Slashdot Mirror
Domain: doxpara.com
Stories and comments across the archive that link to doxpara.com.
Comments · 106
-
Yadda Yadda
Two pages, same hashes, etc. (This is the guy who wrote the MD5 someday paper.)
http://www.doxpara.com/t1.html
http://www.doxpara.com/t2.html -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
PAX Concerts were incredibleOK, seriously, _you_ show me another concert that starts out with classical piano, moves onto nerdcore hiphop, and finishes up with metal -- with the audience equally pleased with all three.
Now have two of them, two nights in a row. Rawk.
Couple amusing highlights:- Bawls is going hardcore. They had a...brace for it...Bawls Slurpee Machine. And It Was Good. As if that was not enough...there were some sort of caffeinated yet vaguely carbonated Bawls Pillform spawned in a pitcher that would be poured into confused but curious hands. Yum.
- Take Defcon. Swap Hackers for Gamers. Swap Hot Vegas for Overcast Washington. Swap Feds for...I dunno...Nintendo? Still, the entire thing had the feel of an Alternate Reality Defcon, replete with everyone just so damn happy to be around so many other people who understood them. I mean, just look at Phil here. Happy! (A wink to anyone who sees the very subtle Defcon reference.)
- At Penny Arcade Expo, cosplay girl photograph YOU (in Defcon T-Shirt).
- Best coat check evar
Still, I cannot get over the concerts. Before the Saturday night show began, it was unveiled that there'd be a special act...see, there was this huge gaming competition called the Omegathon, and a mystery game had been decided upon...Karaoke Revolution...with 1700 geeks assembled to watch.
Bet Konami never planned for this.
For those not familiar with Karaoke Revolution, it's basically a game where you're scored on how well your pitch matches what the game tells you you're supposed to be singing. Now, gamers generally do not sing, but it's 2005 and it's time to expand the market (and the eyeballs of these poor geeks that just want to win every NES game ever released). With 1700 people cheering on, we watched...
Two possible reactions:
1) Complete withdrawl
2) Complete insanity
The second was entertaining in its own right, but the first was best represented by...Leroy. Now, these are gaming geeks. Gamers + Leroy = LeeeeROYYYYYYYY!. To say he was cheered on would be an understatement...and to say he didn't take it so well...so the guy's about three fourth through the round, and hasn't managed to sing a single note right. Finally, after much struggling, he gets...one note right. He's on the board! Applause thunders through the audience!
LEEEEEEEEEEROY!
OK. Maybe you had to be there. But it was a truly magical moment.
But about the actual concerts.
Both the Video Game Pianist and Connie Lin were incredible, and MC Chris was more insane than I had any right to expect...but the real surprise, for me anyway, was MC Frontalot. I'd say all sorts of stuff about him, but just grab the single. His CD is great, try not to get it off Bittorrent. Cool guy, too.
It wasn't all hype and noise. Actually just sitting down with a random geek and playing Soul Caliber 2 for the first time in ages was just pure fun. And seeing the faces of all these kids see -
Biometric Hash Reversal
First of all, lets link to the research on how hashes are reversed:
Fingerprint Readers: http://chris.fornax.net/biometrics.html
Face Recognizers
http://www.site.uottawa.ca/~adler/publications/200 3/adler-2003-fr-templates.pdf
Both attacks are based on the idea that the algorithms are necessarily fuzzy, and as such emit not just an oracular "match/not match" but a weighting regarding how accurate the matching is. As such, you basically can perturb the underlying data slightly, run it through the algorithm, and then see if you got closer or farther from the source biometric.
Fingerprint reversal already creates viable (if not completely accurate) candidates. Faces? Well, see the PDF, but they can be made recognizable. (You just, widen the brow, shrink the nose, widen the mouth, whatever incrementally until you achieve match.)
Now, suppose you add a warping factor to faces. Does this help? The stored biometric must contain the warping parameters (since the incoming image must be similarly modified), so we're left with two possibilities:
1) The warping is severe -- not only does the resulting image bear no resemblance to a human face, but so much pixel intermixing has occurred that it'd be near meaningless to invert the warp vectors to try to get back to a meaningful face.
2) The warping isn't so severe, and you can just invert the stored vectors.
Case 1 is what they're implying, but Case 1 doesn't allow for significant features above and beyond what's created by the vector field itself. In other words, almost any face would match, if the warp vectors were irreversable. Put another way -- if the face detection algorithm is able to find a feature, we're able to reverse back to what the feature looks like, and if we're not able to reverse back, we almost certainly can't have a face detector find the feature.
My assumption, then -- and again, this is without seeing detailed research (I happily discount the examples CNN provided...it can't be _that_ bad) -- is that this technique doesn't work against hot/cold style attacks against the biometric algorithm. If the researchers care to clarify -- please mail me, or respond!
--Dan -
Details
OK, I'm partially responsible for people seeing applied attack against MD5, so I'll comment for a second.
Basically, in 2004 Xiaoyun Wang released two different files with the same MD5 hash. This has been predicted since around 1996, when Hans Dobbertin showed the hash was broken -- but it took a while for the actual attack to show up.
Alot of people said there were _no_ applied uses. Not true. For instance, the following two pages have the same hash:
Lockheed Martin
Boeing
What's important to realize about the above content is that both web pages are included in both links; the difference between the source files (which MD5 is blind to) is just used to determine which page is displayed. What that means is that, for forensic purposes, it's trivial to rule out the best known attack against MD5 -- just look at the content being hashed.
Thats not to say we should keep using MD5. It's broken, we need to move on. But attempts to claim that MD5 is broken, so we have no idea of any link between hashed content and real material -- that's just ridiculous. We have plenty of idea, especially with human-guided forensic operations.
That being said -- if you can doctor a photo, you can doctor a hash. This is one of the things that makes files hosted on a single server w/ MD5 hashes "verifying" them a little silly...if you can alter the file, you can alter the -
Details
OK, I'm partially responsible for people seeing applied attack against MD5, so I'll comment for a second.
Basically, in 2004 Xiaoyun Wang released two different files with the same MD5 hash. This has been predicted since around 1996, when Hans Dobbertin showed the hash was broken -- but it took a while for the actual attack to show up.
Alot of people said there were _no_ applied uses. Not true. For instance, the following two pages have the same hash:
Lockheed Martin
Boeing
What's important to realize about the above content is that both web pages are included in both links; the difference between the source files (which MD5 is blind to) is just used to determine which page is displayed. What that means is that, for forensic purposes, it's trivial to rule out the best known attack against MD5 -- just look at the content being hashed.
Thats not to say we should keep using MD5. It's broken, we need to move on. But attempts to claim that MD5 is broken, so we have no idea of any link between hashed content and real material -- that's just ridiculous. We have plenty of idea, especially with human-guided forensic operations.
That being said -- if you can doctor a photo, you can doctor a hash. This is one of the things that makes files hosted on a single server w/ MD5 hashes "verifying" them a little silly...if you can alter the file, you can alter the -
Details
OK, I'm partially responsible for people seeing applied attack against MD5, so I'll comment for a second.
Basically, in 2004 Xiaoyun Wang released two different files with the same MD5 hash. This has been predicted since around 1996, when Hans Dobbertin showed the hash was broken -- but it took a while for the actual attack to show up.
Alot of people said there were _no_ applied uses. Not true. For instance, the following two pages have the same hash:
Lockheed Martin
Boeing
What's important to realize about the above content is that both web pages are included in both links; the difference between the source files (which MD5 is blind to) is just used to determine which page is displayed. What that means is that, for forensic purposes, it's trivial to rule out the best known attack against MD5 -- just look at the content being hashed.
Thats not to say we should keep using MD5. It's broken, we need to move on. But attempts to claim that MD5 is broken, so we have no idea of any link between hashed content and real material -- that's just ridiculous. We have plenty of idea, especially with human-guided forensic operations.
That being said -- if you can doctor a photo, you can doctor a hash. This is one of the things that makes files hosted on a single server w/ MD5 hashes "verifying" them a little silly...if you can alter the file, you can alter the -
Re:What about DNS Cache Snooping?
Yeah, great paper Luis. Check out my slides from this year to see how I used similar methods to divine interrelationships. Hell, you're directly named in last year's slides. Really good work.
--Dan -
More info from the researcher's web site
The news.com article is short on specifics about what the thousands of servers are actually doing, but there's better info at Dan Kaminsky's site: http://www.doxpara.com/
This powerpoint presentation has some details: http://www.doxpara.com/Black_Ops_Of_TCPIP_2005.ppt -
More info from the researcher's web site
The news.com article is short on specifics about what the thousands of servers are actually doing, but there's better info at Dan Kaminsky's site: http://www.doxpara.com/
This powerpoint presentation has some details: http://www.doxpara.com/Black_Ops_Of_TCPIP_2005.ppt -
Ask around first, then buy a cheap GPS
I understand the extreme paranoia of a firewall admin, especially if there are large numbers of windoze machines on her network. There may be a touch of tin-foil hat syndrome from rumours that windoze machines report activation codes encoded in SNTP requests to time.windows.com. If you are on a government network, then some security dudes have already demo'd tunneling secret info over NTP UDP packets, resulting in your properly locked down windoze network. There really is no reason a windoze machine needs to get its time from the internet, when a local time server will do.
There probably is an NTP service on the internal network. Start by asking around if there is an alternative you can use on the inside of the firewall. Try pointing your NTP client at the default router on your segment, and see what happens. Do a traceroute towards the internet, and see if NTP is present on any of the hops before the firewall.
If one sets up an internal NTP server (Windows XP or 2000 workstation)
One note about XP or 2K machines as NTP servers. Windows clocks are accurate to only 10 milliSeconds, and no amount of tweaking will improve that. Save yourself the headache and set up a *nix machine, where clock increments are usually between 2 mSec and 500 nanoSec.
If you have no NTP inside the firewall, you can always pick up a cheap GPS unit with a serial NMEA connector, or if you are in the US, a CDMA timebase. Plug it into a *nix based machine, compile the latest NTPv4 code, and read the docs about setting up a generic NMEA driver. Now you've got a machine accurate to about
Its probably easier and cheaper to ask the network admins to enable an NTP server on a router.
the AC -
As someone who actually _does_ have a P2P attack..
It's a couple pages in my paper here. Basically, the first 300Kb of Kazaa's files are hashed normally, then every 32Kb chunk of the file is hashed independently. This allows independent chunks to be downloaded out of order. These out of order chunks are recursively hashed against one another to create one final value, called a "kzhash", which is verified after the file is downloaded.
The attack is to use the recently released collision -- which creates two blocks that, when mixed against the default initial state of MD5, emit the same system state. Every 32K, you can embed one or the other in the file you're transmitting, and kzhash can't tell. What can you do with this? Morph a file as it traverses the network; have an installation executable describe the systems its being installed on as it propogates through a network. With a fairly large installer, you'd get quite a few bits in there.
You still don't get to do random noise, and while it's no Tiger Tree, kzhashing doesn't appear so exploitable that this group is likely to have anything. I could be wrong, but then, virtual algorithm? Right. -
Lensing Is Awful
You would have a hard time finding someone who wants autostereoscopy to look good than me. I've bought three different sets of LCD shutter glasses, installed and tweaked ungodly numbers of drivers, and partially went to SIGGRAPH simply to see the state of the art in the technology.
As of September, 2004, it's all awful. I've seen the Sharp Laptop. I've seen the X3D display. I've seen every attempt to create 3D without glasses, and they're all embarassingly bad. One inch of depth does not 3D make, especially not at the cost of visually hideous artifacts (half the horizontal resolution means you end up looking at these double width, very blocky pixels). There was one exception, which used several stacked layers to simulate 3D without attempting to use lensing. The depth was still awful but it didn't hurt at all to look at. Of course, you'd never notice any depth from a distance.
Of course, it's not just lensing that's problematic. I got strapped into not one but two HMD-based systems -- one, a swimming simulator, the other a fairly cool cockpit simulation with per-finger force feedback gloves. Both systems looked cool from the outside, but having played with this stuff off and on since the days of Amiga-based Arcade VR (what *was* the name of that system?) I can tell you it hasn't gotten much better. I wanted it to be immersive, but...no.
Really, the only display tech that really blew me away used dual rear projectors that fed back into one another to achieve alignment, then emitted polarized light onto a single screen. With very light and simple glasses, the effect was utterly seamless.
I vaguely remember the spinning display approach also worked.
--Dan -
So Dan Kaminski wrote the MD5 chapter...
-
So Dan Kaminski wrote the MD5 chapter...
-
Re:Why The War Over Stem Cells
> in western militaries
I wonder if middle eastern countries have a policy about this? I mean, Islam teaches that dying while killing an infidel gets you to Janaah, so... hm. Dunno.
I spent 5 years in the Coast Guard and was told that the days of "you have to go out but you don't have to come back" are over. Now "you have to go out _and_ you have to come back!"
Hey, you're Dan Kaminsky! Nice article here. -
Re:My Own Experience
Yeah, I was pretty stoked when they finally ported it over. Here's the latest build of PuTTY hosted off a web page -- quite convenient for Internet Cafes. (If ActiveX is going to be insecure, we can at least make it useful.)
--Dan -
Ahhh, Visualization
So much fun. And so, so utterly useless 95% of the time.
I've been working on particle systems for large scale data visualization. Even got some working code up -- see this for the results of my DNS server research (every particle is a host). It's...OK. The problem is that while a good chunk of our brain is devoted to visual processing, a good chunk of what we do is decidedly abstract and non-visual. Playing across these mental lines can usefully employ underutilized computation frameworks, but that doesn't mean that it will.
Think -- crypto on a GPU, not particularly fast (floating point and crypto only work well together in one extraordinarily obscure context).
It's alot of fun to play in this domain, and occasionally the results are really really useful (like this rendering of failed entropy generators). But...yeah. Way too often, your output isn't as useful as a quickly resortable log file.
That's what makes it such a great challenge, of course. Few other fields show themselves to be empty of value so late in the dev cycle. (Biotech people have it worse, of course.)
--Dan -
Ahhh, Visualization
So much fun. And so, so utterly useless 95% of the time.
I've been working on particle systems for large scale data visualization. Even got some working code up -- see this for the results of my DNS server research (every particle is a host). It's...OK. The problem is that while a good chunk of our brain is devoted to visual processing, a good chunk of what we do is decidedly abstract and non-visual. Playing across these mental lines can usefully employ underutilized computation frameworks, but that doesn't mean that it will.
Think -- crypto on a GPU, not particularly fast (floating point and crypto only work well together in one extraordinarily obscure context).
It's alot of fun to play in this domain, and occasionally the results are really really useful (like this rendering of failed entropy generators). But...yeah. Way too often, your output isn't as useful as a quickly resortable log file.
That's what makes it such a great challenge, of course. Few other fields show themselves to be empty of value so late in the dev cycle. (Biotech people have it worse, of course.)
--Dan -
Kaminsky Presentation
This article is a lot like this one posted on Slashdot a few weeks ago. That article contains a link to Kaminsky's presentation (PPT) on this subject, apparently given at the LayerOne Technology Conference.
-
Re:I'm going to have to go with "blowhard"
And the biggest one that blows the numbers for perl - CPAN. People don't post all their perl components/modules/reusable code blobs to SF or freashmeat because other people don't expect to look for them there.
Second, this "count the stuff on SF" is a bogus argument in the first place since just because a person can choose their own tools on their own projects, doesn't mean they will post the most outrageously "good" stuff on SF.
For instance, (what I consider to be an extremely creative force in breaking the boundaries of thinking about network protocols) a non-perl example Paketto Keiretsu is not on SourceForge, IIRC. And I bet many other packages that would rate at the top of any set of "best written" metrics are not on SF for various reasons. -
DNS Polling?
Hmmm. I'm neck-deep in DNS code anyway; is there any interest in a protocol that would encode update times -- probably not the updates themselves -- in DNS?
The concept is that every time you updated your blog, you'd do a Dynamic DNS push to a RSS name, say, rss.www.slashdot.org's TXT record, containing the Unix time in seconds of the last update (alternatively, and this is how I'd probably implement it in my custom server, lookups to rss.www.slashdot.org would cause a date-check on the entry). The TTL of the DNS entry could be increased to limit the update frequency of clients.
If this is cool (I'm sure some RSS dev's are trolling these comments), throw me an email or reply here. I'll do the server side if someone will integrate support for it into their client.
--Dan -
It has nothing to do with the circles. Anymore.
*laughs*
OK. The last time this came up, it consumed about twelve straight hours of hackery. You can go ahead and play with some of the black boxed code using the demo version of Paint Shop Pro (or the latest Photoshops). Let me tell you: This has nothing to do with the circles. I was actually quite saddened by this fact, as I was planning to print up a "secure t-shirt" that would be unphotographable and unprintable by modern image manipulators. (It'd be a great excuse to talk at Black Hat wearing a T-Shirt *laughs*).
Alas, such adventures were not to be had. Experimenting with copy/paste between an unprotected app and the demo PSP, it quickly became clear that while some old copiers might indeed trigger on the inter-circle distances, counterfeiters now had a vastly more difficult system to fight. What there seems to be is some sort of size and position invariant image fingerprint function, probably wavelet based, that receives the full image after every large scale image transform, executes a fingerprint matching vs. a confidence value, and returns true or false depending on what the confidence threshold is set to. It's not perfect -- Stirmark does seem to cause the algorithm to occasionally stumble, though not consistently (see this gallery for details) -- but it's very good work nonetheless.
Certainly, it does not appear possible to manipulate the watermarking system to create new and unique images that appear, computationally, to still be money. That's a very good thing. And while it's somewhat problematic to have code refusing to obey its controller, the integrity of the financial system really is an important thing. Remember the privacy case for cash -- if paper money becomes something we all distrust, what exactly are we left with? The fault with the RFID approach is that it forces us to carry a reader to validate funds. If we cannot self-validate, we cannot trust (notably, the biggest weakness with the metal strip approach is that we cannot quickly notice that the metal strip has been removed -- the wealth is actually thus represented not by the bill but by an invisible strip of iron and plastic!).
I do not think that image manipulation software is the right place to put this code, specifically because it's too easy to write an image editor from scratch (what are you going to do, ban compilers?). Scanners and printers are however sufficiently single sourced that they're far superior places to trust that anti-counterfeiting logic will be in place. But then, that's just IMHO.
--Dan
-
Re:Smoothwall
A port scan is completely parallelizable, so the speed is only limited by bandwidth. Check out Paketto Keiretsu's port scanner. It uses raw sockets - no need to open a socket for each port.
-
Glorious Insanity
Exhibit One: Saul , right after Foo Camp.
"This...is going to change...my life..." he says.
"A wireless rotary saw?" says I.
"Ice racing."
Ah.
--Dan -
Re:Damn cube farms
Something tells me that this guy wouldn't mind working there either...
-
Damn cube farms
Gaze! Gaze upon the horrifying work conditions my roommate is forced to tolerate.
Man. What people will do for a paycheck. Poor guy, in a cube all day...
--Dan -
Reminds me of something . . . .
ZapMail, except this time it being legal comes from a digital signature AND a money trail, instead of just a money trail. It didn't work before, so I'm skeptical.
-
Re:Utter Bullshit
Canar,
That can be your last response or not, but trust me -- you're quite a bit off.
Sessions are indeed supported by ISO-9660 circuitry -- by the readers. Where they aren't supported worth a damn are in the writing process. Drag and drop for CD's w/ ISO-9660 does not exist because it cannot exist -- the file system is too static. DirectCD (and other CD-RW solutions) use a packetized file system -- another way for referring to sector oriented. Notably, they do not work by default.
That's the fact you've utterly missed. Let me describe the process of using an MP3 player that doesn't support the MSC profile (the one that makes the device show up as a hard drive):
1) Insert CD with driver and software.
2) Install software.
3) Insert device.
4) Launch software.
5) Learn software.
6) Manipulate it to move files as needed.
Compared to:
1) Insert device.
2) Copy files.
See, I can say this, because I'm looking at (no joke) my ELEVENTH MP3 PLAYER, just bought a few hours ago. (You may mock me for this.) I've used quite a few of these players. Things that don't show up as a drive -- don't just work -- well, they suck. FAT32 is the only game in town that "just works". The grand critique of DRM is that the user needs to learn a whole new interface paradigm, compared to what they're used to (just copy the files to the player and go, no need to view the latest bizarrely skinned application of the day).
Developing a competing standard isn't hard. Developing one that works on arbitrary machines -- that's impossible, because MS controls what ships. You being able to only use your player on your computer is only bad to you. Remember, part of the DRM game is suppressing file sharing; the idea of "heh, that's a cool song, lemme pull it off your player" is anathema. Anything that suppresses this is Good.
I'm proud of your dad, but *ahem* I'm no slouch either. MS is caught between a rock and a hard place -- they're traditionally the 800lb gorilla that's enabled as much access to their users as possible. (Little realized fact is that MS was the first company to embed MP3 into their OS, through an ACM driver.) But they're doing alot to try to woo Hollywood -- Black Hat Windows last year was held w/ the SMPTE meeting (hollywood video folks), and MS had rented out an entire theatre to try to woo the guys to Windows Media for Theatres. Pushing the industry has become a story of compromise, and compromise means your system follows restrictions you didn't select (like your DVD player showing you 45 seconds of copyright warnings / movie previews whether you want to see them or not).
Migrating people away from FAT, which (as a sector level interface) is very difficult to add fine grained permissions to, is part of such compromises.
This comment is just wrong, and I think you know it: "Businesses will be eager to have the opportunity to use a supported codebase for their FAT access and thus not have to deal with possible bug problems in their own code." Businesses are never, ever eager to change something that works. Ever. EVER. Ask your dad.
Not to mention I think some of the FAT implementations are in hardware. (Note, I said 'I think'.) Switching to the MS code would be a total rebuild.
What are you saying with regards to China? This doesn't affect them, because they'll just ignore the rules? So it doesn't matter that MS is trying to set them? That means a plan will fail, not that there is no plan.
I will make one claim of ignorance...I don't know what YHBT means. Certainly I don't think you're stupid; you're pretty well spoken. But you're a bit misinformed -- you see the general rule (people can use competing standards, a $0.25 per device is cheap) and ignore the particularities of the computer market (anything that doesn't "just work" fails enough to kill profit margins, and those teeny chinese co -
Re:What's the PCMCIA for?
-
Re:That Slammer analysis paper is quite interestin
One scary though was the comment that most of the previous fast propagating worms are latency limited, since they have to wait for a response from each scan they attempt. They speed things up by spawning multiple threads, but that's inefficient. Sapphire/Slammer got around that by being small enough to fit into a single packet(!) so that it didn't have to wait for a return message, but that small size sharply limited its possible payload. I'm sort of worried about a worm using advanced techniques such as scanrand. As mentioned in a previous slashdot article, it was able to scan an entire class B network in just 4 seconds. With that kind of performance, you could have a similar speed of spread even with a large, sophisticated, and malicious worm.
-
oops..
forgot the main reason of my post which is that he wrote a nice description for those with a clue, but without hardcore knowledge of the lower levels of tcp/ip. 'tis here
-
Re:hey
He should have spent more time writing decent error pages for his website, ones that don't reveal the absolute path directory structure to his stuff. Try clicking on the "paratrace" link from the slashdot story and you'll see this URL in your browser's bar:
http://www.doxpara.com/404.php?f=/home/effugas/d ox para/writings/docs/paratrace.xml -
Tunneling is not the answer.
This solution, far from creative or unique, offers nothing in terms of aiding in the creation of secure PUBLIC networks.
For example, a college campus can't be expected to teach every student, including the non-geeks how to setup IPsec, port forwarding with SSH, and all other kinds of neat things.
Granted, Dan Kaminsky gave a talk at DefCon this year on how to seamlessly tunnel your way through 'hostile' networks it still isn't as simple as just renewing your IP and being online.
One possible solution to secure public nets is similar to the way we validate PGP keys. Face to face signing parties. If I run a public net I'd like to know who is using it. How about you drop by my cafe and just give me your MAC address and I'll add you to the firewall's rulesets. Automatically you now can find out who is in promiscuous mode, who is using all your bandwidth, etc, etc, etc.
There are many other solutions that aren't as much of a hack as IPSec, ssh tunneling, or any of these other high level obfuscators.
Thanks,
David U. -
Sex, Drugs, and Rock 'n Roll
Forgive the mild indescretion of self-linking, but I was speaking of this very occurance a couple months back. The title makes quite a bit more sense if you read the link
http://www.doxpara.com/read.php/music/trinity.html
A number of writers here have stated that Eminent Domain should never be applied to the benefit of individual corporate providers; while I'd normally be inclined to agree, I note there is a strong compulsory licensing program (administered through BMI and ASCAP) that effectively gives radio stations the freedom to play whatever music they like on the air, as long as they hold to certain restrictions(no more of a certain band in an hour, they may only play "official releases"[grr], etc.)
Mass outlets of content should be more free and open, not less free and tightly controlled. As elements of culture become progressively more productized and trademarked(even our stadiums are monetized, at the cost of the legitimacy of our homes), I do believe it's clear that, at least conceptually, there is some dispersal of rights and "ownerships" over that cultural artifact.
Now, what's interesting is the question of whether an artist has the right to prevent their work from becoming such an artifact in the first place. Far from an insignificant argument--it's one thing for "The Red Shoe Diaries" to be compulsory licensed and sold online; it's another for the average person's diary to be downloaded from their computer and sold online! One conclusion you could reach might be that, once the product was commercialized by its author, *but not before*, it was fair game for automatic distribution. Such creates a fluid and "free" market without arduous restrictions on the flow of money.
This does seem to imply that buyers of a good have rights and expectations over that good, even before sale. One could imagine access within a convenient marketplace to be among them.
*scurries off to think this through further*
Yours Truly,
Dan Kaminsky, CISSP
http://www.doxpara.com -
Cluehunting
I wrote about this some time ago. (Actually, I devoted about four months of my life to writing about it, which never went anywhere. Thus, Dan Learns The First Rule Of Design: If Thou Can't Code, Nothing's Gonna Change
Details available at http://www.doxpara.com/cluehunting.html.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com -
Cocksmokin'!
faq code awards privacy slashNET older stuff rob's page preferences andover.net submit story advertising supporters past polls topics about jobs hof Sections 2/7 apache 2/11 askslashdot 1/27 awards 2/11 books 2/9 bsd 2/10 features 2/11 (2) interviews 1/31 radio 2/11 (2) science 2/11 (4) yro Andover.Net AndoverNews Ask Reggie DaveCentral Freshmeat ITR Senior Navy Official Slams Microsoft Posted by Roblimo on 07:21 AM February 12th, 2000 from the bigwigs-on-the-warpath dept. Here is a short article which indicates that the Navy is not happy with Microsoft. One paragraph: "There are shareware products that have better groupware features than those of Microsoft products, he said, drawing applause from the audience." ("He" is Undersecretary of the Navy Jerry MacArthur Hultin.) So, what Linux groupware products can we turn the Navy on to? HP OpenMail or Lotus Notes for the server. What we still need is a good Lotus client for Linux. [ Reply to This | Parent ] he's silly (Score:2) by TummyX on 07:43 AM February 12th, 2000 EST (#16) (User Info) There are shareware products that have better groupware features than those of Microsoft products, he said, drawing applause from the audience.
Ok then, give some shareware developer out there an early christmas present and buy his software. If not, then basically...shutup. Or was he hoping to get some beanie points by bashing Microsoft?
BTW, has he not been looking into Windows 2000? [ Reply to This | Parent ] Re: arg html (Score:2) by TummyX on 07:48 AM February 12th, 2000 EST (#20) (User Info) why was the 'smart' html/text hybrid removed? I keep forgetting the default now is text not html -
Minibars can be found here.
http://www.doxpara.com/minbars.html
X needs a HUGE overhaul in order for this to happen. Its probably best to chuck X and start from scrath, getting rid of all that baggage, but that will never happen.
> so much for innovation in linux.
I think the focus is building a stable platform with familiar tools to the exclusion of trying something new. (Enlightment being the notable exception.)
Cheers -
Time for a new strategy
As much as I love the EFF, having attended the trial I can see why we lost:
They said their stuff was stolen. We argued that we should be able to get away with it.
"Their secret wasn't protected enough" "They waited too long" "They knew it'd be broken" "They don't know for sure we got it from Xing" "Maybe they don't really have the right to sue us!"
Note, we didn't argue some greater good that is served by the taking, nor the harm implied by enforcing a unilateral license agreement upon a captive audience. We didn't claim they had no right to deprive us of rights, hell, we didn't claim a single right at all. This is coming out a hell of alot more bitter than it should, but I think this loss will make us stronger in the long run.
They proved they lost something. We tried to prove...something. I'm not sure.
Here's my summarization of the plaintiff's case. I'm not going to continue this document, but rather work on something completely different--something that directly addresses just exactly what the DVD CCA is trying to take away from us.
I'll be honest: I'm not happy with the way this turned out, and if I wasn't so crammed for time(I literally just secured long term housing for myself around 20 hours ago), I wouldn't even post this. But C'est La Vie.
=====DVD Redux: The Plaintiff's Complaints
=====================================
A Courtroom Analysis by Dan Kaminsky
effugas@best.com
http://www.doxpara.comAfter receiving a rude awakening from the Linux community--and, make no mistake, it's us they're fighting--the DVD Copy Control Association today stepped up their efforts to restrict the further release of the codes necessary to play a CSS-encoded DVD disc. Last time, they walked into court with the presumption of victory on their lips. This time, they fought with far more intensity. But with far more time to prepare, so did we.
As of the writing of this summary, it remains to be seen who will prevail.
For sheer lack of time(and because I have no idea if anyone wants me to finish), I will restrict my analysis to the opening case of the plaintiffs.
The plaintiff's case seemed dedicated to addressing the wounds it received at the TRO(Temporary Restraining Order) hearing. Extensive evidence was offered justifying the claim that the DeCSS code was derived from Xing--a fact not extensively challenged online, but a core doubt raised by the defense at the TRO hearing. Posts on Slashdot were quoted *heavily* by the plaintiffs as an attempt to prove that the Linux community was on notice that it would be illegal to decrypt the video stream.
Yes, this means that Ye Olde Anonymous Coward has been entered into the court record. Numerous comments from many parties to that discussion, including AC's, that contradicted the plaintiff's case and notified developers of their rights to reverse engineer were however conveniently ignored by the plaintiff. Such examples of distorted reality propped up all throughout the hearing; quite annoying, to say the least.
At this point, the Plaintiff's case turned truly bizarre. While the DVD CCA fell over itself to say it wasn't actually invoking the Digital Millenium Copyright Act, which may only be invoked in federal court, it made arguments under the act as a means to express and provide a perspective upon the Public Policy of the United States of America and, indeed, the 171 signing nations of the WIPO treaty. The relevance, argued the plaintiffs, was that since California's Uniform Trade Secret Act spoke of improprietity and not unlawfulness, the established public policy of the country should be used as the standard of what is proper and what isn't.
I must admit, I wasn't aware that playing a DVD qualified as a particularly unamerican activity. It might explain the civil disobedience campaigns(tshirts/contests) that the plaintiffs were so utterly disturbed by, however. Anyway, one wonders about the public policy the courts are supposed to apply when there's absolute consensus outside of Hollywood that individuals should be able to A) Play their own videos, B) Sell their own CDs, and C) Record their own TV Shows while still remaining good, patriotic Americans.
The case then moved into the International realm. Much noise has been made of the fact that reverse engineering of this type is generally quite legal in Norway, and indeed Europe as a whole. Both sides presented experts on the topic; needless to say, the opinions were not identical. pretty much claiming their expert made a more convincing argument than our expert. The plaintiff's expert, a Norwegian lawyer, claimed that the general law prohibiting unauthorized access to another individual's property, and particularly another person's data, should be applied in this case. On its face, this seems rather strange, since this case is about preventing a person from accessing data contained within their own physical property--the lawfully purchased DVD disc. But that's just my opinion.
The defendant's expert, claimed the plaintiff, was far more circumspect and wishy-washy, saying in effect that it could go either way and that the issue was undecided in norwegian courts. Since the plaintiff's answer was definitive and the defendant's answer was less so, the former ought to be considered more valid than the latter.
Returning to the core facts of the case, the plaintiffs reasonably argued that of all the defendants, none had provided an alternative source of the data aside from the Xing rip. Furthermore, the applicable law stated that prevention of *further* disclosure of a fact discovered after the usage to be a trade secret was an acceptable remedy, and since they weren't suing for anything more than such restraint(no damages, real or punitive), an injunction would specify the exact relief the law provided for. Since the defendants were on notice anyway, by both the passage of the DMCA and through "pervasive Slashdot discussions", this wouldn't be a surprising or inappropriate occurance.
Next, the plaintiff's primary counsel addressed the Linux interoperability argument. Given that a Linux developer would be willing to accept the arguably onerous terms of the CSS license(among which is that no imported DVDs may be playable, and that the source code be heavily closed and encrypted), the DVD CSS would be more than happy, he argued, to provide legal access for Linux users to play DVDs. Since IBM and Intel are both heavily invested in Linux, they argued, the means exists for a Linux DVD license to be signed.
The plaintiffs then trotted out the obligatory Coca Cola example: McDonalds sells Coke products, but Burger King only sells Pepsi. Just because you want Coke at Burger King, doesn't mean you get to steal the syrup off the truck, or break into Coca Cola headquarters and steal the formula. (I was unaware any DVDs had been stolen at gunpoint from UPS, or that Eric S. Raymond had led a crack commando team into the heart of Santa Clara for Operation LiViD-By-Any-Means-Necessary.) Because of this willingness, stealing the trade secret could not constitute appropriate self-help under the exceptions granted for interoperability. Sony's successes against the emulation community were raised, and the point that there was no fair use of trade secrets was made.
At that point, a new attorney for the plaintiff came up and began arguing against the EFF's extensive 1st amendment case. The EFF pointed out that the DVD CCA is seeking prior restraint against news sources(Slashdot itself is a named party), and that people merely want their traditional free speech rights to be enforced. Three responses were made: First, that the theft of trade secrets does not constitute a traditional usage of free speech rights. Second, that the defendants were not news sites(Slashdot?), and even if they were, they still couldn't post trade secrets. Finally, that the posting went beyond discussion--actual code was either directly there or being linked to.
The plaintiffs provided an example of what they'd like the judge to rule. It'd be acceptable to them for the San Jose Mercury News to provide commentary and analysis on the topic of the DVD decryption system, but to actually publish or link to the broken system would be a violation of trade secret law in their eyes. (As the defense later noted, such a linking has already taken place.)
In an interesting move, the plaintiffs used the Bernstein precedent that code is a form of speech to defend their position: The government was trying to suppress Bernstein's publication of his own encryption code. This is about a judge suppressing 200 John Doe's republication of someone else's encryption code. Of course, that implies that the code being republished was, in fact, someone elses--an access key does not a software product make, particularly when, as Sega v. Accolade decided, stripping the access key from a piece of software is the necessary to make other software interoperable.
The plaintiffs are continuing to attack even mere linkers--the whole concept of "instant access" to infringing sites scares the DVD CCA. One would think that the downsides of implicating the New York Times(as the defense pointed out) would override the advantages of a bit more protection against spurious links, but perhaps the DVD CCA sees things differently.
One thing the DVD CCA took particular offense to was the claim that the defendants were, in fact, helping them out by exposing the weakness of their system. They rather reasonably noted that, if the defendants were looking to help the CCA out, they could have sent an email, perhaps a real letter. Selling T-Shirts and running contests wasn't helpful.
On a sad note, the plaintiff's case concluded with some of the more vitriolic fear mongering and inappropriate references I have seen in quite some time. Beginning by claiming that the defense was trying to dismantle the entire IP system, massive(and rather irrelevant) hacks against military bases funneled through stolen Pac Bell internet account information, as well as the recent CDUniverse credit card scandal, were brought up as what could only be termed as character assassination against the "hackers" of the defense. Then, with the size of the DVD industry paraded in front of the judge as the sole reference to the irreperable economic damage that DeCSS and Linux players must surely create, the plaintiff made the entirely valid point that while the hacker community has embraced DeCSS, LiViD, and other CSS cracking systems, the mainstream has not yet adopted such tools. But what of the harms, should a mainstream that fought bitterly against record "spoiler systems" and has spent the last twenty years making audio mix tapes using their cassette recorders?
The direct harms that the DVD association brought to bear were summed up in a quote, in which it was stated that without legally backed copy protection, no media format(such as DVD Audio) could ever be good enough for Hollywood. And perhaps this is true. Manufacturing costs, the splurge of spending that accompanies repurchasing of previously owned content, now New And Improved, maybe even the profits from the conflicted interest consumer electronics divisions(Sony) just wouldn't be enough. Without the ability to technologically mandate what the courts would never accept--government enforced regional sale restrictions, arbitrary demands on DVD player manufacturers, a ban on personal backups and "mix DVDs"--perhaps we'd never see the big studios agree to new formats.
Oh well, I'm off to go play an 8-Track and catch some sleep, secure that they'll never give me a better quality music format for me to play with...
More next time, if you like.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com -
This Might Not Be A Good Thing!
Heh! Slow down!
Open Source Software is a wonderful thing, for innumerable reasons, but I'm not sure upper management(i.e. Congress/Parliament/Whoever) should be mandating its usage any more than it should be mandating its avoidance.
Res Ipsa Loquitar--Let The Facts Speak For Themselves. In this case, let the value of the software speak for itself--I'm a hardcore advocate of Open Source, but let the engineers on the front lines make the technical decisions, not someone whose top priority is to Cut The Budget. It's one thing to have a policy that explicitly states that it's acceptable--even encouraged--to use (L)GPL'd code for your projects. It's quite another thing to demand it, and to stigmatize the use of anything else.
Closed Source code shouldn't be presumed better because it costs many; Open Source shouldn't be presumed better just because it's free. Let the engineers be free to make their choices regarding what to use--hopefully, the track record of our development model, the quality of our code, and the immutability of our support(hi, RSA) will convince them to operate within the system we've created.
I'd rather convince the engineers than threaten their jobs. But that's my opinion.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com -
Creative: Doing it right, for profit
A bit more thought on this:
Wow, creative is setting up CVS/Bugzilla. They're not merely opening the source; they're not just trying to grasp a bit of extra PR out of the Linux mindshare gods(Taco and Hemos
This is amazing, and deserves a retrospective profile in around six months to see how this great, precedent setting experiment panned out.
Of course, Creative isn't dumb. As I mentioned in another post, Creative stands to have their card become the standard DSP component in innumerable Linux machines--their foresight in developing a programmable sound card is very likely to pay off handsomely in increased sales.
The economics of Open Source just got much more interesting.
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com -
Security *IS* Stability
Watching the development of Samba, I'm struck by the degree to which system stability and system security are related.
If you ever want to find a program that's easy to crash, look for one that's been designed without any security in mind. Similarly, if you wish to locate the most stable, trustable system, look for those where security is a critical specification to which every design pattern must adhere to.
This isn't that hard to understand. Software that's not designed to accept data streams that lack "sanity"(translation: Data formatted according to the protocol specification) from external procedures, processes, or network connections is doomed to, on occasion, accidentally recieve such "contraband" information and crash and burn from the time-bomb buried within.
Often, such missing sanity checks are the result of the following "famous last words" from a software developer: "That'll never happen--the code would never do that."
Not only can it happen, not only will it happen eventually, but because of those who would exploit such weaknesses--be they joyriders, or worse--it will happen to such a degree that customers will be harmed, and code will need to be patched and deployed long after it was written.
The same kind of bean counters that decide it's cheaper to let 100K people die from an exploding gas tank and settle each of those lawsuits than fix a problem that's embedded in a few million vehicles also work at computer companies. If it wasn't for those who would discover and address the flaws in the infrastructure of our increasingly critical(and simultaneously fragile and surprisingly resilient) technological lifestyle, the computer industry's accountants could honestly claim it would be much less expensive for customers to crash(making them more likely to upgrade anyway!) then for the company to build security/stability into their code.
There are some, of course, who criticize the willingness of hackers to release vulnerability information publically, primarily because the information can then be used (and abused) by the cracker set. There are two responses to this:
1) Software companies have a miserable record responding to anything but crisis. If I close my eyes and imagine a half million people like me(only much more experienced in whatever field they're specialized in), I completely understand. Regardless, it bothers me to know that, from what I've seen, security/stability patches are almost never issued unless there is an active exploit being used. It is a common theme for example code to be released with the disclaimer "I sent this to Microsoft a month ago and they never responded." I personally discovered a reasonably troublesome flaw in the Windows 9x TCP/IP stack--the most I've ever gotten back from Microsoft is a third hand message through a PR Flack that--you guessed it--"This is hardly ever a problem." And, of course--no fix.
I'd like to say YMMV(Your Mileage May Vary), but I doubt it. As for my second response...
2) I'll take some kid playing around with his first script long before I want to be attacked by either a competitor or (shudder) a hostile foreign government. Competing corporations(*ahem* I'll avoid getting Gibsonian for this one post) and hostile governments are quite unlikely to divulge their discoveries regarding infrastructural weaknesses, but the Hacker Ethic demands that Hackers do. Furthermore, it assigns significant prestige to those who not only describe flaws but provide effective solutions to them as well. It is these solutions that are the "carrot" delivered to server administrators in an honest attempt to strengthen the stability/security of the overall infrastructure, while the crackers of the world essentially form a constant, low-level "stick" that reminds administrators of the damage a full-scale, corporate or military infrastructure attack can levy.
Mandating security by governmental fiat is essentially ineffective, though there is no small irony as to the inititals of the Internal Security Service such a mandate would create. (For those who don't know, ISS is one of the more respected groups of security professionals.)
The continual, open dialog of hackers, however, is responsible for the fact that we actually do have a pretty extensive Certificate Authority architecture backing online Credit Card Transactions. Without hackers raising the red flag, businesses would have ignored the risk so as to increase online purchasing at lower initial investments, media would have ignored the faults so as to not upset the advertisers, and government would have stayed out of the way so as to not lose any votes from Big Business. (Granted, it's likely the Hackers got so much press in the mid-90's because preventing people from feeling secure inputting CC#'s online benefited certain uberconglomerate interests that weren't ready to go online just yet and had a large stake in people actually *gasp* going to a store/mall. But the same guys who spoke about what you shouldn't do online also emphasized the SSL solution to transactional privacy, thus training millions of people to look for the lock before sending in their card #. That the SSL system is actually reasonably air-tight considering its ambition is genuinely impressive.)
I have, of course, spoken of only one subset of hackers--the network security gurus that I worship and hope to one day be among. Each of the many flavors--and yes, they all blend together in one form or another--of hackers bring something to the table that, yes, is of significant social import.
It'll be interesting when the sociologists turn around and start analyzing the scene in earnest...
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
-
Wearable Computing's Future
Wearable computers will take off when you don't look like a hardcore geek using one.
Before you jump on me, keep in mind I am a hardcore geek , so I'm allowed to say stuff like that.
You can't ask most people to have some kind of crazy display contraption(and watch--they'll call it almost exactly that) over their eye. They'll run in fear. The display form factor that the market will adopt en masse(there's some serious pent-up demand for this) are Sunglass Displays. When Ray-Ban can sell you a monitor, believe me, the marketing machines will go into their own peculiar form of orgiastic frenzy faster than you can ask what kind of coca-leaf derived substance the Patent Office was respirating at the time it gave Xybernaut its rather interesting portfolio.
In the mean time--and here's where I expect the CIA-derived organization to eventually move towards--we're almost assured to see some form of wristwatch display come into popularity. At first, it'll be rather clunky, but with the assistance of engineers from one of the design/engineering fusion multinationals(er, Sony) some very intriguing designs should come through. The combination of a small microphone/bone-amplified miniature speaker that clips behind one's ear and displays that integrate with whatever modality you're presently in(a watch for on foot, your car's HUD when driving along, etc.) will bring wearable computing into its place as one of the Next Big Things of the 21st Century.
The fact that lots of servers will need to be sold to meet the need of all those wireless wearable clients will mean shockingly high levels of hype from companies like Sun. But to go out on a limb here, VA Linux may end up making the biggest killing--anyone listening to Linus lately knows he's fallen head over heels for the embedded environment. The amount of press that millions of Linux/Transmeta wearables will create should generate significant corporate interest in Linux servers to match.
You can thank(or blame) this one on Microsoft for their "Windows Clients means you should have Windows Servers" marketing point.
Comments?
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
-
Re:heads up
The phrase "Core Competency" is a [tm] trademark of Gary Hamel, a management science professor at the London Business School.
Did he come up with the concept that I named my paper after? Hurm, after I clean it up a bit(some significant alterations are in order after that rather interesting session I had at LWCE), I may toss the paper over to him for evaluation.
The term is reasonably public domain(hell, I've heard of it), but if he's the inventor of the field of thinking, it would behoove me to understand a bit more of what his theories are.
(For those who are wondering WTF all this is about--Core Competencies is an essay regarding the economics of Open Source. I brought it up when discussing the diseconomic meanderings of everybody's favorite registrar.)
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
Once you pull the pin, Mr. Grenade is no longer your friend.
