Domain: mit.edu
Stories and comments across the archive that link to mit.edu.
Comments · 7,673
-
robotic arm that catches and throws
Since we're on the topic, you can find some clips of some work I did way back in 1995 on robotic catching at http://www.mit.edu/nsl/www/. The arm can only catch underhand tossed objects. The trajectory is planned to match position and velocity with the object and then decelerate along a smooth path. This allows for a greater window of time for closing the hand. Removing the matching constraint allows the arm to catch faster objects, but then the limiting factor becomes the vision system (60fps) and the timing of hand closure. We also added in some aerodynamic predictors that let us catch paper airplanes, but those are much harder to throw back.
-
Re:only one class?
Another perfect example is from SBC 2004. MIT professors developed this "cutting edge" biological technology where students can build biological system using component parts. In a competition among 'top' schools (MIT, Princeton, Caltech, etc) UT Austin dominated.
(And ended up with a really cool product.) -
My God is a Squid
A buddy of mine wrote a great article after we got preached at by a small heard of Christian Fundies outside a symposium on Evolutionary Theory, the Fossil Record, and Soft Bodied Mollusks.
If you're interested in a quick, funny read, here is a copy:
http://eddie.mit.edu/~jc/humor/Squid.html
There is another, more indepth article about the problems with the vertibrate eye, that can be summed up with a nice simple catch phrase...
"If the creationists are right, God is a Sqiud." -
Re:How is this different from *NIX shell scripts?
I remember it too. There's a good chance it could happen again: it would have to spread via HTTP, SMTP, and SSH vulnerabilities to use ports that aren't blocked on gateway systems, rather than telnet and rsh, and woould perhaps also require probing VPN setups to gain access from infected machines to corporate networks. But a better built package more aimed at damage could easily replicate its password guessing and replation capability and cause quite a lot more damage today. People should be concerned about this stuff. It's amazing how Morris never spent a day in jail, but instead is now a professor at MIT ( http://pdos.csail.mit.edu/~rtm/ ). Gee, writing destructive worms that ruined systems worldwide, and help ruin your father's career as head of the NSA must really be work which MIT wants to foster as part of their "ubiquitous computing" developments. That's just what I'd look for as part of the computing in my home!
-
Microstrip antennas
When we designed the SPARTAN Packet Radio Experiment, we designed and used a microstrip antenna (aka patch antenna) for VHF communications. It makes a lot more sense for a space payload to use patch antennas rather than anything that sticks out of the side of the spacecraft.
Here is a good wideband VHF/UHF microstrip antenna example. -
Mmmmmmm, FUD
>So what will Linux do that Windows can't already do?
>Will it wash my car? Make a nice scrambled egg and
>bacon? Still has a web browser. Still has an email
>program. Still point and click.
It might not wash your car, but you *could* set up a home security/surveillance system with it if you got some cameras/sensors and wanted to. Also, there are a number of experimental robots in existence running Linux now, so if you were smart enough on the hardware end you very well possibly *could* build something that could wash a car...same for the egg and bacon. There's a HOWTO in existence for a Linux-powered coffee machine.
>Perhaps the decision makers of Linux should focus
>on newer ways of doing things.
You mean like this, this, this, or maybe this?
>So where is the free folks? Only a matter of time
>before licensing fees are added.
Been here recently?
Not to be antagonistic, but before forming an opinion, you might want to do some actual research to base it on first. This is one of the most ignorant comments I've seen for a long time. -
Structures and Interpretation of Computer Programs
I'd recommend the SICP lectures at
http://swiss.csail.mit.edu/classes/6.001/abelson-s ussman-lectures/
for an introduction of what Lisp can do. And if you're a programmer and havn't read the SICP book yet - please do, it teaches you a thing or 10 applicable to all programming languages.
(Yes - so SICP is about Scheme, a much simpler dialect of Lisp than Common Lisp of the topic here.. still..) -
Re:Speculative article != news article
This isn't a speculative article. It's a quiet attempt by Microsoft to gauge the community's reaction to a possible open source product.
Recently I was paid $10 to take a survey geared towards IT professionals about "current trends within the Software and PC Industry". The questions were clearly written by Microsoft, and one possible plan was obvious:
-Microsoft will compose a list of dozens of software patents allegedly violated by Linux and will offer total indemnification for Red Hat users only. If necessary, it will use its own patent portfolio as leverage.
-Microsoft will strengthen Red Hat's source offerings to emphasize "interoperability", which means that it will be possible to administer a RH install from Windows.
-Microsoft will buy Red Hat for considerably more than it seems to be worth and will immediately cripple it just as it's crippled every other worthy competitor it has bought out.
This is a clever plan to defeat Linux.
(Part of the survey really bugged me because it seemed like a push poll - see here.) -
some thoughts
maybe contact these guys see if they have any protypes to test out
http://laptop.media.mit.edu/
there's also
http://www.freeplayfoundation.org/
I own two of their radios, great stuff! Multiband, no batteries required
And maybe visit a few solar dealers, see if you can get some donated stuff, panel or two, charge controller, etc. snag a truck battery once you are there.
Oh ya, good water filter! I use a royal berkefield with the "black berky" filter elements. -
You are wrong.I am not personally familiar with Kerberos. However, I know how to read documentation. So let's look at the Kerberos spec, shall we? Any emphasis below is mine.
The client prepares the KRB_TGS_REQ message, providing an authentication header as an element of the
And then later on, multiple things to the effect of:
padata field, and including the same fields as used in the KRB_AS_REQ message along with several optional fields: the enc-authorization-
data field for application server use and additional tickets required by some options.authorization-data[10] AuthorizationData OPTIONAL
The "data authorizaton" you refer to is-- by the spec-- clearly referred to as "optional" every time it comes up. This means that spec implementors are under no obligation to observe its contents. Now, if you go and look up the original problems with the MS Kerberos extension:From discussions with Microsoft, which were not under an NDA, the situation appeared to be as follows circa October, 1997. This information comes from the USENIX publication
So what we are left with is this. The Microsoft kerberos extensions took a field clearly marked in the spec as "optional" and made it non-optional, while other implementations took the optional field and ignored it. Ignoring an optional field would be a correct implementation of the specification; requiring it would not. Meanwhile by the information above, the data Microsoft carried in the field is not only seemingly not the proper encoding of the AuthorizationData field given by the spec, but contains information which was not only outside the scope of the spec, but arbitrarily defined by microsoft and then NOT PUBLICLY DOCUMENTED. Microsoft claims a "loophole" not specified justifies this, but if you use a "loophole" to add information to a protocol which breaks compatibility with existing implementations you cannot possibly blame anyone but yourself for this. ;Login.
NT 5.0 will indeed use Kerberos. However, the protocol has been "extended" by Microsoft, by adding a digitally signed Privilege Attribute Certificate (PAC) to the Kerberos ticket. The PAC will contain information about the user's 128-bit NT unique id, as well as a list of groups to which the user belongs.
The NT PAC is unfortunately not compatible with the PAC's used by the Open Software Foundation's Distributed Computing Environment (DCE). It is also somewhat debatable whether the NT PAC is legal with respect to RFC-1510, the IETF Kerberos V5 protocol specification. The original intent of RFC-1510 prohibited what Microsoft was trying to do, but Microsoft found what they claimed to be a loophole in RFC-1510 specification.
Many folks, including Paul Hill and Ted T'so at MIT, as well as Cliff Neumann at ISI, have tried to work with Microsoft to find a more compatible way of doing what they wanted to do. To that end, we made changes in the upcoming revision of RFC-1510 to add a clean and compatible way of adding extensions such as Microsoft's PAC to the Kerberos ticket.
To Microsoft's credit, they agreed to change NT 5.0 to use a cleaner and more compatible way of adding extensions to the Kerberos V5 ticket ... [snip]
RFC 1510 specifies that the encrypted part of a ticket may include an optional AuthorizationData field. If the authorization-data are present, they are decrypted using the sub-session key from the authenticator. ... [specified encoding of authorization-data field follows]
Microsoft has not fully disclosed their use of the authorization data field. However some information is public knowledge at this time.... [partial, reverse-engineered microsoft encoding of authorization-data field follows]
It would appear you either are misinformed or trying to mislead us. -
PGPfone
Was a neat little app a few years back for simple IP-IP VoIP that was (supposedly, never checked) well encrypted, it converted the key in to english words that you could say in your own voice to confirm that you weren't a victim of a MITM attack
http://web.mit.edu/network/pgpfone -
Re:Why does everyone here love Linux?
Those guys don't care about the rest of us, they have jobs, they're being paid by the government to design their half ass compilers and shitty OS.
Not true! Anything Richard Stallman needs he gets from donations (or anything he managed to save from his MacArthur award). He doesn't work for his food like the rest of us! I don't think he's ever had to earn a wage or salary from productive position.
To be fair, he's hardly alone in this. Like my university professor friend who thinks money grows on the government grant tree, or my charity president friend, who makes her living crying during PBS pledge breaks. -
Re:Net Master 10 base T
No question about it. I remember reading that years ago and LMAO. I'm just annoyed that you posted it before I could find the link in my old bookmarks
:)
Still, there's always Dr Seuss...
http://web.mit.edu/adorai/www/seuss-technical-writ ing.html -
Re:Vista is written in mumps
Mumps code:
f p=2,3:2 s q=1 x "f f=3:2 q:f*f>p!'q s q=p#f" w:q p,?$x\8+1*8
[part of Keith Lynch's .signature; it prints a table of primes,
including code to format it neatly into columns--DPBS]
(from ftp://rtfm.mit.edu/pub/usenet/comp.lang.mumps/M_Te chnology_and_MUMPS_Language_FAQ,_Part_1_2
)
line noise?
Perl's got nothing on mumps. -
Yatta!
-
Re:"Maybe" fix it?
Where do you work? I'm an engineer at MIT Sea Grant, http://auvlab.mit.edu/
This article is pretty bad, and the project deserves better. SAUVIM has demonstrated some cool manipulation in a test tank, but they don't mention it... As your reply suggests, stereo-vision guided hand-eye coordination is hard for any robot, let alone one that is moving around at the bottom of the ocean! The fact that they had a sensor failure during a demo in the harbor means nothing, really; it happens all the time.
I wouldn't call the hardware development easy; although SAUVIM is huge (and expensive) enough to make it easier! The primary challenges are packaging for the underwater environment, and total system reliability... high pressure, corrosive salt water, very limited sensing range, in some ways it's harder than building a spacecraft.
Software for autonomous intervention work is still a ways off. Right now the predominant approach is "supervisory" control, where the AUV is capable of task-level autonomy but is constantly checking with the support ship as to what it should do next. -
Re:UI innovation and the Slashdot audienceAnd let me add something to my own comment that I forgot to say
:-)
I don't think the requirements in terms of the complexity of operations for Grandma will be the same of a UNIX sysadmin or programmer ever. They delve into a dimension of computer use she will never. And, that's all right, because we contitute different publics.
That, IMHO, is why we shouldn't (or won't, for that matter) ever have a GUI monoculture KDE, Windows or GNOME fans always want to push.
I will say this, though. Strangely enough, the type of GUI that satisifes the requirements of children using the computer to augment the learning experience is, IMHO, much more similar to what I've described for UNIX hardcore users/developers than for Granny.
And why is that? Because, if you use the technology (computers) as an enhancement to your intellectual capacity, just like books, dictionaries, pencils, blackboards are, then you have what Alan Perlis wrote beautifully in the Forward of one of the most beautiful books in Computer Science, The Structure and Interpretation of Computer Programs:
Educators, generals, dieticians, psychologists, and parents program. Armies, students, and some societies are programmed. (...)
Every computer program is a model, hatched in the mind, of a real or mental process.
So, the real question is how does the GUI help to make the computer as useful a device as paper-and-pencil? So, it's all about reducing computer illiteracy. It is not only about pretty GUIs. This is Microsoft talk. Microsoft trains people to behave like circus monkeys. It is intrinsic to their model.
True innovation in terms of user interfaces is not coming from GNOME, KDE or Microsoft. Look at OpenCroquet
Transparency, flipping windows, etc, are very superficial changes. -
Re:UI innovation and the Slashdot audienceAnd let me add something to my own comment that I forgot to say
:-)
I don't think the requirements in terms of the complexity of operations for Grandma will be the same of a UNIX sysadmin or programmer ever. They delve into a dimension of computer use she will never. And, that's all right, because we contitute different publics.
That, IMHO, is why we shouldn't (or won't, for that matter) ever have a GUI monoculture KDE, Windows or GNOME fans always want to push.
I will say this, though. Strangely enough, the type of GUI that satisifes the requirements of children using the computer to augment the learning experience is, IMHO, much more similar to what I've described for UNIX hardcore users/developers than for Granny.
And why is that? Because, if you use the technology (computers) as an enhancement to your intellectual capacity, just like books, dictionaries, pencils, blackboards are, then you have what Alan Perlis wrote beautifully in the Forward of one of the most beautiful books in Computer Science, The Structure and Interpretation of Computer Programs:
Educators, generals, dieticians, psychologists, and parents program. Armies, students, and some societies are programmed. (...)
Every computer program is a model, hatched in the mind, of a real or mental process.
So, the real question is how does the GUI help to make the computer as useful a device as paper-and-pencil? So, it's all about reducing computer illiteracy. It is not only about pretty GUIs. This is Microsoft talk. Microsoft trains people to behave like circus monkeys. It is intrinsic to their model.
True innovation in terms of user interfaces is not coming from GNOME, KDE or Microsoft. Look at OpenCroquet
Transparency, flipping windows, etc, are very superficial changes. -
Re:Quantum Consciousness, Not Size, Counts
Please note that the Penrose-Hameroff hypothesis is at this stage only an hypothesis, and it most certainly does not explain what consciousness is or how to reproduce it. In fact no one knows if the brain performs quantum computations of any kind, or if such computations are required for consciousness. Some AI luminaries think consciousness is in fact very simple, nothing more than memory.
At this stage physicists are trying to build very simple quantum computers, which could be used for accelerating some very specific computations. Some other people have proven that even quantum computing would not be the panacea that many think it would be. For a start it doesn't give any new insight on how to perform specific calculations that would lead to consciousness. All computations possible on a QC would also be possible on a classical one, albeit usually much slower (but it wouldnt' matter that much, at least in theory).
In other words the Penrose/Hameroff hypothesis doesn't really help in any significant way. It is just saying that the brain somehow performs some magic quantum thingy, and that thingy would somehow be the basis for consciousness. It doesn't say what this thingy is exactly, and most crucially doesn't say how to reproduce it in any way.
the P/H hypothesis is basically just saying "we can't have true AI with the current batch of computers, something else is required", but doesn't say what.
Needless to says this is not very helpful, and might be false entirely. -
Holy crap!
That thing is wicked! It's like Kismet with appendages!
-
Re:Where does a CS degree get you?
But Perl scripts and Visual Basic applications aren't computer science. A decent bachelor's in computer science program teaches you how to analyze and write algorithms, discrete math, the theory and application of various different technologies (compilers, operating systems, graphics), language theory, and other theory courses. This is a sample curriculum from a highly ranked public school. You might also want to look at this (another highly ranked public university) and this (from MIT). You'll also get a nice helping of calculus, statistics, differential equations, linear algebra, physics, chemistry, humanities courses, and some more.
If you want to spend your time learning Perl and VB, get an IT degree (like an MIS degree or a BS from Devry). If you want to spend your time learning the theory and application behind the interpreters that parse and interpret your Perl and VB code, you might want to get your BS in CS from a decent university.
A bachelor's degree (yet alone a master's or doctorate) isn't supposed to be job training; job training is left to trade schools (whose job is to teach people how to perform various jobs). An university degree is supposed to be used for education about a certain subject. If your job requires Perl and VB, learn them. Just don't expect the computer science department to teach you those languages; that's not computer science. This doesn't mean that the BS degree is a waste of time. You might be hired to help write the next Perl or Visual Basic.
-
other info
3-D chips do decreases wire length, according to the thesis and the IEEE paper in the links below, 56% less interconnect is required for a 5 layer chip. Wafer bonding has been thoroughly investigated, and processes compatible with standard CMOS have been found and will soon find a use in memory (I'm sure I read something about a start-up stacking chips for memory, I think it was called Tezzaron).
http://www-mtl.mit.edu/researchgroups/icsystems/3d csg/publications.html
http://www.stanford.edu/class/ee311/NOTES/3DProc_I EEE.pdf
The big problems facing the industry are the lack of good design tools and the issues associated with yield and heat. Design tools will be developed as the processes become more refined. Yield issues and heat will likely need to be taken into consideration in the design. Consider if you have an 80% yield on each wafer; when you have 5 layers of silicon--assuming defects are not correlated to the location on the chip, and no defects due to the bonding process--your yield reduces to 33%. Of course, we are able to have more redundancy with more silicon layers, so we can design systems that are fault tolerant (google: fault tolerant architectures. lots of good stuff). The costs of the chips will probably direct represent the decrease in yield -- good designs and tools will likely save companies a lot of money (i shouldn't give away my secrets before i patent them :-)
Cooling the higher density chips is probably the most major hurdle towards development of 3-D circuits. A few of these documents hint that microfluidic cooling systems may be the solution. Georgia Tech researchers made an advance on this end a few weeks ago by presenting a microfluidic manufacturing process compatible with standard CMOS design:
http://www.physorg.com/news4657.html
Expect lots of great things in the years to come. For now you can probably expect 3-D integration to creep into specialty mixed signal chips that are extremely expensive, and memory where heat generation is less of a problem. Microfluidic cooling technologies will be adopted in the near term for 2-D high power chips. The first 3-D micro-processor architectures will probably use extra layers for clock distribution, global interconnect systems, and power distribution systems. Caching systems will likely be added to as a third layer until new design approaches (and better tools) allow for the design of multi-layer integration with logic interspersed between the layers. -
Re:Sustainable cities?
The Greeks are a bad choice of example. Here's what Plato had to say about a once fertile region, destroyed by the kind of irrigation now being heavily practiced in California, among other places:
What now remains compared with what then existed is like the skeleton of a sick man, all the fat and soft earth having wasted away.... Mountains which now have nothing but food for bees
... had trees not very long ago. [The land] was enriched by the yearly rains, which were not lost to it, as now, by flowing from the bare land into the sea; but the soil was deep, and therein received the water, and kept it in the loamy earth ... feeding springs and streams running everywhere. Now only abandoned shrines remain to show where the springs once flowed.(Quoted in A Short History of Progress by Ronald Wright. Go read it. A complete English translation of Critas is here.)
Has it never seemed strange to you that the area called the "Fertile Crescent", mostly Iraq and Israel, is now anything but fertile? It's that way because of too little long-term vision in farming practices. We have been stressing our environment for a long time.
-
Re:Alleged?
And what else do you expect to happen when you host a site named "mp3s4free"?
Free as in speech or as in beer?
http://magnatune.com/
http://hebb.mit.edu/FreeMusic/
I bet there are a lot others out there. I believe there are even site with free books out there. -
Piggy Bank: Greasemonkey for web data
Piggy Bank promises to turn Firefox into a semantic web browser by providing a means to mine data from web sites and then use that data on other web sites. It's like Greasemonkey for data on the web.
-
Kerberized Login Window Support?
Yes, but has Kerberized Login Window Support been fixed yet? Without support for Kerberos and OpenAFS, Tiger is still next to worthless for many universities.
-
Free Classical Music
Actually there's quite a bit of free classical music out there; try http://www.classiccat.net/, http://commons.wikimedia.org/wiki/Category:Music_
s ound, http://hebb.mit.edu/FreeMusic/ and http://pan.zipcon.net/. The pan.zipcon.net site (functional but not pretty; try DOWNLOAD.html to get to the music) contains much of the catalog of now-defunct Pandora Records from Seattle, who appear to to have had the foresight and courtesy to place their material in the public domain when they closed up shop. I'm sure there's much more but this was just what I found in a brief couple of hours a few months ago. -
Greetings from TMRC
Our own layout is fully computer controlled, and can be operated over the internet (though for practical reasons, we don't let people run it through our web page, and probably never will). That includes over 600 feet of track divided into 120 independent blocks and 151 electrically operated turnouts. This control system was installed in January 2002, replacing an earlier system built in 1966 from surplus telephone relays.
Speaking from firsthand experience, there are a couple of problems with allowing general remote operation of trains (as opposed to running in small loop of track). The first is that it is hard to tell where the ends of the train really are relative to turnouts, block gaps, the ends of sidings and other things you don't want to run into. While we have block occupancy detection, it isn't good enough to park a train somewhere and be sure that you aren't fouling another track.
The other big problem is that you still need to have somebody there to deal with derailments. This isn't a big issue for a small loop of track but is for a larger layout like ours. Video from an onboard camera isn't much help either since it only shows one end of the train and may not be clear enough to spot gaps and turnout positions.
We've tried to let people run our layout remotely at recruiting events, with streaming video from an onboard camera (and someone back at the club room to deal with derailments and the like), but it never quite works right. One problem is that most streaming video systems (we've used Real) have a lot of lag. Even with video conferencing software (iChat) we had trouble with the available bandwidth at the location we were in. There were problems with bandwidth for the control software too, so mostly we could only let people run in a loop of track that they had to themselves which isn't much fun.
You can find information about our control system at http://tmrc.mit.edu/sys3/
Thomas O'Reilly
TMRC Governor -
So There are other places...
to get your free http://hebb.mit.edu/FreeMusic/ classical music.
-
KRB5 vulnerability too
http://www.frsirt.com/english/advisories/2005/106
6
FrSIRT Advisory : FrSIRT/ADV-2005-1066
CVE Reference : CAN-2005-1174 - CAN-2005-1175 - CAN-2005-1689
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-12
* Technical Description *
Multiple vulnerabilities were identified in MIT Kerberos, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.
The first issue occurs in the MIT krb5 Key Distribution Center (KDC) implementation when processing specially crafted TCP/UDP requests, which could be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code on the KDC host.
The second vulnerability is due to a double-free error in the "krb5_recvauth()" function, which could be exploited by an unauthenticated remote attacker to execute arbitrary code in the context of a program calling the vulnerable function (this includes the kpropd program which typically runs on slave Key Distribution Center hosts).
* Affected Products *
MIT Kerberos 5 version 1.4.1 (krb5-1.4.1) and prior
* Solution *
Upgrade to krb5-1.4.2 release :
http://web.mit.edu/kerberos/dist/index.html
Or apply patches :
http://web.mit.edu/kerberos/advisories/2005-002-pa tch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-003-pa tch_1.4.1.txt
* References *
http://www.frsirt.com/english/advisories/2005/1066
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-003-recvauth.txt
* Credits *
Vulnerabilities reported by Daniel Wachdorf and Magnus Hagander -
KRB5 vulnerability too
http://www.frsirt.com/english/advisories/2005/106
6
FrSIRT Advisory : FrSIRT/ADV-2005-1066
CVE Reference : CAN-2005-1174 - CAN-2005-1175 - CAN-2005-1689
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-12
* Technical Description *
Multiple vulnerabilities were identified in MIT Kerberos, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.
The first issue occurs in the MIT krb5 Key Distribution Center (KDC) implementation when processing specially crafted TCP/UDP requests, which could be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code on the KDC host.
The second vulnerability is due to a double-free error in the "krb5_recvauth()" function, which could be exploited by an unauthenticated remote attacker to execute arbitrary code in the context of a program calling the vulnerable function (this includes the kpropd program which typically runs on slave Key Distribution Center hosts).
* Affected Products *
MIT Kerberos 5 version 1.4.1 (krb5-1.4.1) and prior
* Solution *
Upgrade to krb5-1.4.2 release :
http://web.mit.edu/kerberos/dist/index.html
Or apply patches :
http://web.mit.edu/kerberos/advisories/2005-002-pa tch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-003-pa tch_1.4.1.txt
* References *
http://www.frsirt.com/english/advisories/2005/1066
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-003-recvauth.txt
* Credits *
Vulnerabilities reported by Daniel Wachdorf and Magnus Hagander -
KRB5 vulnerability too
http://www.frsirt.com/english/advisories/2005/106
6
FrSIRT Advisory : FrSIRT/ADV-2005-1066
CVE Reference : CAN-2005-1174 - CAN-2005-1175 - CAN-2005-1689
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-12
* Technical Description *
Multiple vulnerabilities were identified in MIT Kerberos, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.
The first issue occurs in the MIT krb5 Key Distribution Center (KDC) implementation when processing specially crafted TCP/UDP requests, which could be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code on the KDC host.
The second vulnerability is due to a double-free error in the "krb5_recvauth()" function, which could be exploited by an unauthenticated remote attacker to execute arbitrary code in the context of a program calling the vulnerable function (this includes the kpropd program which typically runs on slave Key Distribution Center hosts).
* Affected Products *
MIT Kerberos 5 version 1.4.1 (krb5-1.4.1) and prior
* Solution *
Upgrade to krb5-1.4.2 release :
http://web.mit.edu/kerberos/dist/index.html
Or apply patches :
http://web.mit.edu/kerberos/advisories/2005-002-pa tch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-003-pa tch_1.4.1.txt
* References *
http://www.frsirt.com/english/advisories/2005/1066
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-003-recvauth.txt
* Credits *
Vulnerabilities reported by Daniel Wachdorf and Magnus Hagander -
KRB5 vulnerability too
http://www.frsirt.com/english/advisories/2005/106
6
FrSIRT Advisory : FrSIRT/ADV-2005-1066
CVE Reference : CAN-2005-1174 - CAN-2005-1175 - CAN-2005-1689
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-12
* Technical Description *
Multiple vulnerabilities were identified in MIT Kerberos, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.
The first issue occurs in the MIT krb5 Key Distribution Center (KDC) implementation when processing specially crafted TCP/UDP requests, which could be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code on the KDC host.
The second vulnerability is due to a double-free error in the "krb5_recvauth()" function, which could be exploited by an unauthenticated remote attacker to execute arbitrary code in the context of a program calling the vulnerable function (this includes the kpropd program which typically runs on slave Key Distribution Center hosts).
* Affected Products *
MIT Kerberos 5 version 1.4.1 (krb5-1.4.1) and prior
* Solution *
Upgrade to krb5-1.4.2 release :
http://web.mit.edu/kerberos/dist/index.html
Or apply patches :
http://web.mit.edu/kerberos/advisories/2005-002-pa tch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-003-pa tch_1.4.1.txt
* References *
http://www.frsirt.com/english/advisories/2005/1066
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-003-recvauth.txt
* Credits *
Vulnerabilities reported by Daniel Wachdorf and Magnus Hagander -
KRB5 vulnerability too
http://www.frsirt.com/english/advisories/2005/106
6
FrSIRT Advisory : FrSIRT/ADV-2005-1066
CVE Reference : CAN-2005-1174 - CAN-2005-1175 - CAN-2005-1689
Rated as : Critical
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-07-12
* Technical Description *
Multiple vulnerabilities were identified in MIT Kerberos, which could be exploited by remote attackers to execute arbitrary commands or cause a denial of service.
The first issue occurs in the MIT krb5 Key Distribution Center (KDC) implementation when processing specially crafted TCP/UDP requests, which could be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code on the KDC host.
The second vulnerability is due to a double-free error in the "krb5_recvauth()" function, which could be exploited by an unauthenticated remote attacker to execute arbitrary code in the context of a program calling the vulnerable function (this includes the kpropd program which typically runs on slave Key Distribution Center hosts).
* Affected Products *
MIT Kerberos 5 version 1.4.1 (krb5-1.4.1) and prior
* Solution *
Upgrade to krb5-1.4.2 release :
http://web.mit.edu/kerberos/dist/index.html
Or apply patches :
http://web.mit.edu/kerberos/advisories/2005-002-pa tch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-003-pa tch_1.4.1.txt
* References *
http://www.frsirt.com/english/advisories/2005/1066
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA- 2005-003-recvauth.txt
* Credits *
Vulnerabilities reported by Daniel Wachdorf and Magnus Hagander -
Re:Area = pi * r^2i can't find good resources on this, but here are some numbers (in google order)
from a random wireless advisor post :But a typical 150- to 200-foot tower would cover a radius of 2 1/2 miles in urban areas and five miles in rural areas.
from an article on Yale's website "The Physics of Cellphones" (but dated 2003) :The major component of the cell phone system is the cell. The cell phone system divides an area of service into a set of cells on what might look like a hexagonal grid. A phone tower or base station in the center of the cell covers an area of 2 or 3 square miles around the tower.
from a MIT mailing-list :In metropolitan areas, the 'radius' of a cell is a few miles, at *most*.
from a zoning petition :US Cellular only give in building coverage for a radius of three miles. When you are three miles away from where US Cellular is trying to cover, you miss half.
most of the other links that i saw agreed pretty closely with the 2.5 mile radius mark, the Yale paper that is notably different might be a typo? the zoning petition is even older than the Yale paper, so i don't think it is a technology issue -
Re:None vs. Unknown
The training of Alex is an experiment which is constantly in progress. This isn't "bad science" but "science in progress."
It's kind of like condemning an experiment by reading one progress report, decades before the final report is available. And I say decades because Alex is 28 and African Grey parrots can live to be 65+ years old.
I just saw something last night on Animal Planet on the "Most Extreme" intelligent animals. Parrots were #1, specifically this bird Alex, who has been in training for almost 20 years, I think it is.
My dad has an African Grey whose name is Max. Max is not as intelligent as Alex, but he demonstrates a limited intelligence. Simple things like saying "come here" when he wants attention or saying "whoops" when he drops a piece of food. It isn't on par with the counting and identifying that Alex can do.
If you see video of Alex, it's totally amazing. He can identify what objects are made of (wood, metal, wool), he can identify colors (red, blue, yellow, green) and even count up to five--now including zero. He can even flip you attitude: "wanna go sleep" or "wanna go home" or "hungry" -- all in the middle of a training session.
More on Alex can be found here: http://www.alexfoundation.org/
Alex's trainer for the past two decades, Dr. Irene M. Pepperberg, is a visiting professor at the MIT Media Lab, as well: http://web.media.mit.edu/~impepper/ -
Re:Profit range?
" the UK/US military split doesn't exist behind the scenes"
Tactically, and strategically, the US and UK militaries are very different. Strategically, the US holds back major powers with the 2-front war model and multi-tiered mutual assured destruction (MAD) from SLBMs, ICBMs, and stealth bombers. The US military is strategically designed to handle the doomsday scenario as well as a sudden WWII scenario. The UK military is not designed to handle either. The UK military is designed to supplement allies in any doomsday scenario and be able to assert 'influence' throughout the world. They are not able to fight a major 2-front war nor is their MAD capability failsafe.
Tactically, the UK feeds off the US, but this is not vice versa. This is due to military budgets. While the US can spend $250 million per year for each of 12 aircraft carriers (not including $8 billion construction cost), $1 billion for each stealth aircraft, etc. with a military budget of $370 billion, the UK cannot afford the superpower weapons with a military budget of $43 billion. While many people watching the Iraqi wars come to the conclusion that the US and UK have similar weapons, tactics, and strategies, they are missing some big points about the military layout of both countries. These weapons are being used because they are the tool needed in the current wars. They are not the only weapons at disposal. It is easy to forget the the US Army accounts for less than 30% of the annual operating budget of the US military (not including wartime deployment costs). While the weapons of the armies of the UK and US are similar, the areas of most importance: air, sea, and space warfare--the weapons vary drastically. -
Mod Parent Up
Thanks for the information and the links. Some interest. I'd figured the upper end of my scale would be good for a single bomb released from the air... concussion would wipe out life. From the Tsar Bomba link, I see I was wrong.... maybe by a couple orders of magnitude.
So, I can sleep better knowing that a terrorist couldn't destory the earth with something that could fit in his pocket... he'd need at lease a U-Haul to make that happen.... end what are the odds of that? :) -
MIT Museum Art Machines
My personal favorate among "robotic" art is Machine With Oil by Aurthur Ganson. It can be seen at The MIT Museum
-
Typical Slashdot Advice
Very few responses have actually answered this guy's first question: "What books would you recommend to a beginning game developer?"
Core Techniques and Algorithms in Game Programming. I own many game development tomes, and this one replaced 3 1/2 shelf feet of my reference material. This book contains everything the beginning competent programmer needs to get a quick start at programming any sort of game imaginable, and it covers topics from *useful* design patterns and data structures to shader programming.
Game Architecture and Design is another good book, but is a survey of information from design patterns, architecture, game design/ludology, project management, and business practices in games. Probably up your alley but not exactly what you asked for.
As for an introduction to game theory, none is better than Rules of Play. This book is the first extensive critique of the entire field of game theory as it is applied to game design that I have read. Lengthy, and it reads like a textbook (it was designed as one), but engaging. -
I agree, but here's another approach.
The projects that the poster wants to work on sound like more of a showcase of gameplay rather than graphics. So, it might not be necessary to dive into linear algebra and x86 assembly just yet
;-)
Here's the tough part: I can't stand the majority of design book. I've read a few (and skimmed/browsed dozens), and they mainly seem to be essays written by game designers on what games they do/dont like. Interesting, but imho they didn't equip me with any tips/trick/knowledge that could I could actually use. I've heard that Rules of Play is good at defining what makes good gameplay (there's virtually no mention programming languages or hardware). In fact, many of the design studies are simple board-games. However, some people have called it it too academic.
I'd stick w/ Java for now, and find a book on java game development. It'll make it easier to get your design to reality, and port it to c++/directx later on. Java is slower, but it "feels like" c++ so porting wont be as bad as porting a VB or flash game. -
Re:MFile
We use some sort of AFS-based system at MIT, although I haven't had occasion to use one yet. http://web.mit.edu/accounts/www/lockers.html
-
Re:I believe you're right on.
is MIT's hyperarchive gone? try http://hyperarchive.lcs.mit.edu/
-
Sign me up! I'm making the switch!
To an operating system with TCP/IP, DECNET, IPX and SNA support -
OS/2
In the early 90's, if you wanted, you could get OS/2 to load a whole pile of transport protocols - which was pretty much necessary for the alphabet soup that ran client-server apps back then. In fact, Doom ran on IPX/SPX before it ran in TCP/IP.
-
Re:Informed choices
There are several projects along these lines listed here; are there other people out there doing this kind of thing?
-
typo that matters
Incidentally, the summary gets the name wrong. It's not Felice Franel, but Felice Frankel.
-
Re:I've always wondered why there isn't more of thShort answer. No. But there should be.
Ancilliary note:
Free Mozartrecording I got off the bottome of the Wikipediapage on him. -
Re:I've always wondered why there isn't more of thSeveral gigs of free legal classical music
Ok, so it's mostly amateurs, but I definitely like some of it.
-
Wrong.
Actually, according to the WorldBook via START, "The temperature on Earth varies from -130 to +140 degrees F (-90 to +60 degrees C)."
-
Re:Think about this, man!
"Hey! You big giant mega-corporation! WHAM BAM LAWSUIT!!!"
And since they way more money than you AND a bunch of trivial patents they were granted ten years ago, you lose the lawsuit and you're ruined.
Every software patent is tied to some kind of mathematical algorithm. Just read this from Knuth and tell us why mathematics should be patented.