I find it extremely interesting that Appendix E of that report does not discuss the NSA's role (or not) in twiddling with Dual EC DRBG. It's the only crypto component that they've been explicitly called out on, and it's not discussed.

NIST and NSA have all sorts of partnerships (look at NIAP as an example). On the whole, however, they are distinct organizations with some overlapping function. NIST, for example validates cryptography implementations through the CMVP and the CAVP. Also of note is that the NSA has two arms: an offensive arm and a defensive arm. I'm somewhat annoyed with the /. crowd for not recognizing this and realizing that it is the offensive NSA arm which is potentially responsible for deliberate cryptographic weakening.

I just saw a TED talk in which the presenter asked this very question.

Actually, although your message is clear, the details are not entirely correct. Regardless of how long you are outside of the country, if you have strong ties in Canada (a house, a wife/husband/children/family, bank accounts, etc.) then you are still considered a "factual" resident for tax purposes (http://www.cra-arc.gc.ca/tx/nnrsdnts/cmmn/rsdncy-eng.html). You must still FILE taxes, but you don't (necessarily) have to PAY taxes. You pay taxes only on income received from Canadian sources. Any so-called "Worldwide income" is exempt from Canadian taxation as long as there is a tax treaty with the counterparty country (http://www.cra-arc.gc.ca/E/pub/tg/t4131/t4131-e.html#P201_20183).

If you live outside of the country for more than 6 months (6 months plus one day), then you aren't afforded medical insurance. Hence, snow birds who fly back and forth from Canada every 6 months.

Yahoo Answers is the only site I've ever decided needs to be worthy of the Google block.

I've always been amazed at things like SAS 70 which, as the poster states, is based on self-defined criteria. The most shocking part, if I recall correctly, is that the criteria are not publicly consumable! This is the worst part of it all and the key part which needs to change.

You mean something that causes something to churn whenever you see it?

I prefer sexy robocalls from Cowboyneal.

I think /. needs a "this" button. I'd mash it on this post.

Wow. The multi-target radar system is *more* complicated than your proposal, is it? I'd like to see how you quantify your variables and make it hold up in a court of law.

Look, I'm all for simplicity especially when it comes to rules and laws, but anything that is "relative" is asking for interpretation and hence, more complexity.

Actually, TFA believes that the vector was a removable drive by which they periodically update their map collections.

Remember, Canada is a big place. 75% of all Canadians live within 90 miles of the US border. So keep this in mind while you read all of the comments saying what a calamity this is for Canadians. Northern Canada -- and I say this as a Canadian, though some may disagree (like we disagree about what it means to be in Eastern Canada or Western Canada) -- generally are those who live above 55-60 degrees N which is an exceptionally small percentage of the total population.

I believe it was a multi-tiered attack in that Java, Flash, and PDF exploits were all tried. What is shown in the video is that the Java attack was successful.

TFA specifically uses an example of a failed hard drive to describe the workflow. You can see that a failed hard drive is something small, easily diagnosable, and -- in the greater scheme of things -- easily fixable.

Now, if you recall what happened with AWS in April, they had a low-bandwidth management network that all of a sudden had all primary EBS API traffic shunted to it. This was caused by a human flipping a network switch when they shouldn't have. Something like this is not something that happens all the time, has little, if any diagnosable features, is not well-defined to have a proper workflow attached to it, and needs human engineers to correct. This is an example of a complex, large-scale problem.

Read the article, it's actually quite interesting.