Slashdot Mirror

scubacuda writes "Glenn Peterson, attorney at McDonough Holland & Allen, represents 'Jane Doe,' one of the first to fight the constitutionality of recent RIAA subpoenas. In this GrepLaw interview, Glenn gives his thoughts on recent RIAA strong arm tactics, Matt Openheim's assertion that Jane Doe's arguments have 'already been addressed by a federal judge,' and the danger of giving subpoena power to anyone pretending to have a copyright claim."

Luciq asks: "The other day I was cleaning out my closet and started reminiscing about all the good times I had with my 33Mhz 486DX. I got the machine 10 years ago just as the first Pentiums were coming out. With a 33Mhz processor, 212MB hard drive and a whopping 8MB of RAM, I could surf the net at 2400 baud, manipulate photos and even play games with full-screen video like The Seventh Guest. Today I use an Athlon XP 2400, 80GB HD, 512MB [not 512K!] RAM. While I can do some neat things with it, I must say that it's fallen short of the wonderous expectations I had for such a system in 1993 (no immersive VR?, no seamless voice recognition?). What expectations did you have for today's PC, 10 years ago and how does the reality match up? What do you expect from computing, 10 years from now?"

scubacuda writes "/.ers interested in the recent editorial on real $ in MMORPGs might also be interested in a GrepLaw interview I just conducted with Edward Castranova (expert witness in the recent Black Hat Hacker Court) about how his work on synthetic economies affects larger law and policy issues on the Internet. Ted has some interesting thoughts, particularly how online game-based economics (Star Wars Galaxies, EverQuest, Lineage, etc.) will eventually serve as the bases for "real governments." Should mainstream economics journals take his work on gender and virtual economies seriously, Ted promises to eat his virtual hat."

Well, one science journalist's opinion, anyway. Charles Seife writes for Science magazine and is the author of Alpha and Omega: The Search for the Beginning and End of the Universe. These are his answers to your questions, and they're very detailed, to the point where you may want to set aside more than a few minutes of quiet time to read and digest them. Q1) "Publishing hype" by BobTheLawyer (#6606631)

A1)I'm not embarrassed at all because it's not hype. Scientists now know how the universe will end. Of course, as with all things scientific, there's a big honking asterisk on the word "know," but before I get to that, let me explain why I feel justified in making such an arrogant statement.

We're in the middle of a scientific revolution, in the honest-to-god paradigm-shift sense. This revolution started in 1997 when two groups of astronomers, the High-Z Supernova Search Team and the Supernova Cosmology Project used the bright flashes of a particular type of dying star (a type-Ia supernova) to measure the expansion of the universe at different times in the past. Since then, a whole raft of astronomical observations -- of faint patterns in the afterglow of the big bang, of distributions of galaxies, of the composition of intergalactic clouds of gas, of distortions of light going around massive bodies -- have all forced cosmologists into a remarkable consensus about the composition of the universe and, yes, its fate.

Just to give you a little taste of what the difference in the state of knowledge was like: in 1997, if you asked an astronomer how old the universe is, you'd get an answer somewhere between 12 and 15 billion years. Now, you'll get an answer of 13.7 billion years, plus or minus about 100 million. That's a big jump in precision. Similarly, before 1997, nobody had a clue how the universe would end; now, cosmologists agree on its fate. Some of the details haven't been worked out (what an understatement!), but the gross picture of the ultimate fate of the cosmos seems to be pretty well established for the first time in history. And by the end of the decade, a lot of the details will be fleshed out.

The ongoing revolution isn't just astronomical; it's physical. A decade ago, nobody knew whether neutrinos have mass. (For those who aren't particle physicists, neutrinos are particles that so rarely interact with matter that they can easily pass through the Earth without noticing the big chunk of mass they've passed through. This property makes them exceedingly hard to study.) Now, neutrino physicists are in accord -- and they've concluded that neutrinos, collectively, weigh about as much as all the visible stars and galaxies in the universe combined. High-energy physicists are using an accelerator in Long Island to recreate the condition of the universe a few microseconds after the big bang. By next year, they will formally announce the creation of a new state of matter that existed only in the very, very early universe. (There are alreadystrong hints that they've succeeded.) And another particle accelerator under construction in Geneva is very likely going to discover the particle responsible for exotic dark matter. (More on this shortly.)

All these experiments, all these observations, are pointing in exactly the same direction; they reveal the composition of the universe and its fate. But as with any good scientific revolution, such as relativity or quantum mechanics, it generates more questions than it answers. Scientists now know how the universe will end, but that understanding comes at the cost of a new mystery in physics.

As to the asterisk on the word "know," scientists are acutely aware that their theories are subject to revision. But at the same time, they have good reasons for being confident about their theories -- and they are more confident about some theories than about others. The new cosmological picture that's emerged has a darn high confidence rating; extraordinary claims require extraordinary proof, and the scientific world wouldn't accept the ideas of dark matter, much less dark energy, if there weren't a number of independent lines of evidence that forced scientists to make that conclusion. And while they're not confident about many of the details of the cosmos and the mechanisms that shape it, they are pretty sure that the overall picture is correct. (More on this coming, too.)

Q2) [Almost] Serious question! by Noryungi (#6606694)

and

Q3) Why does the rate of expansion change? by Anonymous Coward (#6606745)

A2,3) The universe will end in... umm... you really want me to give away the ending to my book?

Actually, I reveal the answer in chapter four, because the understanding of the fate of the universe is just the beginning of the current cosmological revolution. So it's not a spoiler to say...

-- drum roll -- the universe will die a heat death, or "Dark & Cold" by your terminology.

In a big bang universe governed by the laws of general relativity, there are two possibilities. (Actually, there are more than two, but all the cases boil down to two real outcomes.) Big crunch or heat death, fire or ice.

The fate of the universe depends on how the universe expands. In general, things that expand cool down and things that are compressed heat up. (This is what causes a propane container to feel so cold after a barbecue -- all the gas that expanded.) After the big bang the universe was extremely hot and was seething with energy. As it expanded, it cooled; free-roaming quarks condensed into protons and neutrons, and wound up as hydrogen, helium, and a handful of other light elements and isotopes. About 400,000 years after the big bang, the universe cooled enough so that the electrons could combine with the nuclei and form neutral atoms. Now, about 14 billion years later, the universe is a pretty cool place.

The expansion of the universe is like a cannonball shot into the air. As the cannonball flies ever higher, the force of gravity tries to drag it back to earth, reducing its upward velocity and slowing it down as it zooms upward. If gravity is very strong, then the cannonball rapidly loses its speed and quickly comes crashing back to the ground. On the other hand, if gravity is very weak, then the cannonball might escape the pull of the earth entirely and zoom away into outer space.

Similarly, the big bang gave the universe an initial cannonshot of expansion. If the mutual gravitational attraction of the objects in the universe is very strong (if there's a lot of matter in the universe) the expansion will slow down, halt, and eventually reverse itself. After the cooling phase of expansion, the universe will begin to swallow itself, getting smaller and smaller each day. This will make it heat up. The skies will get brighter and brighter as galaxies and stars get closer and closer together, and eventually, the universe will become a bath of radiation once more. Electrons will separate from atoms, atoms and then protons and neutrons will shiver into their components, and the universe will collapse in a "big crunch," a reverse big bang. The cosmos will die a death by fire.

On the other hand, if there's not much matter in the universe, then the expansion of the universe will continue forever. The expansion will slow down, but it will never halt and never reverse itself. The universe continues to cool down, and for a long time, space will look pretty much as it does now. Stars will be born and die, and galaxies will age. The night sky would get darker and darker as distant objects get too dim to view, and eventually, as the hydrogen in the universe is consumed, stars and galaxies will begin to wink out. Many billions of years hence, the universe will be a lifeless soup of dim light and dead matter. It will be a death by ice.

In 1997 and 1998, the two supernova teams used the brightness of distant supernovae to measure the rate of expansion at different times in the past. (Because the speed of light is finite, looking into the distance is the same as looking into the past. This causes no end of tense problems when writing a book about cosmology.) What they found was absolutely gobsmacking. Not only was the universe's expansion not slowing down very much -- it was speeding up! The cannonball was zooming into the air faster and faster as if it were propelled by some sort of weird antigravity force. Not only was the cannonball going to escape, it is so OUTTA HERE! This means a death by ice.

Yegads -- an antigravity force. This was a really hard thing for scientists (and probably you) to accept. But there's a number of different lines of evidence that support the idea, and in the book I go through those lines of evidence in great detail. I'll have to settle for a brief summary here. In 2000, a balloon experiment known as Boomerang took very detailed pictures of the ubiquitous afterglow of the big bang, the cosmic microwave background (CMB). This afterglow has hot and cold spots in it, and for years, scientists have been making very, very detailed predictions about the size and distribution of those spots. The results of the Boomerang experiment and the DASI and WMAP experiments matched those predictions incredibly well, giving scientists great confidence in the underlying theory. It also allowed them to figure out the amount of matter and energy in the universe, and 73% of the "stuff" in the cosmos was dark energy, this antigravity force.

There are a number of other lines of evidence, too; the current distribution of galaxies, for example, implies the presence of an antigravity force, and just last month, scientists made a very nice measurement of something known as the late integrated Sachs-Wolfe effect. This effect can't occur unless you have something like dark energy counteracting gravity's pull.

Unfortunately, a fuller exposition requires a lot more writing -- it takes up several chapters in my book. (Shameless plug). But in summary, there's a number of independent observations that all point to the existence of a dark energy. Furthermore, the theories underlying the idea have made very specific predictions that have been verified with incredible precision. It's extraordinary stuff, but no matter how scientists look at it, they're forced by extraordinary evidence to make the same conclusion.

Yes, it's true that scientists don't know the mechanism of dark energy (though they're not entirely at sea) but there's little doubt that the cannonball is zooming into space faster and faster. They don't know precisely why, but the universe is being pushed toward its icy death by an antigravity force. Scientists are watching it happen.

And you don't need to wait billions of years to know the outcome -- you don't need to observe something directly to conclude that it's going to happen. The planet Pluto was discovered in 1930. So why don't people object to the statement that it takes about 250 years to complete an orbit? Just as you don't have to wait until 2180 to confirm the conclusions of Newtonian dynamics, you don't need to witness the end of the universe to be able to figure out its fate or validate the theory that leads you to that prediction.

Q4) Dark Matter by notcreative (#6606772)

A4) You are correct; the nature and location of dark matter are crucial puzzles in modern cosmology, but I think that the answers will be pretty much in hand by the end of the decade.

I've already mentioned results (most notably WMAP) that reveal the amount of "stuff" in the universe, and 73% of it is dark energy. The rest is matter. But the grand total of the matter locked up in visible stars is a mere 0.5% of the stuff in the universe. What is the other 26.5%? That's dark matter, and, in fact, there are two different types.

Scientists have known for decades that most of the matter in the universe is invisible to telescopes. In the 1960s, Vera Rubin measured the motion of stars wheeling around the center of the Andromeda galaxy and concluded that there had to be a lot more matter pulling on those stars than could be seen.

Despite what some contrarians say, dark matter isn't dogma; viable alternatives, like Moti Milgrom's MOND are taken seriously, if not accepted. Unfortunately, all of the alternatives, including MOND, fail in crucial ways. Besides, you can see dark matter, both directly and indirectly. The MACHO and OGLE projects see the twinkle of stars caused by a passing chunk of dark matter, and they can see the distortion of light caused by a huge amount of unseen mass sitting on the fabric of spacetime. (Distant galaxies are stretched into arcs around this gravitational lens.) This is allowing scientists to figure out just where dark matter resides. But at the same time, a number of observations lead scientists to conclude that the minority of the matter (dark or light) in the universe is ordinary, atomic matter -- the stuff of stars, planets, and people. Again, it will take too long to describe all the lines of evidence, but one powerful way of measuring the number of atoms in the universe is to look at the proportion of hydrogen to deuterium, helium, and lithium in primordial gas clouds. In the first three minutes of the universe, atoms were fusing, just as they do in a hydrogen bomb. The universe was a giant pressure cooker, turning protons and neutrons into heavier elements. If there are a lot of atoms, then there is a lot of fusion and a lot of heavy elements made; if there are not very many atoms, then the universe winds up being almost entirely hydrogen. By looking at the ratios of heavy elements to light elements, scientists concluded that atomic matter makes up about 4% of the "stuff" in the universe -- which is precisely what other measurements, like the CMB ones -- imply, too.

So, 27% of the stuff in the universe is matter: 4% "atomic" matter, leaving 23% to be made of "exotic" matter, stuff that's not made of atoms. I've already described some of that exotic matter; neutrinos make up about 0.5% of the stuff in the universe, about the same as the visible matter in the universe. What's the remainder?

That's the big open question, but one that I'd wager will be solved by the end of the decade. There are very good reasons -- particle physics ones, rather than cosmological ones -- for believing that the main constituent of dark matter is a proposed particle known as the LSP. If it is, then the LHC accelerator in Geneva will find it. If not, then the LSP almost certainly doesn't exist and the puzzle will be compounded -- but I think that scientists are extremely optimistic. Again, there's lots more detail in the book about the justification for this.

Q5) variable constants by Cally (#6607000)

A5) The point's well taken, and I'll get to it after a few remarks.

First, you're right in that the supernovae serve much the same purpose as Cepheid variable stars do -- they're both objects of known brightness, or "standard candles," that allow astronomers to make a precise measurement of the distance to a faraway galaxy. However, they are not the same thing. Cepheids are stars that pulsate and the rate of that pulsation reveals its intrinsic brightness. They're what Hubble used to spot the expansion of the universe in the 1920s, but they're relatively dim and impossible to find in very distant galaxies. Type-Ia supernovae are standard candles that are much, much brighter than Cepheids, and so can be seen halfway across the universe. (And as you note, since distant supernovae mean ancient supernovae, they reveal the expansion rate of the universe billions of years ago.)

Second, the time-varying speed of light (or more precisely, the time-varying fine structure constant) is a controversial idea. The scientists that made the observation in question are pretty solid and they're taken seriously. However, my impression is that mainstream thinking is that the results are due to a systematic error. That aside, the effect, even if real, is very small, and it has nothing to do with interpreting the data from standard candles. The interpretation there is quite well established; there's little question that scientists are seeing an expansion of the universe;. Alternative theories, like tired light, fail in countless ways and scientists have even seen the relativistic time dilation caused by the motion of the distant object.

But, yes, it's natural for a layperson to conclude that the concordance cosmological model is looking increasingly kludge-y, and you're naturally led to wonder whether scientists are trying to prop up a failing model with the equivalent of epicycles or aether. I don't think this is the case for a few reasons.

For one thing, the theory isn't really getting added to and made more complex; it's getting subtracted from and being made more simple. This seems counterintuitive, but it comes from the fact that modern big bang theory is really a class of theories, rather than one set-in-stone dictum about the way the universe is. All these theories agree on the basic physics about the manner of the universe's birth, the forces that drive the universe, and the physics behind them; the difference between the theories are the values of a handful of parameters that are not predicted by the theory. These parameters are inputs rather than outputs, and by pinning down the values of these inputs, the acceptable class of theories gets narrower and narrower.

Dark energy is one of these inputs. Although nobody took it seriously before 1998 -- everyone thought that the value of the parameter in question was zero -- it was lurking there nonetheless. It turns out that this parameter is not only non-zero, it's really big, much to everyone's surprise. But this doesn't add complexity to the model, especially since other parameters, such as the "curvature" of the universe as a whole, which many physicists thought would be non-trivial, turn out not to be important after all. (In other words, the universe seems to be slate flat, rather than saddle-shaped or sphere-like.)

So, from a mathematical viewpoint, the model is no more complex than it was in 1997, and is, in fact, significantly leaner. But what about from a physical viewpoint? Dark matter and dark energy seem to fly in the face of Occam. But here, too, the increase in complexity is much less than it appears. Long before this cosmological revolution, astronomers knew that dark matter had to exist; more recently, they've begun to see it. Even without worrying about cosmological questions, astrophysicists had accepted the existence of dark matter. Cosmological measurements like WMAP showed that these astrophysicists were right -- it was an independent confirmation that dark energy exists and that it comes in two forms, something that other astronomers had concluded a while ago.

Dark energy, on the other hand, has more claim to being a "hack" to the theory. It really is something new and unexpected (even though it was always a mathematical possibility, nobody in the physics world suspected it actually existed.) Nevertheless, the groundwork was already there, and modern big bang theory implicitly requires the existence of a form of dark energy in the very early universe. And since the 1930s, scientists knew that even the deepest vacuum is full of energy and can exert pressure (something known as the Casimir effect, which I describe in this book and in my previous book, Zero: The Biography of a Dangerous Idea). Thus, the idea of dark energy wasn't completely alien to physics before 1997, and in some sense, it was a necessary component.

Yes, it's possible that scientists are looking at the cosmos in the wrong way, and somebody will establish a simpler, more elegant theory that takes all these threads and weaves them together. (More on this shortly.) But at the moment, far from having a kludged-up theory, cosmologists have a leaner (if weirder) theory than ever before -- one that makes very precise predictions that are getting verified with stunning accuracy. I think this argues for increased confidence in the theory rather than for increased fear that it's falling apart.

Q6) Universe's container by bios10h (#6606748)

A6) It freaks a lot of people out. There's a lot of philosophical problems with having an infinite universe -- for example, if the universe is truly infinite, and if, as scientists believe, the number of quantum states of a finite volume is finite, then it's hard to escape the conclusion that, some great distance away, there's a bizarro-you on bizarro-earth reading bizarro-Slashdot. On the other hand, there's no positive evidence that I can think of that the universe is truly infinite; it's just the sparest conclusion in a mathematical sense, if not a philosophical sense.

But an infinite universe is not a foregone conclusion. Earlier this year, Max Tegmark at the University of Pennsylvania published an intriguing paper that looked at slight anomalies in the WMAP data that seem to imply that the universe is not only finite, but shaped like a donut. Nobody takes the idea terribly seriously, not even the author, because there are other statistical tests that seem to rule the donut-shaped universe out. But it's the sort of thing that people are looking at very closely.

Whether it's finite or infinite, in a mathematical sense, there's really no need for the universe to be "in" anything -- there are models where our universe is embedded in a higher-dimensional space, but there are models where it isn't. Philosophically, though, I don't see any advantage to embedding the universe in something bigger -- as you say, it just punts the problem forward. (Who, then, will contain the containers?)

It's one of those things that is hard to get comfortable with -- and even when you accept it, it sometimes can cause pangs of uncertainty. Quantum mechanics does this, too... it's just something that's hard to wrap your head around. Take solace in the fact that it's hard for everyone else, too.

Q7) How ultimate is the end of the universe? by Lane.exe (#6606766)

A7) If there were a collapse-type universe, yes, there could be a reboot and a new big bang. (And if Microsoft built the universe, a reboot would be coming sooner rather than later. *duck*)

In fact, the theory behind the cosmic microwave background stemmed from calculations to see whether this was possible. Remember the expansion-cooling/contraction-heating bit I mentioned a while ago? A physicist at Princeton was trying to figure out whether matter would break apart into its constituents in a collapsing universe, so he looked at how the universe heated up as it compressed. He then realized that his calculations worked equally well in reverse -- the young expanding universe was very hot but cooling -- and it had to have an afterglow: the CMB.

There are restrictions on this rebirth argument, though. For one thing, the fact that the universe will expand forever prevents a big crunch in our future, so we're at the end of the line if such a line existed. And in 2001, Alan Guth proved a mathematical theorem that shows that bang/crunch/bang universes can't have an infinite history; they must have started some finite time in the past. (Though there are a few ways around the theorem if you reject a few assumptions.) So yes, it's possible, but there is no reason to believe it actually happened, and there are very good reasons for thinking it won't happen in the future.

Q8) comparable ramifications? by sstory (#6606658)

A8) I'm not going to give the usual B.S. answers about spinoffs (though there are some). And I'm not going to evade the question by saying that genomics hasn't yielded any transformation, because the potential is certainly there. But I will answer this question obliquely.

If I asked you, "Quick! What's the most important scientific achievement of the 20th century?" how would you respond?

You would probably answer relativity or quantum mechanics, or perhaps the Apollo landings. Probably some would say the atom bomb. I suspect that only a handful of people would mention the computer, and even fewer people would say penicillin. (Am I right?)

Science has two faces -- it can transform society (for better or worse), and it can advance human knowledge. The two are not inextricably bound, though they often come together.

Relativity was a profound shift in our understanding of the way the universe works, but you have to look pretty hard to see a direct effect on our lives. Conversely, penicillin wasn't a central advance in understanding biological systems, but it affected all of us -- I suspect many people here on Slashdot wouldn't be alive today without penicillin and its descendants.

For me, though, relativity is a greater scientific triumph than penicillin -- even though penicillin is probably much more important to us. It altered our view of the universe and gave us a greater understanding of the fundamental laws of the universe -- it was a philosophical advance as much as it was a technical one. That's why we seem to admire Einstein more than Fleming and Newton more than Jenner.

The present cosmological revolution won't change our lives dramatically; heck, a good spam filter would probably have more direct effect on our quality of life. But at the same time, it will finally answer some of the most ancient questions of humanity -- where did the universe come from and how will it end -- and when it ends, we will have a firm grasp of the answer of the latter if not the former. It will be a towering intellectual achievement, and I think that is what will set it apart from even the human genome project.

Q9) What is the next paradigm shift? by geeber (#6606890)

A9) I disagree with the idea that there's no paradigm shifts left -- indeed, I think we're in the middle of one now. I think that it will be associated with one in the Standard Model of particle physics that will begin before the end of the decade.

It's hard to say where future paradigm shifts lie, but there are lots and lots of outstanding questions in science, some of which are incredibly basic, yet totally out of scientists' reach. For example, neurologists have a very good idea about how individual neurons work -- how they connect and communicate. But when it comes to explaining how a large sloppy hunk of neurons becomes a conscious entity, they're completely at sea. I don't think there's even a good definition of consciousness, which is crucial if you're going to study it seriously. Even more basic -- scientists are struggling to define what life is. There's a heck of a lot more work to do, and plenty of room for paradigm shifts.

Speaking of paradigm shifts, I'd like to take a bit of issue with the term (which I've used myself a number of times in the responses to these questions.)

For those who don't know, the idea of a "paradigm shift" comes from Thomas Kuhn's Structure of Scientific Revolutions, a seminal work in history of science. While I think that Kuhn's idea of a paradigm shift has a lot of merit -- models and philosophies do change suddenly and dramatically in the face of mounting conflicting evidence and despite resistance -- I think the term itself is misleading. It implies the complete abandonment of one idea and acceptance of a replacement.

In my view, this is not the way modern science works -- I think that science is cumulative. Each model extends and corrects the previous one, and while there might be a dramatic shift philosophically, there is almost never a dramatic shift physically. Relativity, for example, made a profound change in the way we think about time and space and gravity, yet the functional difference between Newton and Einstein is pretty small. All these complicated tensor equations are approximately equal to Newton's laws in the vast, vast majority of cases -- it's only under conditions of extreme gravity, extreme speed, extreme energy, or extreme time that relativistic predictions diverge from Newton's. Similarly with quantum mechanics.

While I think that relativity and quantum mechanics are paradigm shifts, they're not rejections of the Newtonian picture as much as they are extensions. The paradigm shift can be huge philosophically, but its effects tend to be small in magnitude. And with these small corrections, scientists extend the applicability of their model of the universe -- they can explain the orbit of Mercury or the photoelectric effect -- and in the cases where Newton's laws were strong, these models boil down to Newton's laws.

If I remember my Kuhn correctly, he explicitly rejected the idea of cumulative science; he really saw each model getting completely replaced by its successor, rather than as an extension -- and this leads, at least in my view, to the excesses of postmodernism.

I think that this issue goes to the heart of the questions about how scientists can be sure about the end of the universe if their models can be replaced at any time. To that I'd argue that, yes, all models are provisional, but even with "paradigm shifts" models are usually extended rather than replaced. The central findings of the previous model still hold with good accuracy in most cases, even if the philosophical underpinnings are badly shaken. Maybe scientists are missing some crucial understanding that will simplify the way we look at the universe -- and scientists are seriously pondering alternate models to things as widely accepted as the inflationary big bang -- but even if such a shift occurs, it probably won't invalidate today's discoveries.

Q10) What will it mean? by boatboy (#6607285)

A10) One thing's certain. If I knew the answers, I'd be even more insufferable than I am now.

Seriously, I'm not sure that knowing the answers would have a profound moral and sociological effect. While I think that asking and answering big questions is a hallmark of a prospering society, a society doesn't necessarily draw strength or stability from its intellectual curiosity. (For example, Athenian democracy lasted only about 80 years if I remember right.) Even the most profound philosophical ideas can wind up having little real effect on the everyday functioning of a civilization -- for example, I think that Godel's incompleteness theorem hasn't changed society in the slightest.

As for the next big question, I think there are some in biology: what is life? What is consciousness? How did life arise? Are we alone in the universe? In physics, I think there are profound questions yet to be answered in a realm that I'd describe as "information theory" in the broadest sense -- what's really going on in a black hole? What makes quantum mechanics so weird? And I think that answering the question about the true nature of dark energy will probably have to await a future cosmological revolution. But one of the wonderful things about science is that you don't really know what big questions are within your grasp until you begin to grasp them. We'll know the next revolution when it appears.

Editor's note: Due to long answer lengths, we linked to the questions instead of running them directly here in order to keep this page from getting too large. This was an experiment. If you have comments or questions about Slashdot interview formatting, please email Roblimo.

scubacuda writes "Cal State Fullerton's Edward Castronova (who recently wrote an excellent analysis of gender inequality between male and female Everquest avatars) has just updated his notes on 'Hacker Court', a mock trial held at Vegas' Black Hat Conference on whether virtual items destroyed during the hack of an online video game constituted real loss. 'No verdict was reached, but the jury and audience agreed that the damages were real,' says Castronova."

mpawlo writes "I have just published an interview with Mr Brad Templeton, chairman of the board of the EFF, over at Greplaw. Mr Templeton presents, among other things, his view on spam and freedom of speech among. If that's not enough, there is also a rather unique tongue-in-cheek interview with Professor Lessig."

mpawlo writes "I have just published an interview with Mr Brad Templeton, chairman of the board of the EFF, over at Greplaw. Mr Templeton presents, among other things, his view on spam and freedom of speech among. If that's not enough, there is also a rather unique tongue-in-cheek interview with Professor Lessig."

Slashback with a followup on the perpetual motion DeLorean, a word on RIAA bank-account-jacking, a reminder about the fast-tracked vote on software patents in the EU, the real meaning of "high speed USB" and more. Read on below for the details.

Now even less than a week ... mpawlo writes "As reported by Greplaw, although I am still looking for further confirmation, it seems like the EU vote on software patentability has been moved from the late fall to June 30, 2003. Yes, that is in one (1) week. If you have more information and another source - please comment on this news item."

Mikael writes: "Personally, I find it somewhat disturbing from a democracy perspective that this proposal seems to be fast-tracked in the middle of the summer, when most Europeans want to focus on whether they should have strawberry or vanilla ice cream. In Sweden, we also got our Swedish version of the DMCA this week. I guess the ice cream will have to wait."

DoSthAboutIt points out that "A 'Petition for a Free Europe without Software Patents' has gained more than 150000 signatures. Among the supporters are more than 2000 company owners and chief executives and 25000 developpers and engineers from all sectors of the European information and telecommunication industries, as well as more than 2000 scientists and 180 lawyers. Companies like Siemens, IBM, Alcatel and Nokia lead the list of those whose researchers and developpers want to protect programming freedom and copyright property against what they see as a 'patent landgrab.' The whole article can be found here, including some statistics like signatories by country"

The story of Peng. mantispraying writes "Looks like the college student who settled with the the RIAA for $12,000, his entire life savings, has recouped all of his money thanks to a very generous file sharing community. Also, the search engine he created that got him in trouble is back online, for demonstration purposes only, of course."

Reader T points out that while one of the students who lost his life savings to RIAA has made it back through PayPal donations, "the other, Dan Peng, is still short about $12,000. Brother, can you spare a dime?"

I'd prefer the garrote and the stick, but hey. Mark Ferguson writes: "I attended the FTC spam forum. It seems I was on their call list :-) I parlayed that into getting several others on the panels as well. While there I spoke with bulk emailers and other industry folks. Some people defined Confirmed OPT-IN to mean you sending a confirmation that the email address was subscribed so they were doing double, confirmed OPT-IN.

My heads spins.

What I figured from what I learned was these folks truly refused to accept real definitions the Service Providers have been using for years so I decided to do a site for just this. ... Anyway, reboot, aka Andrew Cockrell myself and another built The Carrot and the Stick to explain email, define the best practices and to get people to abide by them.

Thoughts, comments and/or suggestions?"

Sooner or later, that DeLorean's going to land someone in jail. hackwrench writes "According to channel WSMV news, Alternate Energy Inventor Carl Tilley's compound was raided. Tilley was previously mentioned on Slashdot here."

Tilley had announced the then-upcoming demonstration of his perpetual-motion DeLorean.

My nanodots can fit inside your nanodots! Rocky Rawstern writes "I recently had the distinct pleasure to interview one of my favorite authors, Wil McCarthy. Upon completing three of his latest books - two sci-fi and one work of non-fiction - I realized that others would probably enjoy his ponderings as much as I. The questions for this interview stem from my own interest in programmable matter, and the awe-inspiring possibilities raised by Wil in his book Hacking Matter."

How to succeed (not necessarily) in business. jameshowison writes "A few months ago Ask Slashdot published Kevin Crowston's question on what makes open source software successful ... well the results are in and the paper typed. We ran the responses through a funky content analyser (called Grad Students). The metrics that academics and the industry have used for years simply don't work for OSS.

More and more it seems that we'll need to survey the number of job offers developers get and the size of the community to get at this one ..."

You sound very familiar to me. Interested Observer writes "Thanks to a slashdot article discussing false positives using Soundex I thought if Soundex can be used for something as important as "no-fly" lists then certainly we should be able to get some entertainment value out of it! See if your Soundex last name-counterparts show up in a Google News search."

A member of the USB-IF Administration writes to dispel the confusion raised by the seeming conflict between many USB products' labels and their actual data-transfer speeds:

"The source of confusion derives from the fact that USB specification revision numbers and data-transfer rates are often being used in place of the logo on consumer packaging, a purpose for which they were not originally intended. The USB-IF's recommended nomenclature for consumers is 'USB' for slower speed products (1.5 Mb/s and 12Mb/s) and "Hi-Speed USB" for high-speed products (480Mb/s), as signified in the USB logos that were introduced in late 2000. In short, consumers wishing to be certain they are getting the performance they paid for in their USB products can use the logo for clarification.

The USB-IF's naming and packaging recommendations for low- or full-speed USB products, as listed at the website http://www.usb.org/developers/packaging, state that such products can carry only the basic version of the USB logo, which simply states "Certified USB." We state clearly that manufacturers should avoid using terminology such as USB 2.0 Full Speed, Full Speed USB or USB 2.0. These formal recommendations were published to the USB-IF membership and posted on the website in August 2002.

The USB-IF is a nonprofit industry organization. We do not and cannot control how manufacturers label their products. We do work continuously with system and peripheral manufacturers, striving to provide consistency in the use of this nomenclature and the logos. The logo indicates that a product's performance against and conformance with the standard have been tested, and that the product has passed the USB compliance program.

Anyone having questions about the performance of a product should contact the manufacturer for clarification.

For a brief Q & A on this topic, please visit our website at http://www.usb.org/info/usb_nomenclature."

Slashback with a followup on the perpetual motion DeLorean, a word on RIAA bank-account-jacking, a reminder about the fast-tracked vote on software patents in the EU, the real meaning of "high speed USB" and more. Read on below for the details.

Now even less than a week ... mpawlo writes "As reported by Greplaw, although I am still looking for further confirmation, it seems like the EU vote on software patentability has been moved from the late fall to June 30, 2003. Yes, that is in one (1) week. If you have more information and another source - please comment on this news item."

Mikael writes: "Personally, I find it somewhat disturbing from a democracy perspective that this proposal seems to be fast-tracked in the middle of the summer, when most Europeans want to focus on whether they should have strawberry or vanilla ice cream. In Sweden, we also got our Swedish version of the DMCA this week. I guess the ice cream will have to wait."

DoSthAboutIt points out that "A 'Petition for a Free Europe without Software Patents' has gained more than 150000 signatures. Among the supporters are more than 2000 company owners and chief executives and 25000 developpers and engineers from all sectors of the European information and telecommunication industries, as well as more than 2000 scientists and 180 lawyers. Companies like Siemens, IBM, Alcatel and Nokia lead the list of those whose researchers and developpers want to protect programming freedom and copyright property against what they see as a 'patent landgrab.' The whole article can be found here, including some statistics like signatories by country"

The story of Peng. mantispraying writes "Looks like the college student who settled with the the RIAA for $12,000, his entire life savings, has recouped all of his money thanks to a very generous file sharing community. Also, the search engine he created that got him in trouble is back online, for demonstration purposes only, of course."

Reader T points out that while one of the students who lost his life savings to RIAA has made it back through PayPal donations, "the other, Dan Peng, is still short about $12,000. Brother, can you spare a dime?"

I'd prefer the garrote and the stick, but hey. Mark Ferguson writes: "I attended the FTC spam forum. It seems I was on their call list :-) I parlayed that into getting several others on the panels as well. While there I spoke with bulk emailers and other industry folks. Some people defined Confirmed OPT-IN to mean you sending a confirmation that the email address was subscribed so they were doing double, confirmed OPT-IN.

My heads spins.

What I figured from what I learned was these folks truly refused to accept real definitions the Service Providers have been using for years so I decided to do a site for just this. ... Anyway, reboot, aka Andrew Cockrell myself and another built The Carrot and the Stick to explain email, define the best practices and to get people to abide by them.

Thoughts, comments and/or suggestions?"

Sooner or later, that DeLorean's going to land someone in jail. hackwrench writes "According to channel WSMV news, Alternate Energy Inventor Carl Tilley's compound was raided. Tilley was previously mentioned on Slashdot here."

Tilley had announced the then-upcoming demonstration of his perpetual-motion DeLorean.

My nanodots can fit inside your nanodots! Rocky Rawstern writes "I recently had the distinct pleasure to interview one of my favorite authors, Wil McCarthy. Upon completing three of his latest books - two sci-fi and one work of non-fiction - I realized that others would probably enjoy his ponderings as much as I. The questions for this interview stem from my own interest in programmable matter, and the awe-inspiring possibilities raised by Wil in his book Hacking Matter."

How to succeed (not necessarily) in business. jameshowison writes "A few months ago Ask Slashdot published Kevin Crowston's question on what makes open source software successful ... well the results are in and the paper typed. We ran the responses through a funky content analyser (called Grad Students). The metrics that academics and the industry have used for years simply don't work for OSS.

More and more it seems that we'll need to survey the number of job offers developers get and the size of the community to get at this one ..."

You sound very familiar to me. Interested Observer writes "Thanks to a slashdot article discussing false positives using Soundex I thought if Soundex can be used for something as important as "no-fly" lists then certainly we should be able to get some entertainment value out of it! See if your Soundex last name-counterparts show up in a Google News search."

A member of the USB-IF Administration writes to dispel the confusion raised by the seeming conflict between many USB products' labels and their actual data-transfer speeds:

"The source of confusion derives from the fact that USB specification revision numbers and data-transfer rates are often being used in place of the logo on consumer packaging, a purpose for which they were not originally intended. The USB-IF's recommended nomenclature for consumers is 'USB' for slower speed products (1.5 Mb/s and 12Mb/s) and "Hi-Speed USB" for high-speed products (480Mb/s), as signified in the USB logos that were introduced in late 2000. In short, consumers wishing to be certain they are getting the performance they paid for in their USB products can use the logo for clarification.

The USB-IF's naming and packaging recommendations for low- or full-speed USB products, as listed at the website http://www.usb.org/developers/packaging, state that such products can carry only the basic version of the USB logo, which simply states "Certified USB." We state clearly that manufacturers should avoid using terminology such as USB 2.0 Full Speed, Full Speed USB or USB 2.0. These formal recommendations were published to the USB-IF membership and posted on the website in August 2002.

The USB-IF is a nonprofit industry organization. We do not and cannot control how manufacturers label their products. We do work continuously with system and peripheral manufacturers, striving to provide consistency in the use of this nomenclature and the logos. The logo indicates that a product's performance against and conformance with the standard have been tested, and that the product has passed the USB compliance program.

Anyone having questions about the performance of a product should contact the manufacturer for clarification.

For a brief Q & A on this topic, please visit our website at http://www.usb.org/info/usb_nomenclature."

LawGeek writes "The venerable GrepLaw crew has struck again, this time with Editor Mikael Pawlo interviewing PGP author and all-around encryption expert Phil Zimmermann. Pawlo discussed a number of topics with Zimmerman, including the current state of encryption export laws, DRM, and activism against erosion of privacy both in the U.S. and internationally. The interview is here."

LawGeek writes "The venerable GrepLaw crew has struck again, this time with Editor Mikael Pawlo interviewing PGP author and all-around encryption expert Phil Zimmermann. Pawlo discussed a number of topics with Zimmerman, including the current state of encryption export laws, DRM, and activism against erosion of privacy both in the U.S. and internationally. The interview is here."

LawGeek writes "The venerable GrepLaw crew has struck again, this time with Editor Mikael Pawlo interviewing PGP author and all-around encryption expert Phil Zimmermann. Pawlo discussed a number of topics with Zimmerman, including the current state of encryption export laws, DRM, and activism against erosion of privacy both in the U.S. and internationally. The interview is here."

user555 writes "The RIAA and MPAA have seen Palladium as a way to prevent piracy. But this article argues that ironically Palladium may actually make P2P piracy more widespread (PDF). They argue that the security features of Palladium could be used to create P2P networks that are more resistant to attacks from content owners."

LawGeek writes "Aimee Deep is probably most famously known as the highly attractive cover-girl of Madster (formerly known as Aimster). Since being involved with Madster (her father's business), she has had the opportunity to become more interested in legal and business issues surrounding the music distribution business and now blogs on the subject. Greplaw editor Mikael Pawlo recently interviewed the 18-year old Ms. Deep on various topics."

LawGeek writes "Aimee Deep is probably most famously known as the highly attractive cover-girl of Madster (formerly known as Aimster). Since being involved with Madster (her father's business), she has had the opportunity to become more interested in legal and business issues surrounding the music distribution business and now blogs on the subject. Greplaw editor Mikael Pawlo recently interviewed the 18-year old Ms. Deep on various topics."

LawGeek writes "Aimee Deep is probably most famously known as the highly attractive cover-girl of Madster (formerly known as Aimster). Since being involved with Madster (her father's business), she has had the opportunity to become more interested in legal and business issues surrounding the music distribution business and now blogs on the subject. Greplaw editor Mikael Pawlo recently interviewed the 18-year old Ms. Deep on various topics."

You asked nmap creator Fyodor many excellent questions, and his answers (below) are just as excellent. You'll want to set aside significant time to read and digest this interview, because Fyodor didn't just toss off a few words, but put some real time and energy into his answers.

1) Interesting stories involving nmap?
by Neologic

Nmap has obviously become a huge success in the *nix world. I would wager that practically all sysadmins and security folk use nmap. With this sort of use by such creative and lazy people, there must have been some interesting stories involving nmap, perhaps unusual uses of it, or funny anecdotes. Are there any you would like to share?

Fyodor

The coolest use ever was undoubtedly when Trinity used it to try and save the human race :). But the use I find most gratifying are the Chinese students and residents who have written me about how they use Nmap to locate open proxies. These proxies allow for surfing the uncensored Internet, including the news, educational, pornographic, religious, open source software, government, political, search engine, and human rights sites that are blocked by the Great Firewall of China.

Many of the best features in Nmap came from the user community in ideas if not implementation. For example, the protocol scan (-sO) determines what IP protocols (TCP, UDP, GRE, etc.) a host is listening for. I had not thought of this, but the idea and patch came out of the blue one day in an email from Gerhard Rieger. On another day, a guy named Saurik sent a patch called Nmap+V that allows Nmap to do basic service/version fingerprinting against open ports. It has attracted a cult following, and I plan to add similar functionality to Nmap this year. The initial Windows port by eEye arrived similarly. Despite all these great suggestions, certain other user-contributed ideas are not on the agenda.

Then there are a small handful of users who detect problems nobody else would ever notice, like 4 byte/host memory leaks. They send me error messages with notes saying the bug happens "about once per 700,000 IPs". I have no idea what these guys are up to, but some have been sending me this kind of mail for years. They can't be spammers, as they are intelligent and also use more sophisticated scan techniques than you would need to just find SMTP servers.

2) Recent increases in anal-retentiveness...?
by Zeriel

There's been a marked increase in system administrators thinking that anything even remotely resembling a network scan is eeeeevil (case in point, last year I almost got kicked out of college for scanning port 80 on my dorm subnet looking for interesting websites to read)...

What do you think can be done to make scanning IP addresses/ports have less of a negative stigma? This is in the same sort of category as legit vs. illegit uses of anything else (P2P, whatever)--what's the rationale for punishing something that could maybe lead to criminal activity, and how can we make network scanning tools have practical uses again?

Fyodor

That is an excellent question, and one that concerns me as well. But first, I think your final statement is too extreme. I would guess 90% of network scanning is non-controversial. You will rarely be badgered for scanning your own machine or the networks you administer. The controversy comes when scanning other networks. There are a lot of (good and bad) reasons for doing this sort of network exploration. Perhaps you are scanning the other systems in your {dorm, department, cable LAN, conference LAN} to look for publicly shared files (FTP, SMB, WWW, etc.). Or perhaps your just trying to find the IP of a certain printer. Maybe you scanned your favorite web site to see if they are offering any other services, or because you are curious what OS they run. Perhaps you are just trying to test connectivity, or maybe you wanted to do a quick security sanity-check before handing off your credit card details to that ecommerce company. You might be conducting Internet research, or be bored on a rainy afternoon. Or are you conducting reconnaissance in preparation for a breakin attempt?

The remote administrators rarely know your true intentions, and do sometimes get suspicious. The best approach is to get permission first. I've seen a few people with non-administrative roles land in hot water after deciding to "prove" network insecurity by launching an intrusive scan of the entire company or campus. Admins tend to be more cooperative when asked in advance than when woken up at 3AM by an IDS alarm claiming they are under massive attack.

You compared Nmap to P2P tools in having a "negative stigma". In both cases, one effective way to fight the stigma is to limit your own use to "legitimate" purposes. Use BitTorrent to download RedHat ISOs, but not Matrix Reloaded. Use Nmap to secure and monitor your computers, but not to attack other networks. And if you decide to attack other networks anyway, please be courteous and set the evil bit.

Now I'll admit that I don't always obtain explicit permission before scanning other networks. I don't believe (but IANAL) that a simple port/OS scan of a remote system is or should be illegal. Any machine connected to the Internet will be scanned so often that most admins ignore such "white noise" anyhow. But scan other networks often enough, and someone will eventually complain. So my advice would be:

1. Don't do anything controversial from your work or school connections. Even though your intentions may be good, you have too much to lose if someone in power (boss, dean) decides you are a malicious cracker. Do you really want to explain your actions to someone who may not even understand the terms "port scanner" or "packet"? Spend $10 bucks a month for a dialup or shell account. You didn't really violate this rule, as scanning your dorm subnet for just port 80 should not even be remotely controversial!
2. Target your scan as tightly as possible. If you are only looking for web servers, specify -p80 rather than scanning all 65,535 TCP ports on each machine. If you are only trying to find available hosts, do an Nmap ping scan. Don't scan a /16 when a /24 will suffice. The random scan mode now takes an argument specifying the number of hosts, rather than running forever. So consider -iR 1000 rather than -iR 10000 if the former is sufficient. Use the default timing (or even "-T Polite") rather than "-T Insane".
3. Nmap offers many options for stealthy scans, including source-IP spoofing, decoy scanning, and the more recent Idle Scan technique. But remember there is always a trade-off. You will be harder to detect if you launch scans from an open WAP far from your house, with 17 decoys, while doing followup probes through a chain of 9 open proxies. But if anyone (such as Tsutomu Shimomura) does track you down, they will be mighty suspicious of your intentions.

I occasionally consider adding some sort of "notification packet" prior to a scan that would give hosts the chance to respond and opt-out. This would be like the /robots.txt directives currently used to control polite Web robots. Perhaps the format could even include a text string that IDS systems could log, like: nmap -sS -p- -O -m "Direct questions about this scan to ops at x3512" 192.168.0.0/16 nmap -sS -p- -O -m "mY n4m3 iZ Zer0 |<00L and I'll 0wn j0o%#@" targetcompany.com/24 Of course Nmap would have an option to omit the notification or to send it and ignore any negative responses. Some scanners, such as ISS Internet Scanner already send out NetBIOS popup messages to scanned hosts by default, and other scanners use syslog. I won't be adding any features like this to Nmap unless I see substantial demand and the obvious issues are worked out.

3) OS fingerprinting
by neoThoth

What are the latest advances in fingerprinting networked devices that seem most promising to you? I have started reading papers on HTTP fingerprinting and such and wonder how these will figure into the NMAP architecture. What are the most elusive OS's that aren't on the NMAP OS fingerprint database?

Fyodor

There are a number of OS detection techniques I hope to add this year. One is to guess (or calculate) the initial TTL of response packets, since this varies by OS. Some operating systems also "reflect" your own chosen TTL under various circumstances. Then there are some newer TCP options, such as selective ack that I might test for. Explicit Congestion Notification (RFC 2481/3168) also shows promise. I'll probably add all of these at once later this year, after discussions with the Nmap-dev list. If you wish to participate, you can join that list by sending a blank email to nmap-dev-subscribe@insecure.org. There is also a low volume, moderated list for announcements about Nmap, Insecure.org, and related projects. You can join the 15,000 current members by mailing nmap-hackers-subscribe@insecure.org [archives].

While adding new fingerprinting techniques is fun and exciting, improving the signature database often ads more value. The DB now contains more than 850 signatures, from the Acorn RISC OS and Aironet wireless LAN bridge to the ZoomAir wireless gateway and Zyxel Prestige routers. We're talking gaming consoles, phones, PBX systems, PDAs, webcams, networked power switches, you name it! New fingerprints are submitted daily.

Application level fingerprinting (including HTTP) is coming. I usually regret stating dates, but I hope to develop this functionality within the next 3 months.

4) Stepping into a network security career
by Anonymous Coward

I'll be graduating this month with a shiny new BS in Computer Science. I've done plenty of Unix sysadmin work throughout college and even deployed some high-interaction honeynets. I'm very interested in network security and systems programming. Do you have any advice for people in my situation who want to head into a career in network security?

Fyodor

Congratulations on your graduation! Unfortunately (for newcomers), the security field is one that often expects substantial experience and references. This is partly because these jobs require extraordinary trust, and also because of an aversion to mistakes. Everyone makes mistakes, but they can be extraordinarily costly in security and neophytes tend to make more of them. But don't lose hope! Talented security minds are still in very high demand, just be aware that you will have to work even harder to prove yourself.

Here are my suggestions for anyone starting out in network security, whether for fun or profit:

Step 1: Learn everything you can

1. You may wish to start with reading a general overview of security, such as Practical Unix and Internet Security 3rd Edition.
2. Reading alone won't teach you much. Hands-on experience is critical, so I would set up at least a basic test network. At the very minimum you should have a Unix box or two and a Windows machine (because these are very common in the real world). You can use very cheap machines, or even emulate a large network with virtualization software such as VMWare.
3. Next you should learn more about how attacks are performed. Take a look at the excellent and free Open Source Security Testing Methodology Manual (OSSTMM). This document aims to provide a comprehensive framework for security testing. But it mostly lists tasks to perform, without specifying how to do so. You will gain a lot from this manual if you research the tasks you don't know how to complete, and if you actually try performing the tasks on your test network. If this manual is too curt or hard to follow, you could try a more verbose book on vulnerability assessment, such as Hacking Exposed 4th Edition.
4. Now that you understand many of the general security ideas, it is time to get current. This is one area that has actually become easier in the last decade. The thinking used to be that vulnerability information should only be distributed to well-known and trusted administrators and security researchers through private digests such as Zardoz. This was a disaster for many reasons, and the full disclosure movement was born. In the last couple of years things have started to shift toward more limited ("responsible") disclosure and there is also a disturbing pay-money-for-early-disclosure trend. But information is still much more available than it used to be. Most of the news is carried on mailing lists, and I archive the ones I consider the best at Lists.Insecure.Org. You must subscribe to Bugtraq, and I would also highly recommend pen-test, vuln-dev, and security-basics. Read at least the last 6-12 months of archives. Choose other lists that correspond to your interests. SecurityFocus also offers a security-jobs list which is an excellent resource for finding jobs or just understanding what employers desire.

   There are two major reasons for reading Bugtraq. One is that you must react quickly to new vulnerabilities by patching your servers, notifying your clients, etc. You can get this by simply scanning the subject lines or advisory summaries for bugs that directly apply to you. But then you will miss out on another crucial purpose of Bugtraq. Actually understanding a vulnerability helps you defend against it, exploit it, and identify/prevent similar bugs in the future. When you are lucky, the advisory itself will provide full details on the bug. Check out this excellent recent advisory by Core Security Technologies. Note how they describe exactly how the Snort TCP Stream Reassembly vulnerability works in detail and even include a proof-of-concept demonstration. Unfortunately, not all advisories are so forthcoming. For bugs in Open Source software, you can understand the problem by reading the diff. The next step is to actually write and test an exploit. I would recommend writing at least one for each general class of bug (buffer overflow, format string, SQL injection, etc.) or whenever a bug is particularly interesting.

   Be sure to read the latest issues of Phrack and the research papers posted to the mailing lists. Send your comments and questions to the authors and you may start interesting discussions. Read well-regarded books on the security topics that interest you most.

   I can't emphasize enough that you should intersperse hands-on work with all of this reading. Install unpatched RedHat 8 (or whatever) and run Nmap and Nessus against it. Then compromise it remotely, maybe via the latest Samba hole. Start out with a prewritten exploit from Bugtraq, which isn't quite as easy as it sounds. You may have to modify the 'sploit to compile, brute force the proper offset, etc. Then break in again using a different technique, and your own exploit. Install Ethereal and/or tcpdump and ensure you understand the traffic on your network during both your exploitation and normal network activity. Install Snort on an Internet-facing machine and watch the attacks and probes you'll experience. Wander around your neighborhood with Kismet, Netstumbler, or Wellenreiter on your Laptop or PDA to look for open WAPs. Install DSniff and execute an active MITM attack on an SSH or SSL connection between two of your computers. Take a look at my Top 75 Tools List and ensure you understand what each does and when it would be useful. Try out as many as you can.

5. Take a vacation, or at least a weekend camping! You deserve it! The steps above would probably take at least 3-12 months full-time, depending on your motivation level and the depth and breadth of your research.

Step 2: Now apply your newfound knowledge

Now you have learned enough to be dangerous. At this point, you would have little trouble obtaining most certifications, after studying the specifics of each topic. If your main goal is to find a job quickly, perhaps adding these extra feathers to your cap might be worthwhile. But I think your best bet is to prove your knowledge by joining and contributing to the security community. While this does indeed help others, it isn't an entirely selfless act. It improves your skills, leads to important contacts, and demonstrates your knowledge and ability in a constructive way. The latter is important if securing a career is one of your goals. These steps should also be fun! If not, perhaps you should keep looking at other fields. Here are some ideas:

Start participating with insightful comment and answers on the mailing lists. This is very easy and serves as a great learning experience, way to meet people, and garners some name recognition. If a security manager with a stack of 60 resumes recognizes your name, that is a huge win!

When a new worm or a big new vulnerability comes out, everyone wants to know the details. If you stay up all night disassembling the worm/patch and write the first comprehensive analysis, many folks will find that valuable. And you will learn a lot. Let your first priority be quality - if someone beats you to it, just compare your results with theirs to see if you (or they) missed (or misinterpreted) anything. You can also post your own exploits, although that is more of a political hot potato.

Attending security conferences is a great way to learn, party with fellow hackers, and network (in every sense of the word). Much better is to speak at these conferences. This field changes rapidly so there are always new topics and technologies to discuss. You don't have to be a well-known expert with a long history - just learn your topic well and put in the effort for a quality presentation. You could present at Defcon, at one of the more commercial events, or at a smaller regional con like ToorCon, CodeCon, Hivercon, etc. Among other advantages (often free admission/travel/hotel), this is a great way to meet people with similar interests. I spoke at the latest CanSecWest and have submitted a proposal for the next Defcon.

Now that you've seen and understand a wide variety of software vulnerabilities from your Bugtraq research, start finding your own. You can start by downloading any PHP app from Sourceforge. Most of those are hopelessly vulnerable to Cross-Site-Scripting, SQL injection, and/or remote code execution by "remote include" directives. Many (if not most) Windows shareware daemons are also vulnerable to simple buffer overflows and format-string bugs. Notify the authors and then write an advisory. After a few of these "easy targets", try breaking some more widely deployed programs.

Write a security tool! I could list some suggestions, but by this point you will have many of your own ideas as to what is needed. Scratch an itch.

I hope this helps. If you want more suggestions, Ask Slashdot. From that story, I found this post particularly insightful, especially the emphasis on "people skills". I don't claim to have any, but understand the value :).

5) Have you ever been tempted to use your gifts...
by Tim_F

...in a negative manner?

Have you ever hacked into someone else's computer? Have you ever considered it? What would cause you to think of doing this? Would your tools (nmap, etc.) be enough to allow you to do this?

And if you haven't, why is that the case?

Fyodor

I never do script-kiddie style "hack any random vulnerable box on the Internet" cracking. But sometimes I will launch targeted attacks at specific companies. I'll usually start with just a web browser and various search engines to learn everything I can about my target. I need to understand what the company does, who it partners with, and whether it has any corporate siblings, subsidiaries, or parents. Beyond that, posts by individual employees can be a gold mine. Besides providing names and titles for social engineering and brute force password attacks, the IPs in the mail/news routing headers can be very valuable. One of the reasons I run my own mailing list archive is to maintain access to the raw mail folders which contain the routing info and X-no-archive posts that web archives strip out. Another advantage to locating employees is that you can send them trojan executable attachments, which can be a very effective way into the network.

Next I'll gather known IP network information on the companies via DNS, whois, regional registries like ARIN, routing info, Netcraft, etc. Then comes the scanning (I tend to use Nmap), application-probing, vulnerability discovery, and exploitation stages.

Of course, I only do this when the company is paying me to do so. Performing these pen-tests offers several advantages over blackhat activity:

1. You don't go to jail (If you've worded your contract carefully.)
2. Instead of having to keep your übertechniques secret to avoid prosecution, you get to demonstrate them to management.
3. They actually pay you for this! And you are helping to protect them and the privacy of their customers.

Now some people might ask how you gain these skills without practicing on other networks first. Cheap hardware and the evolution of free UNIX operating systems have made this much easier than in the past. See the previous answer for some suggestions. And remember that you can always work together with friends, or participate in hacking contests like Defcon's Capture the Flag.

6) You'll have seen a lot of breakins.
by Hulver

During your time running Honeypots, you'll have seen a lot of compromised systems. Is there any incident that's really stuck in your mind because of the audacity of the attempt, or the stupidity of the person attempting the breakin.

Fyodor

On the humorous front, one attacker was was running a public webcam during his exploits, so we were able to watch him crack into our boxes in real time :). I will resist the urge to link a screenshot. His rough location was determined when we noticed Mrs. Doubtfire playing on his TV and correlated that with public schedule listings. He was working with a Pakistani group, but was actually on the US East Coast.

In the "disturbing audacity" front, this year we found that a group of crackers had broken into an ecommerce site and actually programmed an automated billing-sytem-to-IRC gateway. They could obtain or validate credit card numbers by simply querying the channel bot! Expect a more detailed writeup soon.

7) What makes a honey net enticing?
by cornice

It seems that many of the honey nets that the average hobbyist would run are built to attract a lesser cracker. What I mean is that ports are left open that normally would not be left open. Services are running that normally should not, etc. I think that a really smart fish would see this as nothing but a cheap lure and refuse the bait. Do you think it's possible to fool the really smart fish? Is is possible to bait with something enticing enough without tipping off the big fish? Does publication of your work make this task more difficult?

Fyodor

Excellent question, and I had many of the same concerns upon joining the project. Then I remembered that most of the attacks and real-world compromises are committed by these marginally skilled script kiddies. So there is still a lot of value in understanding their tools, tactics, and motives. Despite this apparent limitation, I have been surprised by some of the sophisticated things we have found. For example, the first known "in the wild" attack using the Solaris dtspcd vulnerability was caught by one of our honeynets and resulted in this CERT advisory. Then one of our Honeynet Alliance members had their Win2K honeypot compromised and joined into a botnet with 18,000 machines! Attackers on such a grand scale won't even know all of the companies they have compromised, much less whether any of the systems are honeynets.

I do believe baiting the "smart fish" might be possible, but I have never done this. Is not legally entrapment, as we aren't any sort of police force, but I am not very comfortable with the idea. If someone attacks my box that is just unobtrusively sitting on the network, I believe the attacker should have no expectation of privacy for his activities on the system. Things become more complex if I try to lure the attacker.

8) IPv6
by caluml

Do you think that with the very large address space of IPv6 that random scanning for a certain port will die off? (I notice nmap doesn't support random IPv6 address scanning - maybe you've already come to the same conclusion?) Simply put, the chances of finding a machine if it's not advertised anywhere will be very much reduced. Will this make people lazy and complacent, trusting on the large numbers involved to protect them?

Fyodor

Finding a machine by by pinging a completely random 128-bit address will probably never be effective. Fortunately, we won't have to! Nmap does not even do that for 32-bit IPv4 addresses - it is smart enough to skip huge blocks of address space that are unallocated or used for private (RFC1918, localhost) addresses. We will also see patterns emerge for IPv6. For example, they may often be allocated sequentially so that finding one leads to many others. I am waiting until adoption rises and we start seeing these patterns emerge before I can implement them appropriately in Nmap. Certain new DNS features may also prove useful for locating IPv6 machines and networks.

9) standalones and small home nets
by zogger

it seems like most of the emphasis is on enterprise networks, but that still leaves millions and millions of home machines and small home networks just stuck. What do you see as some of the trends and solutions for those people? Their data and system integrity is just as important to them as any corporations is, and usually not having the appropriate skill set, is even harder to implement.

Fyodor

I am afraid the focus by security companies on enterprise networks will continue, as that is where the money is. The good news is that securing small home networks is far easier. But that doesn't make it simple, nor mean that many people will bother. I would categorize the risks into 3 categories:

Traditional network server vulnerabilities: Your average home user doesn't need to run any network daemons or have any TCP/UDP ports open to the Internet. Most of the time they only have 1 IP, used either by a standalone PC or a NAT device (e.g. "broadband router") in front of their small network. This is a good configuration, as it limits what attackers can reach directly. But you need to be sure that the IP doesn't have any unnecessary ports open. You can verify this by running 'netstat' on the Windows or UNIX machine using the IP. I would also recommend confirming using a port scanner such as Nmap. Here are example commands:

nmap -p- -sS -T4 -v -O [your IP]
nmap -p- -sU -v [ your IP ]

The TCP and UDP scans could be combined into one execution, but are listed separately since the TCP scan may go much faster. Remote UDP scans are also less reliable against some heavily filtered hosts. You may have to rely on the netstat info or configuration details in this case.

Any open ports found should be evaluated with extreme prejudice. Unless clearly necessary, close Windows file sharing, external NAT device admin ports, and everything else found.

Don't forget the wireless backdoor! Blocking the Internet link from your private machines is insufficient if anyone can hop on your open WLAN and attack your machines. WEP isn't perfect, but the 104-bit (so-called 128-bit) version should at least keep people from accidentally connecting to your network or sniffing your data. Be sure to set a good password and upgrade to recent firmware for your WAP and other network devices.

Subscribe to the security advisory lists for all the operating systems (and devices, if available) you run. Major vendors such as RedHat, Debian, FreeBSD, Mandrake, and Microsoft all offer these. Most even offer automatic updates if you desire that.

Client vulnerabilities: Once you close the services you don't need (ideally all of them), client vulnerabilities must be addressed. Keeping your web browser and mail reader up-to-date is particularly crucial. Also harden them as much as possible. For example, IE is full of holes but at least has a good interface for site-by-site security policies (Tools -> Internet Options -> Security). Go through and neuter the "Internet zone" settings by disabling ActiveX and Java. In the rare case that sites need this, find an alternative site or add them to the trusted zone. If your are really serious about security, neuter "trusted sites" and "local intranet" privileges as well. Many recent IE vulnerabilities trick the browser into using the wrong zones. Consider using a different browser. Also configure your mailer to disregard HTML and JavaScript.

Remember to pay careful attention to security warnings, whether they come from IE, Mozilla, your ssh client, or anything else. Don't just click OK. And don't shoot yourself in the foot when configuring your apps. It is hard to entirely blame the vendor when users tell P2P apps or Windows filesharing to share their whole drive without any password. Failing to change default passwords or enable basic restrictions on X Window or FTP servers is only slightly more forgivable. All of these errors happen frequently! The apps/devices should be secure by default, but you have the ultimate responsibility for protecting your data.

Malware: This is what I consider the biggest problem on desktops: people running applications they can't trust. Email borne viruses, worms and trojans are an obvious example. Be very careful what you click on. Unfortunately, it is very difficult to know what to trust. Mail is trivial to forge, and even the "proper" installers for many P2P applications infest your computer with loads of invasive spyware. Even Intuit TurboTax was caught writing to customers' boot information track.

What can you do? My honest suggestion is to run peer-reviewed open source applications on a free OS such as Linux or FreeBSD. You still have to be careful, but these problems are far less prevalent on UNIX platforms, which also have better tools and procedures to deal with them.

What if dumping Windows is not an option? Run NT/2K/XP instead of Win9X/ME, and try to run everything you can as an unprivileged (non-administrator) user. Be extraordinarily careful about what you install and run, and make frequent backups. You might also want to look into a personal firewall such as Zone Alarm (limited free version.

10) What is your favourite tool?
by Noryungi

I have just read your top 75 security tools list. Thank you for posting all this information, which I am going to study very carefully.

One question though: in all these tools, which one is your personal favourite? (This excludes Nmap, of course).

Fyodor

I have far too many favorites among this great group to choose just one! But here are a few developers and tools that are particularly worthy of mention:

One of the people I most admire in the security field is Solar Designer. He is a guru in networking, security, and low level kernel/assembly/architecture details. He has also created many tools that security professionals use daily. Yet he never exhibits the arrogance, elitism, and egotism that sadly characterizes so many "stars" of the security community.

Among SD's tools is John the Ripper, my longtime favorite local password hash cracker. It has been around forever, but was written with a flexible and powerful interface while keeping extensibility in mind. So it is still as useful in these days of shadowed password files and MD5/Blowfish hashes as it was back in the days of crypt() and unprotected /etc/passwd. Lately SD has been working on the Owl secure GNU/Linux distribution, which can be installed on disk for hardened systems like firewalls, or booted and run from CD as an easy way to run security tools such as John and Nmap.

Another of those "brilliant yet still nice" security developers is Dug Song. Even after the seminal "Insertion, Evasion, and Denial of Service" paper by Ptacek and Newsham, many IDS vendors continued to ignore the problem. When Doug released Fragrouter (now fragroute), which implements some of these attacks, vendors finally took notice! He has also written the excellent libdnet library, but my favorite of his tools is DSniff, a suite of tools for advanced network sniffing and "monkey-in-the-middle" attacks. It even handles ARP poisoning and other techniques for sniffing hosts on a switched LAN.

While I'm on this topic, let me also give "mad props" to the Hping2 packet prober, Kismet wireless stumbler, Ethereal packet decoder, Netcat, recent THC releases, Snort IDS, the Nessus vulnerability scanner, and all the other great Open Source tools out there!

I would also like to thank Slashdot for granting me this interview and to everyone who asked such excellent questions. I only wish I had time to answer more of them. Then again, I have probably rambled on enough. Now it is your turn to ramble in the comments :).

Cheers,
Fyodor

You asked nmap creator Fyodor many excellent questions, and his answers (below) are just as excellent. You'll want to set aside significant time to read and digest this interview, because Fyodor didn't just toss off a few words, but put some real time and energy into his answers.

1) Interesting stories involving nmap?
by Neologic

Nmap has obviously become a huge success in the *nix world. I would wager that practically all sysadmins and security folk use nmap. With this sort of use by such creative and lazy people, there must have been some interesting stories involving nmap, perhaps unusual uses of it, or funny anecdotes. Are there any you would like to share?

Fyodor

The coolest use ever was undoubtedly when Trinity used it to try and save the human race :). But the use I find most gratifying are the Chinese students and residents who have written me about how they use Nmap to locate open proxies. These proxies allow for surfing the uncensored Internet, including the news, educational, pornographic, religious, open source software, government, political, search engine, and human rights sites that are blocked by the Great Firewall of China.

Many of the best features in Nmap came from the user community in ideas if not implementation. For example, the protocol scan (-sO) determines what IP protocols (TCP, UDP, GRE, etc.) a host is listening for. I had not thought of this, but the idea and patch came out of the blue one day in an email from Gerhard Rieger. On another day, a guy named Saurik sent a patch called Nmap+V that allows Nmap to do basic service/version fingerprinting against open ports. It has attracted a cult following, and I plan to add similar functionality to Nmap this year. The initial Windows port by eEye arrived similarly. Despite all these great suggestions, certain other user-contributed ideas are not on the agenda.

Then there are a small handful of users who detect problems nobody else would ever notice, like 4 byte/host memory leaks. They send me error messages with notes saying the bug happens "about once per 700,000 IPs". I have no idea what these guys are up to, but some have been sending me this kind of mail for years. They can't be spammers, as they are intelligent and also use more sophisticated scan techniques than you would need to just find SMTP servers.

2) Recent increases in anal-retentiveness...?
by Zeriel

There's been a marked increase in system administrators thinking that anything even remotely resembling a network scan is eeeeevil (case in point, last year I almost got kicked out of college for scanning port 80 on my dorm subnet looking for interesting websites to read)...

What do you think can be done to make scanning IP addresses/ports have less of a negative stigma? This is in the same sort of category as legit vs. illegit uses of anything else (P2P, whatever)--what's the rationale for punishing something that could maybe lead to criminal activity, and how can we make network scanning tools have practical uses again?

Fyodor

That is an excellent question, and one that concerns me as well. But first, I think your final statement is too extreme. I would guess 90% of network scanning is non-controversial. You will rarely be badgered for scanning your own machine or the networks you administer. The controversy comes when scanning other networks. There are a lot of (good and bad) reasons for doing this sort of network exploration. Perhaps you are scanning the other systems in your {dorm, department, cable LAN, conference LAN} to look for publicly shared files (FTP, SMB, WWW, etc.). Or perhaps your just trying to find the IP of a certain printer. Maybe you scanned your favorite web site to see if they are offering any other services, or because you are curious what OS they run. Perhaps you are just trying to test connectivity, or maybe you wanted to do a quick security sanity-check before handing off your credit card details to that ecommerce company. You might be conducting Internet research, or be bored on a rainy afternoon. Or are you conducting reconnaissance in preparation for a breakin attempt?

The remote administrators rarely know your true intentions, and do sometimes get suspicious. The best approach is to get permission first. I've seen a few people with non-administrative roles land in hot water after deciding to "prove" network insecurity by launching an intrusive scan of the entire company or campus. Admins tend to be more cooperative when asked in advance than when woken up at 3AM by an IDS alarm claiming they are under massive attack.

You compared Nmap to P2P tools in having a "negative stigma". In both cases, one effective way to fight the stigma is to limit your own use to "legitimate" purposes. Use BitTorrent to download RedHat ISOs, but not Matrix Reloaded. Use Nmap to secure and monitor your computers, but not to attack other networks. And if you decide to attack other networks anyway, please be courteous and set the evil bit.

Now I'll admit that I don't always obtain explicit permission before scanning other networks. I don't believe (but IANAL) that a simple port/OS scan of a remote system is or should be illegal. Any machine connected to the Internet will be scanned so often that most admins ignore such "white noise" anyhow. But scan other networks often enough, and someone will eventually complain. So my advice would be:

1. Don't do anything controversial from your work or school connections. Even though your intentions may be good, you have too much to lose if someone in power (boss, dean) decides you are a malicious cracker. Do you really want to explain your actions to someone who may not even understand the terms "port scanner" or "packet"? Spend $10 bucks a month for a dialup or shell account. You didn't really violate this rule, as scanning your dorm subnet for just port 80 should not even be remotely controversial!
2. Target your scan as tightly as possible. If you are only looking for web servers, specify -p80 rather than scanning all 65,535 TCP ports on each machine. If you are only trying to find available hosts, do an Nmap ping scan. Don't scan a /16 when a /24 will suffice. The random scan mode now takes an argument specifying the number of hosts, rather than running forever. So consider -iR 1000 rather than -iR 10000 if the former is sufficient. Use the default timing (or even "-T Polite") rather than "-T Insane".
3. Nmap offers many options for stealthy scans, including source-IP spoofing, decoy scanning, and the more recent Idle Scan technique. But remember there is always a trade-off. You will be harder to detect if you launch scans from an open WAP far from your house, with 17 decoys, while doing followup probes through a chain of 9 open proxies. But if anyone (such as Tsutomu Shimomura) does track you down, they will be mighty suspicious of your intentions.

I occasionally consider adding some sort of "notification packet" prior to a scan that would give hosts the chance to respond and opt-out. This would be like the /robots.txt directives currently used to control polite Web robots. Perhaps the format could even include a text string that IDS systems could log, like: nmap -sS -p- -O -m "Direct questions about this scan to ops at x3512" 192.168.0.0/16 nmap -sS -p- -O -m "mY n4m3 iZ Zer0 |<00L and I'll 0wn j0o%#@" targetcompany.com/24 Of course Nmap would have an option to omit the notification or to send it and ignore any negative responses. Some scanners, such as ISS Internet Scanner already send out NetBIOS popup messages to scanned hosts by default, and other scanners use syslog. I won't be adding any features like this to Nmap unless I see substantial demand and the obvious issues are worked out.

3) OS fingerprinting
by neoThoth

What are the latest advances in fingerprinting networked devices that seem most promising to you? I have started reading papers on HTTP fingerprinting and such and wonder how these will figure into the NMAP architecture. What are the most elusive OS's that aren't on the NMAP OS fingerprint database?

Fyodor

There are a number of OS detection techniques I hope to add this year. One is to guess (or calculate) the initial TTL of response packets, since this varies by OS. Some operating systems also "reflect" your own chosen TTL under various circumstances. Then there are some newer TCP options, such as selective ack that I might test for. Explicit Congestion Notification (RFC 2481/3168) also shows promise. I'll probably add all of these at once later this year, after discussions with the Nmap-dev list. If you wish to participate, you can join that list by sending a blank email to nmap-dev-subscribe@insecure.org. There is also a low volume, moderated list for announcements about Nmap, Insecure.org, and related projects. You can join the 15,000 current members by mailing nmap-hackers-subscribe@insecure.org [archives].

While adding new fingerprinting techniques is fun and exciting, improving the signature database often ads more value. The DB now contains more than 850 signatures, from the Acorn RISC OS and Aironet wireless LAN bridge to the ZoomAir wireless gateway and Zyxel Prestige routers. We're talking gaming consoles, phones, PBX systems, PDAs, webcams, networked power switches, you name it! New fingerprints are submitted daily.

Application level fingerprinting (including HTTP) is coming. I usually regret stating dates, but I hope to develop this functionality within the next 3 months.

4) Stepping into a network security career
by Anonymous Coward

I'll be graduating this month with a shiny new BS in Computer Science. I've done plenty of Unix sysadmin work throughout college and even deployed some high-interaction honeynets. I'm very interested in network security and systems programming. Do you have any advice for people in my situation who want to head into a career in network security?

Fyodor

Congratulations on your graduation! Unfortunately (for newcomers), the security field is one that often expects substantial experience and references. This is partly because these jobs require extraordinary trust, and also because of an aversion to mistakes. Everyone makes mistakes, but they can be extraordinarily costly in security and neophytes tend to make more of them. But don't lose hope! Talented security minds are still in very high demand, just be aware that you will have to work even harder to prove yourself.

Here are my suggestions for anyone starting out in network security, whether for fun or profit:

Step 1: Learn everything you can

1. You may wish to start with reading a general overview of security, such as Practical Unix and Internet Security 3rd Edition.
2. Reading alone won't teach you much. Hands-on experience is critical, so I would set up at least a basic test network. At the very minimum you should have a Unix box or two and a Windows machine (because these are very common in the real world). You can use very cheap machines, or even emulate a large network with virtualization software such as VMWare.
3. Next you should learn more about how attacks are performed. Take a look at the excellent and free Open Source Security Testing Methodology Manual (OSSTMM). This document aims to provide a comprehensive framework for security testing. But it mostly lists tasks to perform, without specifying how to do so. You will gain a lot from this manual if you research the tasks you don't know how to complete, and if you actually try performing the tasks on your test network. If this manual is too curt or hard to follow, you could try a more verbose book on vulnerability assessment, such as Hacking Exposed 4th Edition.
4. Now that you understand many of the general security ideas, it is time to get current. This is one area that has actually become easier in the last decade. The thinking used to be that vulnerability information should only be distributed to well-known and trusted administrators and security researchers through private digests such as Zardoz. This was a disaster for many reasons, and the full disclosure movement was born. In the last couple of years things have started to shift toward more limited ("responsible") disclosure and there is also a disturbing pay-money-for-early-disclosure trend. But information is still much more available than it used to be. Most of the news is carried on mailing lists, and I archive the ones I consider the best at Lists.Insecure.Org. You must subscribe to Bugtraq, and I would also highly recommend pen-test, vuln-dev, and security-basics. Read at least the last 6-12 months of archives. Choose other lists that correspond to your interests. SecurityFocus also offers a security-jobs list which is an excellent resource for finding jobs or just understanding what employers desire.

   There are two major reasons for reading Bugtraq. One is that you must react quickly to new vulnerabilities by patching your servers, notifying your clients, etc. You can get this by simply scanning the subject lines or advisory summaries for bugs that directly apply to you. But then you will miss out on another crucial purpose of Bugtraq. Actually understanding a vulnerability helps you defend against it, exploit it, and identify/prevent similar bugs in the future. When you are lucky, the advisory itself will provide full details on the bug. Check out this excellent recent advisory by Core Security Technologies. Note how they describe exactly how the Snort TCP Stream Reassembly vulnerability works in detail and even include a proof-of-concept demonstration. Unfortunately, not all advisories are so forthcoming. For bugs in Open Source software, you can understand the problem by reading the diff. The next step is to actually write and test an exploit. I would recommend writing at least one for each general class of bug (buffer overflow, format string, SQL injection, etc.) or whenever a bug is particularly interesting.

   Be sure to read the latest issues of Phrack and the research papers posted to the mailing lists. Send your comments and questions to the authors and you may start interesting discussions. Read well-regarded books on the security topics that interest you most.

   I can't emphasize enough that you should intersperse hands-on work with all of this reading. Install unpatched RedHat 8 (or whatever) and run Nmap and Nessus against it. Then compromise it remotely, maybe via the latest Samba hole. Start out with a prewritten exploit from Bugtraq, which isn't quite as easy as it sounds. You may have to modify the 'sploit to compile, brute force the proper offset, etc. Then break in again using a different technique, and your own exploit. Install Ethereal and/or tcpdump and ensure you understand the traffic on your network during both your exploitation and normal network activity. Install Snort on an Internet-facing machine and watch the attacks and probes you'll experience. Wander around your neighborhood with Kismet, Netstumbler, or Wellenreiter on your Laptop or PDA to look for open WAPs. Install DSniff and execute an active MITM attack on an SSH or SSL connection between two of your computers. Take a look at my Top 75 Tools List and ensure you understand what each does and when it would be useful. Try out as many as you can.

5. Take a vacation, or at least a weekend camping! You deserve it! The steps above would probably take at least 3-12 months full-time, depending on your motivation level and the depth and breadth of your research.

Step 2: Now apply your newfound knowledge

Now you have learned enough to be dangerous. At this point, you would have little trouble obtaining most certifications, after studying the specifics of each topic. If your main goal is to find a job quickly, perhaps adding these extra feathers to your cap might be worthwhile. But I think your best bet is to prove your knowledge by joining and contributing to the security community. While this does indeed help others, it isn't an entirely selfless act. It improves your skills, leads to important contacts, and demonstrates your knowledge and ability in a constructive way. The latter is important if securing a career is one of your goals. These steps should also be fun! If not, perhaps you should keep looking at other fields. Here are some ideas:

Start participating with insightful comment and answers on the mailing lists. This is very easy and serves as a great learning experience, way to meet people, and garners some name recognition. If a security manager with a stack of 60 resumes recognizes your name, that is a huge win!

When a new worm or a big new vulnerability comes out, everyone wants to know the details. If you stay up all night disassembling the worm/patch and write the first comprehensive analysis, many folks will find that valuable. And you will learn a lot. Let your first priority be quality - if someone beats you to it, just compare your results with theirs to see if you (or they) missed (or misinterpreted) anything. You can also post your own exploits, although that is more of a political hot potato.

Attending security conferences is a great way to learn, party with fellow hackers, and network (in every sense of the word). Much better is to speak at these conferences. This field changes rapidly so there are always new topics and technologies to discuss. You don't have to be a well-known expert with a long history - just learn your topic well and put in the effort for a quality presentation. You could present at Defcon, at one of the more commercial events, or at a smaller regional con like ToorCon, CodeCon, Hivercon, etc. Among other advantages (often free admission/travel/hotel), this is a great way to meet people with similar interests. I spoke at the latest CanSecWest and have submitted a proposal for the next Defcon.

Now that you've seen and understand a wide variety of software vulnerabilities from your Bugtraq research, start finding your own. You can start by downloading any PHP app from Sourceforge. Most of those are hopelessly vulnerable to Cross-Site-Scripting, SQL injection, and/or remote code execution by "remote include" directives. Many (if not most) Windows shareware daemons are also vulnerable to simple buffer overflows and format-string bugs. Notify the authors and then write an advisory. After a few of these "easy targets", try breaking some more widely deployed programs.

Write a security tool! I could list some suggestions, but by this point you will have many of your own ideas as to what is needed. Scratch an itch.

I hope this helps. If you want more suggestions, Ask Slashdot. From that story, I found this post particularly insightful, especially the emphasis on "people skills". I don't claim to have any, but understand the value :).

5) Have you ever been tempted to use your gifts...
by Tim_F

...in a negative manner?

Have you ever hacked into someone else's computer? Have you ever considered it? What would cause you to think of doing this? Would your tools (nmap, etc.) be enough to allow you to do this?

And if you haven't, why is that the case?

Fyodor

I never do script-kiddie style "hack any random vulnerable box on the Internet" cracking. But sometimes I will launch targeted attacks at specific companies. I'll usually start with just a web browser and various search engines to learn everything I can about my target. I need to understand what the company does, who it partners with, and whether it has any corporate siblings, subsidiaries, or parents. Beyond that, posts by individual employees can be a gold mine. Besides providing names and titles for social engineering and brute force password attacks, the IPs in the mail/news routing headers can be very valuable. One of the reasons I run my own mailing list archive is to maintain access to the raw mail folders which contain the routing info and X-no-archive posts that web archives strip out. Another advantage to locating employees is that you can send them trojan executable attachments, which can be a very effective way into the network.

Next I'll gather known IP network information on the companies via DNS, whois, regional registries like ARIN, routing info, Netcraft, etc. Then comes the scanning (I tend to use Nmap), application-probing, vulnerability discovery, and exploitation stages.

Of course, I only do this when the company is paying me to do so. Performing these pen-tests offers several advantages over blackhat activity:

1. You don't go to jail (If you've worded your contract carefully.)
2. Instead of having to keep your übertechniques secret to avoid prosecution, you get to demonstrate them to management.
3. They actually pay you for this! And you are helping to protect them and the privacy of their customers.

Now some people might ask how you gain these skills without practicing on other networks first. Cheap hardware and the evolution of free UNIX operating systems have made this much easier than in the past. See the previous answer for some suggestions. And remember that you can always work together with friends, or participate in hacking contests like Defcon's Capture the Flag.

6) You'll have seen a lot of breakins.
by Hulver

During your time running Honeypots, you'll have seen a lot of compromised systems. Is there any incident that's really stuck in your mind because of the audacity of the attempt, or the stupidity of the person attempting the breakin.

Fyodor

On the humorous front, one attacker was was running a public webcam during his exploits, so we were able to watch him crack into our boxes in real time :). I will resist the urge to link a screenshot. His rough location was determined when we noticed Mrs. Doubtfire playing on his TV and correlated that with public schedule listings. He was working with a Pakistani group, but was actually on the US East Coast.

In the "disturbing audacity" front, this year we found that a group of crackers had broken into an ecommerce site and actually programmed an automated billing-sytem-to-IRC gateway. They could obtain or validate credit card numbers by simply querying the channel bot! Expect a more detailed writeup soon.

7) What makes a honey net enticing?
by cornice

It seems that many of the honey nets that the average hobbyist would run are built to attract a lesser cracker. What I mean is that ports are left open that normally would not be left open. Services are running that normally should not, etc. I think that a really smart fish would see this as nothing but a cheap lure and refuse the bait. Do you think it's possible to fool the really smart fish? Is is possible to bait with something enticing enough without tipping off the big fish? Does publication of your work make this task more difficult?

Fyodor

Excellent question, and I had many of the same concerns upon joining the project. Then I remembered that most of the attacks and real-world compromises are committed by these marginally skilled script kiddies. So there is still a lot of value in understanding their tools, tactics, and motives. Despite this apparent limitation, I have been surprised by some of the sophisticated things we have found. For example, the first known "in the wild" attack using the Solaris dtspcd vulnerability was caught by one of our honeynets and resulted in this CERT advisory. Then one of our Honeynet Alliance members had their Win2K honeypot compromised and joined into a botnet with 18,000 machines! Attackers on such a grand scale won't even know all of the companies they have compromised, much less whether any of the systems are honeynets.

I do believe baiting the "smart fish" might be possible, but I have never done this. Is not legally entrapment, as we aren't any sort of police force, but I am not very comfortable with the idea. If someone attacks my box that is just unobtrusively sitting on the network, I believe the attacker should have no expectation of privacy for his activities on the system. Things become more complex if I try to lure the attacker.

8) IPv6
by caluml

Do you think that with the very large address space of IPv6 that random scanning for a certain port will die off? (I notice nmap doesn't support random IPv6 address scanning - maybe you've already come to the same conclusion?) Simply put, the chances of finding a machine if it's not advertised anywhere will be very much reduced. Will this make people lazy and complacent, trusting on the large numbers involved to protect them?

Fyodor

Finding a machine by by pinging a completely random 128-bit address will probably never be effective. Fortunately, we won't have to! Nmap does not even do that for 32-bit IPv4 addresses - it is smart enough to skip huge blocks of address space that are unallocated or used for private (RFC1918, localhost) addresses. We will also see patterns emerge for IPv6. For example, they may often be allocated sequentially so that finding one leads to many others. I am waiting until adoption rises and we start seeing these patterns emerge before I can implement them appropriately in Nmap. Certain new DNS features may also prove useful for locating IPv6 machines and networks.

9) standalones and small home nets
by zogger

it seems like most of the emphasis is on enterprise networks, but that still leaves millions and millions of home machines and small home networks just stuck. What do you see as some of the trends and solutions for those people? Their data and system integrity is just as important to them as any corporations is, and usually not having the appropriate skill set, is even harder to implement.

Fyodor

I am afraid the focus by security companies on enterprise networks will continue, as that is where the money is. The good news is that securing small home networks is far easier. But that doesn't make it simple, nor mean that many people will bother. I would categorize the risks into 3 categories:

Traditional network server vulnerabilities: Your average home user doesn't need to run any network daemons or have any TCP/UDP ports open to the Internet. Most of the time they only have 1 IP, used either by a standalone PC or a NAT device (e.g. "broadband router") in front of their small network. This is a good configuration, as it limits what attackers can reach directly. But you need to be sure that the IP doesn't have any unnecessary ports open. You can verify this by running 'netstat' on the Windows or UNIX machine using the IP. I would also recommend confirming using a port scanner such as Nmap. Here are example commands:

nmap -p- -sS -T4 -v -O [your IP]
nmap -p- -sU -v [ your IP ]

The TCP and UDP scans could be combined into one execution, but are listed separately since the TCP scan may go much faster. Remote UDP scans are also less reliable against some heavily filtered hosts. You may have to rely on the netstat info or configuration details in this case.

Any open ports found should be evaluated with extreme prejudice. Unless clearly necessary, close Windows file sharing, external NAT device admin ports, and everything else found.

Don't forget the wireless backdoor! Blocking the Internet link from your private machines is insufficient if anyone can hop on your open WLAN and attack your machines. WEP isn't perfect, but the 104-bit (so-called 128-bit) version should at least keep people from accidentally connecting to your network or sniffing your data. Be sure to set a good password and upgrade to recent firmware for your WAP and other network devices.

Subscribe to the security advisory lists for all the operating systems (and devices, if available) you run. Major vendors such as RedHat, Debian, FreeBSD, Mandrake, and Microsoft all offer these. Most even offer automatic updates if you desire that.

Client vulnerabilities: Once you close the services you don't need (ideally all of them), client vulnerabilities must be addressed. Keeping your web browser and mail reader up-to-date is particularly crucial. Also harden them as much as possible. For example, IE is full of holes but at least has a good interface for site-by-site security policies (Tools -> Internet Options -> Security). Go through and neuter the "Internet zone" settings by disabling ActiveX and Java. In the rare case that sites need this, find an alternative site or add them to the trusted zone. If your are really serious about security, neuter "trusted sites" and "local intranet" privileges as well. Many recent IE vulnerabilities trick the browser into using the wrong zones. Consider using a different browser. Also configure your mailer to disregard HTML and JavaScript.

Remember to pay careful attention to security warnings, whether they come from IE, Mozilla, your ssh client, or anything else. Don't just click OK. And don't shoot yourself in the foot when configuring your apps. It is hard to entirely blame the vendor when users tell P2P apps or Windows filesharing to share their whole drive without any password. Failing to change default passwords or enable basic restrictions on X Window or FTP servers is only slightly more forgivable. All of these errors happen frequently! The apps/devices should be secure by default, but you have the ultimate responsibility for protecting your data.

Malware: This is what I consider the biggest problem on desktops: people running applications they can't trust. Email borne viruses, worms and trojans are an obvious example. Be very careful what you click on. Unfortunately, it is very difficult to know what to trust. Mail is trivial to forge, and even the "proper" installers for many P2P applications infest your computer with loads of invasive spyware. Even Intuit TurboTax was caught writing to customers' boot information track.

What can you do? My honest suggestion is to run peer-reviewed open source applications on a free OS such as Linux or FreeBSD. You still have to be careful, but these problems are far less prevalent on UNIX platforms, which also have better tools and procedures to deal with them.

What if dumping Windows is not an option? Run NT/2K/XP instead of Win9X/ME, and try to run everything you can as an unprivileged (non-administrator) user. Be extraordinarily careful about what you install and run, and make frequent backups. You might also want to look into a personal firewall such as Zone Alarm (limited free version.

10) What is your favourite tool?
by Noryungi

I have just read your top 75 security tools list. Thank you for posting all this information, which I am going to study very carefully.

One question though: in all these tools, which one is your personal favourite? (This excludes Nmap, of course).

Fyodor

I have far too many favorites among this great group to choose just one! But here are a few developers and tools that are particularly worthy of mention:

One of the people I most admire in the security field is Solar Designer. He is a guru in networking, security, and low level kernel/assembly/architecture details. He has also created many tools that security professionals use daily. Yet he never exhibits the arrogance, elitism, and egotism that sadly characterizes so many "stars" of the security community.

Among SD's tools is John the Ripper, my longtime favorite local password hash cracker. It has been around forever, but was written with a flexible and powerful interface while keeping extensibility in mind. So it is still as useful in these days of shadowed password files and MD5/Blowfish hashes as it was back in the days of crypt() and unprotected /etc/passwd. Lately SD has been working on the Owl secure GNU/Linux distribution, which can be installed on disk for hardened systems like firewalls, or booted and run from CD as an easy way to run security tools such as John and Nmap.

Another of those "brilliant yet still nice" security developers is Dug Song. Even after the seminal "Insertion, Evasion, and Denial of Service" paper by Ptacek and Newsham, many IDS vendors continued to ignore the problem. When Doug released Fragrouter (now fragroute), which implements some of these attacks, vendors finally took notice! He has also written the excellent libdnet library, but my favorite of his tools is DSniff, a suite of tools for advanced network sniffing and "monkey-in-the-middle" attacks. It even handles ARP poisoning and other techniques for sniffing hosts on a switched LAN.

While I'm on this topic, let me also give "mad props" to the Hping2 packet prober, Kismet wireless stumbler, Ethereal packet decoder, Netcat, recent THC releases, Snort IDS, the Nessus vulnerability scanner, and all the other great Open Source tools out there!

I would also like to thank Slashdot for granting me this interview and to everyone who asked such excellent questions. I only wish I had time to answer more of them. Then again, I have probably rambled on enough. Now it is your turn to ramble in the comments :).

Cheers,
Fyodor

Ben Perry writes "News.com.com has a story about a Harvard researcher's study on how Gator operates. The report 'provides some data as to how much advertising Gator is showing and to whom it is targeted' and focuses on where Gator replaces a site's ads with Gator's ads. Gator is facing several lawsuits because of this technique."

scubacuda writes "Robert Clyde, CTO of Symantec, recently warned an audience at the United Nations that there's an increasing gap between the speed at which attacks are being launched and the industry's ability to respond. Most attacks on Web sites are classified as Class III threats because they tend to take several hours/days to execute. Recently, however, Class II "Warhol attacks"--such as the SQL Slammer worm that make themselves famous in 15 minutes--have emerged. Before long, Clyde predicts that groups of well-funded hackers working in concert will be able to launch Class I "Flash attacks." To combat this, Clyde says that patches would need to be developed more quickly and deployed continuously in an automated mode. Admins would need better ways of locking down networks so an attack on one router is automatically recognized by all routers on the network; throttling back the throughput of suspicious packets on the network in order to limit damage; automating tools for ensuring that all network clients are compliant with security policies; and creating Web services technologies that do not interfere with application performance."

word spreader writes "The Third OSCOM conference on free and open source content management is happening at Harvard Law School May 28-30, 2003. The conference theme is 'Leveraging content with CMS: authoring and syndication towards the semantic web.' It is organized in conjunction with the Berkman Center at the Law School. The keynote will be given by Dave Winer (author and co-inventor of numerous important Internet technologies). A second keynote will be delivered by Jon Udell from Infoworld."

SEWilco writes "A record of recent global temperatures has been assembled by piecing together the hundreds of studies with past temperature estimates [Discovery, Harvard]. The record shows there was a "Medieval Warm Period" warmer than the 20th Century. This was followed by the "Little Ice Age", which ended around 1900. We're having average climate now. Numerous sources indicated this, but apparently were not gathered into one document" This adds some more background reading to the previously linked Telegraph story.

scubacuda writes "The Inquirer and Get Reading report that a UK man accused of having pornographic pictures of kids on his computer was acquitted after a court heard that his machine was infected with a Trojan on his PC which probably auto-downloaded the images. (In light of moves like Operation Ore, we'll probably hear more defenses like this.)"

David Turner writes "Tomorrow, Tennessee's Senate Judiciary Committee is holding a hearing on two nearly identical DMCA-like bills. These bills threaten personal privacy, anonymity, and security research. SB 213 and HB457 are similar to state laws introduced all over the country by the MPAA. Despite amendments, the bills still threaten digital freedom. Last month, twenty people showed up at the Massachusetts public hearing, and effectively opposed the one MPAA lobbyist. If you attend, speak from notes rather than simply reading a statement (but you may be able to submit written testimony). Please come to Legislative Plaza in Nashville, rooms 12 and 14 at 3:30pm." And Kraken137 writes "The House and Senate of the Arkansas state legislature have passed the MPAA's "Super-DMCA" Bill, and it is now sitting on the Governor's desk awaiting his signature. It's not too late to convince him to veto this bill! Arkansas residents are urged to contact the Governor's office to express their opposition to this violation of rights. The ever-vigilant EFF has a page where residents can send a fax to Governor Huckabee's office to let their voices be heard. Remember, paper and phone calls make more of a difference than emails!"

dan moore writes "Students at Caltech and Harvard have developed a system that analyzes playlists and learns people's listening patterns. It then channels its knowledge into generating streams of music that the people themselves would like to listen to. Intuitive, accurate, and finally someone has done it. Check out the website to get one of the available plugins. Another interesting approach to digital music."

Uosdwis writes "The New York Times (FRYYY) has an article about SIRTF, the fourth and last 'Great Observatory'. It is a Space based Infra Red Telescope Facility which will extend the work of The Hubble telescope, The Compton Gamma Ray telescope and The Chandra X-Ray telescope. SIRTF is quite an amazing project using new ideas such as an Earth Trailing starting from an L1 orbit, and cooling only the intruments. Saved tax payers over $1 billion in redesigns. Check it out!"

KIondike writes "The Register talks about how a term ("Second Superpower") coined by the anti-war culture suddenly got radically neutered and altered by a weblog that a lot of people link to. Searching for the term on Google now brings up his blog and other people talking about his blog for the first several entries. Can Google's power to give information to the people be misused and perverted? This only took 42 days." First the widespread usage of "googling" to mean web searching, and now this.

mpawlo writes "Gnuheter reports that the Berkman Center for Internet and Society releases the H20 courseware software as open source. Two years and 1 million USD are invested in the software so far... The software has been tested at Harvard Law School, but should be suitable for other disciplines than law."

mpawlo writes "Gnuheter reports that the Berkman Center for Internet and Society releases the H20 courseware software as open source. Two years and 1 million USD are invested in the software so far... The software has been tested at Harvard Law School, but should be suitable for other disciplines than law."

Slashback with updates and amplifications on Apple's stance on DRM, EasyInternetCafe's court battle over CD burning, a copyright law being drafted after Lessig's own heart, the lawyer vs. eBay saga, and VoIP calling with Linux. Read on below for the details.

But sir, all of these songs are under the Open Content License! atta1 writes "In an article on The Register, EasyInternetcafe has lost its court battle against British Phonographic Industry (BPI) over burning downloaded music to CD."

When last mentioned (August of last year), EasyInternetCafe was trying to avoid fines from BPI for letting Internet cafe customers burn to CD music they'd downloaded there.

After all, somebody's got to write 'em. g_adams27 writes "Several weeks ago, Larry Lessig proposed anti-spam legislation he'd like to see Congress pass -- legislation which he was willing to bet his job on. Now it looks like Washington might be taking his bet... and they want us to help out!

A congressional aide appears to be drafting legislation based on Larry's suggestions and is asking the Politech list for suggestions. The proposed law is posted here."

IP leases are nicer than telephone leases. Lots of people were interested in the story posted the other day about VoIP support in GnomeMeeting. I mentioned there that theKompany had a VoIP application for Zaurus owners; Shawn Gordon of theKompany writes with information about a forthcoming desktop version as well.

"So we released tkcPhone a few weeks ago, we found some issues with Net2Phone that we've just finished sorting out today, and we've about wrapped up the tkPhone beta, which we expect in a day or two. Having tkPhone allows us to do some things we couldn't on the Zaurus, like make use of a Speex codec which is part of the Xiph umbrella these days, we couldn't use it on the Zaurus because it requires floating point support. We also can have a system tray notifier and a roomier user interface. Because we spent so much time optimizing everything to work on the Zaurus, it means your desktop performance is going to be very good.

We decided to use SIP as opposed to H323 for a lot of reasons: smaller, faster, lighter, newer, easier hardware requirements. So with our phone a regular sound card and a headset/mic will typically suffice for what you need or want to do. Our arrangement with Net2phone means that in addition to PC-to-PC calls, you can make PC-to-phone and PC-to-mobile calls as well. The prices range from free to as little as $0.02 per minute in the U.S. and $0.03 minute internationally. You're already paying for your internet access, might as well start to piggyback this stuff.

tkPhone is not free however, it is $9.95 for the electronic version of the application. We expect to have it up for sale about February 10, 2003."

And as several readers pointed out, if you're interested in VoIP on Linux, you should also check out the sites of both the Bayonne project (mentioned several times before)and asterisk (also discussed here).

You mean they're against my inalienable right to watch movies for free? geekee writes "An article on CNET states that the Internet Streaming Media Alliance (ISMA) will include DRM support in the MPEG-4 open standard. Without DRM, the ISMA doesn't believe MPEG-4 will be able to compete against proprietary standards such as that provided by Microsoft since content owners 'want continually improved tools, with rights management.' For instance, Movielink, an online movie rental source, has opted to support Microsoft and RealNetwork formats because of their DRM capabilities. An interesting thing to note is that Apple is a member of the ISMA, and has previously declared its opposition to DRM."

Money talks, and sometimes it says nasty things. scubacuda writes "Since eBay removed the alleged libelous statements, Roger Grace has agreed to drop his libel lawsuit for $2.5 million in punitive damages from eBay and $100,000 from Tim Neeley (who wrote that the magazines he bought from Grace had arrived late and in a worse condition than advertised). Interestingly, eBay removed the feedback not because it was 'negative,' but rather because 'the contact information for the seller was not correct.' Chris Donlay, eBay spokesman, says, '[T]hat is one of the circumstances in which we will consider removing the feedback,' EBay attorneys even went to far as to claim that Grace's original lawsuit is 'completely without merit.'"

(Here's the Slashdot post from last Saturday, 'Attorney Sues eBay over Negative Feedback'.)

Slashback tonight brings you updates on Red Hat's EOL timetable, NASA's tutorial on creating your very own spooky UFO images, the status (back up!) of the PCI Vendor and Device lists, and more -- read on below for the details.

With a baby and some makeup you can add in some aliens. Docrobot writes "NASA is obviously tired of the recent fanatical conspiracy claims dealing with 'faked' Apollo Moon Landings, the 'Face on Mars,' and most recently EuroSeti's claim that enhanced SOHO satellite images show UFOs.

NASA debunks EuroSeti's resent image enhanced SOHO satellite UFO photos covered by us here with this snappy and smug how-to article entitled: How to Make Your Own UFO.

It looks like Euroseti should to go back to the drawing board, or up their meds..."

At least use a security envelope next time. mpawlo writes "As reported by Greplaw, Reuters will not be prosecuted due to the alleged hack of Intentia's web server. Intentia did not clearly state that the information was secret, nor did Intentia try protecting it. Intentia stated that the report would be available at a certain time, and you only had to slightly change the URL from the report of the previous quarter in order to obtain the current report. Hence, the prosecutor will not initiate proceedings against Reuters or any of its reporters."

(Here is Slashdot's previous story on this affair.)

A happy turn in the PCI list saga. DieNadel writes "I've received an email today from PCI-SIG regarding the End of the Free PCI Device List, that says:

'Dear PCI Community,

The PCI Vendor and Device Lists located at http://www.yourvote.com/pci/ have been restored. The PCI-SIG recognizes the value of Jim Boemler's Web site and our officers have worked with him to restore it.

We are committed to working with Jim and the rest of the community to ensure this service is not interrupted in the future.

Thank you for your continued support of our technologies. We will keep you informed with any other updates.

Best Regards,

Tony Pierce
PCI-SIG Chairman.'

I think it's a nice move from PCI-SIG!"

Making money with Free software, explained. Yesterday, we posted a link to an article explaining Red Hat's new EOL schedule for various versions of its operating system. Red Hat's decision drew a lot of flak in the comments attached to that story; not that it won't again, but over on NewsForge, Red Hat's Jeremy Hogan has a reaction-to-the-reaction (not just on Slashdot) which the new EOL schedule drew.

Brian Golden writes "As a result of a suit filed by the RIAA, the identity of a Verizon customer with a penchant for mp3's was ordered to be released. Man, how many people are now sweating bullets trying to remember what they downloaded?" News.com.com also has a story. If you've forgotten about this case, see our earlier story. Verizon wasn't making any sort of principled stand to protect its users' privacy, it just wanted to avoid the costs of complying with the (many) subpoenas it will now receive.

Shooter6947 writes "A new transiting extrasolar planet has been announced -- the only other known object that passes between its star and the Earth each orbit, a situation known as a transit, is HD209458b. The new planet, OGLE-TR-56b, is 0.9 times the mass of our own Jupiter and 1.3 times Jupiter's radius. It is the closest-in extrasolar planet yet found, with its year being only 1.2 days! Read about it from a cnn.com article or from the original scientific paper."

Gamer writes "There is an interesting debate on Grand Theft Auto and rating of computer games going on. It started with Lawmeme's Paul Szynol wants 'distribution control so that minors don't get access to inappropriate material'. Greplaw's Mikael Pawlo has a reply saying 'Computer games are art and should be dealt with accordingly, without any references to the prohibition tactics of the 1980:ies.' Would the world not be a better place without the violence in GTA? I don't understand Pawlo's art argument, although I love gaming. I agree with Paul Szynol. Kids should not get violent games." I really don't have a problem with regulating violent games- its when the government tries to outlaw them that I have a problem.

Slashback with words on the demise of TIPS, MPlayer's newest add-in, Revolution OS on DVD, Wal-Mart blinking first in their fight with FatWallet, and more. Read on for the details.

Facts is facts, Ma'am. joebeone writes "WalMart has backed down [AScribe.org] from it's DMCA claim in the FatWallet case[1] after FatWallet countered that facts are uncopyrightable (at least in the US). Let this be a lesson to those who would use the DMCA to unjustly intimidate websites into removing content. I definitely think that Boalt Hall's Samuelson Law, Technology and Public Policy Clinic deserves some major credit for sticking up for the little guys who don't have the litigatory resources that companies like WalMart have.

[1] WalMart claimed that their day-after-thanksgiving sale prices were copyrightable."

Maybe they just changed the drop location. An anonymous reader writes "There was one small ray of light in the Homeland Security Act. A provision inserted in the bill killed the Justice Department's TIPS initiative. You'll recall that TIPS was the DoJ's proposal to create a domestic spy network using ordinary citizens. And I was hoping to join up and inform them that John Ashcroft wears women's underwear. Oh well ..."

Best way to play back "L.A. Confidential." An anonymous reader writes "The best media player for *nixes, MPlayer, has just gotten better with the ability to play Windows Media Player 9 (WMV9 and WMA9) files. When Sorensen playback was added the only remaining codecs were the Window Media Player ones. Now that this is complete, Linux finally seems to have a complete solution for multimedia playback. It just remains for the mainstream distros to include this gem."

Measure three or four times at least, cut once. jdevons writes "The Owner-Builder Book that I reviewed a while ago has been updated. The author reads slashdot regularly and included many of the ideas and suggestions offered in the slashdot comments ..."

Jeff, Rob and Chris in their Hollywood makeup. updog writes "The film Revolution OS, which has been discussed on Slashdot here and here, is now available on DVD at Netflix (btw, it's interesting to note that this Netflix version is sub-licensed under the guise of pay-per-view television, and the director J.T.S. Moore wasn't even aware of its existence until recently.)

A 2 Disc Special Edition DVD will be available in January 2003, and will include additional interviews, bonus material, and better video quality over the Netflix version. You can make sure that you're notified when it's released by requesting info here. Finally, I've written a review of the Netflix version of the DVD, which you can read here."

Next year's stocking stuffer, maybe? An anonymous reader writes "nvmax.com is running a story/press release explaining how Dynamism.com is teaming up with the Zaurus Open Source development community to bring the Sharp Zaurus SL-C700 to English!. I need to get one!"

What I want is C-64 style Aztec. retro128 writes "For all of your old schoolers out there, Tierra Entertainment has released a re-make of King's Quest II, which includes original art, completely redone music, and a few extra things not seen in the original game (some early screen shots hinted at a town, which did not exist in the original). What's remarkable is that Tierra has no affiliation with Sierra whatsoever, and is driven by two developers who wish to remain anonymous. I've played their re-make of KQ1 and it's up to snuff. Check out the main page or go straight to the good stuff."

Loligo writes "Harvard University's Berkman Center for Internet & Society has released a study listing some of the sites filtered by Chinese internet connections. Sites about Taiwan are maybe understandable, but Red Lobster?" We've mentioned the ongoing Berkman study before; one of their interesting findings is that the list of blocked sites is a moving target, and some sites are blocked only intermittently. Here are summaries from The New York Times and MSNBC, by way of The Censorware Project. Update: 12/04 21:03 GMT by T : Seth Finkelstein points to his report "Searching Through the Great Firewall of China," which "describes a simple technique which can be used with some search engines to bypass censorware bans on searching for forbidden words. Particular emphasis is placed on the situation of the Great Firewall Of China."

Loligo writes "Harvard University's Berkman Center for Internet & Society has released a study listing some of the sites filtered by Chinese internet connections. Sites about Taiwan are maybe understandable, but Red Lobster?" We've mentioned the ongoing Berkman study before; one of their interesting findings is that the list of blocked sites is a moving target, and some sites are blocked only intermittently. Here are summaries from The New York Times and MSNBC, by way of The Censorware Project. Update: 12/04 21:03 GMT by T : Seth Finkelstein points to his report "Searching Through the Great Firewall of China," which "describes a simple technique which can be used with some search engines to bypass censorware bans on searching for forbidden words. Particular emphasis is placed on the situation of the Great Firewall Of China."

Loligo writes "Harvard University's Berkman Center for Internet & Society has released a study listing some of the sites filtered by Chinese internet connections. Sites about Taiwan are maybe understandable, but Red Lobster?" We've mentioned the ongoing Berkman study before; one of their interesting findings is that the list of blocked sites is a moving target, and some sites are blocked only intermittently. Here are summaries from The New York Times and MSNBC, by way of The Censorware Project. Update: 12/04 21:03 GMT by T : Seth Finkelstein points to his report "Searching Through the Great Firewall of China," which "describes a simple technique which can be used with some search engines to bypass censorware bans on searching for forbidden words. Particular emphasis is placed on the situation of the Great Firewall Of China."

Loligo writes "Harvard University's Berkman Center for Internet & Society has released a study listing some of the sites filtered by Chinese internet connections. Sites about Taiwan are maybe understandable, but Red Lobster?" We've mentioned the ongoing Berkman study before; one of their interesting findings is that the list of blocked sites is a moving target, and some sites are blocked only intermittently. Here are summaries from The New York Times and MSNBC, by way of The Censorware Project. Update: 12/04 21:03 GMT by T : Seth Finkelstein points to his report "Searching Through the Great Firewall of China," which "describes a simple technique which can be used with some search engines to bypass censorware bans on searching for forbidden words. Particular emphasis is placed on the situation of the Great Firewall Of China."

mpawlo writes "I was going to clean up my apartement, but instead I wrote a piece for Greplaw introducing a framework for the debate on how we should obtain a balance between users and authors where the author has good incentives to innovate, but where society at large is not too restricted due to the author's previous innovations. I am afraid that I personally have few practical solutions to introduce, but you might find my text useful as a quick introduction to what the copyright fuss is all about and why you should care."

An anonymous reader writes: "On December 4, John DeTreville from Microsoft Research will give a technical presentation about Palladium, Microsoft's Digital Rights Management effort. The talk is open to the public and is a good chance to ask questions."

mpawlo writes "Patrik Faltstrom humbly describes himself as a short person from Sweden interested in communication and information. However, Faltstrom has a lot of insights on IETF, IESG and ICANN. Greplaw has picked Patrik Faltstrom's brain." Here's a sample: "By minimizing the problem space ICANN work with, and for example maybe only try to look at policy around creations of new top level domains, success can be reached faster. I do not think ICANN should become (intentionally or unintentionally) a kitchen-sink for all Internet-related issues." Read the article at Greplaw.

mpawlo writes "I just did a quick write-up for Greplaw on an interesting pending law suit in Sweden. Two Swedish directors, Vilgot Sjoman and Anders Eriksson, are about to file a suit against Swedish broadcaster Tv 4. According to the author's rights or droit moral doctrine, the work may not be displayed or changed in a way degrading to the author or the author's work. Tv 4 has just changed its policy for commercial breaks. Breaks are now introduced during movies. The commercial breaks used to be placed between the end and start of a program. The directors argue the breaks are degrading from an artistical point of view. They want to try the commercial breaks in court from a copyright perspective."

tiltowait writes In response to the incredulity expressed in this story about the technical prowess of libraries, I'd like to present a short essay titled "Librarians: We're Not What You Think" - read on for more. Update: 10/20 18:15 GMT by M : The author has also put up his essay on his own webpage. From the spinster librarian in It's a Wonderful Life to the crochety archivist in Attack of the Clones, librarians are often portrayed (in everything from movies, musicals, children's books, literature, science fiction, comics and cartoons to pornography - yes, pornography) as something less than noble or admirable. The perception of librarians has been a popular topic recently, with several articles focusing on the fringe-type librarians (ska, rockabilly, bellydancing, modified, bodybuilding, laughing, and lipstick). Although something of an anti-stereotype, these people illustrate the range of librarian personalities.

Many people may hold the image of a librarian as a shushing school marm who does little more than stamp and shelve books because that's all they've seen librarians do. Well think again - that's about as inaccurate as believing that Alan Greenspan is nothing more than a glorified bank teller. The job titles may change but the mission of the profession remains the same: organize information and help people find it. Libraries have been around a lot longer than the Internet, and even library technology can hold its own with the best out there. For example, Google's savvy results ranking was hardly the birth of citation analysis (next up: metadata - cough, cataloging, cough), and there are enormous library systems that also predate the Internet.

Although library geeks and technology nerds may have contrary images, in today's world the boundary between the career of the librarian and the information technologist is disappearing. Librarians today not only administer Web servers and dynamic databases to help manage large digital collections and thousands of electronic resources, they teach people how to use library systems. And just as enlightened computer engineers are advocates of noncommercial software and campaign for online rights, the library profession has a long history of staunchly defending freedom - from book burnings to the FBI's Library Awareness Program to the latest copyright battles and almost all other current issues in intellectual freedom.

Check out LISNews.com (recognize the format?) and some library blogs if you're interested in reading more about real librarians.

LawGeek writes "Adam Kessel has provided Greplaw with exclusive coverage of today's RIAA v. Verizon hearing, in which the RIAA is attempting to force Verizon to produce information about a user who allegedly shared files using P2P technology. It sounds as though the judge had a good grasp of the technology, and has promised to rule quickly. Slashdot has previously covered Verizon's stance on this and other P2P issues."

LawGeek writes "Adam Kessel has provided Greplaw with exclusive coverage of today's RIAA v. Verizon hearing, in which the RIAA is attempting to force Verizon to produce information about a user who allegedly shared files using P2P technology. It sounds as though the judge had a good grasp of the technology, and has promised to rule quickly. Slashdot has previously covered Verizon's stance on this and other P2P issues."

LawGeek writes "Adam Kessel has provided Greplaw with exclusive coverage of today's RIAA v. Verizon hearing, in which the RIAA is attempting to force Verizon to produce information about a user who allegedly shared files using P2P technology. It sounds as though the judge had a good grasp of the technology, and has promised to rule quickly. Slashdot has previously covered Verizon's stance on this and other P2P issues."

mpawlo writes "I just picked Don Marti's brain in a short interview published by Greplaw. Don Marti is the editor of LinuxJournal and the mastermind behind the Burnallgifs campaign. He has strong views on free software, software patentability and the freedom of the Internet. Marti should personally be featured in any encyclopedia under 'geektivism' and the brief interview may be of interest to Slashdotters not yet familiar with Mr Marti."

MagnetarJones writes "Multiple observations made over several months with the Chandra X-ray Observatory and the Hubble Space Telescope captured the spectacle of matter and antimatter propelled to nearly the speed of light by the Crab pulsar, a rapidly rotating neutron star the size of Manhattan. "Through this movie, the Crab Nebula has come to life," says Jeff Hester of Arizona State University."

legal_tinker writes "At grep.law, Tait Graves writes: 'In a majority of states, you can be enjoined from starting a new job because of what you know, even if you have done nothing wrong.' A California court just rejected that idea in California."