Slashdot Mirror

http://firefoxfah.sourceforge.net/fftorrent.html

Whenever these "cartels" as they are called on here, start suing people, it further drives p2p revolution. We have gone from the early days of Napster and song downloading, to days like today with bittorrent and whole movie downloads. The next wave will be secure file sharing, disguised as HTTP traffic. I cannot wait for programs like Rodi, http://larytet.sourceforge.net/, to come into the mainstream.

SpellBound

I think you're being a little short-sighted. You assume user interfaces will stay constant and 2-d. However, when things like http://desk3d.sourceforge.net/this and http://www.pcworld.com/news/article/0,aid,114615,0 0.aspthis become the norm, those "high end video platforms" will be necessary.

Do they still ship with a 4k stack compiled kernel? This is a real pain in the ass for getting linksys wifi cards to work as ndiswrapper does not support 4k stacks.

• Is it really an Application Server and if so what services does it provide?

Zope is a transactional object database with a security layer and an HTTP interface built on top.

The object databases give you a structure for containing content; the security layer controls access; and the HTTP interface lets you publish that content in whatever way you like.

The usual way to use Zope is to store content (eg., documents, images, external data sources), which is manipulated by logic (eg., Python scripts, SQL scripts) and rendered to (X)HTML (eg., with templates).

To illustrate the power that Zope gives you, the entire management interface is built with Zope. To create a site, you build it inside your browser.

If you think this is weird, think about wikis.

Of course, Zope is powerful enough to offer alternative access mechanisms. You can build your site in your own file system, then upload it using WebDAV, for example.

• I ask because the programmers tutorial makes it look like a run of the mill framework for generating webpages.

• Is it compiled into native code?

• I know this is more a Python thing but even mentioning an application server built in a scripting language will have me ridiculed out the door.

• Any performance indications or comparissons? Anyone port Petshop and compare it against JBoss or Geronimo perchance?

• What advantages does Zope offer me over a J2EE server?

I can go on vacation without my PC, and get a call from a customer who has a problem with a page. All I need to work is a PC with a web browser -- an Internet café will do.

Zope is to J2EE as wiki is to the web.

I wonder why return == submit instead of preview. grr.

I was recently reading
the spotlight blurb.

My little virtual filesystem with EA + inference interface
has been moving along for a few years and contains much of
the same stuff as spotlight. Also it will obviously support
reiser4 soon.

PS - why the _HELL_ is Slashdot having an applet in the ads? It freezes up my browser in Windows for a while. It's getting to be a pain. At the very least, provide some way of turning off Applet ads.

One word for you: squid... Never seen ads again since the installation of squid together with a nice redirector script effectively replacing all picture and applet ads with something less distractive.

Man, you actually paid for visual grep? :p

Seriously, though. This adds one more item to my list of things that make me wonder how people can ever work with Windows. You said it yourself, you need a Real OS. Or just grep for Windows, or a whole bunch of utilities while you're at it.

HTH

Okay, I promise this will be my last reply. I now have an iRiver iFP 790T and it's pretty much what I want. It doesn't have UMS firmware, but the iFP Linux driver works fine (it's not really just for Linux, it works on several platforms, including OpenBSD, which is what I'm using.

My home firewall is an OpenBSD box that is my access point as well. I use IPSec to setup VPN to secure my wireless network. Only authenticated IPSec traffic is permitted, so all a war driver can do is to DoS my wireless network.

If setting up IPSec is too much work, one can use OpenVPN that has a Windows client as well.

If you just want to prevent unauthorized usage of your wireless network, you can authenticate using authpf.

All the soloutions above assumes that you uses OpenBSD as an access point. OpenBSD can now support Atheros wireless chipset (for 802.11a), and soon 802.11g will be supported as well : Atheros HAL layer.

I should also mention that without the UMS firmware, there is a Linux program to load music onto the iRiver iFP players.

That GNU-Darwin people decides not to link to proprietary libraries is, of course, a result of them using the GNU Public License so extensively and now because of that decision the primary Darwin development platform is no longer supported in this project!

This makes me shake my head and wonder what the fuck? This project is not only shooting itself in the foot by choosing a platform not fully supported by the OS, but is also screwing over the real meat of Darwin's userbase: PowerPC owners. This move is akin to opening a car garage (in America) whose mechanics are all experienced in servicing American cars, and then changing policy months later, stating that the garage will only work on foreign models.

Where is the fucking logic?

Seriously, am I the only one who is wondering who the Hell is in charge at that project? Kool-Aid Man? This move makes so little sense I can't tell if the people at GNU-Darwin are really that stupid, or if I am waking up in alternate realities every damn morning. I almost kind of hope for the latter.

This is the GPL in action, Mac faithful. Get down on your knees and kiss Apple's butt for choosing the BSD license.

although I must mention that Star Control II was awesome (yes, very old too :P)

Was? It's still maintained.

Well, guess what, Freenet doesn't really aim for anonymity the way you might think of it. (I.e. meaning untrackable sender, receiver and releationships.) Heck, they even admits as much in their FAQ.

For "true" anonymity, look at onion routing (whose speed of course is inversely proportional to the number of hops each message does). E.g. MixMinion, Tor, I2P...

Looked at OpenVPN? Seems a lot easier to configure than a VPN.

Quoting from the mailing list on SF: The reason for it not being compilable for Windows is the fact that Qt is not available for Windows in any GPL compatible version and the license of the GPL:d TOra specifically prohibits it from being linked with the commercial versions of Qt. The reason for this is that previously I and now Quest does not want it to interfere with out commercial products.
This is the author's decision, not a limit imposed by the Qt's license. Qt can very well be used in OSS projects, and it is possible to release windows ports just by allowing it in the license (small extension of GPL) and by finding someone with a Commercial Qt license that is willing to compile and release it. There are many examples of this. Back to your msg, it's _NOT_ really that simple: Qt offers many features that are difficult to find in other libs, and using Qt it is really simple to port from Linux to Win.

The reason for it not being compilable for Windows is the fact that Qt is not available for Windows in any GPL compatible version and the license of the GPL:d TOra specifically prohibits it from being linked with the commercial versions of Qt. The reason for this is that previously I and now Quest does not want it to interfere with out commercial products.

:-D

There are many Linux programs based on libnjb which allow Creative mp3 players to be used with Linux. One of them is this project which causes the device to appear as a file system in KDE. What did the grandparent post say again? Something about "easy to use KDE software"?

As another example, I use my Dell DJ (manufactured by Creative) on Linux with gnomad2. So yes, Linux support for Creative-built mp3 players does exist. "Excellent" might be an exaggeration since you may have to install from source, but that's about it.

Needless to say, it is the parent of _this_ post which should be modded down (or at least not modded up so highly). The fact that a particular individual cannot do something rarely means that it cannot be done, but people tend to make that generalization anyway. And moderators tend to believe them.

There are many Linux programs based on libnjb which allow Creative mp3 players to be used with Linux. One of them is this project which causes the device to appear as a file system in KDE. What did the grandparent post say again? Something about "easy to use KDE software"?

As another example, I use my Dell DJ (manufactured by Creative) on Linux with gnomad2. So yes, Linux support for Creative-built mp3 players does exist. "Excellent" might be an exaggeration since you may have to install from source, but that's about it.

Needless to say, it is the parent of _this_ post which should be modded down (or at least not modded up so highly). The fact that a particular individual cannot do something rarely means that it cannot be done, but people tend to make that generalization anyway. And moderators tend to believe them.

There are many Linux programs based on libnjb which allow Creative mp3 players to be used with Linux. One of them is this project which causes the device to appear as a file system in KDE. What did the grandparent post say again? Something about "easy to use KDE software"?

As another example, I use my Dell DJ (manufactured by Creative) on Linux with gnomad2. So yes, Linux support for Creative-built mp3 players does exist. "Excellent" might be an exaggeration since you may have to install from source, but that's about it.

Needless to say, it is the parent of _this_ post which should be modded down (or at least not modded up so highly). The fact that a particular individual cannot do something rarely means that it cannot be done, but people tend to make that generalization anyway. And moderators tend to believe them.

I'll put my source code on sourceforge.net where I am sure a bunch of quality software developers will pick it up and maintain it

No thanks. It's already there.

They have all the older versions of the Creative software, back to Playcenter 2.x, drivers, and lots of other goodies.

And FWIW, I would suspect the new player will work with Gnomad, the free Nomad software for Linux.

Unless you were just wanting to rant on Creative for a while...

Why pay $10,000? File sharing code compatible with the old Napster is available here.

Maybe more like Karamba, but probably with a more comfortable/easy way of doing/skinning "applets".

Use Desktop Manager.

http://azureus.sourceforge.net/

I use Azuerus the Java BitTorrent client. It uses PeerGuardian's IP DB to block the RIAA/MPPA/Etc IP's. One weird thing I just noticed is that the Azuerus site is gone and Google no longer shows it as a top hit. Does anyone know if Azuerus was taken down?

just for you!

what options are there for anonymous p2p?

Can any bit torrent clients/plugins use anonymous proxies?

I have made attempts to switch people in my department to the open source R http://www.r-project.org/ [r-project.org] as as alternative, but when they saw the interface, they laughed.

Perhaps you should have gone straight to RPy http://rpy.sourceforge.net/

Interfaces don't get much better than that.

IMHO, Mldonkey is by far the most sophisticated P2P client for Linux and OSX, and definitely on par with the clients for Wintendo. It will download from all popular networks, including Soulseek! Granted, it isn't popular with Lugdunum et al, but who cares; they need an antagonist upon which they can vent their frustrations, as we all do from time to time. ;)

Apart from KMldonkey as a frontend, there's also Sancho, which is has very nice gui.

Why oh why would you not P2P without a condom? BT Plugins like SafePeer (for Azureus) or applications like Protowall use blacklists from places like Bluetack to filter out known *AA addresses, among others. I don't really know how effective they are, but I'd be curious to hear from people that use them and still get C&D's. I have heard of plenty of people getting C&D's but those people weren't using condoms.

YMMV of course. I'm not advocating digital theft, nor am I criticizing it. I'm just curious as to why people aren't protecting themselves. Maybe I'm just fooling myself that they work at all, but I'd like to think they do.

-- Foz

How about some torrent sites with great legal content?

This site is excellent.

If you have never used BT and watched how it consumes bandwidth, you really ought to check it out. Pretty neat.

Tools like Etherape will draw funky realtime network connectivity maps. Watching your computer talk to that many other peers makes you feel pretty exposed.

Azureus is my preferred graphical client under Linux. Any other favorites?

How about some torrent sites with great legal content?

This site is excellent.

If you have never used BT and watched how it consumes bandwidth, you really ought to check it out. Pretty neat.

Tools like Etherape will draw funky realtime network connectivity maps. Watching your computer talk to that many other peers makes you feel pretty exposed.

Azureus is my preferred graphical client under Linux. Any other favorites?

The Azureus BT client has the SafePeer plugin that does this. I have no idea how effective it is. I use it, I hope it's working :) -- Foz

The Azureus BT client has the SafePeer plugin that does this. I have no idea how effective it is. I use it, I hope it's working :) -- Foz

new kernel gets posted to /., it seems to me that ms's backwards compatibility record is alot better than linux's

As someone who remembers downloading SLS Linux one floppy at a time from a BBS over a mighty 2400 baud modem, I recall that once I got the base installed, I used Minicom, gzip, tar, and bash in my efforts.

To my knowledge, there is no SLS Linux anymore, BBSes are either gone, or moved to the Internet, 2400 baud modems are considered intolerably slow (and are only supported as a fallback protocol that is almost never used). I still use all of those apps. I used fvwm as my window manager once I had X up. Fvwm is still available today should I choose to use it. I can use it with gtk even though gtk wasn't even thought of when fvwm was the default window manager. I recently switched from XFree86 to Xorg. Nothing else had to be changed.

When the Internet started to be available to non-university students, I got a shell account. I used Slirp to make it act like a slip account. It's still available.

I still have a few disks with DOS/Windows software from the same era, but it's useless because it won't run on a recent Windows OS.

Perhaps you don't hear much about it when a new Windows breaks old apps because it's not news. It's just par for the course. Or it may be that you don't hear about it because there's nothing to discuss. Nobody has the source, so nobody needs to know what to change to fix it. Nobody is deciding if it's worth the effort to update it because nobody has a way TO update it. It's just gone.

Yeah, this is what's keeping me off Thunderbird. I am still using Outlook, but with the cool extension Outclass which is an Outlook front-end for POPFile. It works really well. I know I could use POPFile's web interface, but it's so much nicer when it's integrated into the mail app. If Thunderbird can use Bayes for spam, open it up for other uses!

Popfile does this, I believe. Haven't used it myself (because it only works with POP3), but some people swear by it.

Are there any P2P clients out there that are effective in hiding your identity as a sharer? I know I read that when the RIAA started suing people that it was just a matter of time before someone invented a client that protects those who are sharing files, but I wonder if it's even technically possible. The Gnutella protocol effectively made SEARCHING for files anonymous, but actually transferring a file establishes a connection to the IP address, which can always be traced. Any ideas for accomplishing something like this? Is it technically possible? I am familiar with the freenet project, but to my understanding this isn't really for large file sharing. Any thoughts?

>but the telcom admin of a large corporation isn't going to want to look at a text file to figure out his dialplan or use some arcane interface
As with most things Linux, the install problems usually get simplier through heavy use.

I tried installing asterisk 18 months ago, and wasn't getting their, not much like http://voip-info.org/wiki-Asterisk that I could find then, not much hardware in the market place...

3 weeks ago, I tried again, succesfully. 10* better. now dozens of voip phones, and config scripts...

it's still at the state of hundreds of config files floating around, but you already got:
http://dontpokebadgers.com/rss2cisco
giving scripts that auto configure your cisco config files, and extensions, passwords,... with a querry from a mysql database, and http://sourceforge.net/projects/jasterisk/ that lets you do all real time call routing/handeling from a PC app.

granted both of these take a bunch of config options, but so do those pripriotory systems yo mention. just you send them to a company to configure off site before the bring the $100,000 box's to the site, a couple months later.

Get a linux guru a couple months, and you will have all those fancy java/cgi/whatever scripts doing all this from a single website, thats more intuitive than the costly box. I feal confident saying this, because I got the PBX all loading, and sending XML content on scripts I customized, in 3 weeks, and I had no idea what the rc.d directory was good for, and never wrote a cgi script before.

Why doesn't people use WASTE when sharing??
Why isn't there a WASTE plugin for existing tools??
Why isn't there a native Linux client??
Why don't I do it myself (ok, I know that one...I can't find the time for it).

Oh shit, I just got this idea ...waste as a kio_slave proto!!! MOD ME UP!! START CODING NOW!! I'LL DONATE MY CHEERING!!

Azureus has a similar plug-in called SafePeer.

Azureus has a similar plug-in called SafePeer.

That's really too bad - encrypting VOIP causes extemely annoying overhead problems, because the voice data packets are really small (they're not very big before compressing them, and then they're even smaller), so the minimum overhead for just doing the RTP+UDP+IP headers is several times the size of the voice traffic they carry, and IPSEC adds another two layers of headers, or SSL adds about three, and pretty soon that cute little elegant 8kbps compressed voice stream is looking like 40-80kbps and won't fit on your modem. SIP can use the SRTP protocol as a modification of RTP, so to the extent that anybody implements it, it's basically doing then encryption along with a layer you needed anyway, so it doesn't add much overhead. IAX doesn't appear to have this (which is especially frustrating because the IAX2 trunking protocol makes multiple simultaneous connections much more efficient, though I suppose if you've already done that, the extra overhead of IPSEC or OpenVPN may not bother you as much.)

There are legitimate ways to compare executables (as opposed to the method used by the authors of "Who Wrote SoBig?").

0) All of these ideas involve disassembly. http://www.datarescue.com/idabaseIDA Pro is the best dsassembler on the market; all ideas below are implemented as extensions to it. Nothing even comes close to its sheer strength, except perhaps the underdeveloped, alpha knockoff http://lida.sourceforge.net/Lida.

1) http://www.datarescue.com/idabase/flirt.htmFLIRT signatures work surprisingly well for the detection of statically-linked libraries (assuming the library itself hasn't been recompiled). It is basically binary-based but there are important measures for dealing with code that can/will change between different binaries.

A plugin called http://www.sport-und-event.de/backtrace.de/plugins /idb_2_pat.zipIDB2PAT for IDA can take an executable and produce FLIRT signatures for all functions in it, which can be applied against any other executable for comparison. I find this very handy for malware versioning analysis.

2) http://www.razorteam.com/publish/papers/comparing- binaries.htmlInstruction Semantic-Based Binary Comparison The paper calls itself "Comparing binaries with graph isomorphisms" but this is a misnomer because there is nothing graph-based about the comparison; only the visualization has any bearing on graph theory. This technique attempts to match the assembly instructions almost exactly (not necessarily a byte-for-byte direct comparison). No public implementation is available for this method.

The problem with the two methods above and the reason that byte-for-byte comparison won't work in general is that compilers regularly re-arrange code or change register allocation, especially in the case an optimization is applied differently between builds. Two successive builds might look completely different on the binary level. Microsoft's internal compilers are especially notorious for this.

Enter 3) http://www.sabre-security.com/products/bindiff.htm lBinDiff by Halvar Flake. BinDiff is the most promising idea of the three (though designed for a different purpose than 1)). By using structural and graph-theoretic properties of executables (e.g. the call-tree) and the functions within them, BinDiff is able to compare executables without looking at the instructions themselves (except for properties that can be deduced in a CPU-independent fashion by IDA). That means that BinDiff can potentially diff binaries for different platforms, meaning the binaries could be using a different executable file format and a different assembly language. Obviously, the two binaries described would be remarkably different.

2) & 3) conception was motivated by the idea of diffing security patches (which they do with various degrees of effeciency). 1) is arguably at the core of IDA's power.

P.S. the "Who Wrote SoBig?" authors are completely full of shit. From the paper:

"AMS [a *completely unrelated* email client] and Sobig contain common high-level functionality, as both programs generate and send email. Although there are many ways to create this functionality in source code, it is extremely unlikely that two people working independently would generate similar opcode sequences for this type of functionality. From the results of our comparisons, the first 1K of memory indicated that they are very similar types of executables."

No shit, that's because the first 1k of the executable is usually the PE header. "Very similar types of executables"? What does that mean, anyway? The whole report is anonymous, unfounded slander.

> "security" in Java is so trivially easy to circumvent

Are you confusing encryption with obfuscation? If not I agree that class-level encryption has no ROI.

Obfuscation, on the other hand, is an excellent tool for protecting IP. I use Proguard http://proguard.sourceforge.net/ via Ant and am happy with the result, having tried to grok the resulting byte code (using jad...) Good luck trying to work with that!

R7

I have been decompiling Java regularily. Just get Jode Jode Its very simple and effective. As long as the writers are not using ubfuscation tools, the code is fully readable in it's original form sans commenting.