Security After the Death of Trust 162
An anonymous reader writes "Simon St. Laurent reviews the options in the wake of recent NSA revelations. 'Security has to reboot. What has passed for strong security until now is going to be considered only casual security going forward. As I put it last week, the damage that has become visible over the past few months means that we need to start planning for a computing world with minimal trust.'"
Minimal Trust: (Score:5, Insightful)
Shouldn't that have been the paradigm from the beginning if you really wanted security?
Just because you think a person or organization can mostly be trusted today, doesn't mean it will always be the case.
Re: (Score:3)
Re:Minimal Trust: (Score:4, Insightful)
It has been available for a kind of long time. RFC 2440 for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy. I can't even get my friends to use "Off The Record" for secure IMing. They don't care that their IM is going unencrypted over the network, or at least not enough to spend 2 minutes to install it.
Yes nothing is perfect including this but encryption is a lot better than not. Endpoints (who you talk to) is still exposed but having your message contents hidden still seems like an improvement, but people won't do it even when it's easy and you prompt them to.
Re: (Score:3)
I don't see the point in encrypting all my IM either. If the government wants to watch me joke around with my friends, let them. I encrypt passwords and banking info, but who cares about the rest?
If your friends felt they really had something they needed to tell you about in private, then they could talk to you via an encrypted connection from a Live CD, or tell you in person. For the rest, nobody cares.
Re:Minimal Trust: (Score:5, Insightful)
Until you chat with a friend, make dirty terrorists jokes, and this friend is thought by the NSA to be a terrorist. You'll find yourself interrogated before you know it.
There are countless scenarios that may see you regret this carelessness.
Re: (Score:3)
If the NSA want to feel like idiots, they're free to do so.
I don't live in the US either btw, and I'm happy to let you guys keep it to yourselves.
Should people try to emigrate? (Score:3)
I don't live in the US either btw, and I'm happy to let you guys keep it to yourselves.
Is your country accepting refugees from the U.S. regime?
Re:Minimal Trust: (Score:4, Insightful)
If the NSA want to feel like idiots, they're free to do so.
A similar thing happened to a friend in Germany. And not, the German police didn't feel like idiots, and quite happily wrecked the guys life. If you have a gun, you never feel like an idiot. Instead you just pull the trigger on anybody who dares to snicker...
Great idea, there: (Score:2)
"Instead you just pull the trigger on anybody who dares to snicker"
Yeah, they stop laughing quick. Then they call in the SWAT team that's more heavily armed than you are.
Um... (Score:2)
If the NSA want to feel like idiots, they're free to do so.
A similar thing happened to a friend in Germany. And not, the German police didn't feel like idiots, and quite happily wrecked the guys life. If you have a gun, you never feel like an idiot. Instead you just pull the trigger on anybody who dares to snicker...
Yeah, they stop laughing quick. Then they call in the SWAT team that's more heavily armed than you are.
Um, I think ArsenneLupin was referring to the police as the one's with the guns, who wouldn't feel like idiots, and who would kill anyone who pokes fun at authority. As an attempt at pointing out how out-of-control people can be when armed and in a position of authority or power.
But then, your comment about SWAT teams actually just reinforces that point, so hey.
Cheers,
Re: (Score:2)
Re: (Score:2)
NSA doesn't stop at the US border. They are responsible for GLOBALLY monitoring communications that might be harmful to the United States.
Re: (Score:2)
I'm aware of that, but generally the worst that happens if they don't like you is that they'll stop you from legally entering the US. You have to be being a douchebag on a pretty epic scale before they start being able to justify rendition.
Re: (Score:2)
Re:Minimal Trust: (Score:4, Insightful)
I'm aware of that, but generally the worst that happens if they don't like you is that they'll stop you from legally entering the US. You have to be being a douchebag on a pretty epic scale before they start being able to justify rendition.
ORLY?
Do you think Khalid El-Masri [wikipedia.org] and Maher Arar [wikipedia.org] would agree? Or do you not have a Muslim sounding name, so you figure you'll be fine? First they came for the Muslims, something something...
Re: (Score:2)
I suppose that you mean economically harmful for US corporations [reuters.com], having competition is definately not what is capitalism about.
Is not just monitoring [schneier.com]. Your lack of security will be used against you. If you have something critical enough in another country, you probably have a logical bomb running on your infrastructure. Stuxnet [wikipedia.org] is an obsolete example by now.
But even without logical bombs, information means control, if they have all your information they could control you, or your population. If your cou
Re: (Score:2)
Re: (Score:2)
Yeah? What exactly do I need to be kept "safe" from? Are they going to send thugs round to interrogate me for flirting on Facebook?
Re: (Score:2)
(in another country, no less)
You guys are unbelievably paranoid sometimes.
Yes, I could get hassled if I try to fly into America. But I already knew that before the NSA shitstorm. Everyone knows that. This new wiretapping bullshit doesn't really change anything for me. In fact, considering this was made "legal" with the PATRIOT act, it isn't even a surprise. I'm not sure why anyone is surprised. I thought the whole point in the PATRIOT act was so that the government could abuse their power needlessly.
Re: (Score:2)
(in another country, no less)
You guys are unbelievably paranoid sometimes.
Um, dude [wikipedia.org].
Re: (Score:2)
Whatever, I could use a holiday. If chatting about buying a kitten or playing guitar hero can get me a free holiday, then by all means I will continue what I'm doing.
Re: (Score:2)
Re:Minimal Trust: (Score:4, Funny)
Whatever, I could use a holiday. If chatting about buying a kitten or playing guitar hero can get me a free holiday, then by all means I will continue what I'm doing.
If you think extraordinary rendition is like being on holiday, I'd hate to see where you usually vacation.
Re: (Score:2)
Skyrim. And France.
Re: (Score:2)
Outside the US, they send drones...
Re:Minimal Trust: (Score:5, Insightful)
Yeah? What exactly do I need to be kept "safe" from? Are they going to send thugs round to interrogate me for flirting on Facebook?
"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." -Cardinal Richelieu
No I would imagine not. Any given person likely has little to fear from increased surveillance; most people's lives are uninteresting. But if someone is looking at you with the intent of finding wrongdoing, they will find it. Especially if they have a history to look back on.
The other issue is that these surveillance powers are being used against anyone the US government doesn't like, for whatever reason. Do you agree with everything the US government does and says? I'd guess not. Do you support the actions of people who are organizing to push back against those policies you disagree with? I'd imagine so. Well these surveillance (and detention) powers are being used against those groups who are fighting for what you believe in, whether you participate or not. So your interests are being indirectly harmed by these powers.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
You realize that you just demonstrated that the NSA gives fuck all about their "mandate" right? (or at least their public one)
Re:Minimal Trust: (Score:5, Insightful)
For the rest, nobody cares
I do. I fucking care that I can't communicate without big brother leaning over my shoulder to make sure I'm a good citizen. It's fucked up. Even if they never used a single byte of the data, the act itself is fucked up. Besides that, laws change. Much more of your day to day life than you imagine is already illegal to some extent or another. With pervasive eavesdropping you're just one ticked off bureaucrat away from a prison sentence. And even if you yourself by some miracle live (an almost impossible) squeaky clean lifestyle, it's even less likely that your family and friends to as well.
Re: (Score:2)
I don't see the point in encrypting all my IM either. If the government wants to watch me joke around with my friends, let them.
Then you're part of the problem. You should never let the government conduct such surveillance, and by doing so, you make it more difficult for intelligent people who do care about their privacy to protect said privacy.
Re: (Score:2)
Oh, and just because you think what you're saying is harmless, that doesn't mean the government thinks so. There are numerous cases of the government misinterpreting jokes and statements and then proceeding to try to ruin people's lives. Surely you don't want to suffer the same fate? Or do you believe that people who work for the government are perfect angels? From your comment, I would think not, but it's truly baffling that you would suggest that it doesn't matter if the government conducts such surveilla
Re: (Score:2)
Well, it's not my government, so I don't think I'm part of this particular problem.
If it were my government, I'd have been out there protesting when the PATRIOT act was being mooted. I usually don't care about politics, but that was a really obvious violation of people's rights.
I don't think they should be allowed to do this surveillance at all, but at the same time, I'm not going to encrypt anything that doesn't actually need encrypted.
Re: (Score:2)
I don't think they should be allowed to do this surveillance at all
That's a start.
but at the same time, I'm not going to encrypt anything that doesn't actually need encrypted.
Most likely, it does need to be encrypted, but you'll only find that out when it's too late.
Re: (Score:2)
Privacy is a requirement for personal safety. Wether it is financial, physical or psychological safety. You give up your safety too easily and think it does not matter. I am fine with the first (for now) but not the second.
searchterms: why privacy matters
Re: (Score:2)
This is because most people don't care, most of the time.
For the same reason they use credit cards instead of cash. Now go stand around your local headshop and see how many people suddenly switch to cash.
Re:Minimal Trust: (Score:5, Insightful)
It has been available for a kind of long time. RFC 2440 for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy.
The problem is getting a critical mass of users to adopt encryption. And although it's largerly a matter of people either not caring, or not knowing enough to care, it's also a problem of not wanting to stand out in the crowd and risk getting singled out. My friends and I don't use e-mail encryption because, with so few other regular users of it, we would simply be marking ourselves for special attention from TLA's.
It's the kind of thing where a significant portion of the population - say 10% - needs to start using e-mail encryption simultaneously. And unfortunately, that's not likely to happen any time soon. I've said it before and I'll say it again: like sleight-of-hand in a magician's act, bread and circuses really do work to keep people distracted from what their leaders and masters are doing. Until enough of us pull our heads out of our popcorn bags, organize, and start engaging in the Internet's equivalent of 'passive resistance', the 1% and their minions are going to keep screwing us over.
Re:Minimal Trust: (Score:5, Informative)
To twist an oft abused quote around:
If you have nothing to hide you have nothing to fear so go ahead and encrypt everything. Make the bastards work for every byte.
Re: (Score:2)
They will start to write their own code out of pride or nationalism and be able to offer it to their govs at a fair market rate.
No more trade deals to select from a few 'big' UK/UK brands at a low price and with long term support totally locking out skilled locals.
The only way into air gapped systems will be via special forces teams breaking in or bribed local staff.
Both options are very expensiv
Re: (Score:2)
Millions of people can be sorted per country thanks to poor software and hardware import deals.
Practical problems with the web of trust (Score:3)
RFC 2440 [describing OpenPGP] for encrypted email was written in the 1990s, but people are really resistant to anything that might help their own privacy.
You talk about OpenPGP. How much does it cost to travel to get your key signed by people who are well connected in the web of trust? And how can you trust that the people who signed the key of the person with whom you want to communicate are reliable at signing keys?
I can't even get my friends to use "Off The Record" for secure IMing.
That depends on whether a client supporting Off The Record is available for a particular operating system (such as Windows Phone) and how easy it is to start using. Mobile operating systems prefer monolithic apps over protocol plug-ins that can
Re: (Score:3, Interesting)
Anyone remember when the NSA threw a fit regarding 128bit SSL becoming the next standard?
Then suddenly there was silence, and technology moved forward to 256bit and then 1024 etc... never to hear another whisper from the NSA.
This should have been the beginning of all the questions
For most of us in the field, we rely on solutions doing what they say they will; in order to meet the requirements we set. So we have to maintain some level of trust somewhere, but at the same time, trust wasn't a part of the risk
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
If you follow this link, you have failed the first test of computing with minimal trust.
If it actually goes to crystallographic software and you use that software, you've failed the second and third tests.
Re: (Score:2)
Re:P2P crypto software (Score:4, Insightful)
That is the real problem. If all I do is work from my desktop then I can just use kmail and its fairly strong gpg support and I'm done. The problem is that I use many operating systems, including ChromeOS, so I need Android clients, web-based clients, etc. I've yet to see anybody write a really good web-based email client, and even the IMAP options are very limited if you want to use tag-based email management (as in Gmail).
I really don't want to use Gmail. Its identity management is broken on Android, it isn't good at threading, there is no way to use it with encryption, and it gives Google access to all my mail. The problem is that nobody has come up with an equivalent FOSS option. The best I can do is cobble together a bunch of stuff and still get an inferior product. I've yet to find a web-based MUA that handles keyboard shortcuts nearly as well as Gmail...
most people don't want to bother (Score:5, Interesting)
I try to get my family to stop using gmail, and instead use a local mail program which they can then use for end to end encryption, private non-cloud storage of their old emails, etc, but they don't want to bother. They'd rather have google storing all their emails and are fine with the advertising they get shown as a result of the data-mining of the email contents. They don't care about the NSA because they "aren't doing anything wrong".
That's what security is up against: people who want to put all their information in "the cloud" and don't really care what that means for privacy and security or even services that can disappear at any time or change their terms of service at any moment. It's all about the simplicity, and nothing else matters except allowing it to be a brainless usage model.
Re:most people don't want to bother (Score:4, Informative)
Re: (Score:2)
Re: (Score:3)
Re: (Score:3, Insightful)
The screwy thing about that, is that it needs a plugin at all. This is ancient shit. For the last 15-20 years, most email clients have come ready to use pgp out of the box, but then you get to the high-profile (i.e. popular, because it comes with pre-installed consumer OSes) email clients, and they require people to search for plugins, in order to get basic 1990s-level tech. The problem used to mainly just be Apple Mail and MS Outlook (and then, sadly, Thunderbird, WTF) but then smartphones got popular,
Re: (Score:3)
Re: (Score:3)
I understand how to do exactly everything you're asking your family to do, and yet I still trust all my email to Gmail.
The reason is that it makes the data readily accessible. I'd like to read my email from arbitrary computers using only a web browser, and routinely read my email in this way so the client needs keyboard shortcuts/etc.
Sure, I could set up squirrelmail or roundcube and use IMAP with some client on Android (and have done so in the past), but the software is very clunky. With gmail I can proc
Re: (Score:3)
True. Privacy is not a technological issue but a political one.
I could barricade my windows, put steel fence around my house, install EM shielding etc. Would not be a nice life, through. The same is for Internet privacy: I could install packet filter, firewalls, encrypt everything, but it's not a nice experience of the Internet then.
That is why we need strong privacy laws. We have privacy laws of mail and phone calls, why we don't have privacy laws for e-Mail and Web sites, Skype, etc.? Privacy laws are ess
Re:most people don't want to bother (Score:4, Insightful)
They don't care about the NSA because they "aren't doing anything wrong".
They are missing the experience of living in a police state, bless them. One of the reasons Germany is a little (not enough, but a little) less ignorant of this is that many of its citizens still remember the GDR and the Stasi.
Even risking to Gowdin this, but maybe it gets them thinking to tell them that the Jews in Germany also thought they didn't do anything wrong. The Nazis, on the other hand, were very happy that religious affiliation was on government record and were extremely efficient in rounding up all the Jews who, remember, didn't do anything wrong.
Re: (Score:3)
That's what security is up against: people who want to put all their information in "the cloud"
I don't think that's quite accurate. People want simplicity, ease of use, worry free backups, automatic sync between devices, etc.
Give them thick client, encrypted solutions that give them those things with minimal or no effort, and a great many would probably convert.
The success of the cloud is largely because thick client solutions have largely failed the average user test. Us technical folks don't recognize or ignore this fact far too often.
Re: (Score:2)
Heh, nice car analogy :) I do agree with your general arguments.
That said, the difference is that the mechanic is not likely to put a secret bomb in your car, of course.
Re: (Score:2)
People have always been like this as long as civilization has been around. Some people fully understand a technology and take the details of it into their own hands, while others are more comfortable with someone else providing the expertise.
This. Those individuals don't understand the problem, don't want to understand the problem, and frankly don't care about the problem. To them it isn't a problem, or at least not their problem. Now, you harping on about it and making it their problem on the other hand...different story...
So- (Score:2)
Back to sneakernet?
Re: (Score:2)
Too smelly.
Start buying stamps again (Score:3)
Misunderstanding what trust is (Score:5, Interesting)
Take the view of the Pentagon and assume that you are at all times compromised. You probably are. Any given entity can be broken into by a determined hacker. Talk to a pen tester sometime and ask them how many places they have failed to break into. The entire concept of trust is that you can send data privately over the Internet, you can't unless you encrypt your data offline ahead of time.
On the Internet trust is all about identity and encryption. For most people that translates into a certificate that is used to supply SSL. People then assume that because they are using SSL that they can now trust a given connection. There is no justification for trust and there never has been, the entire concept of trust is a misunderstanding of the concept of how a Certificate Authority works.
All a Certificate Authority does is say that their is an unbroken chain of identity from a given point to a given point. Even then a Certificate can be forged or stolen or issued improperly, and even if controls detect a bad certificate in use most people will click the button to use the bad certificate anyways.
All of this assumes that a given government entity hasn't used a court order to force a Certificate Authority to replicate a Certificate so that your data can be seized. Certificate Authorities cooperate with things like court orders, they don't self destruct like Lavabit. That whole backstory with Lavabit self destructing - it was a fight over getting the key that was used because he wouldn't hand over his private key.
People also forget that SSL is wholly dependent on Certificate Authorities. SSL is used to encrypt data with a key when data is in transit. The problem is that data anyone that owns the network can conduct [sourcefire.com] an MITM [bluecoat.com] attack against your key. SSL is fundamentally broken because it presents a perception of trust when it is incapable of providing that level of trust.
Re: (Score:2)
Your analysis of SSL isnt wholly correct. You can perform casual MITMs when you control the CA chain, and when your end users know they are being spied on.
It is however fairly easy to see if someone has created a forged cert with an alternate CA, as the cert thumbprint and CA chain would be different.
Re: (Score:3)
Not when you hold the same keys the real CA does. The NSA may well have their own copies of these keys.
Re: (Score:2)
The CA never has a copy of the SSL certificate necessary for doing key exchange.
The public certificate is what is signed by the CA. It's also handed out to anyone that asks for an SSL connection, so it's hardly secret. The private key is only ever held by the certificate owner, not by the CA.
If a CA is complicit (or gives you a copy of their key), you can create a pretty good MITM by generating a new keypair with the target's information (obtained from the public cert) and signing that. However, you cannot
Re: (Score:2)
Or someone talking to the target.
Look at what happened to Lavabit.
Re: (Score:2)
To what is "or someone talking to the target" referring?
The only one with the private key is the target. A person communicating over SSL with the target doesn't have the target's private key.
If you want to undetectably MITM an SSL encryption, you need to acquire the SSL private key from the target. Is that more clear?
Re: (Score:2)
I meant if we the target of the investigation is not the target of the MITM attack.
What I meant was if they have the CA cert and a copy of the priv key or heck at that point they can just take the cert like they did for lavabit, it is game over.
Re: (Score:2)
Ive told you this about 5 times in 5 different article threads. The CA NEVER has the private keys for EXACTLY this reason.
Re: (Score:2)
You are showing your ignorance. Lavabit was asked for private keys precisely because the attack you envisioned is IMPOSSIBLE without the private keys.
Re: (Score:2)
Not when you hold the same keys the real CA does. The NSA may well have their own copies of these keys.
The CA doesn't hold any private keys, at least not usually. Even the Mossad allows you to skip giving away your private key.
So, all a malicious CA can do is issue a second certificate with the same info, but for a different private/public key pair. But that means that the fingerprint will be different (this is a hash over the entire certificate, including the public key, which won't match the public key of the original).
So, an observing user can indeed spot this. Only the browser's automatic check (based
Re: (Score:2)
So, an observing user can indeed spot this. Only the browser's automatic check (based solely on the CA's signature) will be fooled by this.
And how many users do you think bother to regularly check every SSL cert is indeed legit? I'll be generous and assume single-digit percentages (realistically, I would put it closer to less than 1%)
Now we move on to the next question, whose fault is this? The users for not being more vigilant? The browsers being lazy? Both? Other third parties? (Insert well-loved TLA name here) All the above?
The Internet may have been developed in part by the military but it was not built on an adversarial (paranoid) securit
Re: (Score:2)
And how many users do you think bother to regularly check every SSL cert is indeed legit?
It is irrelevant. As soon as ONE user spots it-- and SOMEONE will-- the jig is up: everyone will know surveillance is happening, theyll know which CA issued the phony cert, and theyll un-trust that CA.
Re: (Score:2)
The CA cannot generate an identical cert to the end server-- they do NOT have the private key ever.
Please read up on how SSL certs / CSRs are created before commenting on the process.
Re: (Score:2)
It is however fairly easy to see if someone has created a forged cert with an alternate CA, as the cert thumbprint and CA chain would be different.
It in indeed easy to see when a cert has changed.
The difficult bit is deciding whether that cert change is legitimate or not. Sites do change their certs for a wide variety of reasons (upcoming expiry, dumb admin loses the keys, need a different selection of domains on the cert) and larger sites often end up with different load balanced/geolocated instances using different certs. So seeing a different cert from other people isn't nessacerally an indication of foul play.
Re: (Score:2)
The difficult bit is deciding whether that cert change is legitimate or not
Seems like when this happens with Google for example, someone posts to a google groups "hey, google, is this legit?".
Pretty simple for the vendor to throw out a quick "yea that thumbprint is ours".
Re: (Score:2)
People also forget that SSL is wholly dependent on Certificate Authorities
Well, technically, you could always very "certificate" fingerprints manually...
The problem is that data anyone that owns the network can conduct an MITM attack against your key.
Make that "... anyone that owns the network and the CA can conduct an attack...". The purpose of SSL is exactly to prevent attacks by people who "only" control the network between client and server.
SSL is fundamentally broken because it presents a perception of trust when it is incapable of providing that level of trust.
SSL doesn't supply trust, instead it relies on trust. Namely on the trust that CA's are doing their job properly (... which unfortunately, they don't always do...)
Re: (Score:2)
Even worse, you can't trust just _a_ CA. You need to trust every single of them. Including CNNIC, Etisalat who conduct massive MITM attacks themselves, Turktrust and co who are merely criminally sloppy, and the whole rest, 95% of whom I suspect to not even wince when a three letter agency requests a fake cert pair.
Re: (Score:2)
Ok, so out of ~300 suspicious CAs, you are vulnerable to MITMs signed by 299 others.
Trust is context- and stake-dependent (Score:5, Insightful)
I trust some people's knowledge and expertise in one domain, but not in another. Likewise, if I were a US citizen running an entirely legal US company I'd have not the slightest problem with trusting the NSA cloud with all my company data (if they had such a service). I trust AES with keeping my personal data unencryptable by crooks and criminals, but I probably wouldn't use AES to encrypt all my data if I were a member of the Chinese military. It really depends in the threat scenario and your goals. An unconditional discussion of trust is fruitless.
trust is earned (Score:2)
what has the NSA done to earn back our trust? NOTHING!
there is only one logical conclusion: stay outside of their reach and only expose information that you dont mind being public.
the internet has become toxic so where will we go now?
minimal trust (Score:2)
Oh, come on. I mean I don't know about most people, but there has been no day during my life around computers during which I would've ever thought that computers, the networks, the internet, and/or services were more secure or more trustworthy than that 'minimal' the poster talks about. And I'd expect everyone with enough experince and insight to feel the same. So this
nothing has changed (Score:2)
I mean that. Nothing has changed. The issue is still the same: At some point you have to trust someone. Not everyone can write their own software. Even fewer can write their own operating system. Only very few can write their own compiler. Almost nobody can build their own hardware. Unless you are a government agency with almost unlimited budget, you have to trust someone at some point.
It may not be the provider of your technology - it can be someone checking it. The way we don't bring every piece of food w
Re:What? (Score:5, Insightful)
We never really trusted our government.
The problem with elections is that the government always wins :(
Re: (Score:2)
Re:It wasn't a revelation (Score:5, Insightful)
Why would a government not take the effort to look into what people do on a daily basis when they have the technology .
To me it was also predictable, because I've read history books and noticed again and again that the most ruthless, sociopathic, often bloodthirsty control freaks are the ones who want power so badly that they'll do anything to achieve it. That's the nature of government. Public awareness and understanding is the only real thing holding it back. We have public apathy and ignorance because most people have been softened and made complacent by convenience and pointless indulgences (hundreds of channels of brain-dead horse-shit, news media controlled by 5 corporations all of which are cozy with government, public education for obedient workers and not for self-directed thinkers).
But that the government would want to spy on its people and would use technology in that manner, no that's not remotely surprising to anyone who understands the nature of governments and the people who most want to run them. What we need is a majority of people who comprehend this basic fact that has been repeatedly observed throughout history. The stakes are higher now, and become higher the more our tech advances. Our leaders have noted that bread and circuses works, that's because they actually do learn from history.
Re: (Score:3)
because I've read history books and noticed again and again that the most ruthless, sociopathic, often bloodthirsty control freaks are the ones who want power so badly that they'll do anything to achieve it. That's the nature of government.
Give that man a cookie.
I had a few years in an elected position. In the end, I gave it up because I couldn't take standing up against the egomaniac psychopaths anymore whose only concern was themselves and their position. These people will win out because people like you or me will reach a point where we just can't take it any longer, but for them it's the meaning of life.
Re: (Score:2)
For most people it is really not an issue, you only have to worry when you have something to hide. It's funny how people whine and freak out about privacy but they don't really have a point, only the assumed guilty act like they must hid what they do. People who know they aren't breaking the law and don't intend to aren't afraid of just letting people see what they do on a daily basis.
I thought this board had moved past this argument. How do you know you're not doing something illegal? Do you have a working knowledge of every law on the books for your state or local municipality, let alone the federal government? Are you under the impression that all laws are reasonable and adhere to your common sense? Is your idea of "wrong" the same as everyone employed at the NSA? Are you aware that these surveillance powers are being used against people who have not broken a law but are critical
Re:less trust, more thrustworthyness (Score:4, Funny)
"Thrustworthy" sounds like a colloquialism for someone worth having sex with.
Re: (Score:3)
Gah! (Score:2)
Like spongeworthy?
It's Spongeworthy Bobpants, the new porn star!
...
Bleh. That's an image I didn't need to think of today.
Re: (Score:2)
Actually the script would kind of write itself, He lives in Bikini Bottom and works for a crab after all...all that's missing is Squidward coming out in drag...
Re: (Score:2)
I like how all the "conspiracy theory" people are generally considered wacko, yet more of their predictions or "conspiracies" come to be yet they are never given validity.
The people who want modern-day prophets to be wrong so they can ridicule them, call them names, and feel better for a moment about their pitifully desperate and meaningless lives, well, these are not the kind of people who like to admit when they are wrong and try to avoid repeating the same mistake.
Validity was never to be expected from the likes of them. Such people aren't interested in truth. They're interested in feeling superior to someone else. This is fundamentally incompatible with a search fo
Re: (Score:2)
No. It's a noise level problem. MOST conspiracy theories are wrong. There are thousands of conspiracies happening at all times, and still most conspiracy theories are wrong. And it's not because the existing conspiracies are successfully remaining unpostulated.
So. MOST conspiracy theories are wrong. Possibly as many as 95% of them. But many of them are correct. How can you identify the correct ones? Did Castro arrange to have Kennedy shot? How do you know? Was 9/11 and inside job? How do you kno
Re: (Score:2)
Re: (Score:2)
You do realize that the Loongson chip was developed by the People's Republic of China right? Not the first place I'd look for backdoor-free chip designs...
Re:Hardware (Score:4, Insightful)
Like Intel embedding 3g radios in the vPro processors [softpedia.com]? Putting trojan in FPGAs [dangerousprototypes.com]? If i can't walk to the next continent, why worry to start walking?
Do what you have at your hands, you can improve a lot your security in the points where you control. And let the rest of the world figure the missing pieces, with open source software you also have portability, when an alternative comes in that area (i.e. moving to ARM) you will be able to take a step forward. Just don't get too tied to a solution that you can't control.