santosha

I'm not sure if this was addressed in the Credit Suisse report, but these kind of comparisons can be very misleading. The problem is that a lot of people in the bottom 10% have net negative assets (every fresh grad with college loan debt for eg). This skews the distributions, making the wealthy seem richer than they really are.

Suppose A has 50$, B has 30$ and C has -20$ (owes a creditor). A seems to control ~82% of all the wealth, but B is actually in much better shape than that number suggests.

Names, titles and short phrases are not protected by copyright. http://copyright.gov/circs/circ34.pdf If you'd like to take that phrase and make a better T-shirt, it's perfectly legal for you to do so.

Um, the 'statement' they issued was in an email response to the journalists. These guys reached out, and they responded, presumably with some vanilla message about how it was all poppy-cock. If they hadn't bothered to respond, you'd have gotten the same article except with "Boeing and Airbus have not been available for comment", making it just as awkward. There is no good way out for them.

Major privacy issues, single point of failure etc etc. We leave payments to third party services because nobody wants to deal with the compliance nightmare that PCI-DSS is, not for security reasons. Payment is also mostly less sensitive to availability and latency issues than authentication.

Let's not forget Siri.

I've always enjoyed what I call uncoding, which is taking a working piece of code and taking stuff away until things break, and examining how they break. It's really helped me understand what each piece does, and be more efficient when I'm writing it myself.

That you feel the need to ask this question is the best argument against the 'Nothing to Hide' logic there is.

Why is reaching every corner of the phone such a big deal anyway? Speaking for myself, one of the biggest reasons I like large screens is that reading and viewing content is so much easier - I don't have to squint when I'm watching a video, or deal with awkward reflowing. Interface designers don't have to use the new real estate just because it's there, they can design touch areas that are well within reach, while using the new extra space for other visual elements.

You can make the exact same statement about every other deadly virus, though. Why is ebola any different?

I wonder if this can cause security issues. In particular, suppose you can create an arbitrarily named file in a directory. What if there's a service running that does not handle this correctly ( interpreted bash script that is ) - what unexpected behavior might one accomplish by naming the file weirdly?

As a benign example, consider "ls". If you create a file named "-la", then an "ls *" that tries to do a 1-deep recursive listing is going to print the extended listing with permissions and including hidden files, interpreting the "-la" as a flag instead of a file name.

Speaking for the security community as someone who's graduating this year, everyone I know who works on CTFs regularly has an astounding level of enthusiasm. It's really a fantastic group of people to be working with.

I see this line of argument very frequently - that if you are really secure, you should tell everyone how you do it, as some sort of gold standard for security. Kerchoff's principle suggests nothing of the sort - it is something of a thought experiment. When you design a system, you should ask yourself if it would still be secure if you told everyone how it worked. There is no real need to tell anyone, the obscurity adds an extra layer of defense.

Here's Steve Bellovin's thoughts on this:

'The subject of security through obscurity comes up frequently. I think a lot of the debate happens because people misunderstand the issue. It helps, I think, to go back to Kerckhoffs's second principle, translated as "The system must not require secrecy and can be stolen by the enemy without causing trouble," Kerckhoff said neither "publish everything" nor "keep everything secret"; rather, he said that the system should still be secure even if the enemy has a copy.

In other words – design your system assuming that your opponents know it in detail. (A former official at NSA's National Computer Security Center told me that the standard assumption there was that serial number 1 of any new device was delivered to the Kremlin.) After that, though, there's nothing wrong with trying to keep it secret – it's another hurdle factor the enemy has to overcome. (One obstacle the British ran into when attacking the German Enigma system was simple: they didn't know the unkeyed mapping between keyboard keys and the input to the rotor array.) But – don't rely on secrecy.'

The example is illustrative. There is nothing stupid about the original question. Someone else's fault and self-preservation are just convenient escapes in this situation. Suppose instead of a child running in front of the car, it was a large rock. Going straight will kill you. Swerving left will kill a mom and two kids, going right will kill an old trucker. What does your car do?

By the 'fault' logic, it was nobody else's fault that the rock landed in front of you, why should they die so you can live?

Going right and slamming your semi into the mini-Cooper means you live without a scratch, but good luck to the couple in the car. Going left and hitting the other truck there will probably make your truck flip and give you broken bones, but nobody dies. What now?

It is done client side with javascript, in the results.js on the results page. If they'd put it on the original page, it would all have been client side. The only reason I can think of for doing it this way is statistics collection for later.

This is funny because these restrictions reduce the total number of possibilities. I get that the idea was to stop commonly used passwords, but that's what they should have done - disallowed the top N common ones.

Ha, that bugged me a little too. I love being underwater so much because of the sensory deprivation :-)

Neither Comcast nor Netflix are trying to operate a non-profit, it's a payment dispute between two large companies who disagree over who should pay. You could just as well argue that Netflix was letting Cogent / Comcast fight it out instead of directly peering with ISPs which benefits customers.

Not entirely sure why this is such a big deal. Peering agreements happen all the time. Lots of large services peer directly with consumer ISPs because it's cheaper and more efficient than using intermediary transit.

This has nothing to do with net neutrality. Comcast is not throttling or discriminating traffic in any way (at least not publicly). This is a peering dispute settlement.

Does this affect competitors to Netflix? Depends on how much volume they have. If their volumes are low, they can still reliably use transit providers more economically. As their revenue increases, they'll need their own backbone network, but their ability to pay for it goes up too.

Is Comcast big, bad and evil? Probably. But not in this case. Comcast dealing directly with Netflix is good for both parties. They are entitled to charge Netflix to peer directly because most traffic is going to flow into Comcast's network from Netflix. They also probably had a case negotiating away from settlement-free agreements with Cogent for the same reason. Again, none of this is out of the ordinary, ASes negotiate peering deals with each other all the time based on the volume and direction of the traffic they exchange with each other, and this is all fairly unregulated.

Net neutrality is irrelevant in all of this, it only matters if Comcast actively discriminates between traffic at their end. This deal is not connected to the ruling.

Saying the cost doesn't 'go away' is deflecting from the fact that it does reduce overall, because of a number of reasons. Administrative costs are vastly reduced. Employers no longer have to negotiate individual contracts with insurers. Hospitals don't need huge administrative staff for deals with different insurers and paperwork for each one. On the whole, the cost savings from moving to single-payer take a huge bite out of the increased taxes.

http://www.pnhp.org/facts/what-is-single-payer

Under plans like H-R 676, 95% of people are expected to pay less overall for healthcare. So, no, you are not paying for 'that $75k', you are paying for much less.

The point of the n is that you specify the maximum length that it's allowed to copy. It's slightly harder to mess that up than with regular strcpy.

How is this even remotely relevant to this site?

Is there a 'don't send me email about unread messages' option somewhere?

Good on them.

Mobile malware is overrated. People have been making a lot of noise for a long time, there's hardly any actual infections observed in the real world. http://chazlever.com/publications/traffic-ndss13.pdf

A very good point. One of the most important things about strong authentication schemes is the revocation protocol. When things go bad, how easy and secure is the process of changing the auth mechanism? The trouble with fingerprints is that you're stuck with them for life, even if somebody else <pun> gets their hands on them </pun>.

Sure, it probably has not much real world impact. But you have to remember this is academic research, not industry security research. The point of academic research is to come up with non-standard ideas that are sort-of feasible, caveats are okay - but might become important in the future.

"The Arabian Sea is a region of the Indian Ocean..." http://en.wikipedia.org/wiki/Arabian_Sea

Tsunamis are not killer waves or rogue waves, they're strong displacements of water. The height happens only at the shore because the sea floor rises up to meet the shore. At sea, one probably doesn't even see anything abnormal as the wave ( more accurately, the pressure crest ) rushes past underwater.

Sure, the guy's bug report was terrible. However, the blame is squarely on FB. It's the security team's job to follow up, and to ask for more information if they don't have all the details.

Contrast this with how Google responded when someone posted a Youtube video showing a Chrome exploit - they guessed that it was a Flash-based vector, collected millions of sample files and fuzzed for days to eventually discover the bug - based on a YouTube video that they could have also discarded as 'not a bug' based on lack of evidence.

At USENIX this year, Chris Evans gave a talk about how Google does their VRP. Specifically, he mentioned that there weren't many false positive reports at all, way fewer than he expected there would be. In general, most bugs have something to them. Google has a long history of following up on bug reports with little or nothing to go on, because they take their jobs seriously, and aren't antagonistic to community bug hunters. FB would do well to take a leaf out of their book.