Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Submission + - NSA Reform Bill Backed by Both Parties Set to Pass House of Representatives

HughPickens.com writes: The NYT reports that after more than a decade of wrenching national debate over the intrusiveness of government intelligence agencies, a bipartisan wave of support has gathered to sharply limit the federal government’s sweeps of phone and Internet records. A bill that would overhaul the Patriot Act and curtail the metadata surveillance exposed by Edward J. Snowden overwhelmingly passed the House Judiciary Committee by a vote of a 25-2 vote and is heading to almost certain passage in the House of Representatives while an identical bill in the Senate — introduced with the support of five Republicans — is gaining support over the objection of Senate Majority Leader Mitch McConnell who is facing the prospect of his first policy defeat since ascending this year to majority leader. "The bill ends bulk collection, it ends secret law,” says Rep. Jim Sensenbrenner, the original author of the Patriot Act who has now helped author the Freedom Act. “It increases the transparency of our intelligence community and it does all this without compromising national security.”

The Patriot Act is up for its first reauthorization since the revelations about bulk data collection. The impending June 1 deadline for reauthorization, coupled with an increase of support among members of both parties, pressure from technology companies and a push from the White House have combined to make changes to the provisions more likely. The Snowden disclosures, along with data breaches at Sony Pictures, Target and the insurance giant Anthem, have unsettled voters and empowered those in Congress arguing for greater civil liberties protection — who a few years ago “could have met in a couple of phone booths,” says Senator Ron Wyden, Democrat of Oregon. The Freedom Act very nearly passed both chambers of Congress last year, but it failed to garner the 60 votes to break a filibuster in the Senate. It fell short by two votes.

However some say the bill doesn't go far enough. The bill leaves intact surveillance programs conducted by the Drug Enforcement Agency and levies high penalties against those offering “material support” to terrorists. It also renews the expiring parts of the Patriot Act through 2019. "This bill would make only incremental improvements, and at least one provision – the material-support provision – would represent a significant step backwards,” says American Civil Liberties Union Deputy Legal Director Jameel Jaffer. “The disclosures of the last two years make clear that we need wholesale reform.”

Comment Re:Uh, only doubled? (Score 3, Interesting) 160

So how does a 40 year old computer system get replaced and only doubles the number of flights capable of being tracked?

Tracking double the number of flights likely requires about 4x the about of computing power. A naive comparison grows at a rate of (n)(n-1)/2. You might be able to reduce that by not comparing aircraft that aren't going to be anywhere near each other (e.g. a plane in Washington D.C. cannot readily crash into a plane in Los Angeles, CA until they get close to halfway across the country), but still....

Submission + - Mozilla Wants To Deprecate Non-Secure HTTP

An anonymous reader writes: Mozilla today announced its intent to phase out non-secure HTTP, and that it will be making some proposals to the W3C WebAppSec Working Group soon. Specifically, the company says it is committed to "new development efforts on the secure web and to start removing capabilities from the non-secure web." Richard Barnes, Firefox's security lead, emphasized the company needs to work with the broader Internet community to achieve this ambitious objective. "Since the goal of this effort is to send a message to the web developer community that they need to be secure, our work here will be most effective if coordinated across the web community," Barnes said, and then outlined Mozilla's plans as two-fold, though details on how exactly Firefox will be impacted are still unclear.

Comment Re:I remember him From Usenet as quite a gentleman (Score 1) 138

English will rip it out of your hands.

What? But it's not yours, it's ours. O.K., keep it, it makes barbaric (excuse me, i meant English...) easier for us.

James Nicoll put it best:

The problem with defending the purity of the English language is that English is about as pure as a cribhouse whore. We don't just borrow words; on occasion, English has pursued other languages down alleyways to beat them unconscious and rifle their pockets for new vocabulary.

Comment Re:Subs as aircraft carriers (Score 1) 75

Comparing an attack SSN with something the size of an aircraft carrier. Well done. How fast do you think this thing would be and what kind of spike would it give on say, a magnetic anomaly detector? You can't make a small city "stealthy" and quiet underwater. Even SSN's and SSBN's can be tracked. Imagine your carrier. Also, troll does not mean "someone who disagrees".

Submission + - Attack on Point of Sale Vendor Highlights Supply Chain Risk (securityledger.com)

chicksdaddy writes: Warnings about the threat posed by compromised software and hardware supply chains have grown more pointed in recent months. Notably firms like Kaspersky (http://www.kaspersky.com/about/news/virus/2015/equation-group-the-crown-creator-of-cyber-espionage) and Trend Micro (http://blog.trendmicro.com/trendlabs-security-intelligence/securing-the-it-supply-chain/) have highlighted attacks on technology supply chains, while the firm TrapX reported on a malware family, Zombie Zero, that was found lurking on hand-held scanners shipped from China and used by a prominent logistics firm. (http://deceive.trapx.com/rs/trapxcompany/images/AOA_Report_TrapX_AnatomyOfAttack-InternetOfThings.pdf)

RSA brings more evidence that sophisticated cyber criminal and state sponsored groups are looking for ways to compromise technology supply chains. On Wednesday, the company wrote about what is describes as an attempted “supply chain subversion” attack (https://blogs.rsa.com/attacking-a-pos-supply-chain-part-1/) against a prominent point of sale (POS) hardware vendor with links to the PoSeidon point of sale malware campaign.(http://blogs.cisco.com/security/talos/poseidon).

RSA said it detected a sophisticated “spear phishing” campaign against a European POS vendor. According to RSA, e-mail messages were sent to a “small number of employees” of the Point of Sale system vendor posing as support emails from a customer (a prominent New York City restaurant). A malicious Microsoft Word document attached to the e-mail, if opened, installed a copy of the Vawtrak banking Trojan, which is adept at credential theft, according to The Security Ledger. (https://securityledger.com/2015/04/rsa-warns-of-supply-chain-attack-on-point-of-sale-vendors/)

The company said the goal of the attack was apparently to compromise the vendor itself, providing an avenue to “realize subversion of the vendor’s firmware or software built into the products.”

Comment Re:flooding in 3, 2, 1 ... (Score 2, Interesting) 126

This. Does anyone think this is going to help them in any way?

The way the US treats its poor reminds me a lot of the colonialism of earlier times. Patronizing, without any real care or concern and so far detached from the real problems that one has to wonder whether they are just stupid or whether their motives ain't what they claim to be.

Comment Re:Well.. (Score 1) 174

If they do, the US is probably suffering badly for it.

Think who has the most intellectual property. Ponder who does the most research. Consider that spying is cheaper than researching. Know that a backdoor does not care who is using it.

And now ponder what using this backdoor in the computers of a US corporation by a Chinese corporation could do to the GDP of either country.

Comment Re:Just the good guys? (Score 2) 174

And that is exactly the problem. Let's even assume for a moment that they actually are the good guys.

Wanting a backdoor for the "good guys" means wanting a backdoor for everyone. By definition. A backdoor in encryption is what everyone who tries to spy on someone else wants. The FBI wants it to spy on their enemies. Corporations want it to spy on other corporations. And I'm pretty sure China and Iran would love to use it to take a peek into some US government information.

Access to such a backdoor is hard to control. Mostly because the entity that COULD control it, the one where the backdoor is installed, is not supposed to even know it exists. In other words, such a backdoor will not stay secret for long. The relevant people will be bribed, bullied or forced. We're talking about nations here, not some petty hacker groups.

Comment Re:Just the good guys? (Score 1) 174

Bad guys have to set the evil bit; the software checks whether or not it's set. Really people, we've thought this through.

Relevant RFC

You know, it's been years since I actually read that. The basic concept is funny, obviously, but the author took it much further. I'd forgotten such gems as:

Because NAT [RFC3022] boxes modify packets, they SHOULD set the evil bit on such packets.

Indeed, NAT boxes really should mark all their packets as evil, because NAT is evil.

Oh, I also quite enjoy:

In networks protected by firewalls, it is axiomatic that all attackers are on the outside of the firewall. Therefore, hosts inside the firewall MUST NOT set the evil bit on any packets.

Oh, obviously. If you have a firewall, every host inside the firewall is perfectly safe. BWAHAHA...

Comment Re:Not "stupid" just for that reason (Score 5, Interesting) 174

Agencies like the FBI, CIA and NSA have long relied on the general ignorance of the public, and even of Congress, on various technical matters. Further, they had their claws into academia and were thus capable of controlling the dissemination of information in regards to technical matters. These agencies still believe they are dealing with various kinds of ignorant rubes who will believe any technobabble their representatives care to spew. But this isn't the fertile ground for their particular brand of bullshit. The IT world is dominated by people of a rather different mindset, and while companies like Microsoft, Google and Apple couldn't really be regarded as friends of liberty, what they are is highly protective of their revenue streams. Crapola plans like encryption back doors and universal spying on their traffic is already damaging these companies' international reputations, and risks undermining many years worth the work of selling their platforms to foreign buyers.

And this, as sad is it is, is why these agencies will lose. Not because any of the Captains of IT Industry or anyone in Congress gives a flying fuck about liberties, but because it poses a threat to profits. I guess the little guy has to accept that the enemy of their enemy is their friend, and hope the IT companies win the day, but what bothers is that we may win the battle, and lose the war, simply because instead of a bunch of government spooks spying on every bit that gets transmitted over the Internet, we'll have a bunch of corporate spooks.

Slashdot Top Deals

2.4 statute miles of surgical tubing at Yale U. = 1 I.V.League

Working...