Pretty sure those folks are just using a digital press and sending things out w/ a bar-coded envelope w/ printed indicia --- as noted in the article, it was the letterpress aspect which set this apart.
Well, sure. But GP says “this type of service” which is indeed available. The exact service would be outrageously expensive, and too few customers would buy at the required prices.
In SAML you sign a (potentially attacker controlled) subset after normalization. So a lot of saml bugs come down to the attacker adding things that aren't covered by the signature. Sometimes this means appending or prepending stuff, but my favourite is adding comments which can alter the interpretation of the xml document (as it splits text nodes) but doesn't alter the signature.
It’s XML, so the signature inside the document somewhere and signs some other part of the document by reference.
You would be shocked (or, if you’re in the security space at all, not even remotely shocked) to learn that a comical number of SAML implementations verified the signature and then just treated the whole doc as if it was trusted, even if the signed part had nothing to do with the document as a whole.
Reminds me of a similar attack on PGP/MIME/HTML where you'd put <a href="http://evil.example/ in front of the PGP message.
Email's in a bad situation with regards to this because every intermediate server is expected to mangle the message and the headers, so the only way to consistently sign something is to make it a marked up encoded block the way PGP does.
In a JWT this is simple, the signature checks the entire sig and data sections. In XML signatures it checks whatever it says it checks, a list of URIs, which may also be transformed.
So it is possible to have an XML signature that points to an element that does not include some important piece of data.
Given the size of the US, and the variety of local populations, I argue that local enforcement is necessary. Adherence to larger enforcement standards is also necessary. I fear that larger, “cohesive” enforcement runs the risk of bringing more political laws and regulations from other jurisdictions. No one wants to be subjected to some remote jurisdiction’s idea of “lawfulness” especially when religious ideals get mixed in.
> Given the size of the US, and the variety of local populations, I argue that local enforcement is necessary. Adherence to larger enforcement standards is also necessary.
In Canada, Ontario and Quebec have their own province-level police forces, but the rest of the provinces 'contract' the RCMP to do street-level policing in many areas (with larger municipalities having their own forces). Part of the reason for this is that with any organization there's overhead (training, HR, payroll/pensions, etc), and for smaller communities a larger portion of a fixed budget would go to those things, so by leveraging the RCMP those fixed costs are amortized wider.
In Ontario/Quebec, many smaller communities use the OPP/QPP for local policing (larger cities have their own forces) for the same reason.
For the community in the article, is there a reason why the same 5 cops couldn't become employees of the county's force? For really small counties, it may be necessary / useful to 'contract' the state police to run a local detachment.
I agree with this. It may be reasonable for a town to have its own PD if they can afford it and choose to have one, but certain levels of training and evidence collection and ethical standards should be set at the state level or higher.
Well, how fine grained do we need to get? A police force with 5 officers is pretty fine. In this case law enforcement is being taken over by the county (of which there are 254 in Texas) so its still pretty local.
As always: it depends. There are many municipalities throughout the US that are content with (or can only afford) county-level enforcement. If their residents want something more localized, they need to do what it takes to create that.
In this case, what’s happened is fine. Leaving it up to local residents and their local government to form a new trustworthy enforcement agency is fine. Leaving it up to them to not do that is also fine.
Wouldn't you want more data to learn if its "fine" vs "not fine"? If you learned that small departments were significantly worse than larger ones on use of force, corruption, etc wouldn't that inform a decision?
There is a pattern where elective democracy does not work, or at least gets weird at small scales like this. Small pool to elect from, only need to win over a modest number of people, etc.
Why is it so ridiculous that the state can provide police where and when they're needed, and it's only when you have a sufficiently robust metropolitan area that can afford their own police force that you then have "local" cops?
Or are we all about locally-sourced, artisanal law enforcement now?
These two (and many others) are well within management’s purview.
> … there's nothing a manager can do … [emphasis added]
Right, but Management (capitalized and plural) can. A manager should report, and management should fix - if not, it’s management’s fault.
reply