Seagate is correct. Putting a hash on the website doesn't improve security at all because anyone who can change the download can also change the web page containing the hash.

  The fact that this practice is widespread in the Linux world originates from the usage of insecure FTP mirrors run by volunteer admins. There it's possible for a mirror to get hacked independently of the origin web page. A company like Seagate doesn't rely on volunteers at universities to distribute their binaries so the technique is pointless.

A tool to verify the firmware is poetically impossible to write. What code on the drive would provide the firmware in response to a tool query? Oh right ..... the firmware itself. To make it work you need an unflashable boot loader that acts as a root of trust and was designed to do this from the start. But such a thing is basically pointless unless you're trying to detect firmware reflashing malware and that's something that only cropped up as a threat very recently. So I doubt any hard disk has it.

BTW call a spade a spade. Equation Group == NSA TAO

The issue with Silent Circle isn't their jurisdiction. It's that their code is of deeply questionable quality. They recently had a remote code execution exploit that could be triggered just by sending a text message to their phone. It's been literally years since one of these affected mainstream software stacks, so how was that possible?

Well, they wrote their own SMS parsing code, in C, and used JSON to wrap binary encrypted messages and there was a bug that could cause memory corruption when the JSON wasn't exactly in the form they expected.

The amount of fail in that sentence is just amazing. They're a company which justifies its entire existence with security, writing software to run on a smartphone where the OS itself is written in a memory safe language (Java) and yet they are parsing overly complex data structures off the wire ..... in C. That isn't just taking risks, that's playing Russian roulette over and over again. And eventually it killed them. Remote code execution via SMS - ye gods.

After learning about that exploit and more to the point, why it occurred, I will strongly recommend against using Silent Circle for anything. Nobody serious about security should be handling potentially malicious data structures in C, especially not when the rest of the text messaging app is written in Java. That's just crazy.

It is ridiculous of course. It is also a common attitude among PI's toward their postdocs and students, especially in high-profile, high-pressure labs.

This letter from a PI to a worker made the rounds a few years ago. The PI claimed later it was a joke. It doesn't read like a joke, and the exact same attidude is not uncommon at all:

http://www.chemistry-blog.com/...

I used to ride every day. But my place of work changed, so now I walk and take the train instead. Around home we generally walk as well, so my bike sits unused for months on end.

Walking is also good exercize of course, but it does limit the range of places to go. I should fix up the bike and start using it again come spring.

Automation changes the source of production from workers to machines. And that separates the source of production from the source of consumption.

To put it simply, robots produce wealth but does not consume it. Humans consume wealth, but (in this possible future) can no longer produce it. Robots have owners of course, but even if you ignore what happens to the majority of people, a few extremely wealthy people can not possibly make up for the consumption shortfall. Ten-thousand people with 10k each vastly outconsume (by necessity) a single person worth 100M.

So, if the entities making wealth and those using wealth become separate, you need a way to transfer wealth from one to the other. If not, you will see a slow-moving economic collapse, as lack of demand and cost-cutting automation drive each other down.

A basic income, generated from a tax on production (transaction tax, energy tax, direct tax on machinery) is one way, and has the benefit of being simple, straightforward and having low administrative overhead.

The time spent selecting questions, then answer them in a simple and understandable way is not free. Especially in a climate where even keeping a blog in your spare time is sometimes seen as a suspect frivolity that takes time from your research.

That said, I spend several years of my life helping to get rid of the Morse Code test for radio hams, so that smart folks like you could just take technical tests to get the license.

I'm currently assembling a Softrock Ensemble receiver just to play with SDR. I'm starting to become interested in more than passive receiving â" but a major part of my curiousity is about Morse, not voice. I can talk to anybody over the net after all, while Morse code communication feels like a very different kind of thing.

[...] and rather than cutting the least important program, they cut the most visible program, in an attempt to get their funding restored.

Honestly, though, a qestion-answer service for school children probably does rank among the least important programs for a research lab. I very much doubt this is part of their written remit (as opposed to communicate their actual research to the public), and the people spending time at work answering the questions certainly get zero professional recognition for it.

It does sound like a very nice, fun service. And I do agree that this kind of outreach is important. But if this is not part of what their funders want them to do, then it should come as no surprise if it's among the first things to go when money becomes tight.

You want this kind of thing to continue? Make sure there's funding (and paid time) earmarked for doing it. In fact, that may be a good idea in general: add a small fraction (.1% or even less) to any research grant over a certain size for general science outreach. If it's part of your funding, that also removes the career obstacles toward doing outreach we too often have now.

I think the Gemalto response seems reasonable, actually. The documents suggest they weren't doing anything more sophisticated than snarfing FTP or email transfers of key files, which Gemalto say they started phasing out in 2010. And the documents themselves say they weren't always successful.

NSA/GCHQ are not magic. They do the same kind of hacking ordinary criminals have been doing for years, just more of it and they spend more time on it. If Gemalto are now taking much better precautions over transfer of key material and the keys are being generated on air gapped networks, then it seems quite plausible that NSA/GCHQ didn't get in. Not saying they could NEVER have got in that way, but these guys are like anyone else, they take the path of least resistance.

Besides, it's sort of hard for them to do something about a hypothetical hack of their core systems that they can't detect and which isn't mentioned in the docs.

It's hilarious. For a moment I wondered if the transcript is even real. This makes Eliza look sophisticated.

Q: Which of those countries should we give backdoors to?

MR: So, I’m not gonna I mean, the way you framed the question isn’t designed to elicit a response.

AS: So you do believe then, that we should build those for other countries if they pass laws?

MR: I think we can work our way through this.

AS: I’m sure the Chinese and Russians are going to have the same opinion.

MR: I said I think we can work through this.

He seems to believe, "I think we can work through this" is an acceptable answer to a simple yes/no question. The guy doesn't even have a coherent answer to one of the most basic and obvious questions he could possibly be asked. I thought Comey did a poor job of explaining his position but this takes it to a whole other level.

Why would people not report a SIM as stolen currently? They have every incentive to. They'd need to do so, to get their old number back anyway.

But seriously, if you're a terrorist, you're not going to be fazed by just doing some street muggings to obtain cell phones first. It doesn't matter much if the cards get de-activated a day later. Heck, just point a gun at a SIM vendor and force them to activate the cards with fake data. If the vendor doesn't have the IMSI codes for every SIM in their inventory, they can't even report them as stolen.

.... solution is more registration?

[...] please ensure that your channel's primary focus is on gaming or music creation."

Sing your code. Problem solved.

So, "assert(Ieiei == True)"

becomes

"Aaaand IIIIIIIIIIeeeeiiiiiiieeeeiiii wiiiiilllll aaaalways be Ttrrrruuuuuuueeeeeeeee"

I'm talking about the silicon chips doing the things that our brain can do, such as designing the next intel chip.

The major stumbling block isn't processor speed or capacity. It's that we don't know how to architect such a system in the first place.

And if you think about it, a lot of the "smart" things we want to automate really don't need anything like human-level or human-like intelligence. A car with the smarts of a mouse would do great as an autonomous vehicle. Real mice manage to navigate around a much more difficult, unpredictable and dangerous environment, using a far more complex and tricky locomotion system, after all.

The judicial system is, at heart, a method of resolving disputes. Sometimes those are disputes between civilians (civil suits) and sometimes they are criminal cases, disputes between people and the state.

The most obvious and easy place to start is with small claims courts. Commercial arbitration handles many disputes that would otherwise end up in small claims courts, but we don't exploit this anywhere near enough. Most people just rely on their bank to act as a dispute mediator via the credit card chargeback mechanism, but this is a one-size-fits-all solution and banks are often not good at mediating disputes. There's lots of fraud and problematic outcomes.

The place where most of the better-law-through-tech research is happening right now is the Bitcoin community, because of the general focus on decentralisation, global trade and frequent desire to avoid relying on government. So we have for example BitRated which is a platform for doing dispute mediated Bitcoin transactions, where anyone can be the dispute mediator. So you can get a fluid, international market of specialised judges who are experts in very particular types of transactions, like software contracts etc where "I didn't get software of sufficient quality" is not a dispute that makes sense to handle via a chargeback. And it can all happen over the internet.

That's a very simple example. More complex examples involve specifying a contract in the form of a computer program and then effectively having the program be the "judge". I wrote about how to implement this, again with Bitcoin, several years ago. The technology is not that complicated actually. The hard part is figuring out the right user interfaces to make it easy. Presumably only very simple and precise contracts could be managed that way, so there's still open research in how to craft these digital contracts such that you can escape back to human judgement if there's an exceptional case.

When it comes to criminal rather than commercial cases, probably the best way to apply technology to reduce costs is to allow remote lawyering. That is, you should be able to outsource your legal representation to someone who isn't physically present. They may be rather good and experienced, but just lives out in rural areas or in a country where the cost of living is cheaper. The issue here is not really technical but rather just institutional inertia.

The UK is putting its judicial system under tremendous financial pressure at the moment, to the extent that some criminal cases are just being abandoned because there's insufficient money to run them. They're (finally!) starting to experiment with allowing small claims court cases to be resolved over the phone, and also looking at decriminalising TV license violations to reduce pressure on the system. But you get the idea - the judicial system innovates extremely slowly even when being sliced to the bone. So don't hold your breath.