They cancelled this policy [nytimes.com] almost immediately after it was brought to light.

Here's the thing: the data mining apparatus and amount of data entry required to get to this point must be enormous. Finding all of the information required to get to the point of issuing seizures of refunds would require complete integration of all SSI payment history, all tax payment history, family histories, movement pattern tracking, etc.

There might even be a tie in to NSA/"not-TIA" to enable this, since the scope is so large. They probably started putting out bids for the work shortly after the law changed in 2008 and have only recently yielded results.

It's not going to be turned off just like that.

They cancelled this policy [nytimes.com] almost immediately after it was brought to light.

Here's the thing: the data mining apparatus and amount of data entry required to get to this point must be enormous. Finding all of the information required to get to the point of issuing seizures of refunds would require complete integration of all SSI payment history, all tax payment history, family histories, movement pattern tracking, etc.

There might even be a tie in to NSA/"not-TIA" to enable this, since the scope is so large. They probably started putting out bids for the work shortly after the law changed in 2008 and have only recently yielded results.

It's not going to be turned off just like that.

this adds to light pollution

Assuming street lights are removed, does the upward light from these strips exceed the reflected light from the streetlights?

your car is not oriented so as to illuminate it.

That's a good point - I tend to rely on my navigation device to get some forewarning of the curve and slope of the road ahead just because on a dark and winding road there's no way to see very far ahead.

Then again, glowing roads won't work to entirely replace this when the road winds around a hill or mountain. But more passive safety devices are still a good idea if they can help a little bit. It seems like rumble strips - they don't do anything for most people most of the time, but they do a great job for a few people every once in a while.

a whole lot of work had to be done to revise the tooling

Ah, so we need to name the machinists too! Charge the whole lot with a conspiracy to embarrass management!

Somehow Harry Tuttle is probably involved.

I think we need to take a serious look at the "many eyes" theory because of this. Apparently, there were no eyes on the part of parties that did not wish to exploit the bug for close to two years. And wasn't there just a professional audit by Red Hat that caught another bug, but not this one?

This was a failure in the Open Source process.

Indeed. People have been saying for years that the OpenSSL code leaves much to be desired but nobody dares fix it because it might break something (needed: comprehensive unit tests).

There's been a bug filed for years saying that the code won't build with the system malloc, which in turn prevents code analysis tools from finding use-after-free conditions. The need here is less clear - leadership of the project has not made such a thing a priority. It's not clear that funding was the sole gating factor - commit by commit the code stopped working with the system malloc and nobody knew or cared.

Sure, a pile of money would help pick up the pieces, but lack of testing, continuous integration, blame culture, etc. might well have prevented it in the first place.

We still have sites like Sourceforge that are solving 1997 problems, like offering download space and mailing lists when what we need today is to be able to have continuous integration systems, the ability to deploy a vm with a complex project already configured and running for somebody to hack on, etc.

This creates the appearance that, if you do not buy the membership, you'll be stopped and shown absolutely no mercy

we give these people a monopoly on violence and expect what, exactly, Andy Taylor and Barney Fife?

I have to say I'm even less confident in the plan to couple it to DNSSEC.

Sure. We're better. But we need to be even better than that.

I'd say more than just the "community". We have a great many companies that incorporate this software and generate billions from the sales of applications or services incorporating it, without returning anything to its maintenance.I think it's a sensible thing to ask Intuit, for example: "What did you pay to help maintain OpenSSL?". And then go down the list of companies.

OK guys. We've promoted Open Source for decades. We have to own up to our own problems.

This was a failure in the Open Source process. It is just as likely to happen to closed source software, and more likely to go unrevealed if it does, which is why we aren't already having our heads handed to us.

But we need to look at whether Open Source projects should be providing the world's security without any significant funding to do so.

but the failure of challenges to overturn them highly implies constitutionality.

Naw, fewer than 1% of challenges are overturned on Constitutional grounds and many fewer laws than that are challenged. There's no chance 99.9+% of laws passed are in compliance with Madison's Constitution - it's just that the battle is highly asymmetrical in resource allocation.

Jeff, I'm sorry that you're paying more. I'm envious that your state is implementing single-payer, though! California considers and rejects the bill every session, so far.

MVP itself is not-for-profit. Interesting that they think the pool in the two states they focus on is now that much more expensive. I can't imagine why.

Thanks

Bruce

To pick a nit, if you require medical attention after an auto accident, typically the at-fault driver's auto policy would need to cover that.

If they are so kind to stick around and your expenses do not exceed the limits.

Certainly such scams existed, but 30 seconds of googling can typically separate the good from the fraud.

The web helps. At the time, I was not able to see the plan until the salesman was present.