153 posts • joined Tuesday 26th October 2010 07:39 GMT
Want to know what these records have the potential to look like? Press play: http://www.zeit.de/datenschutz/malte-spitz-data-retention
I was just looking into all these services recently...
Have a look at www.box.com.
I believe you'd need to use their enterprise edition to get the features you require in relation to auditing, data trails, and enforced file-deletion policies. Enterprise admin users have a lot of control over how they lock down accounts.
What I noticed about box, was that they have the best attention to detail of any of these companies I've looked at. A few prominent competitors' "prevent user from downloading" functions were trivially bypassed.
The other company to look at, who appear equally robust, and I believe specialise in larger companies, is egnyte.com.
They also have the benefit of being UK based, which could help you for regulatory purposes.
We chose box in the end, as I wasn't happy with Egnyte's audio options, so I can't really go in depth about that one, but I can talk about Box in a bit more detail:
> "The employee working with the rep creates a login for the vendor to use on the site."
with box enterprise, you can create different levels of admin users, so I believe you would be able to do this.
> "Vendor goes to the site, logs in with their account, and uploads the file(s)."
yes. indeed, you can create folders with upload only permissions for certain users.
>"The site gives the vendor and/or the employee a link with the file's location for sharing."
yes, box handles this quite well.
>"The file would stay on the site for a certain period of time, and automatically be removed or archived."
Yes. It's possible to disable both the link to the file, or delete the file itself, after a given period of time. From what I know, enterprise admins can set a company-wide policy in this respect.
>"We would also need the ability to audit the application's usage, and obviously security is paramount."
Box's auditing tools appear to be very hefty. Even at my team's low level usage, I can see exactly who's accessing my files, when, and from where.
Re: Good for him
You can assume you are. Read up on the Five Eyes, an intelligence gathering/sharing pact between the US, UK, Australia, New Zealand and Canada. Even if Canada was not directly involved in this particular incident, your government would likely have had access to the information.
Re: Not sure this is so impressive, and this is dangerous...
"The problem I see with all AI effort is the parsing of CONTEXT. To determine properly meaning and function some minimal grasp of the context or object environment needs to be there. As well subtext, history and expectation (future projection)."
It's an interesting point, isn't it.
At one level, we as humans learn by being able to choose to do an action to interact with the environment, and learn from / experience the result (the classic being kids playing with blocks trying to fit a square peg into a round hole, etc…). Computers, even massive systems like Google's don't really have the chance to perform actions that effect the world around them.
However I guess they can watch intently, and study cause and effect. I wonder, as I said above, could that be a suitable substitute? At the root level, given enough opportunity to observe, could it work? Indeed, can you learn more by standing on the sidelines and watching, rather than being directly involved?
And taking this further, is Google's system getting more chance to learn about making choices that effect things in the real world? Google's Self-Driving Cars, could be seen as one step in this direction. Choices made by that system will have direct effects on physical objects. It can watch what happens to other cars, and people, depending on its choices. How do they avoid the car? What sort of things move which way?
Re: Not sure this is so impressive, and this is dangerous...
"It has no notion of a cat". Maybe / maybe not. Whilst that's the traditional view, Google has resources far beyond what was conceived when people say this. It has access to the context of these images. What they are named, tagged, and placed alongside. This is a massive amount of information. If their AI system has access to this, and it cross references pictures of cats with Wikipedia or say discussions about cats, for example, it can potentially make judgements in a similar way to humans.
Re: Google slow?
Could this be the system wide SSL that Google has introduced? I know they've made vast improvements on SSL latency, but that was focused on user/server data. wonder are they finding that latency becomes an issue when every step internally involves an encryption/decryption cycle that it didn't have before?
Re: SSL / TLS...
SSL is obvious. But you're at the other party's mercy for whether TLS is enabled.
Given that email is transmitted cleartext between mailservers, won't your email contacts be identified by default by the nsa/gchq watching emails fly by past their fibretaps? Whilst this iCloud insistance isn't ideal, does it make a material difference?
Re: Difficult to see this one happening
"The data frequency will have to be subsonic ( < 35Hz) or else the sum and difference products will be definitely audible."
Very good point.
Re: Uh ... computer says no.
I suspect that's been upgraded to a 96kHz clock on newer macs, given the nature of the options presented in Logic (88 and 96k valid, but 176.4 and 192kHz greyed out) when my internal card was selected. [I don't deny they could lie though.
But anyway, I can tell you that it is possible to transmit data like this - I've done it using Dual Tone Multi Frequency encoding, transmitting text from one computer to another through their a soundcards. I knocked something together in an afternoon before, (using FFT, iirc). Mine worked in the audible range, but it will work in the ultrasonic range too. This is (very) slow, but incredibly resilient. We're spoilt for modern data rates. Cut back the bloat, and have a lot of stuff pre-programmed, and there's an awful lot you could achieve with 10bps.
Re: The ultrasonics bit sounds like utter cobblers to me.
I've verified a laptop outputting very strong signal at 20kHz (see my post below). But what's interesting to consider - is there a way that a computer program could induce EM noise into either the mains or the environment, that would result in noise being induced into the input of a computer sound card's Analogue to Digital converter? Doing something with the monitor perhaps, etc?
Re: Uh ... computer says no.
Ok, just ran a test myself: thought so.
20,000Hz (sine wave)* being played out of my laptop (macbook pro), and being picked up by its built-in mic, what looks to be well over 40dB above the noise floor.
I've verified that this is not crosstalk in the electronics.
Macbook pros' speakers are woeful, and their mics are worse. If it can work on a macbook, it can work on anything.
[And I can't edit my post now, but of course I offer my most humble apologies for misspelling your name, oh uncapitalised one! ;-) ]
[*inaudible to me, though I can hear it on square waves due to distortion]
Re: Uh ... computer says no.
Jake, are you sure you were hearing 20,000Hz and not a subharmonic induced by distortion somewhere along the signal chain?
Re: The ultrasonics bit sounds like utter cobblers to me.
They'll be perfectly capable of generating / detecting frequencies well into the 20kHz range. Mic / speaker frequency responses are given as a tolerance - e.g. pro gear would be flat response between 50Hz - 20,000Hz, +/- 3dB, consumer gear 100-15kHz +/- 6dB (it varies a lot). That doesn't mean they can't detect / generate frequencies outside that range, it's just they'll be few dB less sensitive or powerful at, say, 25kHz.
Even the cheapest consumer soundcards handle 96kHz sample rates these days. And, to be honest, unless you're banging pots and pans around the laptop, not much else in an indoor environment generates sound in the 20kHz+ range, so I'd suspect there'd be less interference to handle than you might instinctively expect.
Re: Under flag of convenience in international waters?
Hmmm... in international waters, they're more than a tad vulnerable to physical intervention!
Re: "the physical limits of the aircraft can be improved beyond the current limits."
True, but the reinforcements required also add weight.
You have to remember what 9G means in practical terms - the forces on heavy internal components are immense. Engines have been ripped from their mountings on US fighters before. The 9G limit on the F16 was there to protect the airframe, first and foremost, not the pilot!
Re: Fandroids left at pranksters' mercy
The problem isn't what you have got to hide today, but what innocent behaviour have got to hide tomorrow. Read up on McCarthyism. Things can change and they can change quickly, even in stable, democratic countries. If that happened in 20th century US is can certainly happen in 21st century UK. Imagine what would have happened had that rogue US politician had access to something like PRISM et al?
The highlighted post here is worth reading: www.reddit.com/r/changemyview/comments/1fv4r6/i_believe_the_government_should_be_allowed_to/caeb3pl?context=3
Now I'm on record in el reg comments as saying that there's probably no point trying to avoid he surveillance as it's so extensive. Anything you do is a false sense of security in reality, short of unplugging completely or making things extremely unusable. But to say "what have you got to hide" is a different kettle of fish entirely...
You're criticising spelling mistakes...
Because El Reg has such a flawless record when it comes to typos?
Re: Disable Find my iPhone?
No. But if enough people do this, on all types of phone, eventually people will stop buying them, even for $20. Granted the thieves will just find another target that people DO want, but...
Re: Why Worry? Change is Natural..... THAT TITLE IS TOO LONG!
Indeed. If leverage can be put in the right places - it is surprising how much of a change can happen. Remember the proposed Syria intervention. It was a foregone conclusion, with forces already moving into place, until a handful of Conservative MPs were convinced to speak out, leading to the entire alliance falling apart, until it was only France left, resulting in the incredible situation that it's now seemingly Russia calling the shots.
All because of 20 or so backbenchers going against the party line.
The justifications for this kind of widespread surveillance are even more tenuous, and it could be another case of dominos falling if some parliament was twisted into taking a stand against it.
Re: Jesus Christ
"Is it beyond someone to come up with a better system"
You can walk into any carphone warehouse the next day and pick one up at your leisure...
It's going to all be about context
This new logo is going to look far better on the "flat design" type of site that's becoming the norm. The old one was a tad too busy in that context. For the most part, this logo seems to look ridiculous on the yahoo home page - all the proportions and styles are wrong - it's obvious the page wasn't designed around it.
BUT - it looks pretty stylish in other contexts, especially with the inverted colours - I quite like it here: http://uk.eurosport.yahoo.com
Re: Guardian learning?
Brangon: Source for your statement that the previous password leak was the password for the insurance file?
So what you're saying is TV stations shouldn't pay to broadcast films or tv shows, because they're effectively giving the shows' producers free advertising for boxsets?
Re: But mythbusters sez it can't be dun!!!1
Ha! I believe they said you can't make one that won't kill you for less than 5000 dollars from plans downloaded from the internet - They're still right about that!
Re: Holy undergarments
As for the odd redirects, could that have been because the sites were hosted in some way on google services, blogspot, etc?
The other thing I should add here, is that a user on another site was getting 60% packet loss pinging google during the outage over IPv4, but had perfect connectivity over IPv6.
Re: What time was that then?
El Reg have a very clear, years-old policy that all articles are published based on the conventions of the country in which it was written. In this case, it's clearly stated it's the San Francisco office issuing this article, so PST, and US English.
It's similar for their Australian office.
They don't have the personnel to convert every single article to make it sound like it was written in London - especially not at 1am GMT on a Saturday morning!
What I'm impressed by is that everything seems to have run perfectly once Google came back to life.
What do engineers/admins of these kind of huge systems like this think? I would have expected load balancers etc to have gone out of whack, after receiving normal traffic, zero traffic then 50% above normal, in the space of 5 minutes. That strikes me as the perfect recipe for a cascade failure we've heard so much about of late.
Could it have been DNSSEC, like when almost every .GOV site went offline simultaneously for an hour this week?
Re: It's not so difficult at all..
That's my instinct, I'll admit!
But short of going totally off-grid, I can't see how you're not ALWAYS giving away those essential liberties anyway. We're too far down this line already.
In terms of Google Now, one of the main things is how it collates your emails with your location. Given that your emails are guaranteed to be intercepted, and we already know your location is being tracked for the security services via your phone company, it makes little difference from a privacy perspective whether or not you're using something like Google Now. If they want, they're already able to easily mine all that data regardless.
At present, I've yet to see how we can effectively make it "as expensive and difficult as is humanly possible", in a way that isn't making it incredibly difficult and inconvenient for us to use the internet.
Most techniques I can see mirror TOR's limitations:
Very effective if used in a strictly controlled fashion, but the security/privacy benefits fall apart when you want to do something flexible.
Re: It's not so difficult at all..
What I've been feeling lately is that, I may as well be hung for a sheep as a lamb.
There is no realistic scope of significant privacy in this respect, especially being based in the UK. Running my own email server is virtually no benefit, as emails are sent in the clear in almost all situations, always to US or UK based accounts. It's just not practical to get all your correspondents to use PGP or whatever, so whilst there's some advantages to using my own email server, in all likelihood all communication is going to get scanned anyway, and I'm pretty sure I've used enough trigger words that they'd get intercepted and stored by GCHQ/NSA.
So if everything I do is going to get scanned, analysed, and correlated to NO benefit to me, why don't I let everything I do get analysed in a way that IS beneficial to me, by opening myself up to Google Now. It is incredibly convenient in ways you never expect.
It strikes me as far more logical to take all the benefits that I can, rather than crippling my internet functionality for an illusionary increase in privacy.
When I CAN guarantee total privacy in what I do online, I'll jump at it, but for the moment, I don't see what I've got to lose.
"I doubt we'll hear anything more from him. Russia has made it clear that they expect him to keep his mouth shut"
I wonder is this for the best - he's already given all the information he has to the WP and Guardian (they're taking their time to publish it at their leisure), so the if he stops talking it won't stop the information getting out. But it stops the story from being about him, and moves it back to being focused on the NSA & co.
Re: There is middle ground too
I was under the impression it was hefty documentation in this case (more-so than before). But of course if they only publish excerpts from the docs, I can only take their word for that, and can't argue against you.
*sigh* If only it was possible to organise a massive, coordinated/distributed reverse engineering attempt, to try and figure out what the hell is really getting intercepted and stored, and what's not...
Reading the blog post...
Reading the blog post makes it all the more understandable why companies like Google take the PR hit of shutting down popular services that aren't a clear benefit for their core purpose, even if the financial costs of keeping it running aren't significant.
Keeping old services running must continually gum up the management process of the overall operation, and really tie-up good personnel that could be better utilised elsewhere...
Re: oh dear how sad, not enough of a fall
Rather than it getting lost in the comments, it's probably worth you sending email to firstname.lastname@example.org, reminding them about that for the future!
El Reg is never normally shy of repeatedly kicking tech companies in the teeth to make sure things like that are never forgetten!
As I'm sure Mark '...Bitch' Zuckerberg would attest!
re Half Life
Yes! Unreal was exceptional - I've loved every game in the series except Unreal2, but Half Life was released in the same year, but is surely the best single player FPS game ever. So many scenes from it stick in the memory, and anytime I hear the menu, health or charging sound effects, I'm instantly taken back to being lost in damp tunnels looking anxiously for head crabs -This doesn't happen me with Unreal.
Bizarrely, both games somewhat lose the plot 75% of the way through!
Re: Says who?
Spotify does the opposite of stop piracy - it takes people like me, who bought £60-70 of cds every month, and stops them. I am now paying £10 per month for spotify instead. That's an 80% drop in income for the music industry as a whole from me.
That's not sustainable.
Strange this is only hitting the headlines now - I encountered this months ago.
Who would do the audit?
nah, there's a general degree of speculation that it coincides with a date in islam's history with the west. But it should be noted that there's such a long history there, that something significant has happened for islam on every date on the calendar at some point over the years.
Audio doesn't take up that much space, especially with compression. Even in the 70s you could encode intelligible speech with well less than 5kbit/ second, just using delta modulation. And you don't have to store the silence between words that presumably makes up the bulk of most phone calls.
Even without compression - assuming 8kB/sec* it's still more than feasible - here's a back of the envelope estimate someone did (I suspect he's underestimated the number of phonecalls): http://blog.archive.org/2013/06/15/cost-to-store-all-us-phonecalls-made-in-a-year-in-cloud-storage-so-it-could-be-datamined/
It's running the analysis that'd be a PITA - that would be a phenomenal amount of processing power - and would obviously need more processing power the more compression had been applied to the audio. Again, though, given the surprising fact that storing all the phone calls for a year is feasible, there's probably ways to optimise it!
*(that'd be 8bit, 8kHz PCM mono uncompressed - a tad better than normal phone quality)
Re: I don't bother with encryption
yep. I'm willing to believe it's a case of mostly well meaning people creating something that has unintended consequences. Like you say, they're probably all like Reg readers - many probably ARE Reg readers. We're all guilty at some point, of going too far with tech solutions to meet our own goals as programmers, admins, etc, etc and losing sight of the big picture for other stakeholders. It's no different here.
The issue is that if it's that easy for someone like Snowden to release info of that's in our interest, then it's a real problem if someone who's not as well meaning gets his hands on the data (or is in charge of the data). It doesn't matter if it was made FOR the quelling of dissidence, it's the fact it could easily be used to do so that's the the issue.
Incidentally, does anyone know how well paid the NSA folk are? I know it's been said here repeatedly that GCHQ pay pittance.
Re: More umbrellas
Note to self. Move to Alaska.
"I'd be happier with people randomly selected from the populace than these clowns."
Appropriately, Robert Heinlein's masterpiece, The Moon is a Harsh Mistress (http://www.amazon.co.uk/Moon-Harsh-Mistress-S-F-MASTERWORKS/dp/0575082410) has some superb exploration of this line of thought...
@Yet Another Anonymous coward
you sound like a man who's played as much SimTower as I have!
- Facebook offshores HUGE WAD OF CASH to Caymans - via Ireland
- Review Best budget Android smartphone there is? Must be the Moto G
- NSFW Confessions of a porn site boss: How the net porn industry flopped
- World's OLDEST human DNA found in leg bone – but that's not the only boning going on...
- OHM MY GOD! Move over graphene, here comes '100% PERFECT' stanene