In SAML you sign a (potentially attacker controlled) subset after normalization. So a lot of saml bugs come down to the attacker adding things that aren't covered by the signature. Sometimes this means appending or prepending stuff, but my favourite is adding comments which can alter the interpretation of the xml document (as it splits text nodes) but doesn't alter the signature.
It’s XML, so the signature inside the document somewhere and signs some other part of the document by reference.
You would be shocked (or, if you’re in the security space at all, not even remotely shocked) to learn that a comical number of SAML implementations verified the signature and then just treated the whole doc as if it was trusted, even if the signed part had nothing to do with the document as a whole.
Reminds me of a similar attack on PGP/MIME/HTML where you'd put <a href="http://evil.example/ in front of the PGP message.
Email's in a bad situation with regards to this because every intermediate server is expected to mangle the message and the headers, so the only way to consistently sign something is to make it a marked up encoded block the way PGP does.
In a JWT this is simple, the signature checks the entire sig and data sections. In XML signatures it checks whatever it says it checks, a list of URIs, which may also be transformed.
So it is possible to have an XML signature that points to an element that does not include some important piece of data.
Given the size of the US, and the variety of local populations, I argue that local enforcement is necessary. Adherence to larger enforcement standards is also necessary. I fear that larger, “cohesive” enforcement runs the risk of bringing more political laws and regulations from other jurisdictions. No one wants to be subjected to some remote jurisdiction’s idea of “lawfulness” especially when religious ideals get mixed in.
Well, how fine grained do we need to get? A police force with 5 officers is pretty fine. In this case law enforcement is being taken over by the county (of which there are 254 in Texas) so its still pretty local.
As always: it depends. There are many municipalities throughout the US that are content with (or can only afford) county-level enforcement. If their residents want something more localized, they need to do what it takes to create that.
In this case, what’s happened is fine. Leaving it up to local residents and their local government to form a new trustworthy enforcement agency is fine. Leaving it up to them to not do that is also fine.
Wouldn't you want more data to learn if its "fine" vs "not fine"? If you learned that small departments were significantly worse than larger ones on use of force, corruption, etc wouldn't that inform a decision?
There is a pattern where elective democracy does not work, or at least gets weird at small scales like this. Small pool to elect from, only need to win over a modest number of people, etc.
I agree with this. It may be reasonable for a town to have its own PD if they can afford it and choose to have one, but certain levels of training and evidence collection and ethical standards should be set at the state level or higher.
Why is it so ridiculous that the state can provide police where and when they're needed, and it's only when you have a sufficiently robust metropolitan area that can afford their own police force that you then have "local" cops?
Or are we all about locally-sourced, artisanal law enforcement now?
> If consumers are unwilling to shell out for a TV priced high enough that the manufacturer doesn't need to do things like this to earn a (decent) profit, ...
The problem is, even if the device is priced at cost plus a reasonable margin, they can make more margin by selling data that they acquire by spying. No matter the margin on the sale, there's still more money to make by selling that data. There is no upper limit that magically prevents the manufacturer from looking for other avenues to increase profit. "Premium" device priced 3x the "reasonable" price? Still more money to be made selling data.
Now, factor in the race to the bottom on selling price, and those data sales just look that much more enticing.
I get what you’re saying but the market had a choice on this, and it chose.
They wanted the “smart” tvs. Overwhelmingly. “We” chose this hellscape when we had the opportunity to say no.
So I think the person you’re replying to is kinda right. We didn’t get forced into this so much as everyone collectively said, “Yeah, that’s what I want.”
Have you ever met people that actually wanted to buy a smart tv? I've only ever met one. Besides being dumb, he proved to be a dick, too. Maybe these qualities are related, maybe they're not.
But you're right: obviously there must have been people buying smart tvs in a time when there were still dumb tvs available, but what motivated these "people", where they came from, and where they have been hiding,... it's all a complete mystery to me. Last time I bought a tv, there were still some dumb models available. I may get a new display for whatever computer I'm working on every couple of years, but to me a tv is the sort of appliance you'd replace maybe once every 20 or 30 years at most, so I guess I have only been able to vote with my wallet once. Obviously voting with your wallet is as pointless as voting for certain politicians: so far I have yet to find any evidence that anything people vote for is subsequently reflected in reality in any way.
Cows can be treated nicely, given a field to romp in, fun toys, and then euthanized quickly without causing them fear.
But that means leaving wide open space that’s not making the shareholders enough extra money and therefore we don’t do it. Instead, we torture them.
reply