There's nothing patriotic, altruistic, laudable, or beneficial about screwing up legitimate national intelligence projects.

Why should they care about 'national intelligence' as it pertains to other countries? They have no duty to protect whoever created this. Hell, until they've done the analysis, they don't even know who the hell it is.

If you have code out there that's an attack vector, it's a vulnerability for everyone. If someone repurposed the attack, it's something which can be exploited.

Do you think people should have laid low on the topic of the Sony rootkit on CDs because, clearly they were justified?

I don't buy your argument -- security researchers are looking for vulnerabilities we could all be subject to.

National intelligence be damned ... how the hell are you supposed to know what is being targeted and by whom? Did China write this? The US? Russia? Tuvalu?

That's like saying people should stop worrying if the police are breaking laws because they're doing it for our own good. Then ends don't always justify the means.

Wrong. With something like a photograph, the right commercial customer may come along and find it ideal for a marketing campaign, etc. The photographer - who has not yet licensed it to anybody else - can then license it exclusively to that company, and charge appropriately. If the image has already been appropriated and used out of context by some other infringing part, that can cause problems for the photographer's later ability to license it as he sees fit. You're not understanding how this works.

And as an attorney and someone who publishes stuff herself, she should know that every work is subject to copyright, and that if she can't see where someone has granted her license to use it without asking, she can safely assume that running off with it and using it as part of her own material is infringement, plain and simple.

Yeah, I got that part, but if (as written) they have "an unwritten and unspoken agreement" implies there was, well, an agreement.

What you're describing is what was in my last sentence where I said "it's possible they've all independently decided to leave prices high until the other guys drop them" ... which I would agree isn't collusion. In fact, I said that.

I believe you're either missing what I said, or somehow agreeing and disagreeing with it at the same time.

When there are only two or three competitors in a market, actual collusion is no longer necessary. They simply have an unwritten and unspoken agreement to keep prices where they are

Ummm ... isn't that what collusion means??

If they have any form of agreement to keep the prices high, I kind of thought that was, by definition, collusion.

Now, it's possible they've all independently decided to leave prices high until the other guys drop them (which might be what you were getting at), but then there's not "agreement", and therefore no collusion.

Ummm. Asking a question here. What does the Patriot Act have to do with anything?

The difference being you'd need to go to court to get a warrant, and I believe there would be a legal opportunity to be notified of this. If Canadian law enforcement accessed your data, you could legally know about it.

The Patriot Act basically says they can demand it, with very little legal support, and it is against the law to tell someone that their data has been accessed from your servers under this request.

So, it comes down to the US having granted themselves access to any and all data from a US owned company or US hosted server ... and made it illegal to disclose that access has happened.

If that data access comes under the guise of secrecy and not going through the normal courts, you'll never know it happened.

As I said, those provisions of the Patriot Act give access that concerns a lot of people ... see here.

So, based on what I've read, and what I've been told by corporate policies ... for anybody who isn't in the US, America and American owned companies are completely untrustworthy since the law reads like it bypasses local laws when it comes to data security and privacy.

Now, for a bit of balance the other way, I see that people are starting to say the Patriot Act isn't so intrusive and this is all blown out of proportion.

But, until I see company and legal policies changing here in Canada, I will continue to treat data being put into a US server as a stupid idea, and I will continue to treat those entities as hostile and not trustworthy.

Since I'm not a lawyer, and I don't have anything to gain by suddenly trusting these entities, if I stick with this, I'm in compliance with company policy. I'll just err on the side of caution -- not trusting the US government is just a bonus at this point.

Just put up your truecrypt file and you get all the convenience and almost none of the worry

From a legal perspective, I will opt to not use the cloud for work purposes. They can't crack the encryption if they don't have the files in the first place.

In theory what you propose would probably work ... in practice, it's only theory. :-P

I'll stick with old fashioned access-based security. especially since it would be me who would take the risk for saying "oh, well this should work". Not using the cloud is less effort than trying to make it secure.

we should also recognize that this is self-serving to IBM because it sells IT security consulting services

Maybe yes, maybe no.

But the company I work for has banned DropBox and other things for some time. The problem with "the cloud" is you really don't know where your data goes, and you can't really be guaranteed of who might be accessing it.

So there's definitely a perception that unless you're dropping in strongly encrypted files, it's no longer secure. So depending on what it is, something like DropBox is potentially a bad idea.

I'll use DropBox to move around stuff that isn't sensitive, but anything proprietary or confidential, I just move it via another mechanism.

Also, since I do some occasional work for the Canadian government, I couldn't use DropBox or anything which might end up on a US server (so not even gmail) ... because under the Patriot Act, we have no guarantee that this data wouldn't become visible to American law enforcement. Which means I could be running afoul of Canadian privacy laws -- so by policy any service ran by an US company, or in the cloud, is just something I can't use for work purposes.

Sadly, this is no different that the situation in which companies like Microsoft can either be in compliance with EU data laws, or in compliance with US Patriot Act -- but not both. From a professional perspective, the US has made themselves and many of their corporations untrusted parties -- I just assume that since the US has given themselves legal rights to snoop without disclosure, they do. So it's just easier to treat them as a hostile entity who isn't trustworthy. And, considering that EU financial and air passenger data is handed to the US, I find it hard to go against that stance.

From a legal perspective, once something hits the cloud, you lose a lot of safeguards and access controls to it unless you implement them yourself.

In many cases, what IBM is doing is just sound business.

So, how have the big traditional space contractors like the Rockwell, Boeing, Lockheed, etc., of old, and now United Space Alliance and United Launch Alliance not delivered on their contracts?

It's not that they didn't (eventually) deliver. It's that those were done on a cost + basis of if we keep throwing money at it, eventually we'll get it done.

I believe SpaceX is working under a different model. NASA has said "if you can achieve this, we'll pay you $x for each of this many trips". So the costing is fixed up front. Yeah, here:

The company has a five-year, $1.5 billion contract to make 12 more deliveries.

So SpaceX did their own development up front and are then selling the lift services for a fixed cost. Hell, I think that works out cheaper per flight that the shuttle was. And it sounds like they've created a more overall usable platform.

Someone like Boeing will spend a decade building it with you, spend a large amount of money, probably have cost overruns. They'll give you something, and it will probably be cool, but you don't really know what it's going to cost you.

SpaceX has just become the longest haul trucking company around. ;-)