sudo is just another example of the giant (intentional) hole in the security barrier that is setuid root.

Just because of poor delegation design to start with, the setuid bit was invented instead of changing the design to a proper fine-grained access control. Instead of having proper access control lists for all resources like e.g. printers or privileges to set the system time or time zone, Dennis Richie though that setuid was such a neat idea the he went and patented it.

setuid root elevates the process itself to the all-powerful root account as the effective user. This means that all existing access control is moot. An audit of the access control setup can never reliably list what a user is allowed to do on a system. The existence of just a single setuid root tool means that you will need to know what that tool can do intentionally or unintentionally because of a bug as in this case.

a setuid "service" is not a real service with a limited and discoverable surface which can be independently secured, like e.g. a proper daemon with which you communicate through interprocess means. It is a process of which a would-be attacker has tremendous control the environment and parameters. To know what a setuid tool can do you need to read the source code and be able to verify that the tool is indeed the correct manifestation of the source code.

And yet Windows has since the very first Windows NT done this right: The lock screen / log-in screen runs on a separate "desktop". If the process crashes you are left with an empty desktop, not back to the user desktop. The "attention key" (ctrl-alt-delete) will relaunch the sign-in process.

Even the "elevation prompt" (introduced with Vista/Server 2003) by default uses a separate desktop to prevent "shatter attacks". Processes on the user desktop cannot send messages to, track mouse movements or otherwise control windows on the separate elevation prompt desktop, simply because they run on separate desktops.

Designing a lock screen which only obscures the other windows will cause *any* process crash to bypass the lock screen. That's why the original design of XScreenSaver tried to *minimize* dependencies. But it is still inherently insecure. Sometimes unplugging/switching monitors can cause overflows which will crash the process when rescaling.

Yup. It is not even a corruption. Chkdsk does not find and fix any errors.

I strongly suspect that it is not a corruption at all, but a fault inside NTFS (probably because the access to the alternate datastream will hold a lock), which only flags an operation as faulted, in turn flagging the drive as potentially corrupted.

The bug appears to be that some fault generated within NTFS when executing the command is being wrongly diagnosed by NTFS as drive corruption. The drive is not actually being corrupted. NTFS flags the drive as potentially corrupted and that is what generate the warning to reboot and run chkdsk.

Several users trying to reproduce this have not been able to actually corrupt the drive, for instance: https://www.bleepingcomputer.c...

“These are the things and events that happen when a sacred landslide election victory is so unceremoniously & viciously stripped away from great patriots who have been badly & unfairly treated for so long. Go home with love & in peace. Remember this day forever!” - Tweet by Donald J Trump in the aftermath of the riot.

The tweet got him banned for 12 hours.

Yes, but it can be an asymmetric key. Your vote is encrypted (along with a salt) to yield the encrypted vote. The public encryption key is distributed to all of the voting machines.

If you know the vote, salt and the public encryption key, you can verify the vote by re-encrypting and compare to the ciphertext.

The EletionGuard proposal does not allow that however, as that could enable vote-buying. The votes will be encrypted along with a secret per-vote salt which will make re-encryption impossible.

Instead, you are allowed to produce any number of votes (encrypted vote cipher on a piece of paper) but only submit one. The rest you can have officially unencrypted to verify that each of them would indeed have represented your vote, had you chosen top submit one of those instead. The unencryption will reveal the nonce/salt so that you can verify the original encryption using the public key.

Microsoft ElectionGuard: https://blogs.microsoft.com/on...

ElectionGuard

* does not eliminate paper ballots, rater they should be retained for audits
* allows you to track *your* vote through publicly available lists
* allows everyone to follow anyone's vote
* Your vote is encrypted, i.e. secrecy is maintained. Only you know what the encrypted blob means
* votes are tallied without decrypting the individual votes (homomorphic encryption).
* everyone** can tally the votes, although the result will still be encrypted.
* when results are published, everyone** can validate the tally (by encrypting the tally and verify that it indeed yields the encrypted tally that everyone can reproduce)

** "everyone" in theory as it requires understanding of the encryption/mathematics and access to sufficient computing power to do the homomorphic encryption operations.

Oh? the man at the top seems to think otherwise.

There is always a tweet contradicting the ever changing reality within the fact-free Trump campaign.

Italy has 616 deaths/1M population
US has 694 deaths/1M population

GP point stands: How come that Italy, which was arguably hit early and hard, now has *less* deaths per million than US?

The fact that Italy's hospitals overflowed increased the mortality rate.
Italy has 8023 cases/1M while the US has 26381 cases/1M.

This actually lends credence to Trumps claim that US has improved on the case fatality rate (deaths per case), although a large part of the deaths in Italy probably can be attributed to the overflow situation. But it *also* shines light on how *poorly* the US does in terms of preventing infections.

So 20%-40% of the population having been infected is enough for herd immunity?

Dr. Scott Atlas is not an infectious disease expert.

The real infectious disease experts say that 70%-80% will be the threshold. And that's notwithstanding that the disease is still *far too recent* to have any data on whether immunity will last.

With a case fatality rate of ~2.5% in the US, you will be looking at 5-6 million deaths before herd immunity is reached. Even if you somehow made the CFR drop to 1%, you'd still be looking at millions of deaths.

The tests are not performed randomly on the population. They do not represent a sampling. In fact that is the point.

You test those that you believe could be infected. Maybe they are showing symptoms, but you also test for other reasons, for instance because a family member was infected, or because the individual has attended a gathering where known infected individuals were also in attendance.

That is called contact tracing. You trace contacts and encourage known contacts to get tested.

When that test positivity rate is high (18% is way high) you are clearly not finding all infected individuals. It means that your contact tracing is inadequate.

Good for you that none in your family has been infected. That does not mean that Florida does not have a problem. You are living in a high-risk state.

Here you go: https://www.worldometers.info/...

When Trump tell you that the US is testing more than any other country, he may *almost* be correct in absolute numbers, at this time.

Only China has performed more tests in absolute numbers (almost double that of US).

But that is grossly misleading. China has 4x the population of the US. So when you have widespread transmission you need to consider
* Tests performed per million capita
* Test positive rate

In tests performed per capita, US is at 22nd place. If we consider only the latest weeks, my suspicion is that US does better than that, simply because the US *need* to test more.

Which brings us to the second point: Test positive rate tells you if you are testing *enough* compared to how widespread the transmission is. If it is above 5% you are *not* testing enough. If you can test enough to keep the test positive rate below 5% (according to Johns Hopkins) for 2 weeks, you have enough information to gauge how widespread the transmission is.

US is number 22 in number of tests per million population. US stands at 159,585 per million.

Monaco, Faeroe Islands, Luxembourg, Gibraltar, Falkland Islands, UAE, Bahrain, Cayman Islands, Iceland, Bermuda, Malta, Denmark, UK, Singapore, Lithuania, Russia, Channel Islands, Israel, San Marino, Qatar, Mauritius all test more per million than US.

Most of those countries are smaller, but the UK, Israel, UAE, Singapore, Denmark stands out.

Even *Russia* have performed more tests per citizen than US!

Granted, US needs to test more than most of those countries *now* because of the current level of outbreak, so that gap will probably change.

If the surge in infections was caused by more tests, you would expect the *test infection rate* to go down. In the US. A rate below 5% for two weeks indicate that you have a reliable estimate of how the pandemic spreads. Texas is 13%, Florida is 19%, US overall is 8,4%.

The US is not in control yet. Unlike most other western countries with a comparable standard of living.

On the bright side, New York seems to be in control with a 1.1% test infection rate.

Microsoft didn't actually copy any code. They implemented it themselves, clean-room. Or almost clean-room, since they have now acknowledged that they discussed concepts with Keivan Beigi before deciding and proceeding to implement themselves.

That's why Keivan Beigi talk about the patent analogy. He simply wanted to have been publicly recognized for providing MS with the ideas to the core concepts.

Which MS should have done.

You have right to speak freely.

You do not, however, have a right to be heard.

Free speech means that you are protected from being persecuted by the government for any opinion you express. It does not mean that you can force any media to publicize your opinion.

It is that simple.