i take it you've not seen "Independence Day", or "Ender's Game", then? we need these planes just in case there's ever an alien attack from outer space, man.

well dang, this is gonna get google banned in a few more countries that have human rights abuse issues and corrupt governments... with the possible exception of america, where google would fight tooth and nail to stop that happening. instead i suspect they'll work quite hard to twist what the definition of "verified editorial" is - most likely by deploying operatives within the team. this is gonna be fuun!

fuck me as if we don't have enough to contend with here on slashdot with moderators (users) getting into a bun-fight over what comments are appropriate and which aren't, under this ruling the slashdot web site owners would have to review all the comments *and* the moderations *and* all the meta-moderations *anyway*! let the moderation wars begin... starting with this comment, yaay!

i did indeed... but it obviously wasn't clear enough. i believe that would come from the subject line saying "facebook is sending encrypted emails", rather than the subject saying "facebook allowing you to receive GPG-signed administrative notifications by email".

that's... amazing! i'm very impressed.

errr, so i want to send a communication, ok? it's supposed to be private, right? but it's a web service: facebook could, at any time (even under secret fascist subpoena) change or be forced to change (without informing us) the user interface so that the encrypted message is no longer encrypted, but is in fact entirely in cleartext.

you might think, "ok, well, surely we could then just have a messenger service or app which does the job, and we could trust that, right?" and the answer is "well no, absolutely not you can't... not unless the entire source code is available, and a chain of trust is established that guarantees a verifiable and traceable compile and distribution chain".

which, basically, means you need a software libre distribution (such as debian) because those have full source available, and GPG-signing right the way from the developers (whose identities are verified via key-signing parties that involve showing proof of ID on each signing), all the way through to distribution where a "Release" file containing the MD5 checksums of every package is, once again, GPG-signed by provably verified individuals.

the bottom line is that just because facebook *says* it's secure doesn't actually make it so, and announcing "yeah we provide a secure encrypted email service" is actually a dangerous DISSERVICE. you can't *EVER* guarantee that the servers have been compromised, and web browser *implicitly* trust what the servers give them to run.

the best thing that facebook could do is provide a programming API via which encrypted emails *may* be sent, and then sponsor software libre teams such as mutt, and everyone else, to provide 3rd party (entirely software libre) applications that deliver *and receive* encrypted mail. the only hurdle to get over there would be whether the software libre teams would view working with facebook to be endorsement of SaaSS (service as a software substitute - http://www.gnu.org/philosophy/...) which i can guarantee in advance that any GNU project will *not* do.

i disagree, outright. their aim is to destroy availability and access to anything that could cause people to have "thoughts" outside of the proscribed and permitted range as dictated by them. in that regard, it *doesn't matter* that the copies are imperfect replicas of the original.

in fact, now that i think about it: a second objection to what you say is that if anyone else notices a discrepancy, they may take a copy of the files and improve on it. so in that regard, the fact that these insane people have endeavoured to destroy the originals actually results in *more* people with access to - and thus thinking about - the origins of the artefacts that were destroyed.

either way, these insane people have *helped* spread the messages that they attempted to suppress. so i think i will mark this story as "stressandeffect".

actually... what's now "top news" for when you search "what happened to the dinosaurs" is... greg's post and associated discussions...

i visited bangalore in 2006, to see a friend living there. he explained that when the trees were cut down in the cities (so that more housing could be built), temperatures soared by an additional 10 *centigrade*. so, the ambient temperature surrounding the cities would be 45 degrees, but in bangalore it would reach *fifty five* centigrade. the point of mentioning this is that it's a much more direct version of how man has an effect on his immediate environment. change the landscape, you change the weather, it's as simple as that. we can learn from that... or simply die. it's our choice.

hang on... didn't bunnie huang do the "chumby", and didn't barbie try doing something like this - putting an interactive wifi and mic aspect into one of their barbie dolls... with a huge back-lash as a result? so (a) why is there an expectation that this will succeed (b) why was the patent granted when there is clear prior art???

this is why debian has the GPG key-signing parties, and why all packages are GPG-signed by the package maintainer when they compile it, why the ftp masters sign the package when it's uploaded, and why the release files which include the checksums of all the packages are also GPG-signed. under this scenario there are an extremely limited number of extremely paranoid methods by which debian may be compromised. even the scenario of "cooperation between long-term sleeper agents within debian's ranks" would have a one-shot opportunity to get away with introducing malicious code, following the discovery of which their GPG keys would be revoked, the perpetrators kicked out of debian, their packages pulled immediately pending a review, and the already-effective procedures reviewed to involve multi-person GPG signing that would make it even harder for compromise to occur in the future.

now, if you recall, there was an announcement a couple of years back that the development of Mozilla's B2G was declared to be "open" to all, so i contributed with a thorough security-conscious review of how to do package distribution. it turns out that Mozilla is *NOT* open - at all. several other contributors have learned that the Mozilla Foundation is in direct violation of its charter.

basically, the Mozilla Foundation *completely* ignored the advice that i gave - which was that the use of SSL as a distribution mechanism would be vulnerable to *exactly* the kinds of attacks that we see the NSA attempting to do on google. they went so far as to enact censorship, preventing and prohibiting me from pointing out the severe security flaws inherent in their chosen method of package distribution. i remain deeply unimpressed with many aspects of so-called "open-ness" of well-funded software libre projects.