Domain: nist.gov
Stories and comments across the archive that link to nist.gov.
Comments · 1,805
-
FLAC does matter"And whoah, fanboy. If I was gonna go lossless, I'd go with with a RIFF wav-- those are compatible with every imaginable program."
Yeah, you say that now. But with FLAC, the files are compressed losslessly, and in my experience, I generally get about a 33% size reduction. And with subtle music with a lot of will placed percussion (e.g. my jazz albums) FLAC does give a noticeable improvement over ogg vorbis encoded at 9.1 quality.
So assuming you'd get about 74 minutes of audio on the standard CD, you'd get 747 MiB of wave files per disc.
Note: CD Audio encoding is different than regular data encoding. You cannot fit 747 MiB of wave files on a CD-R in a regular file 74 or 80 minute system because of redundant error correction data that does not exist in the CD Audio format.
So with a 20 GiB Neuros Audio Player you would be able to fit 27.4 CDs on one player. With FLAC, assuming a 33% file size reduction, you would be able to get 40.9 CDs onto the player.
Lossless support in the Neuros player IS a big deal because it allows you to put a significantly larger quantity of non-lossy music on it. And furthermore, if you want, you can just convert the FLAC back to RIFF wave format whenever you want because, one again, the conversion is lossless in both directions.
-
FLAC does matter"And whoah, fanboy. If I was gonna go lossless, I'd go with with a RIFF wav-- those are compatible with every imaginable program."
Yeah, you say that now. But with FLAC, the files are compressed losslessly, and in my experience, I generally get about a 33% size reduction. And with subtle music with a lot of will placed percussion (e.g. my jazz albums) FLAC does give a noticeable improvement over ogg vorbis encoded at 9.1 quality.
So assuming you'd get about 74 minutes of audio on the standard CD, you'd get 747 MiB of wave files per disc.
Note: CD Audio encoding is different than regular data encoding. You cannot fit 747 MiB of wave files on a CD-R in a regular file 74 or 80 minute system because of redundant error correction data that does not exist in the CD Audio format.
So with a 20 GiB Neuros Audio Player you would be able to fit 27.4 CDs on one player. With FLAC, assuming a 33% file size reduction, you would be able to get 40.9 CDs onto the player.
Lossless support in the Neuros player IS a big deal because it allows you to put a significantly larger quantity of non-lossy music on it. And furthermore, if you want, you can just convert the FLAC back to RIFF wave format whenever you want because, one again, the conversion is lossless in both directions.
-
Francium? Freedomium
GAITHERSBURG, MD
22 May 2003
Today, the National Institute for Standards and Technology, the civilian agency of the US Government responsible for researching and making available data concerning the physical properties of substances including chemical elements, annouces the discontinued use of francium as the name of the 87th chemical element.
"It's just not appropriate to continue to refer to an element by the name of a nation whose inaction is tantamount to condoning terrorism," said Dr. Hratch G. Semerjian, director of the Chemical Science and Technology Laboratory. "We decided that it would be better to refer to the 87th element as Freedomium in honor of those who died to secure the liberty of our country.
Asked if the agency would once again return to calling the 87th element francium, Semerjian said that the element would not return to its former name. "We are prepared to take whatever action is necessary to liberate any element whose nomenclature is derived from a repressive regime."
- -
Re:Needs to be atomic
Get something like a Junghans Mega Solar Ceramic. Runs on solar power, syncs every night with the WWVB transmitter in Fort Collins.
-
Exploding the "formatted capacity" myth
Dvd-r's are single layered and only 4.7Gb(4.5 usable)
You mean 4.7 GB and ~4500 MiB usable.
Enough with this "usable" myth! The amount of space consumed on any storage medium to give it a "format" is miniscule compared to their capacities. Formatting reduces capacity on the order of only a few kilobytes whether you're talking of a 135 KB 5.25" floppy disk or a 250 GB Western Digital hard drive.
The discrepancy between advertised capacity and "actual" capacity is adequately explained by the fact that the products are sold using metric measure (1 GB == 10^9 bytes == 1 billion bytes) whereas computers continue to measure them in binary measure (1 GiB == 2^30 bytes == 1,073,741,824 bytes).
Just learn the difference between a gigabyte (GB) and a gibibyte (GiB) for God's sake! This especially means you, Leo Laporte! -
Re:Earth hours?A second is *defined* to be the 1/86,400th part of a Day
Actually that's not quite correct anymore. Look at the link you provided, or anyplace else where the SI units are spelled out. The second is the SI's basic unit of time, and is defined thusly:
The second is the duration of 9,192,631,770 periods of the radiation corresponding to the transition between the two hyperfine levels of the ground state of the cesium 133 atom.
That's the *current* definition of a second, not the historical definition that you were quoting. So, an hour represents 33,093,474,372,000 periods of the radiation corresponding to the transition between the two hyperfine levels of the ground state of the cesium 133 atom, and is no longer defined according to the length of the day. This is a good thing, considering that an Earth day is a bit less than 24 hours long. While useful for writing high school term papers, the definition from Merriam-Webster is not the ultimate source in science. -
Re:There is place for everybody
Thanks, but you're a bit late. I just searched for "cyclomatic complexity" and followed the first link.
Your link looks pretty interesting, too.
Which brings up another question:
Are there any Open Source programs which measure cyclomatic complexity?
(off to google again...)
-
Re:There is place for everybody
Ah, right you are, should have added a link. It's a measure of how complicated a piece of code is - you (more or less) just count the loops and if statements and such.
Yours,
tom
-
$60 billion???The study mentioned in the report can be found here.
Interesting reading, especially since they actually only studied two industries (and from the info provided it doesn't look like those two were studied in too much detail either). They then took the results from those two and extrapolated them to the entire economy. IMHO that just results in the findings of the 'study' being nothing more than an educated guess. Just how educated it is is anybody's guess.
-
Re:Hydrogen is not a source of energyahmn
.. grams are also a measure of weight, not of mass ..
Er, no. A gram is one thousandth of a kilogram, which is the SI unit for mass. -
Accuracy isn't everything...
And just think, if no leap seconds were added since 1972, you'd be having your Noon Lunch at 11:59:38!
Oh the horror... :)
Accuracy isn't everything... -
Re:Future proofing
Or at least let them know that domain-component directory hierarchies are stupid++. And don't stop with LDAP, go with X.500 as your core directory service system and hang an LDAP front end on it for clients that need it. It's a damn shame MSFT embraced and extended directory services (along with Kerberos), having had no interest or input in to naming schema until it was time to extend their monopoly. Never mind years of work that was already in place, obviously MSFT ActiveDirectory was so important and ground-breaking it had to have it's own namespace.
-
Re:Gibabit?
His subject heading has a typo, but it's not a typo of a typo, it's just a regular typo. A gibibit is a real unit. No, really, it is!
-
Re:Gibabit?
blame the IEC.
http://physics.nist.gov/cuu/Units/binary.html -
Re:a hypernova!"Just wondering, is a giganova 1024 or 1000 times stronger than a meganova
:-)"1000. A gibinova would be 1024 times stronger. See http://physics.nist.gov/cuu/Units/binary.html.
-
Re:String match algorithm reference
That's a pretty neat site, very thorough.
Another potentially useful one is the Dictionary of Algorithms and Data Structures (DADS). A query of "String search" returns about 33 hits. -
Re:Of course primes are nonrandom...Right, Primes have intrinsic information content, so we shouldn't be surprised someone could measure their entropy if they tried. These physicists used their own data-analytic tools to measure this in an empirical way. Whether this provides a new insight to the number theorists or not is yet to be seen, but applying new tools to problems with which mathematicians have been "stuck" has sometimes provided a needed boost.
The pattern they've found is a logarithmic distribution, it seems, according to their abstract. (I need to make time to read the full paper.) This is not unexpected, the Newcombe distribution known as Benford's Law (1) is a well-known logarithmic distribution applicable to most naturally occurring numbers. Benford's law is
F(d)=log(1+1/d)
which applies of course only to the non-zero data in the dataset; it generalizes toF(ddd..d)=log(1+1/ddd..d)
While their reported entropy power law is logarithmic, Benford's law doesn't appear to fit the prime interval increments. This leaves open the power law the physicists have found is different, suggesting the possibility that there is something interesting and new in their finding. We can hope this gives the number theorists some fresh insight. Since it was posted to the Physics
:: Condensed Matter directory of arXiv, it may be a while before the real number theorists even notice it; sci.math.research quite reasonably gets postings of the new listings of only the Math subdirs weekly. We can hope Baez cross-posts it.--Bill
IANA-Mathematician, but I almost was one and still pretend -
Simply another Counter Revolutionary Tool
Using the security vulnerabilities that are endemic with WI-FI, The Chinese government can take additional steps to repress free thought, and spy on the chinese people as well as any ignorant western business personnel who may be travelling there. -
Re:That's missing a key point...
It's can't be 802.11b if no access point is required. My guess would be that it uses low frequency radio. I've got a clock that uses that to get the time from NIST. You could build a radio controlled ball. Home-built radios are a lot more popular than home-built serial crap, so the materials would be easier to find. (It is Radio Shack, after all) It can't be too diffiult to find a commercial radio transmitter that goes into a serial or usb port, and that would probably be a lot easier to program. Plus it would most likely have a longer range than 802.11b, and would definitely be preferable to a wired connection. Using 802.11b for something like this is pointless, since the throughput you actually need would be about 1 bps.
-
BILLY!How many times have I told you NOT to play with your perfect sphere of ultrapure silicon outside the house! It's the official standard of weight and here YOU are rolling it through a SANDBOX! No telling how many nanograms of mass you've abraded off of it!
Get in here this INSTANT, and bring it with you! When your father gets home you are going to be grounded, young man! Two weeks to the PICOSECOND by the atomic clock in the kitchen. Now go stand in the corner, and NO LEANING! You'll probably throw the wall out of plumb, or expand the angle to 90.7632+1E degrees or something, you troublemaker!
-
Re:Not a good source. You can do better.
The US government good enough for you??
-
Re:Only 1 TB?
If you had said 1000 > TB you'd be more correct, as a peta is 1000 according to the IEC
a PebiByte is 1024 TebiBytes -
Re:This just in!
- Get a clue. The whole point of a smart card is to keep the data safe even in the event of physical tampering. For this purpose, the processor of a smart card is enclosed in a black box which will chemically self-destruct if you try to tamper with it. Much research on smart cards goes into ensuring that security can not be broken in spite of physical access.
Sorry, I am used to seeing regular static memory chips marketed as being "smart cards", I did not realize that there was an actual secure version of the things. Buzzwords got to me. ^_^
Any encryption can still be broken through though brute force.
Hmm, from the first site you linked to;
- Entertainment: Most DSS dishes in the U.S. have smart cards.
----http://smartcard.nist.gov/faq.html
Yah, and we all know how secure those are! Yup, DSS security has never been bypassed once! ;) -
Re:This just in!
If somebody intent on breaking through the smart card's security has access to the smart card, then sooner or later the security WILL be broken.
Get a clue. The whole point of a smart card is to keep the data safe even in the event of physical tampering. For this purpose, the processor of a smart card is enclosed in a black box which will chemically self-destruct if you try to tamper with it. Much research on smart cards goes into ensuring that security can not be broken in spite of physical access.Some pointers:
-
Re:I'm particularly stuck by this oneI think what he means is not so much that all of the "small" science has been done, but rather the period of time where one very bright person could make a lot of progress in isolation.
I've sometimes heard this as "most of the easy science has already been done", but that is also not very well worded. What it means is that it is no longer possible to make fundamental discoveries (or even any discoveries at all, apart from personal ones) by rolling balls down an inclined plane. Instead, you need either a large scale machine, say a particle accelerator, or even a small scale machine, say a STM machine or similar. Both of these are quite complex devices, which one person could not build and operate by themselves. But, I would argue the "easy" point though. In the 17th century, Galelleo's experiment was surely not "easy", although it is easy to reproduce with modern equipment.
-
Question Answering System
A friend of mine wrote an algorithm for a QA system called 'diet' for his Master's thesis. Several support tools having names like 'trim', 'lowfat', etc. were added to the set. This QA system placed in the top of the world in TREC 9 and 10...Of course, the name was changed for the paper to something a bit more academically professional...
-
Matlab + Java
A nice combination is Matlab + Java. Current Matlab includes a builtin matlab VM (all the UI is in java), allowing matlab code and java to interoperate almost completely transparently. Considering that Java is moving up to C speeds it offers a great way to easily add high speed code to matlab as needed, with a relatively high level language like Java. Also check out Java Numerics page
-
Re:Academic AI is a con gameHow is what you describe an advance in AI? It's just what you said, a list of answers to frequent questions indexed by keyword (ie: a well-designed FAQ or index) trussed up to look like an intelligence. If we told the "community" about it, all we would be telling them is a good way to win this competition. It's nothing that anyone couldn't already add to a system that needs it.
There are better things for AI researchers, especially those dealing with language and dialog, to spend their time on. Check out TRECK, where answers to questions are derived from text automatically, enhancing search engines to answer questions directly, for something worth doing.
To say AI has made no advances because we can't fool people into thinking they're talking to someone is to do three things:
- Downplay the wealth of knowledge needed for intelligent conversation
- Downplay the contributions of the AI community to the computing science wordl
- Oversell the importance of having a computer that can talk to you about stuff - call a friend!
Look for techniques and tasks that play to a computer's strengths (speed, single-mindedness, perfect memory) and you'll see accomplishments in AI. Look to their weaknesses and you'll get the impression that you seem to have gotten. - Downplay the wealth of knowledge needed for intelligent conversation
-
A small step
In 1994 Leonard Adleman solved a seven node instance of the Hamilton Path problem with a DNA computer. As many of you know, this problem is NP complete. That means that only exponential time algorithms (for sequential computations) are known for it. Adleman's machine ran in linear time. RSA decryption is thought (although not proven) to be NP complete. Since then, many NP complete problems have been solved in polynomial time. (I devised an algorithm for Set Cover.) The secret? Massive parrallelization requiring expontential space. Basically, there are so many DNA molecules foating around in the tube and so many enzyme that if you combine them cleverly, you can create all possible answers to a problem. You can then cull out the right answers. The expontential space is the drawback to DNA computing. There is a hard upper bound on the number of DNA molecules that can be used in a computation (for reasons I don't fully understand). It looks as if the article refers to a universal turing machine of sorts implemented in DNA. This an improvement over the previous algorithms which were just hand crafted machines.
-
Re:Actually...Google reminded them all that the most important thing in a search engine isn't how fast it runs (though that's important), but that it returns the most relevant results first.
...the Information Retrieval (IR) geeks reckon there's 2 major factors. You are correct that one of those is relevance, which is known as precision. And the other is recall. Think of recall as getting all the relevant results.
One of the tricks that can be used to cull irrelevant results is to cut down the total number of results. The IR dudes quickly started playing the numbers. Showing the best 20 results is better than showing the top 100 with 60 of those being irrelevant.
I like to think of these as accuracy and completeness.
I used to occasionally browse through TREC. Seems like they have locked up the past results nowadays...
-
sounds like a task for trec
This seems like a pipe dream as it is. Perhaps they should add a track at TREC for such a large scale search / archive project.
-
Re:Sounds Good...
The applications cited are stupid. Measuring the relativistic effects of reasonable masses is a better application for a hyper-accurate clock.
And, as you mentioned, VLBI, where you aim two radio-telescopes far away (like opposite sides of the planet) at the same object and combine the signals to get higher resolution, requires time sync to within a fraction of a cycle of the frequency being observed. This can always use more accurate clocks to make longer observations at higher frequencies.
As for the definition, it is defined that way because that is the most accurate way to measure the second currently known. If somebody finds a better way (like the trapped mercury ion system discussed here), then the second will be redefined in terms of the new, more accurate reference. Just like how the metre was changed in 1983 from a multiple of the wavelength of a certain atom's radiation to 1/299,792,458 of a light-second. This new standard is equal, to the limits of measurement, to the old one, but the limits are those of the old standard; the new one can be measured more precisely.
(See http://www.mel.nist.gov/div821/museum/length.htm for a description of how it's done... it involves building a highly stable laser, measuring its frequency against the second, using the constant 299,792,458 to compute the wavelength, and then counting wavelengths to get the distance. This gives you the meter to 7.2 parts in 10^12, compared to 2.5 parts in 10^11 for an iodine-stabilized HeNe laser or 4 parts in 10^9 for the old Krypton standard.)
As for it not changing... nothing can ever be proved absolutely, but many people have measured it very carefully and have never observed any variation. -
Additional info
You can read a little more about the background of this new clock at NIST's archive of a paper in IEEE T. Instrum. Meas., for those of us who foolishly let our subscription lapse...
It would appear the chief technological development that made this clock possible was the femtosecond laser. The paper also suggests that the average error could be reduced even further than the article suggests (down to attoseconds, perhaps) if higher-order Stark and Zeeman shifts are properly treated. As for practical uses, I personally can't think of any, except to finally answer the question "Does anybody really know what time it is?" But elimination of uncertainties is laudable anyway.
-
Re:Tunnel Brokers
The sad thing is that ipv6 actually does provide you with enough address space to do that, and then some...
IPv6 has a 128 bit address space, meaning that there are 340,282,366,920,938,463,463,374,607,431,768,211,45 6 possible addresses (at least I think so... correct me if I'm wrong).
Now, according to this there are 50 trillion cells in the human body. When you do the math (2^128/50e12) we find that the IPv6 address space is enough for all the cells in 6,805,647,338,418,769,269,267,492 people.
Since the count of 50 trillion is basically a WAG according to that website, I'll calculate something else, as well.
One mole is defined here as the number of molecules in 0.012 kilograms of carbon-12, which is 6.022*10^23 molecules (Avogadro's number). Therefore, if you gave one IPv6 address to every molecule in a given substance, it would take 565,065,371,838,157 moles of that substance to exhaust the address space.
This means it would take 6,780,784,462,057.88 kilograms (or 6,780 teragrams) of carbon-12 to exhaust the IPv6 address space!
Now, maybe I calculated something wrong, but that just seems like a freaking lot of IP addresses... -
Mesh networking to the rescue!
Yet another perfect application for mesh networking! (And another oppotunity for a shameless plug, but I digress...)
One of the products my company makes is a software mesh for 802.11. We have ported this software to PocketPC, so a device like a Compag^H^H^H^H^H^HHP iPaq with a wireless card can mesh with other devices around it. As nodes go down or enter the network the devices seamlessly configure themselves and route traffic around breaks or congested areas. If the access point you were using went down, you could hop through a neighborss handheld and his neighbor's, so on, until you found an AP.
Of course, you could also do this with free software. Familiar + iPaq + AODV would be a viable open source alternative. Once you have the connectivity you could use just about any app. Gnomemeeting or OpenH323 would enable VoIP. Email apps are there too. -
Re:Ritchie's Plan 9Why is Plan 9 cool? I don't know much about it am really curious. What does it do that UNIX does not?
There are various bits of UNIX (and I include Linux here, as it's essentially a UNIX clone) that have been bolted on without regard for the elegance of the whole system. In particular, graphics, pseudo terminals and networking were all added late in UNIX's lifetime and considerably clutter the system and limit its capabilities.
Take the ubiquitous psueudo terminals as an example. Almost nobody actually uses a genuine VT220 (or whatever) as their input device. However, the output from every command-line program in UNIX goes through something that pretends to be such a device. The kernel has much elaborate stuff (the tty driver) built in to convince command line programs that they're talking to a real terminal. The kernel knows about command line editing, it knows how to print control characters nicely, and it knows what key means "word erase".
This is all crap! It adds unnecessary complexity to the kernel, and not only that, but every command line program that wants a a slightly more sophisticated interface (e.g. cursor-based editing) has to do it itself (c.f. GNU readline). This not only bloats the kernel and many of its applications, it also means that the commands are less versatile than they could be (requiring people to use tools like expect to demangle their output).
Under Plan 9, there are no special system calls devoted to terminals or networking: instead, the interface to device drivers is made more versatile (all you need is open, read and write to access a device driver, no fancy ioctls or fcntls required. This gets back to the original purity of the 7th Edition programming interface: programs are a joy to write, and once written can be put to many more uses, as the currency of command line programs (text written to stdin/stdout) is also the currency of device drivers.
Because everything is unified under one hood (the name space), I don't have to write a special program to get fancy functionality. Want to find out what programs have a particular file open?
grep filename /proc/*/fd
Plan 9 is all about the joys of writing less code, more cleanly, and finding it more useful when written; of having a box of tools that can be plugged together in a multitude of different ways, transparently and securely across networks; of having a clean user interface that is concerned principally with power and simplicity rather than appearance.Of course in this day and age, when a word processor takes >2,000,000 lines of code and "features" are rated more highly than overall usability, it's not surprising that Plan 9 isn't that well known, or that Dennis Ritchie reverts to Windows NT in order to browse the web.
As for myself, I'll stick to Plan 9's (and Inferno's) deep joy for as long as I possibly can!
-
Re:Gas stations?
Yes, I can't imagine how NIST could ever adopt pieces of such a "crappy" system. SI units anyone? It seems YOUR 'colony' couldn't make up its mind.....or did you even know that you used to be a series of colonies ? Likely not...
-
See what HAS been published...
For instance, Skipjack and KEA (don't overlook KEA, it's much more interesting than Skipjack; it's a bit complicated, but you can see some REALLY cool stuff in there).
If you're interested in more than just security analyses of algorithms, check out some of the stuff the NSA did during the AES selection process, like this.
You can also check out the cryptological museum run by the NSA near Columbia, Maryland. There are documents on design and implementation of encryption devices all over the place; for instance, SIGSALY, the first digital voice encryption system, used World War II!
Finally, check out patents! The NSA has the patent secrecy act behind it; they've classified a number of applications, only to declassify them later. Patent applications for the above-mentioned digital voice encryption system were declassified in the 1970s. A patent application on an Enigma-like rotor encryption device was declassified a just few years ago. This should give you an idea of what the NSA might have been working on. -
See what HAS been published...
For instance, Skipjack and KEA (don't overlook KEA, it's much more interesting than Skipjack; it's a bit complicated, but you can see some REALLY cool stuff in there).
If you're interested in more than just security analyses of algorithms, check out some of the stuff the NSA did during the AES selection process, like this.
You can also check out the cryptological museum run by the NSA near Columbia, Maryland. There are documents on design and implementation of encryption devices all over the place; for instance, SIGSALY, the first digital voice encryption system, used World War II!
Finally, check out patents! The NSA has the patent secrecy act behind it; they've classified a number of applications, only to declassify them later. Patent applications for the above-mentioned digital voice encryption system were declassified in the 1970s. A patent application on an Enigma-like rotor encryption device was declassified a just few years ago. This should give you an idea of what the NSA might have been working on. -
Interesting ideas about performance profiling
The IBM paper is interesting, but beyond doing these straightforward kinds of measurements, I can think of a lot of better approaches to improving kernel and core application performance, based on research I've seen... When I was doing profiling work on supercomputer stuff a few years back I surveyed the tools and found some systems that use really novel approaches which could definitely be adapted to this purpose. I suppose word doesn't really get out about some of this stuff; anyway, take a look and see for yourself:
S-Check
S-Check starts with your original source code and points suspected of being bottlenecks. It adds artificial delays at the specific points throughout the parallel code. These delays can be switched ON or OFF. The switched delays generate numerous new versions of the program, with the delays simulating adjustments in code efficiency. S-Check methodically executes the many variants, recording delay settings and corresponding run times. S-Check analyzes the recorded entries against a linear response model using techniques from statistics. The results are a sensitivity analysis from which program problem areas can be identified. This provides a portable, scalable, and generic basis for assaying parallel and network based programs.
Paradyn
(overview)
"...a heuristic, goal-seeking algorithm was coupled with a dynamic instrumentation package to drive an automated, systematic inquiry into the performance of a parallel application."
The upshot is tools which can instrument a running system on the fly, and use statistical techniques that identify "hot spots" by looking for the amount of "collateral damage" when adding artificial delays to a particular location. You can even go farther, mapping out relationships, etc.
These are approaches that came out of parallel supercomputing, because in that field traditional approaches to benchmarking and profiling are often useless and/or impractical, and the systems (and programming problems) have become so complex that effective hand tuning becomes nearly impossible as well. Of course the kernel isn't so simple either, and these days you have parallelism to boot... I would love to see these techniques solving a wider range of problems. -
Re:And the point is?
The Weather, umm... look at the sky, that's how I get my forcast.
Then, I suppose, you return to your mud-hut and bang
your stone club on the floor while the missus prepares barbequed woolly mammoth steaks. Not to worry, though, in a few thousand years, man will invent the clock, and for your weather, you could wait around until the internet is invented, and go online and get some weather info here. -
KiB, MiB, GiB, TiB, PiB, EiB?Aren't they all supposed to include the 'i' for the 2^10 bit meaning instead of the 10^3 decimal things that the whole SI system is defined on?
http://physics.nist.gov/cuu/Units/binary.html
:) -
Re:Teach people to use already available tools
The application I work on is a 2-node cluster, but it can have dozens of clients.
Debugging the distributed nature of the problem usually comes down to two things - content of the message (we use our own protocol on top of TCP) and the timing. Our debug logging can log both on the server and client sides, so usualy I just end up looking at the logs (just a visual examination) to see where a problem lies. I can see what messages were sent by whom and when, and what was recieved.
If the problem gets more complex, I have used perl to parse the logs, especially if we have a problem in the field and we get a lot of data back. As I mentioned before, I have also used Ethereal to examine what is being sent across the wire when some even more bizarre problems surfaced. I have also been using a Linux router running NIST Net to help simulate various network conditions when trying to debug problems.
-
Re:CRC/SHA-1/MD5Are they saying that two different files can't have the same hash value? That's a load of crap! It's not hard at all to modify data to create any hash value that you want
From http://www.itl.nist.gov/fipspubs/fip180-1.htm:
The SHA-1 is called secure because it is computationally infeasible to find a message which corresponds to a given message digest, or to find two different messages which produce the same message digest. Any change to a message in transit will, with very high probability, result in a different message digest, and the signature will fail to verify.
So yes, two different files can have the same hash, but it's infeasible to do this. That's why hashing methods like SHA are used in cryptography; SHA-1 is used in DSA signatures. -
So how strong is AES-128?
According to this helpful how-to, you use the Disk Utility to make an image using AES-128 encryption and then you store your home directory on that image.
The NIST has a white paper on AES which announces that the Rijndael method was the official AES algorithm and that Rijndael is designed with some flexibility in terms of block and key sizes.
Apparently 128 bit AES allows for a possible 3.4 x 10^38 possible keys which (correct me if I'm wrong here) puts it somewhere between DES and triple-DES. (?)
Can any Mac users comment on the limitations that are imposed on your choice of a passphrase?
Basically, I'd like to know how strong a method is this. Is it keep your little sister from reading your diary encryption, or more along the lines of if the Feds busted you they couldn't crack open your data with any computers due out in ten years type of encryption. -
Actually, No [Re:No obligation]According to the National Institute of Standards and Technology "the terms 12 a.m. and 12 p.m. are wrong and should not be used." They go on to give the example of railroads and airlines using 12:01 and 11:59 to avoid the ambiguity.
12am is defined as the begining of a day. 12pm is defined as the middle of a day. in commerce, if not in nit-picking astronomy, that is what they mean.
When confronted with this ambiguous situation I have always taken PM to imply night and AM to imply day (yes, I know that's not really what they mean).
But don't take my word for it, a court in the US found in favor of a guy who got a parking ticket based on one of these ambiguous pseudo-times on the nearby no-parking sign. It was about five years ago, I think. Can't remember more details.
Hope the subject line doesn't make this sound like a fame. It was not meant that way.
-
NIST has it (repost with http link)
The National Software Reference Library is at NIST.
-
Re:What about Windows OS?
For Windows (and many other OS's for that matter) you can always turn to the National Software Reference Library (NSRL) put out by NIST.
You can get an anual subscription, with quarterly updates, for $90. Once you have it, though, it can be freely distributed. -
Re:What about source builds?
A database of known good files for Windows is being built by the National Institute for Standards in Technology. It's called the National Software Reference Library and it costs $90 for an annual, agency-wide subscription.
There are some significant problems with their database however:
1. It's huge. They have a single giant flat file with SHA-1, MD5, MD4, and CRC-32 values. Right now the file, when uncompressed, is over 1GB.
2.Over 42% of the entries are duplicates. I found this out by running sort -Uf on it.
3. Many of the files were hashed before installation. The MD5s for these files often change the installation process.
-
Bleah
NIST does this too. For a different reason though. To help forensic examiners eliminate non-important data in a suspect's computer. They use 4 different hash algorithms (MD5, SHA-1, CRC32, and one other), so good luck finding a collision for all 4. They were giving out copies of the CD-hashdb at an InfoSec conference I was at recently.