Smuggling USB Sticks(shkspr.mobi)
shkspr.mobi
Smuggling USB Sticks
http://shkspr.mobi/blog/2012/11/smuggling-usb-sticks/
94 comments
Should people also have their own power plants, wells, car factories and farms?
There are certain advantages when you "oursource" your basic infrastructure. As long as inter-device connections are still problematic (NAT, STUN, ...) and as long as harddrives die, I really enjoy being able to trade money for free time rather than setting up a redundant off-site backup system.
There are certain advantages when you "oursource" your basic infrastructure. As long as inter-device connections are still problematic (NAT, STUN, ...) and as long as harddrives die, I really enjoy being able to trade money for free time rather than setting up a redundant off-site backup system.
The electricity company doesn't try to tell me what devices I can plug into my power points. The water company doesn't call me a thief for pouring a glass of water for my friend. The car factory doesn't weld closed the bonnet of its vehicles and the farmer doesn't whine about lost profits because I dare to have a herb garden in my back yard.
They actually do - by the volt - amp offerings for residential consumers. Also, a big dream of the utilities is to be able to reach in and "hint" to your appliances when they should sleep. Power companies really don't want many people to buy electric cars because the grid has far too little capacity to handle charging them.
Give them time, and they will.
Give them time, and they will.
To stretch the cloud/powercompany analogy (perhaps too far)…
The power company only provides a "standard" volt and amp rated supply, and just like cloud computing, there are various standards to choose from[1]. You're probably thinking "120V 60Hz AC with type-b plugs", whereas for me the default assumption is "220V 50Hz AC with type-1 plugs". Fortunately, half my electronics doesn't actually care what voltage/frequency/current is available thanks to modern power supplies (I've seen my iMac happily keep running during a brown-out where the wall sockets were measuring just 90V AC, while all the routers/modems/harddrives with less capable power supplies were flickering and rebooting continuously.) Other devices I own I can use a transformer to change my 220V down to 120V, though still at 50Hz. If I needed to (and I never have) I could use a US targeted UPS or inverter to provide 120V AC @ 60Hz.
The "cloud" market is kinda the same. Cloud storage, for example, expects 8 bit bytes delivered over tcp (or perhaps udp). In general, "everything just deals with that", pretty much every modern-ish 8/16/32/64 bit device, regardless of native endianness, will happily emit and receive the same 8 bit bytes that S3 stores (converting on the fly, much like a switchmode power supply does for voltages). If you're an edge-case customer, perhaps wanting to use Amazon S3 to store data for your 12bit wide "bytes" from your PDP8, you just convert them on the way in and out. And much like the end result of electricity consumption is pretty much all the same, electricity is mostly just converted into heat - but with side effects varying from cooling your beer to blasting pixels onto your screen at 100fps to making your coffee machine hot; ultimately cloud storage is all just ordered bytes more-or-less reliably stored and retrieved - whether that's plain text passwords, or massively de-duped mp3s in Dropbox or Amazon/Apples cloud music storage, or cryptographically secure blobs which no-one can tell whether they contain your bank records or your secret research project data or child porn - it's all just bytes. There's no "vendor lockin" at the "it's just a bunch of ordered bytes" level. You might need to "change the plugs" if you want to switch you cloud storage from S3 to BigTable to Dropbox to Tahoe/LAFS, just like I need to switch cables or use a plug adaptor for US delivered electrical equipment. It's the same with cloud compute resources - sure EC2 and Linode and CloudNine and AppEngine have different interfaces, but you can view that as all just the plumbing on the way into the "remote universal turing mschine" which, much like the topologists who can't tell the difference between their coffee mug and their donut, in spite of their interface and language differences all the programmable remote computing offerings are identical - if you can compute anything on one of them, you can - in theory- compute it on any of them.
[1] http://en.wikipedia.org/wiki/Mains_electricity_by_country
The power company only provides a "standard" volt and amp rated supply, and just like cloud computing, there are various standards to choose from[1]. You're probably thinking "120V 60Hz AC with type-b plugs", whereas for me the default assumption is "220V 50Hz AC with type-1 plugs". Fortunately, half my electronics doesn't actually care what voltage/frequency/current is available thanks to modern power supplies (I've seen my iMac happily keep running during a brown-out where the wall sockets were measuring just 90V AC, while all the routers/modems/harddrives with less capable power supplies were flickering and rebooting continuously.) Other devices I own I can use a transformer to change my 220V down to 120V, though still at 50Hz. If I needed to (and I never have) I could use a US targeted UPS or inverter to provide 120V AC @ 60Hz.
The "cloud" market is kinda the same. Cloud storage, for example, expects 8 bit bytes delivered over tcp (or perhaps udp). In general, "everything just deals with that", pretty much every modern-ish 8/16/32/64 bit device, regardless of native endianness, will happily emit and receive the same 8 bit bytes that S3 stores (converting on the fly, much like a switchmode power supply does for voltages). If you're an edge-case customer, perhaps wanting to use Amazon S3 to store data for your 12bit wide "bytes" from your PDP8, you just convert them on the way in and out. And much like the end result of electricity consumption is pretty much all the same, electricity is mostly just converted into heat - but with side effects varying from cooling your beer to blasting pixels onto your screen at 100fps to making your coffee machine hot; ultimately cloud storage is all just ordered bytes more-or-less reliably stored and retrieved - whether that's plain text passwords, or massively de-duped mp3s in Dropbox or Amazon/Apples cloud music storage, or cryptographically secure blobs which no-one can tell whether they contain your bank records or your secret research project data or child porn - it's all just bytes. There's no "vendor lockin" at the "it's just a bunch of ordered bytes" level. You might need to "change the plugs" if you want to switch you cloud storage from S3 to BigTable to Dropbox to Tahoe/LAFS, just like I need to switch cables or use a plug adaptor for US delivered electrical equipment. It's the same with cloud compute resources - sure EC2 and Linode and CloudNine and AppEngine have different interfaces, but you can view that as all just the plumbing on the way into the "remote universal turing mschine" which, much like the topologists who can't tell the difference between their coffee mug and their donut, in spite of their interface and language differences all the programmable remote computing offerings are identical - if you can compute anything on one of them, you can - in theory- compute it on any of them.
[1] http://en.wikipedia.org/wiki/Mains_electricity_by_country
Why not?
I mean there are certainly folks doing "off the grid" experiments that are moving this way, and I can certainly see a future where you create enough power for most of your home needs locally, including using some version of a 3D printer to build common items out of stock you have around the house (once they can also accept such). Things that are too costly to build at that scale or require special feedstock could be built by a neighborhood machine (much like mills used to service their neighborhoods), with the feedstock being ordered as needed.
Yes, as long as it is massively inconvenient there is a benefit for trading money for free time. But I would like to spend some of that free time making it possible for me to have a choice of my own - rather than a choice for my provider (who likely will eventually decide they need to make a profit).
I mean there are certainly folks doing "off the grid" experiments that are moving this way, and I can certainly see a future where you create enough power for most of your home needs locally, including using some version of a 3D printer to build common items out of stock you have around the house (once they can also accept such). Things that are too costly to build at that scale or require special feedstock could be built by a neighborhood machine (much like mills used to service their neighborhoods), with the feedstock being ordered as needed.
Yes, as long as it is massively inconvenient there is a benefit for trading money for free time. But I would like to spend some of that free time making it possible for me to have a choice of my own - rather than a choice for my provider (who likely will eventually decide they need to make a profit).
We're just seeing economies of scale in action.
It is cheaper per unit of energy to make a natural gas power plant and sell the power than it is to build a small-scale generator to power one home on natural gas. Once that model is established, there is resistance to local power generation. The same scale works at neighborhood level power generation. (Or construction, or manufacturing)
Cost is the difference now between using the cloud and running your own hardware. It is cheaper both in time and money to let a company like Google run your e-mail than to run your own server. So people do it. It is a very simple matter of convenience. I don't expect a backlash until people become mistreated to the point of breaking.
I am an enthusiast of 3D printing and I like the vision you've laid out, but I see it always being cheaper per unit to make 10,000 of something than 1 of something. So delegation will continue unless the underlying behavioral incentives, cost and convenience, change.
It is cheaper per unit of energy to make a natural gas power plant and sell the power than it is to build a small-scale generator to power one home on natural gas. Once that model is established, there is resistance to local power generation. The same scale works at neighborhood level power generation. (Or construction, or manufacturing)
Cost is the difference now between using the cloud and running your own hardware. It is cheaper both in time and money to let a company like Google run your e-mail than to run your own server. So people do it. It is a very simple matter of convenience. I don't expect a backlash until people become mistreated to the point of breaking.
I am an enthusiast of 3D printing and I like the vision you've laid out, but I see it always being cheaper per unit to make 10,000 of something than 1 of something. So delegation will continue unless the underlying behavioral incentives, cost and convenience, change.
It isn't cheaper ... yet.
Such visions are the stuff of startups.
Such visions are the stuff of startups.
Mature commodity items, services tend to be well regulated. Because it's generally better for customers and therefore economic activities.
We barely have SLA standards for uptime, privacy, data breaches, etc.
It's cool to be a pioneer. But you're largely on your own. A trade off.
We barely have SLA standards for uptime, privacy, data breaches, etc.
It's cool to be a pioneer. But you're largely on your own. A trade off.
From my experience, on-premise vs. cloud/hosted is a tradeoff between engineering talent (keeping the servers up) and SLA management (filing tickets/contacting providers when SLA is not being met or bad stuff happens).
VLC was available on the App Store for a very limited time. It was pulled over licensing issues:
http://obamapacman.com/2011/01/vicious-nokia-employee-gets-v...
http://obamapacman.com/2011/01/vicious-nokia-employee-gets-v...
Wow that's a biased and skewed article. The truth is Apple do not allow GPLed software on the App Store, and hence do not allow easy install of GPL software on iOS (iPad & iPhone). Microsoft are fine with people installing GPL software on MS Windows OSs. The problem is Apple's strict rules about licencing and software installation, not a "vicious Nokia employee who just doing it because Apple & Nokia are compeditors". I assure you, there are many Free Software/Open Source developers who are ethically and morally opposed to the App Store idea.
From what I know the issue is that the App Store adds some DRM that the GPL would require to be open-sourced. Might be wrong though, I only have a vague understanding.
From my under standing that's pretty close. More specifically it has to do with the GPLv3's concept that the hardware cannot limit what you can do with the software. Its why the only GPL software still in OS X is GPLv2, and the only reason its still there is because it hasn't been replaced with a BSD licensed equivalent yet.
The largest example of this is probably CLANG. https://en.wikipedia.org/wiki/Clang
The largest example of this is probably CLANG. https://en.wikipedia.org/wiki/Clang
AFAIK one of the problems was that Apple disallow certain actions (like commerical usage) for software via the AppStore. You can only distribute GPL software written by someone else if you don't add any extra conditions. Apple won't distribute it via AppStore without the "no commerical usage" rules, so Apple can't carry it.
DRM is fundamentally incompatible with open source licences like the GPL. You almost certainly cannot distribute other people's open source code with DRM. Other people wrote code and developed software that they'll give you the right to copy it under copyright law if you follow their rules. The AppStore does not meet those rules.
DRM is fundamentally incompatible with open source licences like the GPL. You almost certainly cannot distribute other people's open source code with DRM. Other people wrote code and developed software that they'll give you the right to copy it under copyright law if you follow their rules. The AppStore does not meet those rules.
My understanding is that you can have GPL software on the App Store via dual-licensing.
This is easy when you're the sole developer of an application, but almost impossible for existing GPL projects where you must track down all contributors and convince them to assign copyright to you.
http://stackoverflow.com/a/8694538
http://www.networkworld.com/community/blog/solving-apple-app...
This is easy when you're the sole developer of an application, but almost impossible for existing GPL projects where you must track down all contributors and convince them to assign copyright to you.
http://stackoverflow.com/a/8694538
http://www.networkworld.com/community/blog/solving-apple-app...
Close, but not quite there yet.
The reason Apple does not allow GPL applications on the App Store is because it would be in violation of the GPL license for them to be there. The way the App Store model works requires static linking of both Apple and 3rd party libraries, which, amongst other things, is a violation of the GPL.
The reason Apple does not allow GPL applications on the App Store is because it would be in violation of the GPL license for them to be there. The way the App Store model works requires static linking of both Apple and 3rd party libraries, which, amongst other things, is a violation of the GPL.
I'm not sure whether FSF commented on VLC, but http://www.fsf.org/news/2010-05-app-store-compliance was a complaint about restrictions imposed by the store's terms of service, not about proprietary system code that must be linked in. http://www.gnu.org/licenses/gpl-faq.html#GPLIncompatibleLibs always made a pragmatic exception about doing that, because many early Unixes shipped with proprietary standard libraries and didn't support dynamic linking at all.
Apple is also fine with people installing GPLed software on OSX. They just don't distribute it themselves.
Oh, but they do. http://opensource.apple.com/source/bash/bash-86.1/bash-3.2/C... :)
This makes it even more important that people should not trust Trojan horses in the form of "clouds".
I happen to agree with the EFF position on this.
> (I have no idea on iOS, I suppose it is even worse, do they have VLC on iOS?)
iOS's built in players will play arbitrary media files as long as the codecs are supported, you just need to have a file browser application that can open it locally or on an SMB share. I use one named 'FileBrowser'[0] on my iPad that has worked well so far.
[0] http://www.stratospherix.com/products/filebrowser/
iOS's built in players will play arbitrary media files as long as the codecs are supported, you just need to have a file browser application that can open it locally or on an SMB share. I use one named 'FileBrowser'[0] on my iPad that has worked well so far.
[0] http://www.stratospherix.com/products/filebrowser/
Nothing wrong with using the cloud as long as you really understand what you're getting yourself into.
* Use a vendor specific extension - e.g. EBS + snapshots to mount customer data volumes - make sure you can work around it easily if you move to another provider. * Backup data inside the same cloud provider? - make sure you backup the backups in case of catastrophic cloud provider failure - not doing that? then you need to understand what your risk profile is? * Only use 1 provider? What is your strategy if they fail, temporarily or permanently? Where is your data? How do you fail if they fail?
So on and so on - these are standard considerations in a business risk analysis / disaster recovery plan - but I many IT shops in the cloud are staffed by people who are great at code, but have never dealt with the vagaries of business practice - not their "fault" - but it is a blind spot I see quite often.
* Use a vendor specific extension - e.g. EBS + snapshots to mount customer data volumes - make sure you can work around it easily if you move to another provider. * Backup data inside the same cloud provider? - make sure you backup the backups in case of catastrophic cloud provider failure - not doing that? then you need to understand what your risk profile is? * Only use 1 provider? What is your strategy if they fail, temporarily or permanently? Where is your data? How do you fail if they fail?
So on and so on - these are standard considerations in a business risk analysis / disaster recovery plan - but I many IT shops in the cloud are staffed by people who are great at code, but have never dealt with the vagaries of business practice - not their "fault" - but it is a blind spot I see quite often.
Two (sets of) questions.
1. What do you do if your house burns down? What happens to the documents you care about most? Do you keep a USB drive in a safety deposit box and retrieve it regularly?
(I have a local USB backup, and I have a remote backup through the cloud.)
2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?
1. What do you do if your house burns down? What happens to the documents you care about most? Do you keep a USB drive in a safety deposit box and retrieve it regularly?
(I have a local USB backup, and I have a remote backup through the cloud.)
2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?
> 1. What do you do if your house burns down?
I backup important stuff encrypted to S3 with a script.
> 2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?
I use pfSense [0] as a router / security appliance running on a Atom based micro ATX board with a 4 ethernet ports. I connect remotely using OpenVPN terminated at the pfSense box and use Viscosity [2] on the client side. File storage is on a FreeNAS [1] server. Very easy to setup if you have basic networking knowledge. The only downside is that there is no built in support for OpenVPN in iOS. There is an app that handles it if your device is jailbroken.
[0] http://www.pfsense.org/
[1] http://www.freenas.org/
[2] http://www.sparklabs.com/viscosity/
I backup important stuff encrypted to S3 with a script.
> 2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?
I use pfSense [0] as a router / security appliance running on a Atom based micro ATX board with a 4 ethernet ports. I connect remotely using OpenVPN terminated at the pfSense box and use Viscosity [2] on the client side. File storage is on a FreeNAS [1] server. Very easy to setup if you have basic networking knowledge. The only downside is that there is no built in support for OpenVPN in iOS. There is an app that handles it if your device is jailbroken.
[0] http://www.pfsense.org/
[1] http://www.freenas.org/
[2] http://www.sparklabs.com/viscosity/
I was making a point that you're using the cloud if you're doing remote backup, with point 1.
Do you keep a USB drive in a safety deposit box and retrieve it regularly?
Yes. Why don't you? It's not that hard, and a hell of a lot more reliable and secure than cloud storage.
2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?
Blah, blah, blah. This isn't the 90s, you know. We do have things like Apache/Nginx with self signed SSL certs these days (not to mention SSH, rsync, VPNs, etc, etc), and it's not that hard to setup (used to be a right of passage for geeks; these days it's considered entrance exam to the equivalent of geek pre-school). Things are also getting better everyday with projects for "personal clouds" (aka, your own file server with a web interface).
Yes. Why don't you? It's not that hard, and a hell of a lot more reliable and secure than cloud storage.
2. Do you have this local cloud poked out to the outside? How do you handle security? Is there a simple web interface that you can get to something when you're away from the house and your personal equipment?
Blah, blah, blah. This isn't the 90s, you know. We do have things like Apache/Nginx with self signed SSL certs these days (not to mention SSH, rsync, VPNs, etc, etc), and it's not that hard to setup (used to be a right of passage for geeks; these days it's considered entrance exam to the equivalent of geek pre-school). Things are also getting better everyday with projects for "personal clouds" (aka, your own file server with a web interface).
1) I'm currently in Istanbul, Turkey, and Turkish is still a work in progress, so getting offsite storage would be a bit of a challenge. When I am back in the states, I find that the best way to forget to backup is to place said backup miles away. For the last decade, my existence has been a bit nomadic, and setting up a safety deposit box has never been in my top to-do list..
And I did have a "local cloud" in the 90s. :) I find it a positive development that I don't have to do it today. I work enough that I would rather trade money for babysitting a box, checking for security updates, fighting incompatibilities with the scripts when an interface changes, and the other administrivia minutia.
I mean, for a personal uses, it probably won't come to haunt you that you're using an old piece of software with a security bug. But at this point, I have no problem paying for the privilege of thinking about other things.
And I did have a "local cloud" in the 90s. :) I find it a positive development that I don't have to do it today. I work enough that I would rather trade money for babysitting a box, checking for security updates, fighting incompatibilities with the scripts when an interface changes, and the other administrivia minutia.
I mean, for a personal uses, it probably won't come to haunt you that you're using an old piece of software with a security bug. But at this point, I have no problem paying for the privilege of thinking about other things.
What I do:
1. fire safe. 200kg one. Usb stick in it, although I'm considering switching to DLT. USB stick in my bag. Both encrypted with truecrypt at moment.
2. Do without it. Got a moleskin with everything useful in it.
note: I use a film camera and have cds so my media load is quite low. Negatives live in the fire safe and I have a list of cds in a text file so will just buy them again. I also bin emails. My data volume is approximately 800mb. Not much.
1. fire safe. 200kg one. Usb stick in it, although I'm considering switching to DLT. USB stick in my bag. Both encrypted with truecrypt at moment.
2. Do without it. Got a moleskin with everything useful in it.
note: I use a film camera and have cds so my media load is quite low. Negatives live in the fire safe and I have a list of cds in a text file so will just buy them again. I also bin emails. My data volume is approximately 800mb. Not much.
I found DLNA to be a better solution than SMB for this application, though it will still need a separate app on Android. minidlna should be a good fit for the Raspberry Pi. Apple is doing things their own way (DAAP), but you could probably run a DAAP server as well to cover all clients.
DLNA is awesome. I have a DLNA server set up to share my music, films and tv shows around my home network.
All my TVs are DLNA enabled and on the network, and I just use NFS to access files from my desktop/laptop.
All my TVs are DLNA enabled and on the network, and I just use NFS to access files from my desktop/laptop.
Off-topic: may I ask, which software is your DLNA server running? I'm trying to setup sth. similar.
Serviio is my current favorite.
Was a breeze to setup on my file server (running Solaris for ZFS support; installing software is often unreasonably painful), actively updates its database as new files are added, and allows me to administer it remotely using the Serviio-Console GUI (e.g. to change the folders it scans, update profiles for clients, the directory structure it presents to clients)
For a barebones implementation, minidlna is a fantastic piece of software. I see MediaTomb recommended a lot, and I'm sure it's fantastic, but I've never managed to get it setup properly.
Was a breeze to setup on my file server (running Solaris for ZFS support; installing software is often unreasonably painful), actively updates its database as new files are added, and allows me to administer it remotely using the Serviio-Console GUI (e.g. to change the folders it scans, update profiles for clients, the directory structure it presents to clients)
For a barebones implementation, minidlna is a fantastic piece of software. I see MediaTomb recommended a lot, and I'm sure it's fantastic, but I've never managed to get it setup properly.
Thanks a lot!
Yes, I think my next step is to give DLNA and UPnP a try. What I like with SMB is that it is a barebone tree of files, and so I get a better control than with tools needing a database, a protocol or anything more.
I don't understand what the cloud has to do with the post, but you can run an HTTP server on your Raspberry Pi, and all the players I have on Android (mainly MX Player) work fine. Videos even open right from the browser in the player, without any hassle.
> what the cloud has to do with the post
These USB stick stories tell us that, in fine, "existing" data has to have one physical location (or more). The cloud is not magically breaking this "existence principle". Instead, cloud user and data owners (or are they?) are just trusting a third-party service with the physical existence of their data.
The fast that people are able to smuggle slices of the Web in SD cards should remind us that issue, as much as the next big data loss or leak.
These USB stick stories tell us that, in fine, "existing" data has to have one physical location (or more). The cloud is not magically breaking this "existence principle". Instead, cloud user and data owners (or are they?) are just trusting a third-party service with the physical existence of their data.
The fast that people are able to smuggle slices of the Web in SD cards should remind us that issue, as much as the next big data loss or leak.
>> people should use open tools, running on devices they own, storing things on some storage they own and control.
I agree with your sentiment that "we shouldn't let others control our stuff." However, that doesn't mean you have to completely forego the advantages of cloud services.
For example, you can encrypt your data before backing it up to a storage providers. You haven't lost any freedom there; the worst case scenario is that they don't provide the reliability you paid them to provide. You can mitigate that risk by using more than one provider.
I agree with your sentiment that "we shouldn't let others control our stuff." However, that doesn't mean you have to completely forego the advantages of cloud services.
For example, you can encrypt your data before backing it up to a storage providers. You haven't lost any freedom there; the worst case scenario is that they don't provide the reliability you paid them to provide. You can mitigate that risk by using more than one provider.
I use StreamToMe (http://projectswithlove.com/streamtome) on iOS, and there are a number of similar apps.
I used to work in a Middle Eastern country that fairly aggressively filtered the net and where officially most DVDs, games, and books were banned.
Of course, unofficially you just had to pop down to the souks where you could get anything (pornography included) burnt to DVD. I used my time there as an excuse to digitise my DVD collection, since they certainly weren't going to let me get away with bringing them into the country, whereas a USD hard-drive went pretty much un-noticed.
It seems to me that whilst there are a few countries which enforce a totalitarian approach to censorship (like North Korea), others really just do it for 'appearances', because to not do so would be culturally unacceptable. Certainly pretty much everyone I met was circumventing censorship (both in net and print).
Of course, unofficially you just had to pop down to the souks where you could get anything (pornography included) burnt to DVD. I used my time there as an excuse to digitise my DVD collection, since they certainly weren't going to let me get away with bringing them into the country, whereas a USD hard-drive went pretty much un-noticed.
It seems to me that whilst there are a few countries which enforce a totalitarian approach to censorship (like North Korea), others really just do it for 'appearances', because to not do so would be culturally unacceptable. Certainly pretty much everyone I met was circumventing censorship (both in net and print).
This is by design; when you set up a situation where everyone is a criminal, any time you decide you want to haul someone in or stick someone in jail, you'll have no trouble finding something they're guilty of.
Everyone is guilty of something is pretty much how China works, they even have contradicting laws on the book to ensure this.
A related interesting effect with respect to corruption: any official is corrupt, and can be brought down at anytime because of that. Squeaky clean officials are not trusted because the "nuclear option" won't work on them, so they aren't promoted, leading to a downward spiral in quality.
A reasonable fair legal system is very important, I feel like we take it for granted in the west that things could be much worse.
A related interesting effect with respect to corruption: any official is corrupt, and can be brought down at anytime because of that. Squeaky clean officials are not trusted because the "nuclear option" won't work on them, so they aren't promoted, leading to a downward spiral in quality.
A reasonable fair legal system is very important, I feel like we take it for granted in the west that things could be much worse.
From a legal framework point of view, the US is there already. It probably isn't as blatantly abused. Make no mistake, if you attract the ire of an aggressive prosecutor, you can and will be charged with some sort of serious crime.
http://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp/...
Another angle in the US is are situations where you cannot be charged with a crime, but your property can. For example, if you are travelling on an airplane with a "large" quantity of cash, the authorities can (and have) essentially "arrest" your cash via asset forfeiture. You have rights, but your property does not.
http://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp/...
Another angle in the US is are situations where you cannot be charged with a crime, but your property can. For example, if you are travelling on an airplane with a "large" quantity of cash, the authorities can (and have) essentially "arrest" your cash via asset forfeiture. You have rights, but your property does not.
> Everyone is guilty of something is pretty much how China works, they even have contradicting laws on the book to ensure this.
The US isn't too different from this, especially if you include all the contractual agreements that a typical person enters into.
The US isn't too different from this, especially if you include all the contractual agreements that a typical person enters into.
Contracts are covered under civil law, not criminal.
I'm aware, but my point is that if your landlord or employer wants to make your life difficult, there's a good chance you're violating those contracts in some minor-but-enforceable way already.
No no no. They can put things in the contract, but just because you sign it doesn't mean the clauses are enforceable, many of them are illegal/unenforceable. If it comes to judge (which it almost never does for consumers), you have lots of rights and the judge is fair/unbiased and not in the pocket of your adversary. Disclaimer IANAL.
In China, if someone wants you out of your apartment, they can have you out almost overnight. Can you imagine how stressful a midnight move is?
In China, if someone wants you out of your apartment, they can have you out almost overnight. Can you imagine how stressful a midnight move is?
I don't think the US has outright contradicting laws, but they do have enough that you are probably guilty of something, and they do have the catchall "disorderly conduct" so the police can arrest whomever they wish.
I thought the popular charge in this regard is "resisting arrest."
See, I think they have to fabricate a charge to arrest you for before you can be resisting it. Otherwise they just add that one to the pile to encourage you to plea to lesser charges.
http://en.wikipedia.org/wiki/Resisting_arrest
The courts in the United States of America regard resisting arrest as a separate charge or crime in addition to other alleged crimes committed by the arrested person. It is possible (and has happened) to be charged, tried and convicted on this charge alone.
The courts in the United States of America regard resisting arrest as a separate charge or crime in addition to other alleged crimes committed by the arrested person. It is possible (and has happened) to be charged, tried and convicted on this charge alone.
Wow that would fit right in the middle of Catch-22.
Here's a Brazilian comedy sketch that portrays that exact scenario:
https://www.youtube.com/watch?v=WFd5_YtbScs
(not-so-good English subtitles available)
https://www.youtube.com/watch?v=WFd5_YtbScs
(not-so-good English subtitles available)
Traffic laws work the same way. Put such speed limit (for example) that almost all drivers are breaking the law, and then pick and choose.
Likewise, when you need someone to inform or plant something, you can tell the person "We know you did X, but we'll ignore it if you do Y for us."
Also known as "Sneakernet" (http://en.wikipedia.org/wiki/Sneakernet)
And the old "never underestimate the bandwidth of a station wagon full of backup tapes"
(and the modern version of that calculation, a station wagon fill of microsd cards, is calculated at 500gig per second here: http://www.dansdata.com/gz105.htm )
(and the modern version of that calculation, a station wagon fill of microsd cards, is calculated at 500gig per second here: http://www.dansdata.com/gz105.htm )
Love that term, "Sneakernet". Would love to see an analysis of a modern day sneakernet. This article just seems to remind us that it is possible.
When I saw Johnny Mnemonic again recently, I thought to myself that he could probably get more done -- at less personal risk -- by swallowing condoms full of micro-SD cards.
Agreed, but I believe the original purpose is that if he's killed the data is rendered useless. For organized crime, killing you to get micro-SD cards out of your gut is probably preferable to waiting for you to pass them.
I think there's only one real reference to this in the movie. It's supposed to be a super-secure way to transfer data. However, personally if the data was that important I'd just say "you come to me", because honestly if I got the cash I wouldn't care if you got shot 5 feet outside my building.
I think there's only one real reference to this in the movie. It's supposed to be a super-secure way to transfer data. However, personally if the data was that important I'd just say "you come to me", because honestly if I got the cash I wouldn't care if you got shot 5 feet outside my building.
> For organized crime, killing you to get micro-SD cards out of your gut is probably preferable to waiting for you to pass them.
Not if they're encrypted well enough and the data is somewhat time-sensitive!
....have we just found the solution to this XKCD? http://xkcd.com/538/
Not if they're encrypted well enough and the data is somewhat time-sensitive!
....have we just found the solution to this XKCD? http://xkcd.com/538/
Pertaining to the XKCD you just have to hope they don't get wise and go with vivisection.
However, the sender would likely phone/email/deliver the password on notification of arrival, which IIRC was what was supposed to happen in Johnny Mnemonic, but the Yakuza attacked and Johnny gets a portion of the password, which incidentally ties in with frame 2 of that comic.
I guess the lesson here is that a $5 wrench and a $50 mix of acid/shrooms/K applied to the right person would beat any cyrpto known to man.
However, the sender would likely phone/email/deliver the password on notification of arrival, which IIRC was what was supposed to happen in Johnny Mnemonic, but the Yakuza attacked and Johnny gets a portion of the password, which incidentally ties in with frame 2 of that comic.
I guess the lesson here is that a $5 wrench and a $50 mix of acid/shrooms/K applied to the right person would beat any cyrpto known to man.
Aka "rubber hose cryptanalysis".
32 gigabytes for 20 "high definition" movies? That's 1.6GB per movie. Seems awfully low, compared to eg Blu-Ray. Afaik movies on blurays are in the 20GB range, ie. an order of magnitude larger than the presented 1.6GB. Even movies downscaled to 720p are usually sized to fit a DVD5, 4.3 GB, still much larger than 1.6GB.
Point being that movie files are still quite huge.
Also, transferring 32GB over fairly modest 10Mbps line takes roughly 7 hours, far less time than what it'd take via post service.
Point being that movie files are still quite huge.
Also, transferring 32GB over fairly modest 10Mbps line takes roughly 7 hours, far less time than what it'd take via post service.
Due to the asymmetric nature of most end-user lines, 10Mbps of upload bandwidth seem far from modest. Around here you'd need a 100mbps (download) line, which is available but pricey, and as far as I know they're not even available in most of the world.
If you're talking about countries where this censorship is common, even a 10/1 line is probably not affordable by anyone except an elite.
If you're talking about countries where this censorship is common, even a 10/1 line is probably not affordable by anyone except an elite.
I think in censored countries, a 10/1 line is essentially non-censored. The only people who would be getting that are government officials or company executives who are in bed with the government.
I think the premise of the article is flawed, because I have a 16/2 connection. I recently express mailed an envelope across country (GTA to Vancouver) and it took approximately 4 business days and cost me ~$12. To do this through the internet, we're looking at 1.5 days for my internet connection (assuming upload is the speed issue). Even at the average 10/1 connection, we're talking 3 days. Still beats mail, and god forbid you mail on a thursday and it takes 6-7 days to get the mail through. What about from Canada to Australia? Well an express letter, you're looking at 2 weeks if you're lucky.
Remember, this is only a product of our lazy ISPs happy to keep service where it is whilst bumping up prices. If Google Fibre has an effect on the market this discussion is meaningless. Up to 1gbps up and down. This discussion is meaningless if it only attains 10mbps upload, it won't even leave the post office in the time it would take to transfer.
The notion that SOPA et al will destroy the internet is a little absurd, all it will do is expand the darknet, which will cause rapid expansion.
Think what Tor would be if every computer in the world was on it and acting as a proxy. This is what governments will force to happen with restrictive legislation and our "controlled freedom" will become uncontrollable freedom.
I think the premise of the article is flawed, because I have a 16/2 connection. I recently express mailed an envelope across country (GTA to Vancouver) and it took approximately 4 business days and cost me ~$12. To do this through the internet, we're looking at 1.5 days for my internet connection (assuming upload is the speed issue). Even at the average 10/1 connection, we're talking 3 days. Still beats mail, and god forbid you mail on a thursday and it takes 6-7 days to get the mail through. What about from Canada to Australia? Well an express letter, you're looking at 2 weeks if you're lucky.
Remember, this is only a product of our lazy ISPs happy to keep service where it is whilst bumping up prices. If Google Fibre has an effect on the market this discussion is meaningless. Up to 1gbps up and down. This discussion is meaningless if it only attains 10mbps upload, it won't even leave the post office in the time it would take to transfer.
The notion that SOPA et al will destroy the internet is a little absurd, all it will do is expand the darknet, which will cause rapid expansion.
Think what Tor would be if every computer in the world was on it and acting as a proxy. This is what governments will force to happen with restrictive legislation and our "controlled freedom" will become uncontrollable freedom.
Very true. I'm on "Superfast" broadband in the UK. That means 16Mbps down, 1.3Mbps up.
The only way to get 10Mbps up is to be on fibre-to-the-premises. And even then only if you live in one of the blessed areas.
ADSL supports up to 24Mbps down in the UK - assuming that you're (very) close to the exchange. I could theoretically get that with my old ISP, were I not 1.6km from the exchange.
Cable supports up to 100Mbs down (at least I'm pretty sure that Virgin has started to roll that out, if not then 50Mbs), though contention might be an issue at peak times.
I've got BT Infinity, which is fibre to the cabinet rather than all the way to the home. Since the distance to the cabinet is likely to be pretty minimal you can get pretty high bandwidth over the last length of telephone wire. For reference, I get 76Mbs down and 20+Mbs up - more than fast enough for plently of thing to feel instant, such as downloading movies which now takes in the order of minutes.
Cable supports up to 100Mbs down (at least I'm pretty sure that Virgin has started to roll that out, if not then 50Mbs), though contention might be an issue at peak times.
I've got BT Infinity, which is fibre to the cabinet rather than all the way to the home. Since the distance to the cabinet is likely to be pretty minimal you can get pretty high bandwidth over the last length of telephone wire. For reference, I get 76Mbs down and 20+Mbs up - more than fast enough for plently of thing to feel instant, such as downloading movies which now takes in the order of minutes.
Cable supports even more. I'm on a 150Mbps cable modem now and it's nice. Too bad the upload is limited to 6Mbps.
DVD/Bluray typically use MPEG2- for the sake of discussion this is 'uncompressed' because studios don't make raw video data available. Many consumer videos are transcoded into a more compact MP4 format - of course you need a specialized device or a PC to watch MP4. Most media players nowadays can support mp4 decoding, however. It's not the same quality as mpeg2, but passable to the casual viewing audience, mp4 uses predictive motion encoding, spatial and temporal compression, and reduced chroma sampling sometimes. Modern video streaming services now all probably use moderate-complexity mpeg4 encoding, resulting in a lower bandwidth. (movies rented from Apple, amazon, netflix, etc). A 1.6 Gbyte mp4 file is decent 720p depending on the scene contents and length of the video, at a fixed bitrate.
edit: and it's worth noting that these small video files will typically strip the multi-channel audio and favor a remixed stereo-only sound track. saves more bytes.
edit: kudos to poster below for clarifying my half-baked explanation.
edit: and it's worth noting that these small video files will typically strip the multi-channel audio and favor a remixed stereo-only sound track. saves more bytes.
edit: kudos to poster below for clarifying my half-baked explanation.
MP4 is a container format, MPEG2 is a compression algorithm. A variety of video and audio compression algorithms can be used inside the MP4 container although H.264 is probably the most common.
DVD does use MPEG2. Blu-ray supports a variety of algorithms for video and audio with the BDAV container (.m2ts), commonly MPEG2, H.264 (AVC) and VC1 for video and DTS-HD MA, Dolby TrueHD and garden-variety LPCM for lossless audio.
Today, most Blu-rays are being authored with H.264 or VC1 encoding for video. That being said, space savings are achieved by trans-coding the raw .m2ts to much lower bitrate H.264 and downmixing the audio to, say, 620kbps DD5.1 or even just stereo.
DVD does use MPEG2. Blu-ray supports a variety of algorithms for video and audio with the BDAV container (.m2ts), commonly MPEG2, H.264 (AVC) and VC1 for video and DTS-HD MA, Dolby TrueHD and garden-variety LPCM for lossless audio.
Today, most Blu-rays are being authored with H.264 or VC1 encoding for video. That being said, space savings are achieved by trans-coding the raw .m2ts to much lower bitrate H.264 and downmixing the audio to, say, 620kbps DD5.1 or even just stereo.
To add to the clarification, both DVD and Blu-ray content is basically always sampled as YUV 4:2:0, and basically no transcode ever changes that. Masters generally have higher chroma sampling (eg. 4:2:2) but this is reduced to 4:2:0 when the content is put on DVD/BD, not by encoders further down the chain. Masters can also have a higher bit depth (eg. 10-bit) per channel which is then converted to 8-bit for DVD/BD.
Also, multi-channel is rarely downmixed to stereo in case of HD content - for Blu-ray rips, however, only the core from Dolby TrueHD (640kbps AC3) or DTS-MA (1536kbps DTS) is generally used (at least in case of western content) instead of the full lossless audio (and in cases where lossless audio is used it is generally converted to FLAC because it compresses better).
Just because rips have drastically smaller filesizes doesn't mean that they're going to have drastically lower quality, though - Blu-ray has limitations in the amount of H.264 features that can be used, and encoding applications also matter. x264, which is a FOSS H.264 encoder, is generally recognized as the best H.264 encoder in the world. If you use x264 and go above Blu-ray limits, hell even H.264 level 4.1 limits, or even encode in 10-bit, it's not uncommon that you'll be able to shave off over 50% of the file's original size or more (compared to the original .m2ts file on the BD) with no discernible loss in video or audio quality. In case of western content, people tend to mostly stick to level 4.1 8-bit H.264, though, because of hardware compatibility. 5.1 DTS/AC3 core is used instead of say, 5.1 AAC is used for compatibility reasons as well - because S/PDIF can't do 24-bit 5.1 LPCM.
There is one scene that cares very little about hardware compatibility, though: the anime scene. You can find pretty much the most advanced video, audio and subtitle formats in use there, with 10-bit H.264 video going up to level 5.1, AAC/FLAC audio, very complex ASS subtitles, Matroska ordered chapters... it's quite fascinating, really.
Also, multi-channel is rarely downmixed to stereo in case of HD content - for Blu-ray rips, however, only the core from Dolby TrueHD (640kbps AC3) or DTS-MA (1536kbps DTS) is generally used (at least in case of western content) instead of the full lossless audio (and in cases where lossless audio is used it is generally converted to FLAC because it compresses better).
Just because rips have drastically smaller filesizes doesn't mean that they're going to have drastically lower quality, though - Blu-ray has limitations in the amount of H.264 features that can be used, and encoding applications also matter. x264, which is a FOSS H.264 encoder, is generally recognized as the best H.264 encoder in the world. If you use x264 and go above Blu-ray limits, hell even H.264 level 4.1 limits, or even encode in 10-bit, it's not uncommon that you'll be able to shave off over 50% of the file's original size or more (compared to the original .m2ts file on the BD) with no discernible loss in video or audio quality. In case of western content, people tend to mostly stick to level 4.1 8-bit H.264, though, because of hardware compatibility. 5.1 DTS/AC3 core is used instead of say, 5.1 AAC is used for compatibility reasons as well - because S/PDIF can't do 24-bit 5.1 LPCM.
There is one scene that cares very little about hardware compatibility, though: the anime scene. You can find pretty much the most advanced video, audio and subtitle formats in use there, with 10-bit H.264 video going up to level 5.1, AAC/FLAC audio, very complex ASS subtitles, Matroska ordered chapters... it's quite fascinating, really.
I don't that cubans have many 10Mbps connections.
For a very expensive, not modest, line in Iran download is restricted to 128kbps while upload is probably less than that.
But you completely missed the point the article is trying to make...
But you completely missed the point the article is trying to make...
The article the author points to on Cuba is very good. I have been to Cuba and I find it quite accurate. Indeed, the news also spread via USB stick. If you ever go to Cuba why not bring some data. Be it music, video or pages of the Spanish Wikipedia..
> If you ever go to Cuba why not bring some data. Be it music, video or pages of the Spanish Wikipedia..
I'd certainly hope that they already have a copy of that, given that an entire dump is <32 GB[1], depending on how much meta-info (edit history, etc.) you want to include.
From there, all you have to do is smuggle in the diffs every now and then, which should be minuscule.
[1]http://dumps.wikimedia.org/eswiki/20110911/
I'd certainly hope that they already have a copy of that, given that an entire dump is <32 GB[1], depending on how much meta-info (edit history, etc.) you want to include.
From there, all you have to do is smuggle in the diffs every now and then, which should be minuscule.
[1]http://dumps.wikimedia.org/eswiki/20110911/
How about an update of Fidonet where people just have to take laptops into internet cafés, such that laptops pass such data to each other with no intervention from users? This wouldn't replace the USB Sticks, rather it would supplement the distribution. (For WPA protected networks, there may have to be some mediation to establish the first connection.)
You can hide the micro-SD cards inside some of the coins sold by spy-coins.com (they're also sold by ThinkGeek). Only downside I've noticed is that when you drop one of the coins onto a hard surface it doesn't sound right - the "ring" it makes is different. But if you have it in with a handful of legit coins, it passes without notice. Just don't spend it by accident. ;)
> I don't know what will happen to the Internet. SOPA, DEA, and HADOPI all conspire to break the way we share knowledge - under the benign guise of copyright protection. And yet all it takes is a dozen USB sticks, a few memory cards, and very little effort to break their embargo.
For the technically savvy, yes. But by enacting these changes, governments and other interests can dramatically alter the mainstream discourse and culture negatively. Having a difficult technical means for a few to work around the damage won't prevent the overall harm.
For the technically savvy, yes. But by enacting these changes, governments and other interests can dramatically alter the mainstream discourse and culture negatively. Having a difficult technical means for a few to work around the damage won't prevent the overall harm.
I'm currently uploading my iPhoto backup to Amazon S3. It will take 2 more days. Would be glad to have an option to mail the files in a card or something like that.
You can - http://aws.amazon.com/importexport/
Well, not a SD card, but you can mail Amazon a HD and they'll transfer it over for you. It may not suit your particular use case, but people do use it.
Well, not a SD card, but you can mail Amazon a HD and they'll transfer it over for you. It may not suit your particular use case, but people do use it.
Yes I've seen that but I belive it's more suitable for high volume data, say, tens of terabytes or more. As the prices are high for something like my personal backup.
It'd be great to think that things like Usenet, FIDOnet or similar are still being used with people sneakernetting USBsticks around.
http://deaddrops.com/
Internet without cables? Dead drops started as an art experiment...
Internet without cables? Dead drops started as an art experiment...
I smell something rotten. Hide a microSD in a cake? If security and customs missed a cake going thru you think they would manage finding it stuck in your shoe?
You could tape a micro-SD card to the bottom of your foot, under your sock, and the TSA would never find it. Just opt for the pat-down, and they have never checked the bottom of my feet before.
Smuggled USB sticks are the 21st Century version of samizdat.[1]
[1] https://en.wikipedia.org/wiki/Samizdat
[1] https://en.wikipedia.org/wiki/Samizdat
As usual, relevant xkcd: http://xkcd.com/691/
Bad title! The only smuggling is of an SD card. The USB sticks in Cuba are "passed around", not smuggled.
(Everyone's being pedantic about the numbers, so I felt entitled to be pedantic about something else.)
(Everyone's being pedantic about the numbers, so I felt entitled to be pedantic about something else.)
It takes about 2,89 days on a 1 Mbit connection to download 32 GBytes.
It's about upload, not download. Download in Iran is usually restricted to 128kbps, upload probably is significantly less.
Also, you completely missed the point of the article.
Also, you completely missed the point of the article.
Getting information into Iran is probably just as important as getting information out though. While the specific example would be about upload speed from Iran, the over-arching issue is about upload and download speed.
[deleted]
Last time in a Pycon conference in Beijing, 5/4 speeches were about new cloud offers (it was advertising actually). This makes no sense.
People should not do their stuff in free apps running on devices they don't really own, and these apps should not store that stuff in a cloud vaguely rented by the app maker.
Instead, people should use open tools, running on devices they own, storing things on some storage they own and control.
On my bed, I can use my tablet to browse pics I have taken with my phone, while listening to music I have ripped on my desktop long time ago. It seems necessary to be able to do so, but it is not necessary to hand over all your stuff to Apple or Google or Dropbox to do so. (And all your things should be right there even if you ISP is down.)
The obvious solution I used is a "local cloud" (just a samba server on a little Raspberry Pi actually). But on Android strangely only very few media players on devices acknowledge this need and let my slide pics, listen to music or watch video from the LAN. (I have no idea on iOS, I suppose it is even worse, do they have VLC on iOS?)
edit: clarify