Posts by PyLETS

Re: Cheapest?

The cheapest of all is cleary hydroelectric. But relatively little new hydro capacity can be installed in the UK due to most of the best sites already being in use for this purpose. In practice many existing sites will have to be uprated to store more water behind dams when wind is plentiful and generate more electricity when it isn't.

Arguing that external costs off the polluters balance sheet are not relevant ignores the existence of governments and emissions regulations contstraining the ability of polluters to pollute at other people's expense, a factor which has quite traditionally and consistently brought the costs of their activities back onto the balance sheets of ex polluters. So what's the cost of dumping poisons in a river and having to fit extra equipment and controls to prevent this from happening ? That's always been partly a political and partly a technical question and the same principle applies here.

Re: had a patch out within 90 minutes...

obviously after the same level of comprehensive testing as the original plug-in.

Depends upon whether they have an automated test suite. If they do, then it's very likely that both versions of the plugins passed exactly the same set of tests.

Re: Time to migrate? Well sure it is -- now!

Now that this asshole has publicized the exploit and wrapped it up in a package any half-assed script kiddie can screw somebody over with ...

Bad guys are never going to be afraid of knowledge which gives them lower sentences if caught than what they get from using it illegally anyway, so your attitude isn't going to deter them from obtaining it and keeping it to themselves.

So how does it help if us good guys with systems to defend are not informed exactly how weak the stuff which implements what we are using is proven to be ? It's thanks to those like Moxie Marlinspike who put this kind of research into the public domain that we're able to know.

Re: Non Disclosure Agreements should be banned

Otherwise how can anyone else avoid inadvertently infringing a patent? Or is that the idea?

Given a US patent office which has a license to print money by issuing millions of poor quality patents which lack any significant innovative step, are contaminated with prior knowledge and which are obvious to anyone skilled working in the field, it's just not in the interests of anyone trying to assert such dodgy monopoly rights to say what these are. Those asserting these almost certainly know the patents asserted are dodgy, but the protection racket works because those against whom these are asserted can't afford to litigate them. To compete in this fight, a company has to have patents of its own and can then engage in cross licensing, in nuclear arms terms: mutually assured destruction, so bad patents are only used by big fish against small fry.

Re: SSH on port 22

I always run SSH on port 22, as I manage and share work on too many systems to remember obscure port numbers. I disable root logins on SSH, run Denyhosts (equivalent of fail2ban) before I expose a system to the net by forwarding the port and enforce strong enough passwords so that 5 attempts won't make any dent on the number of guesses likely to be needed. The attacker has to guess login account names as well, and the logs show this doesn't happen successfully very often, though 15 addresses or so get blacklisted every day for trying on the typical SSH server I operate.

Re: Half-assed attempt, if you ask me.

you the user need to have the ability to say "no" to these sorts of requests

On Android you already have the ability to say no, but the app then has the ability to decline to install. What's needed is the ability to have an app think it has your location, but you the user can provide it with the location you want it to have. Or the app thinks it has the ability to send SMS, but these SMSs go to /dev/null and cost you nothing. Alternatively you should be able to force installation regardless, and take whatever functionality of the application is broken as a consequence. If your phone can run Cyanogen mod, you might want to consider this as an option.

Also the permissions model probably isn't fine grained enough, and there is no obligation for the app to state why it wants you to grant it a particular permission. It isn't possible to make an informed security decision unless you know _why_ the app requests a particular permission.

Gary was a naughty boy

The argument isn't just about where he should be punished, but also about whether the scale of his offence is sufficient to justify extradition. Gary didn't kill or injure anyone. He did minor damage to property of a foreign nation. Imagine a nutty Greenham common woman cutting through the fence on a US airbase, wondering in and looking at some files in an unguarded office for evidence of alien visitations. The airbase security commander then orders a $10million security upgrade and blames her for this cost.

Should she be extradited ? No don't be silly. The UK magistrates local to the airbase can deal with it.

Should she get away scot free ? No.

Should she be tried locally and given a non - custodial community sentence ? Yes and Yes.

That's all that Gary's supporters are arguing - that he should be tried locally and given a sentence appropriate to the scale of his offence.

Re: OK, but

All in favour of open access, and providing web space for papers is cheap and easy to the point of being effectively free.

But the real cost of publishing, apart from the work of authorship, concerns finding appropriate peer reviewers, editors and proofreaders. Also very often the best peer review will come from another university. For this reason, good open-access journals are often not associated with a single university, but operate through websites run by the editorial collaboration.

Re: No no no no no...

I think there are many more people buying telecommunications this way - e.g. you get 300 minutes, 1000 texts and 2GB internet all for £10/month. Same goes for season tickets on public transport, and paying a higher landline flat rate and getting "free" calls. Hardly anyone buys Internet connectivity on price/Mb these day, and when you do it's a ripoff (e.g. use of data on roaming abroad).

The advantage to the consumer is you know what it will cost. The advantage to the provider is regular and known income. That's also how a radio station pays for broadcast rights on music, so why should it be so wrong for an ISP to negotiate a similar kind of deal on behalf of customers with music rightsholders if both sides believe they benefit ?

market failure

I take photos and sell them and as I understand it if one of my shots gets used the company using it has no obligation to find me and pay me my due, unlike current law where they have to make a reasonable effort to pay me for my creative work.

So just how many haystacks do you expect someone who accepts a bogus statement made by a third party and taken in good faith that your needle is within the public domain, to have to search through and at what expense to them ?

I'm not talking about a large corporate customer here either. Possibly a one-man band local historian who wants to publish a book on local history which might contain your photo, who genuinely wants to find you and tries hard but can't, and who probably won't make much of a profit if any from a few hundred copies sold, and where your photo constitutes less than 0.2 % of the proposed publication's value, but really doesn't have money to spend in court cases. Under current law this book can't be profitably published unless the small litigation risk can be acceptably insured against.

It's reasonable to premise the concept of a commercial market in copyright work when zillions of examples exist on the basis of owners being findable and value being limited otherwise. If governments want to facilitate markets, in preference to imagining that these theoretical but for the most part unenforceable rights should never be tampered with, then some kind of searchable copyright registry is needed to fix this problem.

The problem is, that when we look through the data registration and processing requirements for such a registry, including that efforts carried out by an indentified party to find your work within it should be stored as evidence within a future case which you might want to bring against them, this makes it increasingly improbable that this job can be done by the private sector representing the interests of the sellers alone, as opposed to a public sector database similar to the land registry which is intended to balance the interests of purchasers and sellers.

Re: The missing %

It's likely also to include my £15/month Virtual Machine server, capable of running a variety of encrypted services. I'm not expecting plod to ask for access to my email logs any time soon, but if he does, I'll want to be sure the request is legal and required under the law before I comply, otherwise I might be breaking the Data Protection Act by acceding to a bogus request. If plod wants to put a DPI black box on the network of the ISP hosting the VM or use other techniques e.g. to obtain access to the VM filesystem on the VM host, that's up to them. If I were bothered enough about this, I'd find a virtual server host in a country with different laws.

Securing direct real time access for plod seems more likely for larger CSPs than small ones like yours truly. Going after the minnows is going to be much more expensive and generally slower. So if you want plod to have to ask politely and have his credentials checked carefully when he asks, choose a smaller CSP in preference to Gmail or Hotmail or Facebook.

Re: Hear, hear!

Patent officers and offices who and which grant invalid patents should suffer consequences, given we all suffer as a result of their negligence in granting invalid patents.

If this puts up the cost of a patent application, so that acceptable searches and evaluation can be done prior to granting a patent then so be it. Too many patents are granted, and the current system gives patent offices, through their right to grant monopolies, a license to print money.

Personally, I'd like to see patent applications provisionally accepted then published openly, with the public having a right notify examples of prior art and challenge obviousness, prior to objections being reviewed by a wider panel prior to final decision. There would have to be a fairly short time limit on the period between provisional and final acceptance, to limit the window within which other innovators are uncertain as to the status of a provisional patent.

Re: Level Playing Field

A level playing field sounds like a great idea, as well as being very unlikely any time soon. There's just too much politics involved. All forms of generation are subsidised one way or another by various parties. Some subsidies, e.g. feed in tariffs, are paid by increasing electricity bills for everyone. Others get onto your property insurance, e.g. the costs of increasingly weird weather and flood damage. Other major subsidies concern public investment in nuclear research and the uninsured losses suffered by Fukushima and Chernobyl evacuees or limited taxpayer funded compensations offered them. If you expect the nuclear operators to cover such risks, you'd have to do without nuclear power, which would increase coal burn and weirder weather with insufficient justification.

That said, the kind of spot market appropriate for massive generators probably isn't suitable for domestic generators. E.G. I'm likely to change my gas boiler for a CHP one, so I can get more out of the gas supply, but only if I get a sensible price for the electricity generated when the primary motivation for running the boiler is to heat my house. Having to compete within an unstable spot market appropriate to very large generators wouldn't help me to do the calculations as to whether a more expensive gas installation is worth doing. If there is to be a social policy to minimise wastage of energy used to to heat homes and maximise use of this energy, then political intervention would be appropriate at least to kickstart this market opportunity if not in the longer term.

Re: If the EU rejects it ...

The US congress rejected SOPA/PIPA once push came to shove. Traditionally things went the other way because big media were the only effective intermediation between politics and voters so they got everything their lobbyists wanted. Now that the Internet community has become effective in mobilising political support, the game has changed. While Andrew will claim the sky is falling down and that art is doomed, I don't see a majority opposed to all possible forms of copyright anytime soon, but there seems to be a large enough group of concerned enough citizens capable of being mobilised who are sufficiently opposed to extreme copyright for legislators in wired parts of the world to have to think twice about such proposals.

@Fibbles - Re: Governments not always very efficient

To be granted copyright to these images in your world I'd have had to pay £60 today up front. Now consider that I created these vector images on the prospect that I might earn some money from them in the future.

Simple. Copyright is created automatically but isn't treated by reformed law and courts as worth very much until the owner registers it (e.g. maximum cost you can charge for reproduction per copy of an unregistered photo £0.001 ). You still own the copyright and can register it whenever it suits you. I dispute the need for a fee as high as £5 to put a hash signature, description, small watermarked copy and search keywords onto a public database, but let's assume that £5 is what it costs the creator to register it. If it's worth less than £5 to you, the creator, then why on earth should your cheapness in being unwilling to pay £5 bankrupt anyone else who uses your copyright reasonably thinking it to be in the public domain because notarised searches which they can prove they have carried out have not located it ?

If I've put it on my website and the logs say a couple of thousand accesses were made, charging me a couple of quid isn't going to bankrupt me, and I'm less likely to ignore your invoice once you do register it. The fact you subsequently register after your discovery of it on my site will encourage me to take your ownership claim as genuine as opposed to a cheap shot I should ignore until legally summonsed, if making a false registration claim is something with criminal consequences.

And if you discover the Daily Mail have reproduced 1,000,000 copies of the photo you valued at or less than 1p/copy , because you thought it unlikely to be copied 5000 times, you can still get £1,000 off them for it even if they can prove they diligently searched. You can always register your photo later, and if it's of enough interest for someone to print 1,000,000 copies, chances are it should become a regular earner.

Re: WiFi MAC database flaw

MAC addresses are routinely configurable in software, so are very easy to spoof, as anyone who has configured a router in expert mode or used Aircrack-NG is likely to know. So these addresses should be expected to relocate, and should not be expected to be globally unique, which was the original intention of making these up using first half as unique manufacturer code and the second half as unique to manufacturer serial number. When I upgraded my home from a computer acting as a router to using a dedicated router I reconfigured the MAC address on the new router to the same as the old Ethernet card on the WAN side so the ISP didn't change my IP address.

Re: So what happens if Assange is given asylum?

I think they let him go to Ecuador to rot there. Once there he'd be refused entry to any other country other where by nationality he has a right (Australia?) to return. If the Ecuadoreans are daft enough to give him asylum I'd be surprised if UK authorities are not happy to be shot of him, once they have collected their £200,000, not that that paltry amount would cover the state prosecutors costs concerning the extradition trial so far. Besides which, he'd probably have diplomatic immunity from arrest in transit from here to there as Ecuador's diplomatic baggage.

Re: Sendmail?

Struggled with Sendmail's documentation for about 15 years whenever I needed to change anything before finally replacing it with Postfix as part of a planned dist-upgrade a couple of years ago. I've found Postfix much easier to use in a moderately complex email environment as a replacement, together with Dovecot and Amavisd. It's probable there exist some extreme volume and highly complex mail environments where Sendmail is the only tool sufficiently flexible, but these would probably be places employing full time email admin people who can write their own sendmail.cf configurations, which uses a very nasty custom macro language reminding me of Perl on steroids.

Re: Wild West

I agree, and this to me signals the time when it's more appropriate for ICANN to come under control of the ITU. The idea that a company registered in California can dictate global naming issues to every government in the world bar the US which has higher authority isn't diplomatically sustainable once ICANN sets a foot wrong, and now they have. BTW, the ITU are the group responsible for deciding national telephone prefixes, and they wouldn't get away with the equivalent behaviour in that namespace.

@Naughtyhorse

And as for religious organizations that work to ameliorate social ills, well anything they accomplish is more than written off by the actions of 1 pedophile priest ...

Is everything Atheists accomplish written off by the atrocities of Pol Pot and Stalin ? Not a fair comparison ? If not, then please explain why should all Atheists, and all of Atheism be judged based upon a different standard from every other faith position ?

Protecting sources

Journalists have to remove attribution from materials if not doing so involves the source getting hassled, murdered, arrested by a dodgy regime or sacked.