* Posts by tom dial

2187 publicly visible posts • joined 16 Jan 2011

Uncle Sam needs you... to debug, improve Dept of Defense open-source software at code.mil

tom dial Silver badge

Re: Ha Ha, no.

The claim is not the proof.

Is there any evidence that the quality of code produced by government employees is inferior to that produced in the private sector (in any country)?

As an aside, it appears buildings can, in fact, be copyrighted: see

http://www.dmlp.org/legal-guide/copyrightable-subject-matter

'First ever' SHA-1 hash collision calculated. All it took were five clever brains... and 6,610 years of processor time

tom dial Silver badge

Re: Sound and fury, signifying nothing

6,500 CPU-Years is a few weeks of work on a 150,000 unit botnet. It is well not to make too much of numbers that criminals can be downscale easily. For that matter, the US DoD has nearly three quarters of a million civilian employees, nearly all of whom are provided workstations that could, in principle, be recruited for about 100 hours a week, producing 6,500 CPU-Years in a week or so.

Producing a document tailored to specific semantic change might (or might not) be many orders of magnitude more expensive, but sticking with SHA-1 based on some big numbers seems rather foolish.

tom dial Silver badge

Re: "Why does the size have to be identical? "

To verify the hash meaningfully, no matter what kind is used, you need to know what the output of your hash computation should be. That is no different from knowing what the size should be. That you might need to get that out-of-band may not be a major objection.

Republicans send anti-Signal signal to US EPA

tom dial Silver badge

As a earlier post observed somewhat differently, the main difference in education since the federal Department of Education was established is civil service and contractor staffing under management by the Secretary of Education. That, and the turmoil in public schools arising from periodic changes to educational standards.

tom dial Silver badge

Re: Holy Smeg...

It it not entirely clear that the federal government has an appropriate role in managing "Education." The proposition that it does at least is an arguable matter for political discussion, and a bill to disestablish the Department of Education is one way to start that political discussion.

It also is not clear that the Department of Education has brought much improvement to education in the US despite its large budget and the voluminous regulations and "Dear Colleague" letters it has issued.

It is fairly clear that it has contributed significantly to confusion about sexual abuse at and near colleges and universities and effectively demanded that those institutions act in matters where they have little or no experience or competence and apply rules that, in practical terms, require that accusers have their word accepted without significant question and accused prove their innocence.

Rape is a felony offense, and other forms of sexual abuse often are at least misdemeanors. They warrant criminal prosecution, along with the constitutional and legal protections for the accused that apply in all criminal cases.

tom dial Silver badge

Re: Illegal order

In the federal military and civil service, unlawful orders may be argued against, and a service member or employee may require that the order be delivered in written form, which may provide some cover or even cause the order to be changed or withdrawn. In the civil service, an employee who object to an order (whether legal or not) also may resign with immediate effect or take advantage of whistle blower laws.

Such actions may have career effects, but that also is true of executing an unlawful order.

tom dial Silver badge

Re: Are they also ...

Private communications of federal employees with each other are not subject to FOIA requests. Their private communications with others outside the government generally are not either subject to FOIA or other government restriction.

Public statements about their agencies policies or operations generally are restricted and required to be reviewed or issued by the agency public affairs office.

Private communications advocating, organizing, or coordinating resistance within the agency to lawful direction might conceivably be of interest in the event of actual insubordination that becomes cause for adverse personnel actions. In most cases, however, it will not because the specific insubordinate acts that lead to adverse action usually will (or will not) be sufficient by themselves, without recourse to communications.

Paranoia among both employees and managers, is unwarranted.

Bruce Schneier: The US government is coming for YOUR code, techies

tom dial Silver badge

Re: One World One Tinternet

"Is the Nation state not extinct as the network boundary?"

China think not.

tom dial Silver badge

Re: But wait

Congress often does a shoddy job, but they are there for what I said, and a good deal of executive mischief comes from their failure to sufficiently narrow executive branch freedom to act.

Moreover, through the well documented mechanism of regulatory capture, agencies designated in the laws tend to become most attentive and responsive to vociferous policy advocates These often the very entities that the agency is to regulate. The agencies also tend to recruit from and retire to employment by regulated entities; consider both Tom Wheeler and Ajit Pai, for example.

tom dial Silver badge

Re: But wait

The implicit point was that it is unclear whether having such a law will have much beneficial effect in limiting damage from shoddy software. In an environment where ensuring security of large software/hardware systems is all but impossible, legislating against insecure software is likely to be a waste of time.

A huge number of IoT and similar devices with embedded computers run a general purpose operating system, and the SoC in many of them has roughly the complexity and capability of a late IBM S/370 system. They certainly qualify as "large software/hardware systems." Furthermore, a great many of these systems allow or even require end user configuration. That will generate vulnerabilities in addition to any that came in the box and confuse issues of responsibility for what, inevitably, will go wrong.

tom dial Silver badge

Re: Compare and contrast

Loan repackaging had been going on since the 1960s, when I made a small investment in a real estate investment trust. My 1983 mortgage was sold off to a repackager, although the local S&L that originated it continued to service it.

The 2008 crash was a classic bubble of the type Charles MacKay described more than 175 years ago. It plainly was aggravated by the unintended consequences of laws and regulations intended to increase home ownership and ensure that it did not exclude racial and ethnic minority members, as well as enthusiastic participation by large numbers of dishonest borrowers, lenders, and resellers.

Still, it is extremely doubtful that it would have happened without the strong encouragement of the federal government, which allowed risk to be passed on, as happens in all financial bubbles and is building up to happen even now for the college education bubble.

tom dial Silver badge

Re: Motivation?

This is a bit unfair to the Democrats. A considerable part of the Republican party is as much "establishment" as any Democrat. Despite their private horror of Donald Trump they have gone along so far because the power to organize the Senate and House of Representatives is a good thing from their viewpoint, and even better with a nominal Republican as president.

Still worth an upvote, though.

tom dial Silver badge

But wait

"Schneier ... plans to call for the creation of a new US government agency to sort through the issues arising from putting software in everything." This, presumably, will require laws, since government agencies do not "sort through the issues," but apply the laws enacted by the legislature and approved by the executive. Sorting through the issues, and reconciling the many competing interests, is the job of legislators who do not always do it well and often are somewhat clueless in technical matters. The recent history of the Cybersecurity Information Sharing Act is instructive.

In the end, however, even if good legislation can be passed, it will not ensure that network connected devices that combine hardware and software will be secure, and the law will not apply to either US criminals (except as punishment if caught) or foreigners sheltered by uncooperative governments (at all). It also will not protect against clueless users who click on dodgy email or web links.

No crypto backdoors, more immigration ... says Republican head of House Committee on Homeland Security

tom dial Silver badge

Re: Dear Europeans and at least one American

By reasonable standards, the US has a quite decently representative government. Gerrymandering aside (it has been going on for well over 200 years and been practiced assiduously by any political party that could do so) Representatives are chosen by plurality* in their districts, and nearly always by a majority, since most districts are meaningfully contested only by Democrats and Republicans. The same is true for the Senate. And in presidential elections, the candidate with a plurality or majority of the vote usually is elected President, although it has turned out otherwise several times in recent presidential elections.

The fundamental problem of the national legislature is to reconcile a very large number of competing interests that are as fully legitimate to those who advance them as different interests are to their opponents. Many of these interests are local or regional, or break on other criteria such as degree of urbanization. The disagreements at the national level are real, not a matter of perversity, and will not be settled by being more democratic or otherwise fudging the electoral process. Many or most would be largely unchanged if gerrymandering were discontinued.

The national political parties are weak organizations that coalesce for presidential elections and revert to regional characteristics between. Democrats and Republicans from prairie states, for instance, are likely to resemble each other more than they do members of their own party from another state or region, especially a heavily urban coastal area. That is because, whether gerrymandered or not, they do represent the voters in their districts in matters important to those voters, although they have considerable freedom in other matters. It is significant that the Congress has a seriously unfavorable rating with most survey respondents, but most representatives and senators get a favorable rating from respondents in their state or district.

* Of the actual vote, and in most states.

tom dial Silver badge

Re: Knock, Knock. American here.

I almost stopped reading at this point: "Over 20 states have tried to banish this blight called the electoral college." The legislatures of those states have signed on to a misbegotten scheme whereby they would, quite possibly, render the vote of a clear majority of their voters irrelevant. They can do this under the constitution, as some states did into the early part of the nineteenth century.

In this context, it is worth noting that, like him or not (I do not), Donald Trump was the choice of an absolute majority of the voters in 21 states, and of a plurality in 9 more. By contrast, Hillary Clinton received a majority vote in only 13 states and the District of Columbia and a plurality in only 7 more.

The US is no longer a largely agrarian country, but the notion that the 70% (your figure) who are city dwellers should should have largely unrestricted power over the remaining 30% is utter rubbish, and one of the reasons the designers of the government chose not to establish a democracy.

Oracle refuses to let Java copyright battle die – another appeal filed in war against Google

tom dial Silver badge

In the federal agency where I used to work, at least 95% of the databases, comprising perhaps 70% of the work, could relatively easily have been replaced by MySQL, PostGres, or SQL Server. The remaining 5% of the databases then - around 5 years ago - were running DB2 on IBM zSeries. The only real migration issues had we chosen to abandon Oracle were databases where we had locked ourselves in by using PL/SQL; some of those would have required significant recoding and testing effort.

Along with a few others, I argued for adoption of free and open source software where it made business sense, but the truth is that even at Oracle's sometimes astonishing and outrageous cost, eve fair economic analysis would show benefits so far in the future as to render them fairly meaningless. In addition, there was a good deal of management discomfort with products that did not come from large vendors who provided "support." Little was done then, and I doubt much more has happened since beyond a slight shift toward SQL Server.

tom dial Silver badge

Re: And the Exodus of IT Companies from the USA

As we have seen quite recently, the executive branch of the US federal government does not necessarily have much influence over the courts. Moreover, juries sometimes behave in strange ways, and certainly are not creatures of the executive branch. The notion that "it won't be allowed to happen" is paranoid nonsense, but may well be what Oracle is betting on.

The lawyers, however, will be willing to accept Oracle's money at a rate of $1,000+ a person-hour for as long as Oracle is willing to make it flow.

Feds snooping on your email without a warrant? US lawmakers are on a war path to stop that

tom dial Silver badge

Re: Trump would probably veto it anyway

A two-thirds vote in both the House and Senate would trump Trump.

tom dial Silver badge

Re: Glass house?

There are substantial legal and constitutional protections in the US from the NSA as well. While they might have exceeded them on a number of occasions, the documents released courtesy of Edward Snowden indicate fairly plainly that NSA generally followed its rules, approved by the FISC, although they regularly (and with FISC approval) acquired data that many thought overbearing. The approved limits, however, were consistent with the law in 50 USC 36 and restricted targeting of "US persons" defined roughly as US citizens anywhere in the world along with citizens of any country who were legally present in the US.

This, of course, allowed them to target a citizen of any other country who was not legally present in the US and not protected by either a treaty approved by the US Senate (equivalent to a US law) or an intergovernment agreement not to spy on each others' citizens. Neither the "Snowden documents" nor officially declassified documents that I am aware of say anything about either, so we may be substantially in the dark here. An obvious consequence of this is "incidental" collection of US person information, both data and metadata, where targeted persons and untargeted US persons were in communication. It is not obvious that this is avoidable, but the law imposes significant restrictions on its use.

We may disagree with the legal limits of NSA data collection as concerns the US persons, as well as with the constitutionality of various parts of 50 USC 36, not to mention the validity of the FISC decisions, many of which are classified and few of which were appealed to the Foreign Intelligence Surveillance Court of Review. Given the international scope of The Register, a great many of the readers will have a much different perspective on this and may object strongly to it, although most will be citizens of a Five Eyes country and have potential issues with their own governments' SigInt and police agencies. I suspect there are treaty provisions or intergovernment agreements with less status that protect citizens of each from all, but do not know that; we all should be asking our governments about it.

The matter of privacy grants by individuals as a matter of contract is much different from legal privacy breach by government officials. It seems to be an active development area, in legislatiive activity as well as litigation. Courts will enforce the contract, but establishing violations is likely to be very costly and inconvenient for individuals. In the US we have the possibility of class action lawsuits, but quite often these have the primary effect of enriching plaintiff attorneys and only a secondary and relatively trivial effect of compensating class members.

tom dial Silver badge

Re: You mean...

Federal law trumps state law. Indeed it does, giving us thereby the Civil Rights Act of 1964 and numerous other laws that most people would approve. The good with the bad. The upshot is that in CA, the state officials have to get a warrant unless they can establish enough of a federal case to enlist the FBI or DHS to fetch for them.

That said, I do not think the warrant requirement, if passed in both the House and the Senate and signed by the President, will be a serious impediment to federal criminal investigations, and do not know why Senator Cornyn torpedoed it the last time around. The existing authority to obtain old email content without a warrant doubtless simplified matters in some cases and reduced the workload on federal magistrate judges, but it is likely that in nearly all cases, orders were issued to produce email messages of people already under significant suspicion based on enough facts that a reasonable judge would issue a search warrant. But then, again, my own practice is to download and delete email from my ISP every minute and leave them on the ISP's server for no more than 14 days.

Trump's cybersecurity strategy kinda makes sense, so why delay?

tom dial Silver badge

One may hope, perhaps even with reason, that the cybersecurity order will be more carefully thought out and better staffed, and its implementation better planned, than the partial immigration suspension order of January 27. That would cause significant delay and indicate that the new crew at the White House are learning.

Based on the leaked draft, it is fairly likely that there is a lot of pushback from some agencies over what is to be done and how fast. The DoD, mostly, will be in fairly good shape, as they began long ago to tighten the screws, manage information security, and document their status. They will not find it hard to provide status and recommendations in 60 days. While they were well short of perfect five years back when I left their employ, they were far better than the State Department through at least the end of Secretary Clinton's tenure, or the Office of Personnel Management through early 2015; they, and probably a good many other agencies would find it hard or impossible to complete the evaluation in the required period, although the recommendations might be far easier, beginning with something like "maintain up-to-date security patch status."

Wanna protect your data center? Take tips from the US Secret Service

tom dial Silver badge

Re: Securing the Perimeter

Our (USDoD) data center did not allow end to end encryption, as they required (and used) the capability to scan all traffic entering or leaving the premises. This started after a remote user's account was compromised and used to upload malware that, as I understood it, affected a major application quite seriously. Those of us already using SSH to internal hosts were not forced immediately to stop, partly because telnet and ftp were disallowed on principle, but ultimately had to switch to out-of-band access using a VPN that terminated at a premise gateway.

In an ideal situation, multiple factor authentication and end-to-end encryption may be suitable, but situations usually are less than ideal. DISA centers typically support thousands of external users and systems, not all of them subject to DoD control.

tom dial Silver badge

As I understand this correctly, it is not a new idea, even in the government. When I retired about 5 years ago, US DoD data centers had largely implemented a scheme of many VLANs with detailed access control lists and intermediate firewalls such that users of an application (including other applications) were permitted access only to the resources required. As far as I was concerned, as DBA for a number of specific databases, applications that did not connect to those databases might as well not have existed. The data centers also had implemented out-of-band access for their own administration and begun to impose that on customers who did their own administration.

As Gleicher and various commenter have noted, it is not easy to implement even for new work, quite a lot harder to retrofit, and more than a little painful for various categories of user. It took them for or five years In general, though, it worked well once in place, giving trouble only occasionally when changes had to be made.

Out-of-band requirement for us external administrators was especially irksome, as it brought a required VPN that shut off all other workstation networking, cutting off email and the IM that we used for internal communication. These were hard to do without for more than a short period because our agency was geographically distributed, by branch, across three widely separated locations; this problem eventually was solved, I believe, by providing those affected with secondary workstations (and additional LAN drops) for their VPN use. This requirement also led my former agency to drop out of the server operation business, as the network upgrade cost, combined with increasingly stringent and costly configuration management and security requirements came to be seen as diverting resources from their primary mission.

Trump signs 'no privacy for non-Americans' order – what does that mean for rest of us?

tom dial Silver badge

Re: Since..

Bears shit in the woods. Spies spy on foreign governments, including their leaders. That may offend some people, but it is incomprehensible it would surprise anyone with even minimal knowledge and understanding of history and foreign affairs.

tom dial Silver badge

Re: UK not covered by the agreement..

As specified in the outgoing Attorney General's notice on the Judicial Redress Act, inclusion of the United Kingdom, Denmark, and Ireland would need to be triggered by a notification from the European Commission.

tom dial Silver badge

Re: Agencies shall, to the extent consistent with applicable law

"Obama classified the laws."

He did not. The laws, as enacted, are widely available for anyone with even a passing interest to see.

Some executive orders are classified in part or in their entirety, but executive orders cannot authorized what the laws do not. Some of them stretch laws to their limit or beyond, or sometimes interpret them to permit actions that many or most of us would think they do not allow. However, such actions, once known, are likely to be trimmed back by the courts and either discontinued or (as with the PATRIOT Act) authorized in subsequently enacted laws.

tom dial Silver badge

Re: I was sat in the pub this evening.

Have an upvote for the general tenor and content. I would ask, though, whether anything imagined of Trump's actions exceeds what we already have seen of Putin. I do not think of Putin as a "safe pair of hands," and I do not live in a country with a common border to Russia.

tom dial Silver badge

I am not a constitutional lawyer or scholar, but have read it more than a few times and studied and thought about it some, and suggest the following.

Under the US Constitution, treaties, once approved by the Senate, have the effect of a law passed by the congress and signed by the president. (That is in Article II, section 2 and Article VI, section 2). It is probable that subordinate agreements negotiated under the authority of a treaty (approved by the Senate) also have the same effect as a law that the congress passed and the president signed. The EU-US Privacy Shield may be in this category.

The Judicial Redress Act is a law passed by the congress and signed by the president; as such, it would be subject to possible repeal. It might, however, have been an act to implement certain features of an existing treaty, and might therefore not have much, or any, effect on Privacy Shield rights. The outgoing Attorney General's notice in the Federal Register, as a derivative of the Redress Act, probably would go away in the event of repeal of that act. Redress after privacy compromise, of course, has little to do with whether the US government adheres to the agreement. It also is subject to rescission by the new AG, so everyone should be on watch for that.

tom dial Silver badge

Re: Yet ANOTHER Trump story?

I do not object to Register articles on US political matters, and in fact often find them and the ensuing commentary of interest in rasing issue and making points that had not occurred to me. That is not to say they are not sometimes slanted; they are, but not necessarily more than those in other news sources I read.

Of the four articles from yesterday on "Trump" I only looked back at the one on Trump administration use of the RNC private email server, so this comment, too, is potentially and probably actually biased. That said, the article, and the Newsweek article on which it seems to have been biased and misrepresent the facts.

"Senior members of the administration have been accused" of having RNC email accounts, not of using them for official duties. They also have not, according to the Newsweek article, been accused of continuing to use them (or, indeed, of using them at all). The Newsweek article also contains a statement from the RNC that the accounts have were deleted yesterday and suggests strongly that they never were used at all for sending or receiving email. To be fair, that was in a revision that may have been made after the Register story was posted.

The relevance of the 22 million "lost" RNC email messages from the first couple of years of GW Bush's second term is somewhat marginal, but might be considered a bit slanted in omitting the fact that they were recovered in the first year of the Obama administration. In that context enclosing the word "lost" in quotes also might be thought to show a slant; as far as I can remember or could find today, evidence never was offered to indicate anything other than an IT operations failure, albeit one that may have been overlooked, possibly for its beneficial side effect of (temporarily) precluding disclosure of the email contents.

The points about appearances, however, are quite on the mark.

Did you know? The FBI investigated Gamergate. Now you can read the agents' thrilling dossier

tom dial Silver badge

Re: A pox on both your houses

Utah State University, which I suppose is the referent of the parenthetical comment, is a creature of the state government and subject to state law. In the case of Utah, that means those with appropriate permits may carry firearms.

For what it's worth, despite Utah's quite relaxed gun control laws, firearm murders there occur at rates lower than in all contiguous states but one, and also lower than some states with much stricter laws such as New York and California.

Welcome to the Wipe House: President Trump shreds climate change, privacy, LGBT policies on WhiteHouse.gov

tom dial Silver badge

Re: @dalethorn

"The ability to make racist, misogynistic, homophobic, 'religiophobic', hateful slurs ..." is a right included in the first amendment; it did not need to be "won" as it already existed. It is not an unlimited right, but criminalizing rudeness is not within the lawful authority of governments in the US.

tom dial Silver badge

Re: The *people*

The electoral college ensures, to a degree, that the elected president had reasonably broad geographic support. Clinton really did not: she got a majority of the popular vote in 13 States and the District of Columbia and a plurality in 7 states. Donald Trump got a popular vote majority in 23 states and a plurality in 7. As a"flyover country" resident I respectfully disagree with the proposition that nearly all knowledge and wisdom is to be found within ~100 miles of the Atlantic or Pacific oceans.

For the record, I did not vote for either Clinton or Trump.

tom dial Silver badge

Re: I'd offer the world an apology for the garbage that is "American First"

While I agree with much of the comment, and don't disagree all that strongly with any of it, I consider downvote in order for rudeness. It is entirely possible to oppose, Donald Trump and all you think he stands for and will try to enact without being rude or directing crude personal attacks at his wife, who appears to be a reticent and decent person.

Quite understandable to post anonymously, though.

French spies warn politicians of hack risk as election draws near

tom dial Silver badge

Re: Hacking French politics ? Not worth it.

Clinton did not win, by the only valid criterion for a US Presidential election, and repeating the false claim that she did, no matter how many times, will not change that.

tom dial Silver badge

Re: Hacking French politics ? Not worth it.

The assumption that use of paper ballots is secure is a bit delusional, as is the idea that controls in paper ballot systems cannot be circumvented. In the US this was true a century (and more) ago, before the progressives cleaned it up; half a century ago, in the waning days of the large city political machines; and it is true still in the time of optically scanned ballots.

True story: at a primary election in a state and city I do not choose to name, the senior official on site directed that the box containing the paper ballots be unsealed and the ballots removed, sorted by political party, and counted so that we could be sure that the machine count would agree with the paper records being prepared as "controls." I do not think anyone altered or spoiled a ballot, but could not testify that it was not done, as I was busy with my own counting. know that I could easily have spoiled or with slightly more difficulty recorded votes on incomplete ballots. Once the counts had been reconciled, the ballots were replaced in the box and a new seal applied.

Thanks, Obama: NSA to stream raw intelligence into FBI, DEA and pals

tom dial Silver badge

Re: That's a *lovely* hand grenade under US business..

It's an (amendment to an) executive order. Any time after Noon next Friday Donald Trump can rescind or modify it it if he chooses. There is no meaningful sense in which it binds him. So it is not, actually, a good point at all.

tom dial Silver badge

Re: Number of times "warrant" appears in the guidelines

The warrant requirement already exists in the Foreign Intelligence Surveillance Act, as amended. My recollection is that in exigent circumstances, surveillance can be done for up to 72 hours while a warrant is being obtained. E.O.12333 is an executive order and, as Edward Snowden was advised by the NSA legal staff when he asked, executive orders cannot legally go beyond what the law and Constitution permit.

Discussion of actions like the one described in the article, without reference to their legal context, is not useful and tends to spawn a lot of fairly extreme commentary that may not be warranted. There is no guarantee, of course, that the agencies that comprise the intelligence community always operate within legal and constitutional bounds, but if they act illegally, an executive order cannot change that.

tom dial Silver badge

Re: Does not apply to Israel

This was reported widely at some time during the 2013-2014 moral panic over Snowden, as I recall. Google should turn up references fairly quickly, or a search of the Washington Post, New York Times, Guardian, or Intercept web sites

Prez Obama expels 35 Russian spies over election meddling

tom dial Silver badge

Re: Evidence it was the Russians what dunnit

The us-cert link given makes no explicit mention, nor as far as I can see any implicit one, relating to Weiner's laptop, which entered the discussion independently of hacking by anyone. However, it also tells absolutely nothing of substance about any unauthorized acquisition of Democratic Party documents and communications. The Russians might have done it, as the document claims without presenting any meaningful evidence, or an insider might have done it.

In the end, the leaked information probably had little to or nothing to do with the election result. Nearly everyone with the initiative to vote probably had made up their minds before the conventions, and Clinton's well known prior history and manifest inadequacies as a candidate almost certainly were the deciding factors.

The claim that Clinton's mail server was not accessed by foreign intelligence is most unlikely to be true given the publicly known vulnerabilities and the fact that messages to or from the server were known to have been obtained by hackers.

US cops seek Amazon Echo data for murder inquiry

tom dial Silver badge

Re: Not their call

Nothing in the Register article, or in the c/net article to which it links, suggests Amazon has done more than refuse to honor the warrant. They might have done, but neither article mentions more than simply refusal to comply and general public statements with no legal justification pertinent to the particular case.

Oracle finally targets Java non-payers – six years after plucking Sun

tom dial Silver badge

Re: VirtualBox Extensions Pack next?

I dropped Virtualbox in favor of qemu-kvm shortly after Oracle acquired Sun and changed the license for that. I did not return, even though the kvm management tools were less attractive and even after they apparently backed off on the license.

This only reinforces my decision.

If you bought a dildo in Denver, the government must legally be told

tom dial Silver badge

Re: Some research was done

"is there a requirement in *any* state tax law that the resident shall be responsible for determining and paying this value $y?"

Yes, there is, although I believe almost nobody actually pays it except on things like cars and boats that must be licensed by the state. Colorado's objective is to obtain information it can use to enforce their tax. It is called "use tax" and generally is charged at the same rate as the sales tax that would be charged for an in-state purchase. I know of it specifically only from Ohio and Utah, and now Colorado, but believe it to be somewhere between common and near-universal. States may vary in how they handle local tax add-ons.

The amount reported to the state doesn't have to be right, but those whose aggregate purchases are reported should expect to be questioned if they fail to file the use-tax return (which may be included on the state income tax return) or report much less than was reported to the state. The workability of the suggested circumvention might vary, but surely would risk other offenses like fraud, if not now, then after the various legislatures wake up to the possibility.

tom dial Silver badge

Strictly speaking, the article and the various agitators it references are correct: If you purchase a dildo (or anything else that might be subject to a Colorado sales or use tax) from a retailer who does not collect the tax, Colorado law requires the retailer to provide information to the state Department of Revenue. However, the retailer is not required to tell the Colorado DoR what you bought, only that you bought something, or maybe many things, during the calendar year. It does not authorize reporting more than who you are and the amount you spent. The implementing regulation specifies name, billing address, delivery address, and total dollar amount spent for the year - a one line entry per year for each Colorado purchaser - and it prohibits including additional information.

The law also requires non-collecting retailers to send Colorado purchasers an itemized list for their use in preparing their return for the use tax they are required to pay directly for the purchases they made during the year. The itemization probably is necessary because Colorado, like most states, does not tax all sales.

tom dial Silver badge

The article here states that retailers who do not collect Colorado sales tax on behalf of the state must provide the state with a detailed list of who bought what, and references a Deloitte tax alert. The tax alert does not make any such statement, but contains a reference to Colo. Rev. Stat. § 39-21-112(3.5).

That, although convoluted, seems to lay on the retailer that do not collect Colorado sales tax a requirement (subparagraph (d)(I)(A)) to report to each Colorado purchaser, by January 31 of the following year, specific information about his or her purchases during the preceding year. That information, as given in the statute, does not explicitly include a specific description of the item (e. g., "dildo"), although the paragraph has some hand waving that allows the department of revenue to specify what is to be reported. This information is to be sent to the purchaser, not a government agency (subparagraph (d)(I)(B)) by first class mail, separate from any purchase shipment.

Subparagraph (d)(II)(A) requires the non-collecting retailers to submit to the department of revenue "an annual statement for each purchaser ... showing the total amount paid for Colorado purchases of such purchasers during the preceding calendar year or any portion thereof." There is no mention of any other information, and nothing in the subparagraph suggests the department of revenue may add to it. The corresponding regulation appears to forbid reporting anything beyond name, billing and shipping address, and total dollar amount.

It appears that NetChoice's DelBianco and others, although making statements that are literally true, exaggerate the actual privacy threat.

tom dial Silver badge

I do not understand why anyone would downvote a fairly clear explanation of legal fact; have a compensatory upvote.

An additional comment: if I understand correctly the article in yesterday's paper, the state of Utah has worked out with Amazon to collect Utah sales/use tax at the statewide rate, ignoring (or leaving for the taxpayer) anything to do with local add-ons.

CIA: Russia hacked election. Trump: I don't believe it! FAKE NEWS!

tom dial Silver badge

Re: "Refusing to elect Trump"

Not quite. When no presidential candidate receives a majority of the electoral votes, the House of Representatives is required to choose from the three candidates with the highest number of electoral votes, with each state delegation having one vote. They cannot choose "anyone." Choice of vice-president is done similarly.

This is in the twelfth amendment, which was a fixup for the situation that occurred in 1800, when the rule was that the candidate with the highest number of votes was to be president and the one with the next highest number vice-president. Thomas Jefferson and Aaron Burr were tied for electoral votes, and the House of Representatives had to sort it out.

tom dial Silver badge

Re: The result is irrelevant

"I suspect you would mind that more than what the Russians did to Hillary because this time you approved of the outcome".

You would be quite wrong. I never have written and posted, or spoken, anything that indicated either support for Donald Trump or a preference for him over Hillary Clinton as US president, and I did not vote for him, although I often have expressed great disapproval of Ms. Clinton's inexcusable behavior in matters of IT governance as Secretary of State, to the point of asserting her unfitness for any public responsibility position.

tom dial Silver badge

It very well may be true that the Russian government tried to influence the presidential election outcome, and that they tried to influence it in favor of Trump. And he won. Post hoc, ergo propter hoc?

"Tried" doesn't cut it. Hillary, along with all of those who endorsed her, and all of those, quite a few of them professional Republicans, who went out of their way to trash Trump, tried to influence the election. And they all failed.

What is lacking, and will continue to be lacking given the state of Political Science, so called, is any evidence that the Russians (or whoever stole or leaked the emails to Wikileaks) actually succeeded in swaying the outcome. Hillary Clinton's evident deficiencies and baggage, her overbearing sense of entitlement and overconfidence, and her lackluster campaign are what did her in. The belief the Russians did it may comfort the Democrats during their two or more additional years in the wilderness without even a President to ease their pain with executive orders, but there is no need whatever to suppose that is true, nor is there any reason.

Trump's 140 characters on F-35 wipes $2bn off Lockheed Martin

tom dial Silver badge

"One interesting facet to the whole sorry saga is in the timing of the tweet and subsequent share price drop..."

Lockheed dropped by$6.12 on Dec. 12 following Trump's tweet. It also dropped by $7.13 on Dec 8. After those "major" drops (and a small rise in the trading day between) it remains $16.83 above its recent low on Nov. 4, a few days before the election.

According to https://www.thestreet.com/quote/LMT.html, the LMT price was $248.50 at 08:20 (well below its Friday close at $259.53) and $248.64 at 08:26; It rose to $249.92 at 08:55 and dropped to a low of $245.52 at 10:08, after which it generally rose for the rest of the day and closed at 253.11. If there was insider trading, it did not happen at 08:20, and it probably did not happen on Monday.

Russian hackers got Trump elected? Yeah, let's take a close look at that, says Obama

tom dial Silver badge

Re: Conflicts of interest

That is something for the Senators to inquire after during their advising and consenting. That, along with the question of whether any such business interests have been divested (as cabinet officers must do), and whether they were so substantial that even after divestiture the candidate is unworthy of consent. It might be argued that Republicans cannot be counted upon to ask the questions, but there are nearly as many Democrats (plus Bernie Sanders) who probably can.

Perhaps we should take a few deep breaths and let the process play out, as Trump seems to be acting fairly conventionally in most respects, although his choices offend quite a few, mostly of the progressive bent.