http://www.bbc.co.uk/news/uk-politics-17576745

http://www.whitehouse.gov/the-press-office/2011/12/31/statement-president-hr-1540

http://www.fastcompany.com/1826121/employers-want-your-facebook-password-now

Boy the more I read stories like this, the more I'm convinced that 
privacy and personal freedom is a thing of the past. Governments and now 
employers seem to be marching lock step, and arm in arm all over things 
that up until /were/ deemed scared. Why don't they just go ahead and 
implant a chip in our necks and be done with it :-(

Post a reply to this message

James Holsenback <nom### [at] nonecom> wrote:
> http://www.bbc.co.uk/news/uk-politics-17576745

  Fortunately, privacy laws in Finland are (still) really strict, so
here there's (still) little to worry about.

  There have been many cases already where privacy-compromising acts or
laws in other countries have caused the Finnish government to start an
investigation on how it could possibly affect Finnish citizens. For
example, at one point the Swedish government wanted to enact a law that
would permit it to monitor people's private emails, and this caused
concern in Finland (because most internet traffic in Finland is routed
through Swedish servers). Likewise when it was discovered that Google
keeps track of people's IPs and search keywords, this likewise caused
concern. More prominently, when Google introduced their street view mode
of many Finnish cities in Google Maps, the Finnish government requested
a report from Google on what kind of measurements they were employing
to ensure that Finnish privacy laws were not compromised. (For instance,
it's illegal in Finland to publish comprehensive lists of photographs of
cars with their license plates visible; privacy laws are that strict
here.)

-- 
                                                          - Warp

Post a reply to this message

On 01/04/2012 01:42 PM, James Holsenback wrote:
> http://www.bbc.co.uk/news/uk-politics-17576745

So they're talking about allowing traffic analysis. No actual data 
content, just what you looked at and when.

It's rather worrying that anyone "official enough" would be able to 
browse through any data they want without needing a warrant. But beyond 
that, I suspect whoever suggested this doesn't quite comprehend the 
volume of data we're talking about here. The daft thing is, the 
technically sophisticated criminals these measures are purportedly 
supposed to catch will easily get around them, so it affects only naive 
innocent citizens.

I gather last time somebody proposed this, it didn't get very far due to 
massive opposition. I expect the same thing to happen with this one.

> http://www.whitehouse.gov/the-press-office/2011/12/31/statement-president-hr-1540

TL;DR.

> http://www.fastcompany.com/1826121/employers-want-your-facebook-password-now

Some employers are arseholes. Don't work for them.

If some employer wanted access to my personal data, I would simply 
refuse. If that means they don't hire me, that's their loss, not mine, IMHO.

Post a reply to this message

On 04/01/2012 09:40 AM, Orchid Win7 v1 wrote:
> On 01/04/2012 01:42 PM, James Holsenback wrote:
>> http://www.bbc.co.uk/news/uk-politics-17576745
>
> So they're talking about allowing traffic analysis. No actual data
> content, just what you looked at and when.
>
> It's rather worrying that anyone "official enough" would be able to
> browse through any data they want without needing a warrant. But beyond
> that, I suspect whoever suggested this doesn't quite comprehend the
> volume of data we're talking about here. The daft thing is, the
> technically sophisticated criminals these measures are purportedly
> supposed to catch will easily get around them, so it affects only naive
> innocent citizens.
>
> I gather last time somebody proposed this, it didn't get very far due to
> massive opposition. I expect the same thing to happen with this one.
>
>> http://www.whitehouse.gov/the-press-office/2011/12/31/statement-president-hr-1540
>>
>
> TL;DR.
>
>> http://www.fastcompany.com/1826121/employers-want-your-facebook-password-now

All this (the apparent trend) I find troubling.

> Some employers are arseholes. Don't work for them.
>
> If some employer wanted access to my personal data, I would simply
> refuse. If that means they don't hire me, that's their loss, not mine,
> IMHO.

Recently I applied for part time work at a local grocery ... walking 
distance, and hey a little extra cash right! They wanted a saliva test 
for heavens sake. I declined because I thought it was a bit extreme, and 
(not to mention) an invasion of my privacy. There's a BIG disconnect 
going on here! Average, normal ... or whatever you want to call them 
folks are getting walked all over.

Post a reply to this message

Orchid Win7 v1 <voi### [at] devnull> wrote:
> I suspect whoever suggested this doesn't quite comprehend the 
> volume of data we're talking about here.

  If there's anything positive that can be fathomed about email spam,
it's that its sheer amount (it broke the 50% mark of all email traversing
the internet long time ago) twharts any kind of comprehensive automatic
traffic analysis of email (or at least makes it impractical and expensive).

-- 
                                                          - Warp

Post a reply to this message

On 01/04/2012 2:40 PM, Orchid Win7 v1 wrote:
> On 01/04/2012 01:42 PM, James Holsenback wrote:
>> http://www.bbc.co.uk/news/uk-politics-17576745
>

>
> I gather last time somebody proposed this, it didn't get very far due to
> massive opposition. I expect the same thing to happen with this one.

Three hours after the article being posted there are ~ 1600 comments.

-- 
Regards
     Stephen

Post a reply to this message

On 4/1/2012 6:40 AM, Orchid Win7 v1 wrote:
>> http://www.fastcompany.com/1826121/employers-want-your-facebook-password-now
>>
>
> Some employers are arseholes. Don't work for them.
>
> If some employer wanted access to my personal data, I would simply
> refuse. If that means they don't hire me, that's their loss, not mine,
> IMHO.

Sadly, like the argument that American Libertarians fail to grasp, along 
with Tea Partiers, and a lot of Republicans, when it comes to economics, 
business practices, regulation, and buying politicians, the 
***biggest*** problem with this idea is that it only works until 
most/all of them are doing it.

The example I just used today was if the government wasn't allowed to 
regulate carnivals, so every carnival had prizes booths that cheated 
people, and it turned out that the number of the cheating just happened 
to be 100% of them. Going to a different booth isn't going to work, nor 
is going to a different carnival. But, according to the morons, the 
"free market", whether you are a buyer, or the guy trying to find a job, 
or you are worried someone might find that you read hustler, instead of 
playboy (or just read either), is supposed to somehow fix this, without 
someone else stepping in to stop them doing it.

Post a reply to this message

Le 2012-04-01 11:03, James Holsenback a écrit :
>
> Recently I applied for part time work at a local grocery ... walking
> distance, and hey a little extra cash right! They wanted a saliva test
> for heavens sake. I declined because I thought it was a bit extreme, and
> (not to mention) an invasion of my privacy. There's a BIG disconnect
> going on here! Average, normal ... or whatever you want to call them
> folks are getting walked all over.

In soviet Canuckistan, this is illegal.  They can only do drug testing 
ONCE you are employed and ONLY IF it pertains to your duties (e.g. 
airline pilot, heavy machinery operator, etc...)

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

On 02/04/2012 12:28 PM, Francois Labreque wrote:
>
> In soviet Canuckistan, this is illegal.  They can only do drug testing
> ONCE you are employed and ONLY IF it pertains to your duties (e.g.
> airline pilot, heavy machinery operator, etc...)

But they are good at Curling as Jim will know. ;-)

-- 
Regards
     Stephen

Post a reply to this message

On 04/02/2012 09:07 AM, Stephen wrote:
> On 02/04/2012 12:28 PM, Francois Labreque wrote:
>>
>> In soviet Canuckistan, this is illegal. They can only do drug testing
>> ONCE you are employed and ONLY IF it pertains to your duties (e.g.
>> airline pilot, heavy machinery operator, etc...)
>
> But they are good at Curling as Jim will know. ;-)
>

LOL ... yeah! Just like shuffleboard only substitute ice and a rock ;-)

Post a reply to this message

On 02/04/2012 4:53 PM, James Holsenback wrote:
> On 04/02/2012 09:07 AM, Stephen wrote:
>> On 02/04/2012 12:28 PM, Francois Labreque wrote:
>>>
>>> In soviet Canuckistan, this is illegal. They can only do drug testing
>>> ONCE you are employed and ONLY IF it pertains to your duties (e.g.
>>> airline pilot, heavy machinery operator, etc...)
>>
>> But they are good at Curling as Jim will know. ;-)
>>
>
> LOL ... yeah! Just like shuffleboard only substitute ice and a rock ;-)

Or shove ha’peny wi’ muckle boulders.

-- 
Regards
     Stephen

Post a reply to this message

On 4/1/2012 6:40, Orchid Win7 v1 wrote:
> suspect whoever suggested this doesn't quite comprehend the volume of data
> we're talking about here.

Uh, no, you realize all that traffic is already being examined and routed, 
right? It's not like google doesn't have 3 to 5 copies of the entire 
internet available in tenths of seconds to anyone in the world, you know?

It's only massive data if you don't automate it. That's why people in the 
USA get peeved when the supreme court decides that police affixing a GPS 
tracker to your car without telling you isn't any more intrusive than 
actually following you around while you drive.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

On 4/1/2012 8:43, Warp wrote:
> (it broke the 50% mark of all email traversing
> the internet long time ago)

It broke the 90% mark a long time ago.

 > twharts any kind of comprehensive automatic
> traffic analysis of email (or at least makes it impractical and expensive).

Classifying spam isn't difficult. It's just that ISPs don't want to carry 
10x as much email data as they need to, and it's hard to track down the source.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

On 4/5/2012 6:58 PM, Darren New wrote:
> On 4/1/2012 8:43, Warp wrote:
>> (it broke the 50% mark of all email traversing
>> the internet long time ago)
>
> It broke the 90% mark a long time ago.
>
>  > twharts any kind of comprehensive automatic
>> traffic analysis of email (or at least makes it impractical and
>> expensive).
>
> Classifying spam isn't difficult. It's just that ISPs don't want to
> carry 10x as much email data as they need to, and it's hard to track
> down the source.
>
They could go a long way by changing the protocol so you can't "fake" 
the source, and the tracking, with respect to how it got there, is kept, 
and correctly reported, so that, even if you changed the supposed start 
point, somehow, it would be more obvious that the source, as it 
traversed the network, wasn't the source being reported. Half the time 
email systems consider this information "inconvenient" and actually make 
it hard, or impossible, to even look at, never mind actually tell you 
that there is a discrepancy of any kind.

If the thing comes from a proxy, its obviously not from where ever it 
was sent from in reality. Might need some rules on whether its legal for 
the proxy itself to misrepresent itself as a) not in the chain, or b) a 
different source. But, once it leaves the proxy, there is still, in 
principle, a way to trace back the address, to the server it claims to 
come from, thereby finding that there is no way in hell the trace in the 
email's own path could match with the claimed source (but, that would 
require an automatic traceroute, and even doing that, from some 
machines, won't work in cases like Windows, where generating the packets 
needed in anything other than the control paths is **not allowed**, as a 
possible detected exploit, and where your ISP, modem, or something else, 
is denying those control commands).

But, yeah, its hardly "impossible" to at least figure out where the hell 
it comes from, and probably easier to use something like that, to ferret 
out new "bad" messages, than all the stupid assed, "Lets look at the 
content, then panic when legit mail contains X formating, and Y list of 
keywords!!!" Hotmail has flagged legit stuff on me, for example, once a 
week, at times, as "possibly dangerous", yet, at almost as much of a 
regular basis, it has failed to flag idiots trying to cell me viagra... 
And, while they suggest to leave the bad emails in there, to better 
handle new bad ones, if you have a good one end up in the trap, you can 
miss it in "page after page" of invalid ones, simply because having one 
good email, on the 50th page, or 800 actual spam messages... really 
isn't a viable solution. Its almost better, if you have fairly low 
volume, to turn the damn spam trap off, and just delete them yourself.

Post a reply to this message

> Classifying spam isn't difficult.

I've yet to see a single system which can do this reliably. Maybe one 
exists, but I haven't seen it.

> It's just that ISPs don't want to
> carry 10x as much email data as they need to, and it's hard to track
> down the source.

This.

Post a reply to this message

> They could go a long way by changing the protocol so you can't "fake"
> the source, and the tracking

Yeah, but that means a breaking change to the mail protocol.

Will. Not. Happen.

Heck, they invented a way to check that the source mail server is 
authorised to send mail, and large ISPs manage to screw that up.

(When receiving mail, you're supposed to look up the domain of the 
source server and check for an authorisation record in the DNS. 
Apparently some doofus thought it would be a good idea to also check the 
domain OF THE EMAIL ADDRESS - despite the RFC explicitly saying that you 
must not do this...)

Post a reply to this message

On 6-4-2012 6:52, Patrick Elliott wrote:
> On 4/5/2012 6:58 PM, Darren New wrote:
>> On 4/1/2012 8:43, Warp wrote:
>>> (it broke the 50% mark of all email traversing
>>> the internet long time ago)
>>
>> It broke the 90% mark a long time ago.
>>
>> > twharts any kind of comprehensive automatic
>>> traffic analysis of email (or at least makes it impractical and
>>> expensive).
>>
>> Classifying spam isn't difficult. It's just that ISPs don't want to
>> carry 10x as much email data as they need to, and it's hard to track
>> down the source.
>>
> They could go a long way by changing the protocol so you can't "fake"
> the source, and the tracking, with respect to how it got there, is kept,
> and correctly reported, so that, even if you changed the supposed start
> point, somehow, it would be more obvious that the source, as it
> traversed the network, wasn't the source being reported. Half the time
> email systems consider this information "inconvenient" and actually make
> it hard, or impossible, to even look at, never mind actually tell you
> that there is a discrepancy of any kind.

Often I receive mail that was not sent by the person that is in the 
from: line. Many people also get mail that claims to be sent by me. I 
even get myself mail sent by me often from places that I might wish to 
visit, but haven't done so yet.
What I never fully understood is if this is legal or not. I know it is 
easy to do, and hard to track down, but I would expect it to be illegal 
anyway. Anyone here knows?


-- 
tip: do not run in an unknown place when it is too dark to see the 
floor, unless you prefer to not use uppercase.

Post a reply to this message

> Often I receive mail that was not sent by the person that is in the
> from: line. Many people also get mail that claims to be sent by me. I
> even get myself mail sent by me often from places that I might wish to
> visit, but haven't done so yet.
> What I never fully understood is if this is legal or not. I know it is
> easy to do, and hard to track down, but I would expect it to be illegal
> anyway. Anyone here knows?

Sending an email is like sending a postcard; you write on one side who 
it's from, and on the other side who it's to. Most people write who it's 
/really/ from, but there's absolutely nothing to stop you pretending to 
be anybody you fancy. (Whether the recipient will believe you is another 
matter...) People seem to think because it's on a computer it must 
somehow be "secure", but it isn't.

Is it illegal? Well, is it illegal to send a postcard claiming to be 
from somebody it isn't?

Clearly trying to deceive somebody for financial gain is fraud, which is 
illegal no matter which way you try to do it. But is pretending to be 
somebody else illegal in itself? I don't know. (And I'd guess it varies 
by country anyway.)

Post a reply to this message

Le 2012-04-06 00:52, Patrick Elliott a écrit :
> On 4/5/2012 6:58 PM, Darren New wrote:
>> On 4/1/2012 8:43, Warp wrote:
>>> (it broke the 50% mark of all email traversing
>>> the internet long time ago)
>>
>> It broke the 90% mark a long time ago.
>>
>> > twharts any kind of comprehensive automatic
>>> traffic analysis of email (or at least makes it impractical and
>>> expensive).
>>
>> Classifying spam isn't difficult. It's just that ISPs don't want to
>> carry 10x as much email data as they need to, and it's hard to track
>> down the source.
>>
> They could go a long way by changing the protocol so you can't "fake"
> the source,

There are many webhosting services that also offer e-mail with their 
package.  In those cases, the source would always appear fake since the 
source would be "mailrelay.webhostingcompany.com" instead of 
"mail.francoispetgroomingservices.biz"

> and the tracking, with respect to how it got there, is kept,

It is.  Look at the "Received:" lines of the header.

> and correctly reported, so that, even if you changed the supposed start
> point, somehow, it would be more obvious that the source, as it
> traversed the network, wasn't the source being reported.

Internal RFC-1918 addressing and dicrepancies between internal DNS vs. 
public DNS names make this impossible.

As an outsider, how can you tell if fred.remoteoffice.mycompany 
(10.2.5.14) and pebbles.datacenter.mycompany (10.254.13.56) are valid 
sources without knowing the internal e-mail architecture of the company?

> Half the time
> email systems consider this information "inconvenient" and actually make
> it hard, or impossible, to even look at, never mind actually tell you
> that there is a discrepancy of any kind.
>
> If the thing comes from a proxy, its obviously not from where ever it
> was sent from in reality.

There's no such thing as a proxy in e-mail parlance.  Only mail relays. 
  And because most companies and ISPs try to limit the path that e-mails 
take to known and trusted sources, you can't get rid of them.

> Might need some rules on whether its legal for
> the proxy itself to misrepresent itself as a) not in the chain, or b) a
> different source.

How should a machine with an internal DNS name of 
pebbles.datacenter.mycompany and an IP address of 10.254.13.56 which 
gets natted by the outside firewall to 209.209.209.209 (and which 
resolves to mx.mycompany.com) represent itself?

> But, once it leaves the proxy, there is still, in
> principle, a way to trace back the address, to the server it claims to
> come from,

Not if the server is behind a firewall (which is should be), or if is 
used RFC-1918 IP addressing (which it should).

> thereby finding that there is no way in hell the trace in the
> email's own path could match with the claimed source (but, that would
> require an automatic traceroute, and even doing that, from some
> machines, won't work in cases like Windows, where generating the packets
> needed in anything other than the control paths is **not allowed**, as a
> possible detected exploit, and where your ISP, modem, or something else,
> is denying those control commands).
>

There are various tricks used by mail relays to try and assert the true 
identity of a mail-relay that contacts them, such as doing DNS lookups 
and reveser lookups to make sure they match the SMTP "HELO" command, 
verifying that the machine is a valid MX record for the domain it claims 
to represent, etc...  But as stated above, these can sometimes prevent 
valid e-mails from small businesses that don't have their own e-mail 
infrastructure from being delivered.

> But, yeah, its hardly "impossible" to at least figure out where the hell
> it comes from, and probably easier to use something like that, to ferret
> out new "bad" messages, than all the stupid assed, "Lets look at the
> content, then panic when legit mail contains X formating, and Y list of
> keywords!!!" Hotmail has flagged legit stuff on me, for example, once a
> week, at times, as "possibly dangerous", yet, at almost as much of a
> regular basis, it has failed to flag idiots trying to cell me viagra...
> And, while they suggest to leave the bad emails in there, to better
> handle new bad ones, if you have a good one end up in the trap, you can
> miss it in "page after page" of invalid ones, simply because having one
> good email, on the 50th page, or 800 actual spam messages... really
> isn't a viable solution. Its almost better, if you have fairly low
> volume, to turn the damn spam trap off, and just delete them yourself.

While it would potentially cut down on the phishing e-mails, even if you 
did manage to make sure that the source was real, there's no way to 
programatically determine if an e-mail that says "get viagra at 80% off" 
that comes from online.farmacia.cr is something you're interested in or not.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

On 4/5/2012 21:52, Patrick Elliott wrote:
> They could go a long way by changing the protocol so you can't "fake" the
> source, and the tracking, with respect to how it got there, is kept, and
> correctly reported,

It is, assuming that you don't have a corrupted routing node. The basic 
problem is getting everyone to switch to a brand new email protocol all at 
once, and getting everyone to support your tracking proposal.

The received-by header isn't something you can completely forge.

> so that, even if you changed the supposed start point,
> somehow, it would be more obvious that the source, as it traversed the
> network, wasn't the source being reported. Half the time email systems
> consider this information "inconvenient" and actually make it hard, or
> impossible, to even look at, never mind actually tell you that there is a
> discrepancy of any kind.

Nah. The received-by headers are always carried along in the email. They're 
just not that useful because they weren't secure from the beginning, so if 
you reject all mail from insecure mail exchanges, you'll cut people off.

> If the thing comes from a proxy, its obviously not from where ever it was
> sent from in reality. Might need some rules on whether its legal for the
> proxy itself to misrepresent itself as a) not in the chain, or b) a
> different source. But, once it leaves the proxy, there is still, in
> principle, a way to trace back the address, to the server it claims to come
> from, thereby finding that there is no way in hell the trace in the email's
> own path could match with the claimed source (but, that would require an
> automatic traceroute, and even doing that, from some machines, won't work in
> cases like Windows, where generating the packets needed in anything other
> than the control paths is **not allowed**, as a possible detected exploit,
> and where your ISP, modem, or something else, is denying those control
> commands).

I don't think you understand how internet email routing works.

> But, yeah, its hardly "impossible" to at least figure out where the hell it
> comes from,

It really is, if you want to do it reliably without breaking all email 
systems currently deployed.

> and probably easier to use something like that, to ferret out
> new "bad" messages,

Sure. You first. Just reject all email that doesn't come from your new 
protocol, and see how that works out for you.

> Its almost better, if you
> have fairly low volume, to turn the damn spam trap off, and just delete them
> yourself.

Annnnnd... you just answered your own question. The system has to be as 
reliable as the delivery is in the first place.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

On 4/6/2012 2:11 AM, Orchid Win7 v1 wrote:
>> They could go a long way by changing the protocol so you can't "fake"
>> the source, and the tracking
>
> Yeah, but that means a breaking change to the mail protocol.
>
> Will. Not. Happen.
>
> Heck, they invented a way to check that the source mail server is
> authorised to send mail, and large ISPs manage to screw that up.
>
> (When receiving mail, you're supposed to look up the domain of the
> source server and check for an authorisation record in the DNS.
> Apparently some doofus thought it would be a good idea to also check the
> domain OF THE EMAIL ADDRESS - despite the RFC explicitly saying that you
> must not do this...)
Uh.. Why would that make any sense, I mean other than the possibility 
that some moron would use a domain that didn't have a record at all, and 
thus generate, "Yep, absolutely a complete fake!" Still, if you do check 
both, and the two being checked do not come back with the same 
information, that is also a sign there is something wrong, its just.. I 
really doubt, from your comment, that they did that, instead of 
something much stupider. lol

Post a reply to this message

On 4/7/2012 5:36 AM, Francois Labreque wrote:
> Le 2012-04-06 00:52, Patrick Elliott a écrit :
>> On 4/5/2012 6:58 PM, Darren New wrote:
>>> On 4/1/2012 8:43, Warp wrote:
>>>> (it broke the 50% mark of all email traversing
>>>> the internet long time ago)
>>>
>>> It broke the 90% mark a long time ago.
>>>
>>> > twharts any kind of comprehensive automatic
>>>> traffic analysis of email (or at least makes it impractical and
>>>> expensive).
>>>
>>> Classifying spam isn't difficult. It's just that ISPs don't want to
>>> carry 10x as much email data as they need to, and it's hard to track
>>> down the source.
>>>
>> They could go a long way by changing the protocol so you can't "fake"
>> the source,
>
> There are many webhosting services that also offer e-mail with their
> package. In those cases, the source would always appear fake since the
> source would be "mailrelay.webhostingcompany.com" instead of
> "mail.francoispetgroomingservices.biz"
>
>> and the tracking, with respect to how it got there, is kept,
>
> It is. Look at the "Received:" lines of the header.
>
>> and correctly reported, so that, even if you changed the supposed start
>> point, somehow, it would be more obvious that the source, as it
>> traversed the network, wasn't the source being reported.
>
> Internal RFC-1918 addressing and dicrepancies between internal DNS vs.
> public DNS names make this impossible.
>
> As an outsider, how can you tell if fred.remoteoffice.mycompany
> (10.2.5.14) and pebbles.datacenter.mycompany (10.254.13.56) are valid
> sources without knowing the internal e-mail architecture of the company?
>
Hmm. Yeah, there is that. In theory, this isn't as big an issue with 
IPv6, since, in principle, every single device, not just IP connection, 
could have its own unique identifier. You could even use MAC for that, 
only.. some people got the idea that you should be allowed to screw with 
those too, so again... Sigh..

In any case, I am not talking about a "complete" solution, just one that 
is marginally less stupid than the ones in existence. Sure, a few "small 
businesses" might look bad, but what would you rather get, 500 different 
emails from 10.254.23.1, each one with a different domain name, or the 
ability to mask out ones that go through 2 other "external" IPs, which 
you can surmise makes it a probable fraud, and only have to look at 1-2 
emails that come from similar locations.

For the most part, unless something goes **very** wrong in a network, or 
a major change happens to its morphology, its not just the endpoint that 
can be used to figure where it came from.

Instead of even an attempt at a smart solution, what we get is clients 
that hide the routing information, and let the scammers add 
"http://www.wellsfargo.com/accounts" to the "mouse over" for all the 
damn links, so that you either a) copy and paste that (it doesn't copy 
the real address under it), and end up at the legit point, of you click 
the link, and end up at "wells.fargo.scam.robyoublind.ru". In other 
words, the ***EXACT OPPOSITE*** of better security, and threat 
identification.

Post a reply to this message

On 4/7/2012 2:56 PM, Darren New wrote:
>> If the thing comes from a proxy, its obviously not from where ever it was
>> sent from in reality. Might need some rules on whether its legal for the
>> proxy itself to misrepresent itself as a) not in the chain, or b) a
>> different source. But, once it leaves the proxy, there is still, in
>> principle, a way to trace back the address, to the server it claims to
>> come
>> from, thereby finding that there is no way in hell the trace in the
>> email's
>> own path could match with the claimed source (but, that would require an
>> automatic traceroute, and even doing that, from some machines, won't
>> work in
>> cases like Windows, where generating the packets needed in anything other
>> than the control paths is **not allowed**, as a possible detected
>> exploit,
>> and where your ISP, modem, or something else, is denying those control
>> commands).
>
> I don't think you understand how internet email routing works.
>
In principle, it works like any other protocol, but, in principle, the 
message grows as it goes through each node, since it tracks where its 
been. Its also possible to route it specifically, but that is *way* over 
most people's heads.

>> But, yeah, its hardly "impossible" to at least figure out where the
>> hell it
>> comes from,
>
> It really is, if you want to do it reliably without breaking all email
> systems currently deployed.
>

That is what exceptions are for. You might still have to check the trap, 
but it would be a "slightly" smarter trap. Right now, the trap tries to 
rely on blacklist data, and keyword identification, using programs that 
are, fundamentally, quite stupid (as in not even using halfway decent 
AI, which might have some limited capacity to guess whether the word 
viagra is someone trying to sell it to you, or your friend, telling you 
about needing to go to the hospital, because they took too much of it. 
All the program knows is "viagra", and if a few other words are there, 
its flagged, hence the moronic fact that those slip through, while 
Hotmail has **multiple** times actually flagged legit emails Origin, 
about things going on with Star Wars: KOTOR.

 From a human perspective, that the later seems to be a possibly threat, 
while the former changes less than 1-2 words, between emails, but always 
makes it through the filters, is just... WTF?

Post a reply to this message

On 4/7/2012 20:29, Patrick Elliott wrote:
> but what would you rather get, 500 different
> emails from 10.254.23.1, each one with a different domain name,

You mean, like, google app hosting?

> or the
> ability to mask out ones that go through 2 other "external" IPs, which you
> can surmise makes it a probable fraud, and only have to look at 1-2 emails
> that come from similar locations.

How do you tell there are 500 different emails each with a different domain 
name without looking at them?

> For the most part, unless something goes **very** wrong in a network, or a
> major change happens to its morphology, its not just the endpoint that can
> be used to figure where it came from.

And it isn't. The ISPs do it too. It's just a lot of overhead for small ISPs.

> Instead of even an attempt at a smart solution, what we get is clients that
> hide the routing information, and let the scammers add
> "http://www.wellsfargo.com/accounts" to the "mouse over" for all the damn
> links, so that you either a) copy and paste that (it doesn't copy the real
> address under it), and end up at the legit point, of you click the link, and
> end up at "wells.fargo.scam.robyoublind.ru". In other words, the ***EXACT
> OPPOSITE*** of better security, and threat identification.

None of which has anything to do with where email originated from.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

On 4/7/2012 20:36, Patrick Elliott wrote:
> On 4/7/2012 2:56 PM, Darren New wrote:
>>> If the thing comes from a proxy, its obviously not from where ever it was
>>> sent from in reality. Might need some rules on whether its legal for the
>>> proxy itself to misrepresent itself as a) not in the chain, or b) a
>>> different source. But, once it leaves the proxy, there is still, in
>>> principle, a way to trace back the address, to the server it claims to
>>> come
>>> from, thereby finding that there is no way in hell the trace in the
>>> email's
>>> own path could match with the claimed source (but, that would require an
>>> automatic traceroute, and even doing that, from some machines, won't
>>> work in
>>> cases like Windows, where generating the packets needed in anything other
>>> than the control paths is **not allowed**, as a possible detected
>>> exploit,
>>> and where your ISP, modem, or something else, is denying those control
>>> commands).
>>
>> I don't think you understand how internet email routing works.
>>
> In principle, it works like any other protocol,

Generally not. There's still store-and-forward nodes, POP nodes, etc. And 
indeed, not that long ago, UUCP nodes, bitnet nodes, TPC nodes, and etc.

> but, in principle, the
> message grows as it goes through each node, since it tracks where its been.

Yes, and generally that works, as long as you realize any initial subset of 
routing hops could be forged.

> That is what exceptions are for. You might still have to check the trap, but
> it would be a "slightly" smarter trap. Right now, the trap tries to rely on
> blacklist data, and keyword identification,

If you want to do it at the ISP level, you can't really do a very good job 
of keyword matching. Maybe you really *do* buy your viagra from an online 
pharmacy. How do you check the trap if some other ISP has thrown away the 
email before it even gets to you?

> "viagra", and if a few other words are there, its flagged, hence the moronic
> fact that those slip through, while Hotmail has **multiple** times actually
> flagged legit emails Origin, about things going on with Star Wars: KOTOR.

And that's the point. For 99.9% of the population, those keywords indicate 
spam. For the 0.1% playing KOTOR, it does not. Hence, the ISP has to process 
each mail message just in case.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

On 4/8/2012 8:59 AM, Darren New wrote:
>> Instead of even an attempt at a smart solution, what we get is clients
>> that
>> hide the routing information, and let the scammers add
>> "http://www.wellsfargo.com/accounts" to the "mouse over" for all the damn
>> links, so that you either a) copy and paste that (it doesn't copy the
>> real
>> address under it), and end up at the legit point, of you click the
>> link, and
>> end up at "wells.fargo.scam.robyoublind.ru". In other words, the ***EXACT
>> OPPOSITE*** of better security, and threat identification.
>
> None of which has anything to do with where email originated from.
>
Well, no, but its part and parcel to the same bloody problem of figuring 
out what you are looking at, and who sent it. If you can't tell who the 
real sender was, you can't tell what route it took to get to you, and 
all "visible" signs of where the links in it point to seem to be places 
that you expect them to, if it was real... Basically 100% of it is 
stacked against you. If you are lucky, your ISP has a halfway decent 
filter, if you are not, you may be screwed.

Its gotten to the point where, if a company actually has a legit reason 
to contact you, with anything other than product advertisements, you 
can't trust it, unless its a phone call, or they provide an "on their 
site" method of messaging you, and even then, someone could scam you by 
saying, "The is a new message for you at Blah.com, click here to log in 
and read it.", and your still screwed. Using email doesn't require 
healthy paranoia anymore, it requires the real world equivalent of 
locking all the doors, and hiding under the bed, until the guy knocking 
goes away, then going around to every place that might have sent someone 
to talk to you, personally, to see if they sent someone to do so. Or 
worse, yelling at the legit guy from the phone company, because he is 
wearing the wrong color shirt, and your neighbor warned you that someone 
wearing that color shirt was robbing houses (the equivalent of the 
filter falsely marking something legit, and not letting you even look at 
it, to make sure). After all, the guy claiming to be from the phone 
company might have intended to rob you... And, that is just a bloody 
nuts way to live, yet its how we have to deal with anything "official 
looking" in email, if the filters don't trap it, or they do, and 
shouldn't have.

It annoys the hell out of me. Heck, Firebird just did it to me today, 
and don't even know why the hell it marked two messages from blogs as 
spam, other than that its a bit more convoluted to tell Firebird, unlike 
Hotmail, to leave shit alone 'period', if it comes from certain email 
addresses.

Post a reply to this message

On 4/8/2012 9:03 AM, Darren New wrote:
>> That is what exceptions are for. You might still have to check the
>> trap, but
>> it would be a "slightly" smarter trap. Right now, the trap tries to
>> rely on
>> blacklist data, and keyword identification,
>
> If you want to do it at the ISP level, you can't really do a very good
> job of keyword matching. Maybe you really *do* buy your viagra from an
> online pharmacy. How do you check the trap if some other ISP has thrown
> away the email before it even gets to you?
>
Actually, it is done on the ISP level, but its shoved into the "spam" 
folder, when things work right. The problem is, it almost never works 
right. lol

>> "viagra", and if a few other words are there, its flagged, hence the
>> moronic
>> fact that those slip through, while Hotmail has **multiple** times
>> actually
>> flagged legit emails Origin, about things going on with Star Wars: KOTOR.
>
> And that's the point. For 99.9% of the population, those keywords
> indicate spam. For the 0.1% playing KOTOR, it does not. Hence, the ISP
> has to process each mail message just in case.
>
Actually, like most of the "false positives" the criteria going on isn't 
just keywords, its in certain combinations, with some crazy assed 
heuristic, which results it in not being so much as flagged "spam" as, 
"We detected, for no apparent reason, that this might be a threat, so we 
won't even show you the plain text, you have to explicitly say you want 
to see **the whole thing**." Umm, OK... But then, in other cases, you 
let me see enough of the plain text to see whether or not you falsely 
marked it, then let me tell you if its spam, or not. So, why the hell 
the difference?

In other words, "Possible real spam = we will let you tell us if it was 
or not", but, "Possible, non-existent threat = we won't even let you see 
it, until you decide to risk what ever threat we imagined existed, and 
then, if it isn't one, we won't let you tell us to stop doing it, over 
and over again, like we would with mere spam." :head-desk:

Makes no damn sense to me. If it wasn't a threat last time, how the hell 
is it next time, and why in bloody heck... Oh, wait, this is Microsoft, 
so they probably added their email equivalent of, "Are you sure you want 
program.exe to actually do anything?", to the bloody service... lol

Post a reply to this message

On 4/8/2012 13:05, Patrick Elliott wrote:
> Well, no, but its part and parcel to the same bloody problem of figuring out
> what you are looking at, and who sent it.

It's easy to tell what you're looking at. You already have it.

It's impossible to tell who it is from, except in a fairly abstract way like 
"at least one of the people who ought to be keeping their private key 
private has sent this."

> Its gotten to the point where, if a company actually has a legit reason to
> contact you, with anything other than product advertisements, you can't
> trust it, unless its a phone call, or they provide an "on their site" method
> of messaging you, and even then, someone could scam you by saying, "The is a
> new message for you at Blah.com, click here to log in and read it.", and
> your still screwed.

This isn't a new problem. The only reason it gets attention now is that it's 
trivially easy to do this sort of phishing on a grand scale. But it's not 
different than any of the other con games played throughout history.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

On 4/8/2012 3:20 PM, Darren New wrote:
> On 4/8/2012 13:05, Patrick Elliott wrote:
>> Well, no, but its part and parcel to the same bloody problem of
>> figuring out
>> what you are looking at, and who sent it.
>
> It's easy to tell what you're looking at. You already have it.
>
> It's impossible to tell who it is from, except in a fairly abstract way
> like "at least one of the people who ought to be keeping their private
> key private has sent this."
>
If it was that trivial, people wouldn't keep falling for it. Just saying.

Post a reply to this message

On 4/9/2012 13:42, Patrick Elliott wrote:
> On 4/8/2012 3:20 PM, Darren New wrote:
>> On 4/8/2012 13:05, Patrick Elliott wrote:
>>> Well, no, but its part and parcel to the same bloody problem of
>>> figuring out
>>> what you are looking at, and who sent it.
>>
>> It's easy to tell what you're looking at. You already have it.
>>
>> It's impossible to tell who it is from, except in a fairly abstract way
>> like "at least one of the people who ought to be keeping their private
>> key private has sent this."
>>
> If it was that trivial, people wouldn't keep falling for it. Just saying.

You misunderstand. It's easy to look at an email message and tell what it 
says. It's very hard to look at an email message and tell what human it's 
from. That latter part is the primary cause of people "falling for it." If 
you could solve the latter problem, the former problem would drop to 
background radiation levels.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

On 4/10/2012 5:48 PM, Darren New wrote:
> On 4/9/2012 13:42, Patrick Elliott wrote:
>> On 4/8/2012 3:20 PM, Darren New wrote:
>>> On 4/8/2012 13:05, Patrick Elliott wrote:
>>>> Well, no, but its part and parcel to the same bloody problem of
>>>> figuring out
>>>> what you are looking at, and who sent it.
>>>
>>> It's easy to tell what you're looking at. You already have it.
>>>
>>> It's impossible to tell who it is from, except in a fairly abstract way
>>> like "at least one of the people who ought to be keeping their private
>>> key private has sent this."
>>>
>> If it was that trivial, people wouldn't keep falling for it. Just saying.
>
> You misunderstand. It's easy to look at an email message and tell what
> it says. It's very hard to look at an email message and tell what human
> it's from. That latter part is the primary cause of people "falling for
> it." If you could solve the latter problem, the former problem would
> drop to background radiation levels.
>
Yep, that is the issue, definitely.

Post a reply to this message

On 4/1/2012 7:42 AM, James Holsenback wrote:
> http://www.bbc.co.uk/news/uk-politics-17576745
>
> http://www.whitehouse.gov/the-press-office/2011/12/31/statement-president-hr-1540
>
>
> http://www.fastcompany.com/1826121/employers-want-your-facebook-password-now
>
>
> Boy the more I read stories like this, the more I'm convinced that
> privacy and personal freedom is a thing of the past. Governments and now
> employers seem to be marching lock step, and arm in arm all over things
> that up until /were/ deemed scared. Why don't they just go ahead and
> implant a chip in our necks and be done with it :-(

When I sign up for an on-line service, many of them specifically require 
that I keep my password confidential from all other parties.  This user 
agreement is a binding contract.

I am wondering whether any jurisdictions permit an employer to require 
an applicant to breach a contract as a condition of employment.  That is 
probably illegal in many places.

Regards,
John

Post a reply to this message

On 5/22/2012 5:26 PM, John VanSickle wrote:
>
> When I sign up for an on-line service, many of them specifically require
> that I keep my password confidential from all other parties. This user
> agreement is a binding contract.
>
> I am wondering whether any jurisdictions permit an employer to require
> an applicant to breach a contract as a condition of employment. That is
> probably illegal in many places.
>

I'm sort of waiting for a company to get sued for exactly this reason.

Post a reply to this message

On 23/05/2012 02:33 AM, Kevin Wampler wrote:

> I'm sort of waiting for a company to get sued for exactly this reason.

Because that, apparently, is how the law works. The result of one court 
case determines what the law is, and until that court case happens, the 
law is undefined.

And here I was thinking that the law-makers define the law...

Post a reply to this message

On Wed, 23 May 2012 09:08:11 +0100, Invisible wrote:

> On 23/05/2012 02:33 AM, Kevin Wampler wrote:
> 
>> I'm sort of waiting for a company to get sued for exactly this reason.
> 
> Because that, apparently, is how the law works. The result of one court
> case determines what the law is, and until that court case happens, the
> law is undefined.
> 
> And here I was thinking that the law-makers define the law...

Lawmakers define law.  The courts interpret it - and sometimes interpret 
it to mean something other than what the lawmakers wrote it to mean.

Jim

Post a reply to this message

Le 23/05/2012 17:28, Jim Henderson a écrit :
> On Wed, 23 May 2012 09:08:11 +0100, Invisible wrote:
> 
>> On 23/05/2012 02:33 AM, Kevin Wampler wrote:
>>
>>> I'm sort of waiting for a company to get sued for exactly this reason.
>>
>> Because that, apparently, is how the law works. The result of one court
>> case determines what the law is, and until that court case happens, the
>> law is undefined.
>>
>> And here I was thinking that the law-makers define the law...
> 
> Lawmakers define law.  The courts interpret it - and sometimes interpret 
> it to mean something other than what the lawmakers wrote it to mean.
> 
> Jim


Lawmakers define law, for reasonnable people.
Courts have to deal with perverts that seek and abuse holes in the
letter of the law. So, they must pave the void in the law with
interpretation.

What if... a law stated :"storing an apple is the right of any citizen
in town."

reasonnable people might have at home an apple or some pounds of them.

But perverts might make a business of storing hundred of tons of apples
at a common place.

Now the issue is that apples would expell ethylen gaz as part of their
aging. one apple is fine, but too many in a not-ventilated room.. there
is a fire-hazard... the court has to state about that: the law says
storing of apple is ok, but maybe large storing of apple need a bit of
regulation, or not.

Post a reply to this message

> Lawmakers define law.  The courts interpret it - and sometimes interpret
> it to mean something other than what the lawmakers wrote it to mean.

Interestingly, I have some experience in this direction.

Under lab regulations, you have to have written procedures for certain 
things. Once you write such a procedure, it becomes a "law" as such. If 
you don't follow that procedure, hypothetically you could go to jail. 
[Although that's rather unlikely in practise.]

Before the procedure goes into effect, it has to go through a long 
convoluted bureaucratic collaboration and approval process. But once the 
procedure is "issued", it becomes law. Whatever the procedure says, 
that's what you have to do.

Usually this isn't a problem. The problems start when some unusual 
circumstance that the procedure writer hadn't considered occurs. Then 
you get people standing around scratching their heads and interpreting 
the hell out of the actual written text of the procedure.

You would think that in the event of an unusual circumstance, the 
scientists running the experiment would be expected to use their best 
judgement to determine the most scientifically sound course of action. 
You would be wrong. Instead, the scientists are required to blindly 
follow the procedure document, no matter how stupid that is. The 
impetus, then, is on the procedure writers to write procedures which 
take into account every possible unusual circumstance that could ever 
occur in the history of civilisation.

OTOH, nobody tries to subvert procedures "on purpose". I gather people 
actually do that with laws. ;-)

Post a reply to this message

> What if... a law stated :"storing an apple is the right of any citizen
> in town."
>
> reasonnable people might have at home an apple or some pounds of them.

The same in UK law about red traffic lights.  It a specific offence to 
cross the line on the road next to a traffic light if it is showing red. 
  But there is no specific definition of "cross", eg what if you were 
half over it as the red light came on, what if you drove around the side 
of it (to avoid physically crossing the line), what if you are crossing 
the line on red to allow an emergency vehicle to continue on its way, 
does rolling the front two wheels over the line count, etc.

It would be a big waste of time (and almost impossible) to write every 
single law in enough detail to cover every single possibility.  In 
fringe cases the court is there to interpret and enforce what it 
considers the purpose/intention of the law.

Post a reply to this message

On 24/05/2012 01:56 PM, scott wrote:

> It would be a big waste of time (and almost impossible) to write every
> single law in enough detail to cover every single possibility. In fringe
> cases the court is there to interpret and enforce what it considers the
> purpose/intention of the law.

And here I was thinking that the lawyers are paid to interpret the law 
in whatever way makes their rich client Not Guilty...

Post a reply to this message

>> It would be a big waste of time (and almost impossible) to write every
>> single law in enough detail to cover every single possibility. In fringe
>> cases the court is there to interpret and enforce what it considers the
>> purpose/intention of the law.
>
> And here I was thinking that the lawyers are paid to interpret the law
> in whatever way makes their rich client Not Guilty...

Of course having better lawyers than the other side helps, especially in 
complex cases.

Post a reply to this message

scott <sco### [at] scottcom> wrote:
> Of course having better lawyers than the other side helps, especially in 
> complex cases.

  Screw the rules, I have money!

-- 
                                                          - Warp

Post a reply to this message

Le 2012-05-25 03:51, Warp a écrit :
> scott<sco### [at] scottcom>  wrote:
>> Of course having better lawyers than the other side helps, especially in
>> complex cases.
>
>    Screw the rules, I have money!
>
That's the Golden rule.  He who has the gold, makes the rules.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

Francois Labreque <fla### [at] videotronca> wrote:
> Le 2012-05-25 03:51, Warp a écrit :
> > scott<sco### [at] scottcom>  wrote:
> >> Of course having better lawyers than the other side helps, especially in
> >> complex cases.
> >
> >    Screw the rules, I have money!
> >
> That's the Golden rule.  He who has the gold, makes the rules.

  And history is written by the victors.

-- 
                                                          - Warp

Post a reply to this message

On 5/25/2012 6:35 AM, Warp wrote:
>
>    And history is written by the victors.
>

Specifically by Victor Ehrenberg and Victor Davis Hanson, among others.

Post a reply to this message

On 5/23/2012 8:28, Jim Henderson wrote:
> Lawmakers define law.  The courts interpret it - and sometimes interpret
> it to mean something other than what the lawmakers wrote it to mean.

Or they often have to interpret it to decide whether a particular case is 
covered. (Hence the term "case law".)

For example: The carpool lane can only be used by a car with at least two 
passengers. Does a hearse with a driver and a dead body count? Does a woman 
8 months pregnant count?

Or, from an Oracle/Google point of view, can you copyright an API?

The lawmakers can pass new laws to override cases that got decided in a way 
they didn't like, if they want, so yes, the lawmakers make the laws.

-- 
Darren New, San Diego CA, USA (PST)
   "Oh no! We're out of code juice!"
   "Don't panic. There's beans and filters
    in the cabinet."

Post a reply to this message

Le 2012-05-26 22:05, Darren New a écrit :
> On 5/23/2012 8:28, Jim Henderson wrote:
>> Lawmakers define law. The courts interpret it - and sometimes interpret
>> it to mean something other than what the lawmakers wrote it to mean.
>
> Or they often have to interpret it to decide whether a particular case
> is covered. (Hence the term "case law".)
>
> For example: The carpool lane can only be used by a car with at least
> two passengers. Does a hearse with a driver and a dead body count? Does
> a woman 8 months pregnant count?

If the 8-month pregnant woman qualifies for using the carpool lane, she 
can also be fined for driving with a child on her lap.



-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

On Mon, 28 May 2012 08:25:36 -0400, Francois Labreque wrote:

> If the 8-month pregnant woman qualifies for using the carpool lane, she
> can also be fined for driving with a child on her lap.

Technically the child isn't on her lap.

Jim

Post a reply to this message

Le 2012-05-28 14:33, Jim Henderson a écrit :
> On Mon, 28 May 2012 08:25:36 -0400, Francois Labreque wrote:
>
>> If the 8-month pregnant woman qualifies for using the carpool lane, she
>> can also be fined for driving with a child on her lap.
>
> Technically the child isn't on her lap.
>
> Jim

In my province, a child has to be in a car seat until he or she is 63cm 
(25in) from the seat to the top of the head, so she could still be fined 
for having an unrestrained kid in the car.

Also, she still can't use the car pool lane has you have to have two (in 
some cases three) people of driving age to be able to use it.  The goal 
is to reduce the number of cars on the roads.  An infant can't drive a 
car by herself, therefore her mom does not qualify to use the carpool 
lane, as the baby's presence has no bearing on the number of cars used 
by that family.

-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message

On Tue, 29 May 2012 08:24:41 -0400, Francois Labreque wrote:

> In my province, a child has to be in a car seat until he or she is 63cm
> (25in) from the seat to the top of the head, so she could still be fined
> for having an unrestrained kid in the car.

It's not like she can take the kid out and place it in a child safety 
seat.

> Also, she still can't use the car pool lane has you have to have two (in
> some cases three) people of driving age to be able to use it.  The goal
> is to reduce the number of cars on the roads.  An infant can't drive a
> car by herself, therefore her mom does not qualify to use the carpool
> lane, as the baby's presence has no bearing on the number of cars used
> by that family.

Yes, and that is something that IMHO makes sense.  But if the law doesn't 
specify that, then generally the cops aren't going to pull someone over 
(especially as most cops really dislike having to do paperwork) unless 
the situation is particularly egregious.

Seeing one person in the car would be such a situation for a cop on 
enforcement duty for a HOV lane.

Jim

Post a reply to this message

On 28/05/2012 07:33 PM, Jim Henderson wrote:
> On Mon, 28 May 2012 08:25:36 -0400, Francois Labreque wrote:
>
>> If the 8-month pregnant woman qualifies for using the carpool lane, she
>> can also be fined for driving with a child on her lap.
>
> Technically the child isn't on her lap.

Kids on the backseat cause accidents.

Accidents on the backseat cause kids.

Post a reply to this message