I'm sure they've issued some updates since then.

Only on Testing and Unstable. Ha ha, that's a Debian joke.

Debian never does anything that really jumps out at you. The more time passes, the more I appreciate that and realize how valuable it is. Gentoo and Ubuntu were cool for a while, but here it is 2014 and I'm back with Debian, same as 10 or maybe even 15 years ago.

That's exactly the point of the article.

Of course, the minimum necessary requirements are actually irrelevant in a competitive environment where there are a surplus of over-qualified people.

Quadcopters don't have the range, speed, or flight duration for SAR.

So it's difficult to argue that his flights are more dangerous than what goes on every weekend at RC modeling sites throughout the United States

I can't fully agree with that. RC planes don't tend to fly out of range because they have to be in sight. A remotely piloted drone is not flown in light of sight, so it could more easily be controlled up to altitudes that might pose a danger to aircraft, or out of radio range.

Not saying they should have shut this guy down, or that taking 9 years to make rules is acceptable. A SAR drone is almost certainly flying where there isn't much risk of crashing into anybody anyways. But keeping signal strength down into valleys would really present some challenges.

I think we need to take a serious look at the "many eyes" theory because of this. Apparently, there were no eyes on the part of parties that did not wish to exploit the bug for close to two years. And wasn't there just a professional audit by Red Hat that caught another bug, but not this one?

How do you propose to separate them? Offense and defense are not really two separate things; if you can do one, you can do the other.

I have to say I'm even less confident in the plan to couple it to DNSSEC.

Sure. We're better. But we need to be even better than that.

I'd say more than just the "community". We have a great many companies that incorporate this software and generate billions from the sales of applications or services incorporating it, without returning anything to its maintenance.I think it's a sensible thing to ask Intuit, for example: "What did you pay to help maintain OpenSSL?". And then go down the list of companies.

OK guys. We've promoted Open Source for decades. We have to own up to our own problems.

This was a failure in the Open Source process. It is just as likely to happen to closed source software, and more likely to go unrevealed if it does, which is why we aren't already having our heads handed to us.

But we need to look at whether Open Source projects should be providing the world's security without any significant funding to do so.

Check the list of agencies sponsoring the research. This is just a little game you have to play to do research in the US.

"More easily", sure. But if somebody is willing to cut cables and shoot guns at equipment, it is more reasonable to worry about catching them afterwards than preventing it. Making the entire grid literally bullet proof is a preposterous idea.

I've been thinking about this a lot as I listen to Kevin Mitnick's autobio, Ghost in the Wires. He devotes his entire life to circumventing various defenses, then laughs at everybody for being 'so easily' fooled. His entire view is basically juvenile - that everything (such as the phone system) just naturally exists and ought to be perfect, so it's amazing if he can prove otherwise. When in fact nobody ever said it was. All the stuff that exists and usually works is just the product of mostly ordinary people doing their 9-5 jobs and trying to keep the wheels turning until their shift ends so they can go home and do something else.

What would be a good UI for this? Too automated, and it's just a big inkjet printer. (You will see research papers doing that in the next few years, I'm certain.) This is fine except the art wouldn't really be getting anything new from the medium, just printed in a different way.

But joysticking in 3d to operate on a 2d canvas doesn't seem right either.

Jeff, I'm sorry that you're paying more. I'm envious that your state is implementing single-payer, though! California considers and rejects the bill every session, so far.

MVP itself is not-for-profit. Interesting that they think the pool in the two states they focus on is now that much more expensive. I can't imagine why.

Thanks

Bruce