongly pro-privacy, but I'm too long in this area to be easily impressionable: there are simply logistical and physical limits to what such a system of mass surveillance can achieve; limits that can't be overcome, no matter what efforts are being put into it. Some will be worried by this fact, others will be reassured by it, but however we see it, that's life. I'd rather prefer life to be somewhat random, and not totally under control, and I think it will always remain this way, thankfully.

Slashdot Top Deals

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Working...