Slashdot Mirror

There is more information at the project website.

The Institute for Security Technology Studies is based there: http://www.ists.dartmouth.edu/

I remember ABC TV's logo getting the Mickey ears on the day Disney acquired them. If Apple takes over Disney, I somehow envision this happening:

http://www.dartmouth.edu/~wgst60/projects/chicago/ Final%20Project_natalia_files/image010.jpg

Anti-market means reductions in economic freedom. There have been plenty of research like this one, and the results are pretty clear: economic freedom combined with well-functioning institutions enhance economic growth.

It is easier for institutions to be well-functioning with economic freedom, as there is less opportunity for corruption in obtaining industrial licenses, etc.

In the west, we abolished child labor around 1900 when our economies had risen to the point where we could go beyond farming and we could afford to invest the human capital in teaching children more than basic skills. Most of the developing world has not reached this level (or even the GDP per capita of the US in 1900).

Research shows that economic growth is the most sure way to end child labor. Artificially trying to end child labor before an economy is ready is bound to fail. There are plenty of devloping countries with child labor laws on the books, yet children still work there illegally because poverty is high and it is better than them starving.

Labor regulations that are premature (given the existing economy in a country) will fail in large part as well as reduce economic growth by pushing production into the illegal informal sector and also encourage corruption.

Economic growth enhances wealth and allows for people to move up the chain of human capital to the point where saftey and obtaining skilled education can actually pay off.

The problem is that as a result physicists really, really like very elegant theories when there's no particular reason to believe that the Universe itself has the same bias.

We may not have any reason to believe that the Universe is elegant, but we also have no reason to believe that it isn't. So when we find that two very simple and elegant theories (QM and GR) describe so many of our observations, who are we to say the Universe can't be simple and elegant?

Personally, I'm offended that so many lay people "don't believe" in dark matter. Just because we humans can only experience EM interactions (i.e. see, feel, smell, hear) why must everything in the Universe interact with photons?

Our current theory (QM+GR) has certain deficiencies in explaining our observations. Adding "dark matter" fixes many of them, no other theory (including modified exponents rather than good-ol' inverse-square for gravity) does as well. Therefore, until something better -- something that can do a better job of explaining so many things (galactic rotation, cosmic background radiation, galactic collisions) as well -- comes along, dark matter is it. Dark matter isn't around just because it would be kewl to have a closed Universe.

Ditto homogeneity and isotropism. If we don't assume the Universe is homogeneous and isotropic, there's not much we can say about cosmology. And if we do assume it, we can match so much of what we see. So why shouldn't we assume it? Until something better comes along....

That should be Dartmouth: http://www.dartmouth.edu/.

One solution is to stop using copper for pennies, this would save tons of copper for other uses.

"The largest known Copper ore deposits in the world are in Chuquicamata in the Chilean Andes, and the largest deposit of native copper is in Michigan's Upper Peninsula."
This is an interesting article about Copper. Apparently Copper is also released as pollution during the mining and refining process, possibly more could be saved if there were more efficient ways of extracting and refining the metal.
One other solution is to go wireless.

I spent a significant time with the Dartmouth PKI project. The goals were to stand up a PKI for Dartmouth and then produce a PKI that could be distributed to Universities as open source with simple startup solutions. Dartmouth initially used the Sun Directory and Identity Manager Software, but changed course when Sun discontinued the Identity Manager. Initially we wanted to provide each student with a PKI public key that could be used to authenticate the user on public and private terminals to applications that had
been modified to permit access only to those whose private keys matched the public keys stored in the Dartmouth LDAP directory. Later private keys were used to "authorize VPNs" and to authorize laptop's access to the wireless network. Further work that is ongoing developed a method by which guests could obtain a temporary private key so that their laptop could use the network on a temporary basis.

In order to use public terminals with the modified applications, students were required to have a PKI token that maintained their private key and did all signing, etc. with the private key without releasing it to Microsoft's browser.

(We noted in our work with the Educause PKI effort that Verisign would not sign a University's generating key. They would however sell key pairs to University users, e.g., University of Texas and University of
California.)

The initial Dartmouth work is complete. You can learn more about it at:

http://www.dartmouth.edu/comp/about/projects/pki/
http://www.dartmouth.edu/~deploypki/
http://www.dartmouth.edu/~pkilab/

Note: the Sun Identity Manager is now an Open Source Project at Red Hat and could be used
with the material developed at Dartmouth.

Dartmouth now has a development project to bridge the use of certificates generated by different
CA's. It is called the Higher Education Bridge Certificate Authority. It would be desirable for University generated certificates to be recognized by Federal Entities, DoD, NIH, NSF. We worked
hard with Peter Alterman at NIH to test out these concepts.

http://www.dartmouth.edu/comp/about/projects/pki/l earn/related.html

I took a different course, obtaining the Microsoft Windows Server 2003 (SP1) which has a better version of PKI than Windows Server 2000.

For academic use, this server is very inexpensive. It provides much of the support that is desired with the use of the Active Directory. As has been pointed out in other posts, one of the major costs for an organization is key management: generation and maintenance. Entrust does a super, automatic job of this. Microsoft offers the possibility of authorizing certied users of the active directory to cause keys to be generated and then stored in their entry in the AD. Further the administrator can specify that the keys be renewed automatically -- that is that a new public key certificate is generated within the active directory context automatically. It also permits subsidiary key/certificate generation CAs on machines
of domains related to the CA. Within the AD, it is possible to generate keys for computers that are part of the domain as well as for users within the domain. These keys can be used to provide encrypted communication between the machines in a IP4 or IP6 VPN. In this way laptop to server communication can be secured.

Unfortunately, the templates provided for the generation of certificates may not be augmented! (at least as far as SP1). Nor may one add to the collection of certificate types; in particular, no attribute certificates are permitted. Entrust does permit the manufacture of attribute certificates (at least as of 2002). These certificates are desirable to provide additional information that might change during the life of an ident

I spent a significant time with the Dartmouth PKI project. The goals were to stand up a PKI for Dartmouth and then produce a PKI that could be distributed to Universities as open source with simple startup solutions. Dartmouth initially used the Sun Directory and Identity Manager Software, but changed course when Sun discontinued the Identity Manager. Initially we wanted to provide each student with a PKI public key that could be used to authenticate the user on public and private terminals to applications that had
been modified to permit access only to those whose private keys matched the public keys stored in the Dartmouth LDAP directory. Later private keys were used to "authorize VPNs" and to authorize laptop's access to the wireless network. Further work that is ongoing developed a method by which guests could obtain a temporary private key so that their laptop could use the network on a temporary basis.

In order to use public terminals with the modified applications, students were required to have a PKI token that maintained their private key and did all signing, etc. with the private key without releasing it to Microsoft's browser.

(We noted in our work with the Educause PKI effort that Verisign would not sign a University's generating key. They would however sell key pairs to University users, e.g., University of Texas and University of
California.)

The initial Dartmouth work is complete. You can learn more about it at:

http://www.dartmouth.edu/comp/about/projects/pki/
http://www.dartmouth.edu/~deploypki/
http://www.dartmouth.edu/~pkilab/

Note: the Sun Identity Manager is now an Open Source Project at Red Hat and could be used
with the material developed at Dartmouth.

Dartmouth now has a development project to bridge the use of certificates generated by different
CA's. It is called the Higher Education Bridge Certificate Authority. It would be desirable for University generated certificates to be recognized by Federal Entities, DoD, NIH, NSF. We worked
hard with Peter Alterman at NIH to test out these concepts.

http://www.dartmouth.edu/comp/about/projects/pki/l earn/related.html

I took a different course, obtaining the Microsoft Windows Server 2003 (SP1) which has a better version of PKI than Windows Server 2000.

For academic use, this server is very inexpensive. It provides much of the support that is desired with the use of the Active Directory. As has been pointed out in other posts, one of the major costs for an organization is key management: generation and maintenance. Entrust does a super, automatic job of this. Microsoft offers the possibility of authorizing certied users of the active directory to cause keys to be generated and then stored in their entry in the AD. Further the administrator can specify that the keys be renewed automatically -- that is that a new public key certificate is generated within the active directory context automatically. It also permits subsidiary key/certificate generation CAs on machines
of domains related to the CA. Within the AD, it is possible to generate keys for computers that are part of the domain as well as for users within the domain. These keys can be used to provide encrypted communication between the machines in a IP4 or IP6 VPN. In this way laptop to server communication can be secured.

Unfortunately, the templates provided for the generation of certificates may not be augmented! (at least as far as SP1). Nor may one add to the collection of certificate types; in particular, no attribute certificates are permitted. Entrust does permit the manufacture of attribute certificates (at least as of 2002). These certificates are desirable to provide additional information that might change during the life of an ident

I spent a significant time with the Dartmouth PKI project. The goals were to stand up a PKI for Dartmouth and then produce a PKI that could be distributed to Universities as open source with simple startup solutions. Dartmouth initially used the Sun Directory and Identity Manager Software, but changed course when Sun discontinued the Identity Manager. Initially we wanted to provide each student with a PKI public key that could be used to authenticate the user on public and private terminals to applications that had
been modified to permit access only to those whose private keys matched the public keys stored in the Dartmouth LDAP directory. Later private keys were used to "authorize VPNs" and to authorize laptop's access to the wireless network. Further work that is ongoing developed a method by which guests could obtain a temporary private key so that their laptop could use the network on a temporary basis.

In order to use public terminals with the modified applications, students were required to have a PKI token that maintained their private key and did all signing, etc. with the private key without releasing it to Microsoft's browser.

(We noted in our work with the Educause PKI effort that Verisign would not sign a University's generating key. They would however sell key pairs to University users, e.g., University of Texas and University of
California.)

The initial Dartmouth work is complete. You can learn more about it at:

http://www.dartmouth.edu/comp/about/projects/pki/
http://www.dartmouth.edu/~deploypki/
http://www.dartmouth.edu/~pkilab/

Note: the Sun Identity Manager is now an Open Source Project at Red Hat and could be used
with the material developed at Dartmouth.

Dartmouth now has a development project to bridge the use of certificates generated by different
CA's. It is called the Higher Education Bridge Certificate Authority. It would be desirable for University generated certificates to be recognized by Federal Entities, DoD, NIH, NSF. We worked
hard with Peter Alterman at NIH to test out these concepts.

http://www.dartmouth.edu/comp/about/projects/pki/l earn/related.html

I took a different course, obtaining the Microsoft Windows Server 2003 (SP1) which has a better version of PKI than Windows Server 2000.

For academic use, this server is very inexpensive. It provides much of the support that is desired with the use of the Active Directory. As has been pointed out in other posts, one of the major costs for an organization is key management: generation and maintenance. Entrust does a super, automatic job of this. Microsoft offers the possibility of authorizing certied users of the active directory to cause keys to be generated and then stored in their entry in the AD. Further the administrator can specify that the keys be renewed automatically -- that is that a new public key certificate is generated within the active directory context automatically. It also permits subsidiary key/certificate generation CAs on machines
of domains related to the CA. Within the AD, it is possible to generate keys for computers that are part of the domain as well as for users within the domain. These keys can be used to provide encrypted communication between the machines in a IP4 or IP6 VPN. In this way laptop to server communication can be secured.

Unfortunately, the templates provided for the generation of certificates may not be augmented! (at least as far as SP1). Nor may one add to the collection of certificate types; in particular, no attribute certificates are permitted. Entrust does permit the manufacture of attribute certificates (at least as of 2002). These certificates are desirable to provide additional information that might change during the life of an ident

I spent a significant time with the Dartmouth PKI project. The goals were to stand up a PKI for Dartmouth and then produce a PKI that could be distributed to Universities as open source with simple startup solutions. Dartmouth initially used the Sun Directory and Identity Manager Software, but changed course when Sun discontinued the Identity Manager. Initially we wanted to provide each student with a PKI public key that could be used to authenticate the user on public and private terminals to applications that had
been modified to permit access only to those whose private keys matched the public keys stored in the Dartmouth LDAP directory. Later private keys were used to "authorize VPNs" and to authorize laptop's access to the wireless network. Further work that is ongoing developed a method by which guests could obtain a temporary private key so that their laptop could use the network on a temporary basis.

In order to use public terminals with the modified applications, students were required to have a PKI token that maintained their private key and did all signing, etc. with the private key without releasing it to Microsoft's browser.

(We noted in our work with the Educause PKI effort that Verisign would not sign a University's generating key. They would however sell key pairs to University users, e.g., University of Texas and University of
California.)

The initial Dartmouth work is complete. You can learn more about it at:

http://www.dartmouth.edu/comp/about/projects/pki/
http://www.dartmouth.edu/~deploypki/
http://www.dartmouth.edu/~pkilab/

Note: the Sun Identity Manager is now an Open Source Project at Red Hat and could be used
with the material developed at Dartmouth.

Dartmouth now has a development project to bridge the use of certificates generated by different
CA's. It is called the Higher Education Bridge Certificate Authority. It would be desirable for University generated certificates to be recognized by Federal Entities, DoD, NIH, NSF. We worked
hard with Peter Alterman at NIH to test out these concepts.

http://www.dartmouth.edu/comp/about/projects/pki/l earn/related.html

I took a different course, obtaining the Microsoft Windows Server 2003 (SP1) which has a better version of PKI than Windows Server 2000.

For academic use, this server is very inexpensive. It provides much of the support that is desired with the use of the Active Directory. As has been pointed out in other posts, one of the major costs for an organization is key management: generation and maintenance. Entrust does a super, automatic job of this. Microsoft offers the possibility of authorizing certied users of the active directory to cause keys to be generated and then stored in their entry in the AD. Further the administrator can specify that the keys be renewed automatically -- that is that a new public key certificate is generated within the active directory context automatically. It also permits subsidiary key/certificate generation CAs on machines
of domains related to the CA. Within the AD, it is possible to generate keys for computers that are part of the domain as well as for users within the domain. These keys can be used to provide encrypted communication between the machines in a IP4 or IP6 VPN. In this way laptop to server communication can be secured.

Unfortunately, the templates provided for the generation of certificates may not be augmented! (at least as far as SP1). Nor may one add to the collection of certificate types; in particular, no attribute certificates are permitted. Entrust does permit the manufacture of attribute certificates (at least as of 2002). These certificates are desirable to provide additional information that might change during the life of an ident

• Animals lack a "theory of mind"
• Animals lack the ability to create new words
• Animals lack syntax in their communications

• Animals lack a "theory of mind"
• Animals lack the ability to create new words
• Animals lack syntax in their communications

The article summary: "An unnamed Dartmouth student was visited by Homeland Security for requesting a copy of Mao Zedong's Little Red Book for a class project."

The first sentences of TFA: "A senior at UMass Dartmouth was visited by federal agents two months ago, after he requested a copy of Mao Tse-Tung's tome on Communism called 'The Little Red Book.'"

Dartmouth != UMass Dartmouth.

The student attends the University of Massachusettes at Dartmouth, which goes by the shorter name "UMass Dartmouth." This is not to be confused with Dartmouth College, which, considering that it predates the founding of the United States, is the proper institution to be called by that one-word name.

let the mod-down begin...

The article summary: "An unnamed Dartmouth student was visited by Homeland Security for requesting a copy of Mao Zedong's Little Red Book for a class project."

The first sentences of TFA: "A senior at UMass Dartmouth was visited by federal agents two months ago, after he requested a copy of Mao Tse-Tung's tome on Communism called 'The Little Red Book.'"

Dartmouth != UMass Dartmouth.

The student attends the University of Massachusettes at Dartmouth, which goes by the shorter name "UMass Dartmouth." This is not to be confused with Dartmouth College, which, considering that it predates the founding of the United States, is the proper institution to be called by that one-word name.

let the mod-down begin...

I remember back when I was in college, Microsoft donated 40 computers to the professors in the Computer Science department, all of which came with NT4 (this was in 1999, I think). In their press release they claimed that the donation was worth $400,000. The machines they provided were relatively high-end at the time, but I don't see how they could possibly say they were $10,000 each, so maybe they were just making up a value for Windows. That's a fantastic way to invent tax deductions - donate a $200 piece of software (that costs you nothing to duplicate) to a school and write it off at a value of $5000+. I asked a couple of profs if they were going to format the machines and put Linux on them and most said they'd like to but were contractually bound to run NT for a while.

Ah, here's some info: http://www.cs.dartmouth.edu/~brd/Press/msr.html

While donations are great and I hate to find ulterior motives for everything, corporations rarely do anything out of the goodness of their hearts. Most "charitable foudations" created by corporations or extremely wealthy individuals exist as a way to create tax deductions for the individuals or corporations in question. They get the tax break and also get to spend the money in a way that may directly or indirectly benefit them. It's mostly a win for everyone involved, but don't chalk it up to altruism or anything like that.

[yawn...]
http://math.dartmouth.edu/~doyle/docs/thesis/thesi s/thesis.html

"At very small scales, this machine is surprisingly fast."

I just thought that was pretty funny. I mean, at pretty small scales a sloth is a speeding bullet. But his point obviously is that it has a large speed to size ratio.

And did anyone else notice that during the video linked in the article as he says, "These robots are maybe 10x the size of human blood cells", while the video shows red blood cells on the machine. It's clear from the image that what he is saying is clearly not true. Maybe just bad editing.

Iannis Xenakis is of course the first who comes to mind, since he had a Ph.D. in mathematics and engineering, and wrote what is known as stochastic music. What is probably his most famous piece, Metastasis, is based upon measurements and shapes from a particular building. He also more or less initiated the field of music made with granular synthesis, which suits itself very well to stochastic and other algorithmic composition methods. There's a pretty good writeup here.

Then there's Conlon Nancarrow, who, while not having any formal mathematical training (so far as I know), spent most of his career hand-punching player piano rolls in very complex rhythmical relationships. (He later said that if he had access to computers, he of course would have done it that way -- hand-punching is a pain in the ass!). Read about him here.

Charles Dodge hung out at Bell Labs for a while, and wrote a piece called "Earth's Magnetic Field", based on measurements of the Earth's magnetic field. He also produced some of the first successful pieces using voice synthesis (which are available on an album called "Any Resemblance is Purely Coincidental"; really good listening!), and is in general a smart engineering guy who writes good computer music. Official page here (not very interesting), and a bit written by him here.

You may also have heard of serialism, which was, if not algorithmic, at least systematic. There were even composers in the classical period using what can really only be called algorithms.

So, anyways, while I agree that the Wolfram music is silly, that doesn't mean you can't make excellent music using formal systems, algorithms, or even representations of some data set.

I mean, there's something to be said for learning data structures and operating systems from a guy who helped invent the idea of pipes.

McIlroy's homepage.

Harvard
Cornell
Princeton
Dartmouth
U Penn

You might like to read this: http://www.dartmouth.edu/~matc/MathDrama/reading/W igner.html

The rule that new theories should simplify everyghing is not that inevitable.

It's not like any of this wasn't known years in advance.

The public macs (a mix of eMacs and iMac G4s) are all running OSX now. I think they kept the old ones on OS9 because they were the old colorful iMacs that run OSX like shit.

More info on blitzmail can be found here. I think the source code for the server and client have been released. It was a pretty good email system for its time (kind of like IMAP), but the client has stagnated a bit.

GIMPshop torrent at:
http://pipe.cs.dartmouth.edu/torrents/

Well, let's say Alice gives the other her public key- Why not just have them send her the full password encrypted in her public key and she can check if it's the correct password? What is the checkerboard of carbon paper needed for, then?

As for mentioning quantum, I agree words like "quantum" and "relativity" are often used more for effect than substance, but if you read an intro on quantum cryptography, it reads almost exactly like this story- see for yourself:

here

Hm. I think the article was just attempting to highlight some often-overlooked contributions by the Barrons. I mean, I've never even heard of them, so I found it quite interesting.
The submitter is the one who seems to have goofed here, by presenting this short blurb as "The Birth of Electronic Music". The article itself makes no such claims; its focus is simply the Barrons.
If you do have an interest, there are plenty of great resources out there for one to peruse. Yes, Theremin was way ahead of his time, as was Cage, Schaeffer, and on and on.
For computer music in specific, look at Lejaren Hiller and Max Mathews. I had the great honor of meeting Max Mathews and man is he interesting. He was speaking to a class I was taking and he said "digital computer". Every time instead of saying computer, he said "digital computer". This confused me at first, but I thought about that and realized that he has a bit more perspective and history on these things and began working on analog computers.

Even more telling is how most Colleges charge exorbitant fees for local and long distance phone calls from student dorm phones.

Don't all Colleges have free long-distance as a cost-saving measure: Dartmouth Ends Billing for Phone Calls

Hi!

I have read the article in Slate, but have only read the precis of the original article in NBER. Based on the Slate article, and the NBER precis, I have some concerns about the quality of the research underlying this.

First, haven't the "C" jobs changed?
In 1981 very, very few corporations, if any, had a position with the title of Chief Information Officer or Chief Technical Officer. Or anything resembling the post. By 2001 practically every major corporation did--if only to satiate the demands of securities analysts who wanted to know if the company would weather the "Y2K Crisis." The CIO/CTO position, by its very nature, is a technical one. Even though experienced IT workers can tell all kinds of stories about some of the bozos we've seen (cf. the Dilbert Principle--engineers with no talent are moved to the place where they can do the least damage: management), the CIO/CTO almost always comes from a technical background.

Why would this have an impact on Ivy League graduates? Despite the fact that ENIAC was developed at Penn, and BASIC was developed at Dartmouth the Ivies are primarily liberal arts colleges. (Indeed, BASIC was developed at Dartmouth expressly to expose English majors to computer programming.) Technology workers with liberal arts degrees are a rarity, Ivy League degree or not. As the number of "C" jobs in Fortune 100 companies grows to include a tech-focused job category, it is natural that the percentage of graduates of liberal arts schools in those "C" jobs will decline.

Second, hasn't the nature of senior management changed?
Once upon a time a budding business executive would take a "well-rounded" college education (meaning a liberal arts degree) and join the management training program of a major corporation. Other budding big-biz big-wigs would study business before joining the management training program. They trained to be managers....

And those mid-level managers got laid off, by the thousands, in the 1980s and 1990s. In the "flattening" of American corporate management driven largely by the stock market's unyielding insistence on ever-increasing efficiency and ever-growing profits, lots of managers got downsized right out the door. The emphasis shifted to "operators"--generally meaning people with experience in sales, engineering, or manufacturing. Look at the ranks of corporate chiefs today--sales is still a good track for senior management, but engineering and manufacturing are far more common today than they were in the early 1980s. (I graduated from Penn in 1980--a number of my classmates went into management training programs at major corporations. To the best of my knowledge, none are still employed by the company they initially joined.)

The companies in the Fortune 100 reflect a similar kind of shift: engineering-driven companies have grown, while traditional corporate conglomerates (Litton, ITT, etc.) have faded from view. There are exceptions (Procter & Gamble, Coca-Cola) but a number of technology companies have burst onto the stage in the past twenty years (Microsoft, Apple, HP, Dell, etc.) and none of them are hiring liberal arts majors to be trainees--in the Ivy League or elsewhere.

Does that make an Ivy League degree worthless?
Absolutely not. The statistic that is not given in the Slate article is the stat that is most significant: what is the percentage of GDP generated by those companies in the Fortune 100? That percentage has dwindled fairly substantially over the past 20 years--the size of companies in the Fortune 500 and Fortune 1000 have increased substantially. And many Ivy graduates don't go to work for corporate America--they go to law school (where they are wildly over-represented in the top spots), med school (where they are wildly over-represented in the top spots), or other graduate schools. Ivy League graduates are grossly over-represented in American politics: remember that John Kerry, John Dean, and George W. Bush were all contemporaries at Yale.

THERE IS A story about two friends, who were classmates in high school, talking about their jobs. One of them became a statistician and was working on population trends. He showed a reprint to his former classmate. The reprint started, as usual, with the Gaussian distribution and the statistician explained to his former classmate the meaning of the symbols for the actual population, for the average population, and so on. His classmate was a bit incredulous and was not quite sure whether the statistician was pulling his leg. "How can you know that?" was his query. "And what is this symbol here?" "Oh," said the statistician, "this is pi." "What is that?" "The ratio of the circumference of the circle to its diameter." "Well, now you are pushing your joke too far," said the classmate, "surely the population has nothing to do with the circumference of the circle."

My college has a larger number of cheap public computers provided by the student assembly that run our small email client, called Blitzmail. (The explain is somewhat dated, but still mostly correct). It's similar to IMAP in that everything stays on the server, but the program itself is well suited to use on public computers, eliminating the need to use webmail. And it's small enough to run on pretty much any old piece of junk (I've seen it running on a Mac Classic).

Anyway, the point is that we have public iMacs pretty much everywhere. The computer penetration here is deeper than anywhere else I've been (note: I haven't been to RIT yet), and email has not been replaced by cell phones. If you had the money and could make the software side of things work, it's very convenient to have as many public kiosks as you can.

My college has a larger number of cheap public computers provided by the student assembly that run our small email client, called Blitzmail. (The explain is somewhat dated, but still mostly correct). It's similar to IMAP in that everything stays on the server, but the program itself is well suited to use on public computers, eliminating the need to use webmail. And it's small enough to run on pretty much any old piece of junk (I've seen it running on a Mac Classic).

Anyway, the point is that we have public iMacs pretty much everywhere. The computer penetration here is deeper than anywhere else I've been (note: I haven't been to RIT yet), and email has not been replaced by cell phones. If you had the money and could make the software side of things work, it's very convenient to have as many public kiosks as you can.

Generates curves from harmonic motion via mechanical arms and a rotating turntable. Real metal construction w/paper discs for output.
(Picture (scroll down) and instruction sheet here, please be gentle!)

Predated the Spirograph, which draws epicycloids. Magic Designer appears to be out of production, but you might find one on ebay. (And yes, I still own mine, and no, it's not for sale.)

When I grew up, I wrote a Magic Designer emulator in Pascal as a class project.

Why even bother with the gelatin mold?

All these security systems have to communicate some way with a backend system to check data that has been collected, even if the data that is being sent is a digested hash or something.

Maybe it isn't trivial, but emulating a security device will also compromise the entire system; it doesn't matter what the front-end is, the "communication" portion is still the weakest, most attackable part of the system.

Nope, until someone can develop a standalone, uncrackable system with perfect communication links, all systems are vulnerable.

And, honestly, I don't think it can be done until we can get into quantum cryptography.

TCPA (the chip that's in these PCs) is simply a Crypto co-processor. It provides acceleration for common crypto algorithms and it also provides a tamper-resistant storage location for keys. IBM maintains an Open Source implementation for the processor.

There's already been really neat things done with the chip like a truely secure version of Linux that's entirely tamper proof (this is doing by signing the kernel and boot loader with the TCPA.

Put away the foil hats people, this is actually really cool innovative technology that so far has given Linux an edge in the security world over Windows.

Here is another paper published in the Review of Economics and Statistics, claiming to predict Olympic performance in Athens. The predictive factors are similar but they get very different results, mainly the drop in medals for the top countries is definetely not as large. Model was devised by two B-School professors who started doing it for Sydney 2000 with very good results.

In a similar exercise, a pair of business professors have predicteding the final Olympic medal count using socio-economic data rather than athletic performance. Andrew Bernard and Meghan Busse developed their methodology using four factors: population, per capita income, past performance, and a host effect.
They were 96% accurate in their predictions for the 2000 Games, including correctly guessing 97 total and 37 gold medals for the USA. Also discussed is why some countries, such as Australia, surpass expectations while others, particularly Canada and Japan, underperform relative to countries with similar populations/national income.
This year's predicted winners? The USA (93), Russia (83) and China (57). The full paper was published in the Feb 2004 Review of Economics and Statistics - summary here.

In a similar exercise, a pair of business professors have predicteding the final Olympic medal count using socio-economic data rather than athletic performance. Andrew Bernard and Meghan Busse developed their methodology using four factors: population, per capita income, past performance, and a host effect.
They were 96% accurate in their predictions for the 2000 Games, including correctly guessing 97 total and 37 gold medals for the USA. Also discussed is why some countries, such as Australia, surpass expectations while others, particularly Canada and Japan, underperform relative to countries with similar populations/national income.
This year's predicted winners? The USA (93), Russia (83) and China (57). The full paper was published in the Feb 2004 Review of Economics and Statistics - summary here.

In a similar exercise, a pair of business professors have predicteding the final Olympic medal count using socio-economic data rather than athletic performance. Andrew Bernard and Meghan Busse developed their methodology using four factors: population, per capita income, past performance, and a host effect.
They were 96% accurate in their predictions for the 2000 Games, including correctly guessing 97 total and 37 gold medals for the USA. Also discussed is why some countries, such as Australia, surpass expectations while others, particularly Canada and Japan, underperform relative to countries with similar populations/national income.
This year's predicted winners? The USA (93), Russia (83) and China (57). The full paper was published in the Feb 2004 Review of Economics and Statistics - summary here.

On the other hand, they know that if this was an IE vulnerability, they'd be all over it and crying out about "why would anybody still be using IE, especially if this was known for five years!!"

This is a vulnerability in IE, and in Opera, and in every other web browser on the planet that has any kind of image+scripting support (DHTML support is needed for a really convincing spoof, but less convincing spoofs can still be effective).

For a good example of a spoof that affects IE, go to this web page and scroll down to the links in the "Spoofing" section (not the links in the "Misleading URLs" section).

So, the only thing that is Firefox-specific about this bug is that the originally cited implementation used XUL (instead of more generic DHTML) and mimicked the look of Firefox (instead of IE's or Opera's look).

On the other hand, all the Farid's technical papers mentioned on his page (linked several posts above) seam to deal with the forgery detection, the detection of steganography being targetted only in several press releases. May be the forgery detection is the first step, the only to be actually taken yet. Or may be the algorithms targetting directly the main goal are kept secret.

RTFP. 0.5% false-positives on their training data, ~1.5% on their test data... More to the point, the process is (of course) susceptible to certain kinds of manipulations... but it does really well with natural phenomena, even ones like 'strange lighting.' It really is picking up on statistical regularities that result from actually taking a photo (no matter what it is of) vs. those that come from, say, manipulating pixels in photoshop in a mathematical (that is, regular) way, no matter how subtle to the human eye.

sp04.html
ih04.html
sacv03.html

And, we have two new papers currently in review (abstracts are currently on-line, and preprints will be available soon):

sp05a.html
sp05b.html

Some of these techniques work, as some have pointed out, only on high-quality jpeg or uncompressed images, while others work on lower-quality images. We are only in the early stages of development, and are currently working to extend some of these ideas to low-quality jpeg and gif images (though this will likely be a harder problem given that the compression artifacts will overwhelm any statistical perturbation resulting from tampering). One outcome of this may be that a legal standard is set that enforces images brought into a court of law to be of a certain resolution and compression quality.

I will be the first to admit that each of the techniques that we have developed can be reverse-engineered, though doing so is more difficult for some techniques than others. It is our hope, however, that as we and others continue to develop more techniques it will become increasingly more difficult (though never impossible) to simultaneously foil each of the detection tools.

sp04.html
ih04.html
sacv03.html

And, we have two new papers currently in review (abstracts are currently on-line, and preprints will be available soon):

sp05a.html
sp05b.html

Some of these techniques work, as some have pointed out, only on high-quality jpeg or uncompressed images, while others work on lower-quality images. We are only in the early stages of development, and are currently working to extend some of these ideas to low-quality jpeg and gif images (though this will likely be a harder problem given that the compression artifacts will overwhelm any statistical perturbation resulting from tampering). One outcome of this may be that a legal standard is set that enforces images brought into a court of law to be of a certain resolution and compression quality.

I will be the first to admit that each of the techniques that we have developed can be reverse-engineered, though doing so is more difficult for some techniques than others. It is our hope, however, that as we and others continue to develop more techniques it will become increasingly more difficult (though never impossible) to simultaneously foil each of the detection tools.

sp04.html
ih04.html
sacv03.html

And, we have two new papers currently in review (abstracts are currently on-line, and preprints will be available soon):

sp05a.html
sp05b.html

Some of these techniques work, as some have pointed out, only on high-quality jpeg or uncompressed images, while others work on lower-quality images. We are only in the early stages of development, and are currently working to extend some of these ideas to low-quality jpeg and gif images (though this will likely be a harder problem given that the compression artifacts will overwhelm any statistical perturbation resulting from tampering). One outcome of this may be that a legal standard is set that enforces images brought into a court of law to be of a certain resolution and compression quality.

I will be the first to admit that each of the techniques that we have developed can be reverse-engineered, though doing so is more difficult for some techniques than others. It is our hope, however, that as we and others continue to develop more techniques it will become increasingly more difficult (though never impossible) to simultaneously foil each of the detection tools.

sp04.html
ih04.html
sacv03.html

And, we have two new papers currently in review (abstracts are currently on-line, and preprints will be available soon):

sp05a.html
sp05b.html

Some of these techniques work, as some have pointed out, only on high-quality jpeg or uncompressed images, while others work on lower-quality images. We are only in the early stages of development, and are currently working to extend some of these ideas to low-quality jpeg and gif images (though this will likely be a harder problem given that the compression artifacts will overwhelm any statistical perturbation resulting from tampering). One outcome of this may be that a legal standard is set that enforces images brought into a court of law to be of a certain resolution and compression quality.

I will be the first to admit that each of the techniques that we have developed can be reverse-engineered, though doing so is more difficult for some techniques than others. It is our hope, however, that as we and others continue to develop more techniques it will become increasingly more difficult (though never impossible) to simultaneously foil each of the detection tools.

sp04.html
ih04.html
sacv03.html

And, we have two new papers currently in review (abstracts are currently on-line, and preprints will be available soon):

sp05a.html
sp05b.html

Some of these techniques work, as some have pointed out, only on high-quality jpeg or uncompressed images, while others work on lower-quality images. We are only in the early stages of development, and are currently working to extend some of these ideas to low-quality jpeg and gif images (though this will likely be a harder problem given that the compression artifacts will overwhelm any statistical perturbation resulting from tampering). One outcome of this may be that a legal standard is set that enforces images brought into a court of law to be of a certain resolution and compression quality.

I will be the first to admit that each of the techniques that we have developed can be reverse-engineered, though doing so is more difficult for some techniques than others. It is our hope, however, that as we and others continue to develop more techniques it will become increasingly more difficult (though never impossible) to simultaneously foil each of the detection tools.

I've looked at their scientific paper and their technique albeit not perfect seems to be very good in detecting any kind of resampling in the image (up- and down scaling, rotating, etc.). When you make the transformation on a grid, the interpolation creates some almost invisible artifacts and regular patters which they are able to find by their analysis. It's difficult to create forgieries without these kinds of manipulation. But probably not impossible.

Details can be found in a preprint of the paper here.

("RTFP? I can't be bothered to RTFA!")