Thespian2

Voting presents uniquely difficult challenges, you need integrity, strong authentication, verifiability, and anonymization.

As others have stated, this particular scheme's weakness to tampering lies at the receiving end of the app's server.

There are other privacy problems with the "send a selfie" of the on-duty soldiers I won't get in to.

But ultimately, voting has unique constraints. The voter needs to be able to verify their vote was counted correctly, outside observers need to be able to verify totals, but not identify individual votes, and the whole system needs assurances only those who are supposed to vote, do so.

Oof!

I'm inclined to side with the researcher on this one, just from this quote from the vendor: "Christiano responded, 'The issue described in the [SpiderLabs] article is certainly not a vulnerability, it is misuse of the product.'"

Attackers don't care what is, or isn't "in scope" for your pen test. They will use what's available. Unauthenticated network services capable of writing files to get code exec is bad.

This doesn't need to be visible on the open internet, what about lateral movement within the organization?

Why not "library every day"?

This is a fundamental problem with Health Insurance being primarily tied to employment. Many older devs, with families to take care of, would experiment this way with health insurance better than what is currently available outside of employer-provided versions.

"Ba weep granna weep ninny bong"

It is the universal greeting for cybernetic organisms, after all.

As others have said, the law isn't a technical spec. it describes what you should do, not how you should do it. The concept of "due care" http://www.businessdictionary.com/definition/due-care.html

comes in to play here. GDPR, at its core, is about legally requiring businesses to care for customer data. It gives customers increased control over how their data is used, and how it should be protected.

In answer to OP's question "how do I know it is appropriate," as a first pass, how would you feel if your most important personal data were being treated that way? As a developer, if that makes you uncomfortable, that's probably a warning sign.

Folks are (rightly) focusing on the descriptor "best." Best needs a specified metric, or it's meaningless. This always annoys me in internet discussions/arguments about "the best X" where nobody specifies a criterion for "best."

The best tool to drive in a nail is a hammer. The best tool to drive in a screw is a screwdriver. Neither one is generically "best" without context.

Thanks. Will try to do so in the future. Forgot to this time.

Link to google cache of document, as current .gov website down for maintenance.

+1 Spider Oak "Hive" for dropbox-like functionality

Not true. For each buy that happens, there must be a sale. There are more buyers than sellers right now, not no sellers. Each time the price goes up, that's a sale _that happened_

This is something we've seen many times before. It's not new. It's a classic bubble where demand (buyers) greatly outstrips supply (sellers).

The big question is why. Crypto currencies haven't suddenly gotten more useful. The current rise is fueled by speculation of the ability to resell at a higher price.

To get your fiat cash out, you'd have to sell that 1 BTC for $10,000. Someone needs to be on the other side of that trade buying it. You get their $10K, and they get your 1 BTC (and coinbase takes a small percentage for facilitating the transaction).

If nobody wants to buy your BTC at $10K, you don't get "your" money out, until coinbase can find a buyer to match with your sale.

In your example, all 10 of you start lowering your asking price, and "the market" goes down until you make a sale.

Coinbase may provide some liquidity, buying your BTC at "market price" with their cash reserves, but only if they think they can resell it at a higher price.

The risk they take on in doing that, and the liquidity they provide, is the nominal economic reason you are paying their fees.

Thanks corford.

I think I looked at spideroak a few years ago. Good to see they are still around. Might be my best fit.

A friend also suggested grabbing this table, export to your own spreadsheet and sort by what matters for you.

https://en.wikipedia.org/wiki/Comparison_of_online_backup_se...

x0x0 not quite. $6 to $10 a month would be acceptable to me, but its now $10 a month per device, where before it was $6 a month for a "family" of up to 10 devices. That's the real cost increase problem. I'm still only one customer, with almost no support burden, but the price to go to office version is substantially different for multiple machines.

Like many in this thread, I'm here looking for alternatives. CrashPlan was sufficient for my family needs, and none of the other services I looked at hit the same sweet spot. Slow, saturated uploads, and their bloated client were tolerable for what I was paying, and what I got. We've got a few mentioned replacement possibilities scattered in the comments and replies below, but I'd like to put forth my "asks" for solutions, which seem to match others.

I'm a tech guy, and "rolling my own" Linux solution is possible, but in this case, I'd be happy to pay someone else to worry about the details of storing a copy of my bits, so I can do other things with my time.

My wish list is as follows:

MUST

======

have both Linux and Windows client

ability to whitelist/blacklist/select subsets of files/folders to be backed up

======

SHOULD offer as many of the following as possible (all optional)

=======

some sort of "Family" pricing deal for multiple machines in one account

encrypted backups with consumer controlled key not necessarily given to service

option to switch out back end bulk storage infrastructure

"forever" file retention / restoration of old versions (charge me for storage)

user scheduled backups and/or don't bring client to crawl or saturate home line

======

Feel free to add any replies with suggestions here which might be useful to others.

For my point of view, if CrashPlan found the home offering unsustainable from "abuse" of the "unlimited" feature, I would have much preferred them introduce a cap to the home plan at some "reasonable" value. They could have balanced the books, and saved 95% of their customers. Start rolling off oldest file version backups when you hit space cap and/or offer extra space at cost+profit. Done.

For board games, like "Settlers of Catan" where resources are generated based on rolls of 2d6, one could use an analog version of this with a cup containing 36 chits, of the numbers 2-12 according to the normal distribution, _without_ replacement. You would still get the randomness of ordering, but over 36 draws/turns would get a complete "average" distribution.

If that is a bug or a feature is left as an exercise for the reader.

Trusting the baked-in rendezvous server would seem to be the most obvious security "nit," which could be addressed by compiling and running your own server. But out-of-the-box, that would seem to be a weak-point for MitM attack.

I'd argue that crypto currencies are a fundamentally new asset class, neither fish nor fowl. To become a useful "currency," yes, stability is a desirable quantity. What it is "supposed" to do is not a useful concept here. What it does is much more important. Currently, bitcoin is still more a highly-speculative, bubble-prone asset class with some of the qualities of a currency, some of the qualities of a stock, and some of the qualities of an asset like gold. It is incorrect to pigeon-hole it as any one of these.

Sounds like you are talking about Identity Based Encryption (IBE)

https://en.wikipedia.org/wiki/ID-based_encryption

There are mature, commercial products which use this to address the "PKI benefits without the overhead of managing PKI" problems. Read the wikipedia page for the gory details, but essentially, you get to use someone's email address functionally as a public key (as per traditional PKI email schemes) wihtout the recipient having to, a priori, create the pub/priv keypair. They can be derived statelessly on the fly.

For one example, See Hewlett Packard Enterprise - Data Security "SecurMail" product.

Full disclosure: I work on this product.

Here is some basic background information on how it works.

https://www.voltage.com/products/email-security/hpe-securema...

There is still a "trusted 3rd party" running the key generator (a deal-breaker for some threat models of privacy) but that generator entity doesn't have to be the ISP or email provider involved at either end.

Unless you try it with a group familiar with game theory, when one person says "You and I bid one and two cents, and everyone else shut up and don't bid, and we all split the $19.97 profit evenly."

Surprised this hasn't gone to front page yet. This is serious stuff.