Forgot your password?
typodupeerror

Comment: Re:I think you're working from a few false assumpt (Score 1) 228

by quantaman (#46792791) Attached to: Bug Bounties Don't Help If Bugs Never Run Out

But I don't think the competition of the official prize with the black market is relevant at all.

Right now a big proportion of exploits come from security researchers, partially because they're looking for exploits, but also because they do have a strong incentive to find and report vulnerabilities. I don't think a cash prize is going to change their calculation much.

The place a prize could make a difference is in ordinary developers. I suspect a lot of bugs are partially discovered multiple times before they're officially reported. Some developer is working with the software, notices some weird behaviour, but doesn't follow up because they lack the incentive. A cash prize increases the incentive and potentially turns some of those dev hunches into new bug reports.

The way the black market comes into play is the devs are competing against the black market. If the bug discovery rate goes up the price of zero-day exploits goes down (since they're shorter lasting) as does the incentive to discover them (since good devs are competing for the same bugs). So you can significantly impact the black hat market without approaching the black hat rate.

Comment: Re:Who are the pro-Russian commenters? (Score 1) 295

by quantaman (#46785985) Attached to: Is Crimea In Russia? Internet Companies Have Different Answers

A lot of the comments comes from long established accounts that have commented on many other topics which doesn't really seem feasible for an astroturf network (unless they were 3rd party groups that get contracted by different entities). But moreso there's a lot of them who do engage in back and forths for quite a while, that's simply something that doesn't make sense for an astroturf because there's no point in a one-on-one with someone you clearly can't convince.

Comment: Re:Old proverb (Score 1) 387

If _Europe_ had the balls to call Putin to task, the US would stand behind them. It gets a little hollow when all of Russia/Ukraine's neighbors are saying "lets negotiate" and the US comes in with bombers and gives them an attitude adjustment. We are working with the pieces that are on the table. Tell the EU to get their head out of their ass and start moving troops to match, if not exceed, what Russia has done. The,n we can see what Putin is made of. Until then (to return to the original Proverb) the US really does not have a dog in the fight because there is no fight; there is an antagonist whose victims are not giving an ounce of resistance.

If I wanted to describe how you would start WWIII I think this passage would be a good start. Remember Europe actually knows what a real war looks like, even if you could keep it conventional a military confrontation with Russia is going to result in hundreds of thousands, if not millions of deaths. Add nukes to the equation and you really want to get hesitant about calling Russia's bluffs.

Personally my vote is for UN peacekeeping troops in Eastern Ukraine, ideally made up of troops from anywhere except the US (and ideally Europe). It puts a neutral party with a good reputation in the crosshairs, it makes a military invasion by Russia extremely costly, but it doesn't embarrass Putin by being overly pro-West and in the worst case of an invasion it won't escalate into a major war.

Comment: Re:Useful Idiot (Score 4, Interesting) 387

What China does in surveillance of their own citizens isn't acceptable in my opinion but how is "they're even worse" a valid defence for the US which has constantly acted like it stands apart on these matters. Secondly, and something I think Americans really don't appreciate, as someone from outside both China and the US I know China would probably try and intercept my calls etc, but at least they don't pretend to be my friend while they are at it which America has been.

I don't think China and Russia being worse is a valid defence for the US. But I do think it's a valid point of criticism for Snowden. It is a bit hypocritical to criticize the US's surveillance activities, and then flee to the only two major powers that are demonstrably worse.

That being said I think he did have understandable motives, he wanted to go to somewhere that wouldn't extradite him to the US. That means a country that is a) not particularly friendly with the US, and b) powerful enough to resist US pressure, that pretty much means China and Russia. As the Evo Morales grounding incident demonstrates Europe was not an option. Maybe Ecuador was but they may not have been big enough and he still had to get there.

It's still unfortunate that he's in Russia, I think the Ukraine incident has revealed that Putin is a bit crazier than anyone anticipated and Snowden's position more tenuous. The Russians may have been threatening to send him back to the US as a concession to ease the sanctions unless he starts cooperating in their propaganda.

Comment: Who are the pro-Russian commenters? (Score 1) 295

by quantaman (#46763697) Attached to: Is Crimea In Russia? Internet Companies Have Different Answers

Everyone has noticed there are a lot of very pro-Russian people popping up on websites and I can't really understand them. The facts seem very apparent that Russia has done some extremely objectionable things, and threatens to do even more objectionable things, and the justifications for those actions seem extraordinarily weak.

Maybe some of the commenters are paid by Russia (I think that's been documented with some blogs), but a lot of them seem to be sincere westerners and I can't figure them out. Do they have Russian ancestry that makes them pro-Russia? Are they just really counter-cultural and suspicious of Western interference in the East?

Personally I'm fairly pro-West, anti-authoritarian, and have Ukrainian ancestry so I have strong feelings on the subject, but I still think I make a fairly impartial assessment of the situation. I just can't figure out the ideology that drives the Russian supporters.

Comment: Re:Original premise is false (Score 1) 580

by quantaman (#46761687) Attached to: How Does Heartbleed Alter the 'Open Source Is Safer' Discussion?

I don't think Heartbleed says anything fundamental about open source security, but it might alter the discussion of how certain low level packages are managed. By any measure OpenSSL is a very important package, but it's also a bit generic. It has a very defined role that everyone needs, but I'm not sure how many people really have a motive to work on it in specific. It might be that the community needs to find a way to devote more resources to maintaining and auditing those packages.

Comment: Sensationalism (Score 4, Funny) 312

by quantaman (#46743143) Attached to: Russia Wants To Establish a Permanent Moon Base

Russia doesn't want to establish a moon base, but they're obligated to step up and protect all the Russian speakers on the moon. Moreover the moon is historically Russian, not only did a recent referendum establish that 98.3% of the moon wants to join Russia, but the moon is so close that on a clear night you can actually see it from Moscow!!

Comment: Re:Eh? (Score 1) 99

I think the lack of party discipline is the worst feature of the American system. In the Canadian system Michelle Bachmann, Ted Cruize, and Jim Inhofe would just be random backbenchers no one listens to. But in the US because there's no discipline each of them has a voice on the national stage.

MPs with lots of independence means political power goes local, instead of debating things on the national stage with everyone it's debated by hyper-partisans because those are the only people obsessive enough to get involved in politics at the local level. Moreover you get drawn into a lot of dumb symbolic stuff because there's not enough time to debunk all the dumb symbolism.

In the Canadian system nuanced debate happens inside the party, when they think they have the best argument they take it public and now the public has just a handful of positions to evaluate. I think a lack of discipline (and that includes an elected senate) is a horrible idea because it makes our political debate into the cacophony the Americans are dealing with.

Comment: Re:Eh? (Score 1) 99

Ideally the Constitutional Monarch should have just slightly more power. Currently in Canada the Governor General does whatever the PM tells him to do, right or wrong. This has resulted in Harper proroguing Parliament when the shit was about to hit the fan a couple of times including once when he's government was going to lose a vote of confidence the next day, then he went on about how it wasn't democratic if the opposition parties ganged up on him and formed a coalition government like the UK and Australia currently have. A government consists of which ever part[y][ies] can pass a budget and if none can then Parliament is dissolved and there are elections. The voters get pissed off if this happens too often.

That prorogue situation was a bit of a mess, the Conservatives had just won the election (as a minority) and introduced a controversial election funding bill they hadn't discussed during the campaign. But the voters understand that the minority party forms government, giving the voters a coalition government they didn't expect isn't really Democratic. I think the proper thing would have been to say withdraw the the bill or we'll defeat it and force another election and let the voters decide whose fault it is.

I think the governor general made the right call, the coalition didn't even last till the conclusion of the prorogue.

Comment: Re:Eh? (Score 1) 99

I've thought of that before, you might end up with rule by bureaucrats but otherwise I think it works pretty well, other than the fact that no legislative body would ever implement it.

Given modern constraints I think constitutional monarchies are the way to go, not because the monarch is useful, but because the monarch takes the "executive" role and all the power ends up in parliament where voters can pay attention.

The problem with the US is power is too distributed. 538 congress critters each with their own agenda, there's too much information to make an informed decision and it's too easy for lobbyists to overpower individual politicians.

I think Canada has about as good a system as you can reasonably get because the parties are so strong. They can stand up to lobbyists or pundits when they think it's in their own best interest (which usually corresponds to what that think is good for the country too). And the opposition can coordinate their attacks a lot more effectively. There's a Tea Party element in the Conservatives but Harper keeps it under wraps. They still introduce some bad legislation like this, but bad bills have been defeated in the past.

Comment: Re:We have those in South Carolina too (Score 1) 325

by quantaman (#46730745) Attached to: Can You Buy a License To Speed In California?

But here's the thing. If I pull you over and you have one of our public servant honor tags, you're still getting a ticket for whatever I pulled you over for. In fact, I am less likely to let you go, because of the appearance of impropriety created by these tags. I get a lot more "by the book" when someone starts flashing special tags and membership cards at me.

Is that just you or your department in general? For you at least I buy your explanation, but my question is, considering all the appearance trouble with the tags, if they aren't for nefarious purposes then what are they for?

Comment: Re:It's not a license to speed (Score 1) 325

by quantaman (#46730727) Attached to: Can You Buy a License To Speed In California?

It's the cops extorting money. It's not just speeding. This creates the appearance that, if you do not buy the membership, you'll be stopped and shown absolutely no mercy, and may even have charges trumped up against you - or otherwise be punished.

This is tantamount to soliciting bribes.

Soliciting bribes maybe, they're not accepting the money personally.

And unless cops go around advising motorists to buy the membership I don't see how it can be extortion, and I don't think the idea that if you don't have a membership "you'll be stopped and shown absolutely no mercy, and may even have charges trumped up against you - or otherwise be punished" is particularly compelling. I'd assume without a card they'd carry out their duties as usual (as good or bad as they usually are).

The cops are obviously doing something very wrong and people should be facing whatever discipline or legal repercussions it takes to make it stop, but I'm not sure what the exact charges are.

Comment: Re:Singapore (Score 1) 386

by quantaman (#46728617) Attached to: UN Report Reveals Odds of Being Murdered Country By Country

Honestly I was being slightly lazy, taking the only per capita figure in the article.

I'll say I'm a bit suspicious how the figures vanish for the last several years until 2003 when Singapore's Prime Minister Goh Chok Tong told the BBC in September 2003 that he believed there were "in the region of about 70 to 80" hangings in 2003. Two days later he retracted his statement, saying the number was in fact ten.

Though I admit it would be very hard for them to hide executions (and there doesn't appear any evidence they did other than that misquote)

If a subordinate asks you a pertinent question, look at him as if he had lost his senses. When he looks down, paraphrase the question back at him.

Working...