Slashdot Mirror

Indeed. Bruce Schneier discussed this very question in a Wired News article, also discussed on slashdot, also discussed on Schneier's weblog.

The answer, I think, as to why the security companies fell down so unanimously on this one is that they're all afraid of the DMCA. So we have yet another crystal-clear example of the DMCA's overly far reach and unintended consequences: it legitimizes malware, as long as the malware takes the form of "copy protection".

No, but Love-shyness is pretty well associated with Aspergers' syndrome.

Being a geek has always been cool. The reason Leo kept his private life so secret was he was getting mad bootay, and he didn't want people trying to step in on his turf.

CS is down as a major because people plan to do crazy shit like give laptops to every kid. We're going to end up with 1 Billion computer programmers on the planet, all earning $3/hr.

That said, we'll probably keep geekin' it up. Not only is it fun, but if she's that big of a BSD fan, we're damn well going to try to get our contributions into the kernel, right?

If the rats don't feel fear, do they also lose understanding of danger? That would be a pretty bad mutation.

-FL

What a load of crap. Not the "demise of Usenet", but the stupid reasons projected by Jack Kapica in his report for its declining popularity. Usenet was a bunch of technologies, including a user interface. That UI is nowhere as useful as the Web's, especially compared to searching with, say, Google, or linking to fragments from websites. And Usenet's (nominal) hierarchical organization and larger admin requirements aren't as appropriate for most people as the Web. It's Usenet/Web portals that have shrunk Usenet's popularity. If it's not popular, big consumer ISPs shouldn't carry it, charging all users for the usage of a few. Real Usenet users will still share feeds, even if "Usenet" itself dies - the tech is available to anyone who wants in on such a protocol/content network, just like a good Internet tech.

Kapica might sympathize with ADD illiterates. Maybe he hasn't heard about Usenet since alt.tasteless invaded rec.pets.cats over 10 years ago, because he got the story wrong: it didn't kill r.p.c - it got the crossposting a.t flamer booted. Death with dignity, or even semiretirement, for Usenet, is hindered by the clueless ramblings of posers like Kapica. I wish Kibo were here to whip him with a cluestick.

Q: And how does IPv6 increase penetration? Does it build wires to people's houses or make provide satellite dishes to third-world countries?

A: No, but it does make sure we have enough addresses once they have some money to buy the actual hardware stuff!

And when a billion $100 laptops come online in 2009, what are their poor MAC's supposed to eat? It'll be anarchy, I tells ya; dogs sleeping with cats, fire and brimstone...

Already posted on digg three times now.

What's that sound? Why, that's the sound of spadefuls of dirt hitting Slashdot's coffin.

This is the text of an e-mail I, Tamas Feher from Hungary, antivirus support worker by profession, sent to Mark and Bruce yesterday to enlighten them about the factual falsity of their bold claims.

****************

Dear Mr. Mark Russinovich

I am totally outraged by your behaviour.

Ad 1., You were not the original in-the-wild discoverer of the Sony BMG -
XCP system level copy protection mechnanism. It was F-Secure Corp., the
finnish anti-virus vendor, whose proprietary Blacklight tool found it on a
customer's PC on 30th September 2005.

They have proof on the F-Secure weblog, read the write-up:
http://www.f-secure.com/weblog/archives/archive-11 2005.html#00000694

Why do you celebrate yourself then?
Now even Bruce Schneier is singing the same false anti-AV tune of yours:
http://wired.com/news/privacy/0,1848,69601,00.html ?tw=wn_tophead_2

To the contrary: XCP was discovered by an anti-virus company, period.

Ad 2., You simply spat in the soup of others. F-Secure has been in quiet
negotiations with Sony BMG for several weeks, trying to convince the giant
behind closed curtains to revoce the XCP "rootkit" technology voluntarily
and Sony did that. The new rootkit-less software version appeared on
Sony's website mere two days after your irresponsible and uncoordinated
disclosure. Don't dream for a minute that you did that, it is impossible
to develop such new code in less than two days. Why do you celebrate
yourself then?

Ad 3., It happened because it was in development for weeks as a result of
F-Secure's quiet diplomacy, not because of your cowboy attitude. The vast
majority of the world does not value vigilantism, unlike americans who
grew up in a gun-slinging culture. Unilateralism is not the solution, as
has been shown this case and the Dubya Bush Jr. Instead of being proud you
should be ashamed, because your action caused tremendous harm to the IT
security industry.

Security is about trust above all and your antagonizing stance demolishes
trust. You literally incited hatred and encouraged hackers to create
malicious code against XCP. Megacorporates will never trust IT security
firms any more and this may demolish the current many small firms
industry, leading to monopoly situation, which they can afford to create,
and then even you will be gagged! You digged a good part of the grave for
our "ideally competitive IT security market".

Ad 4., Buggy software and resulting exploitable code is not a crime as of
now, not even if provided by Sony-BMG. If you want that changed go to the
Capitol and petition the government to that extent. Inciting hackers,
however, to attack and trojanize buggy software and create electronic
anarchy is cyberterrorism and not substantially different from a bus
bombing. How are you different from Mullah Omar who preaches terror
from a cave over the west's mistakes? Both belong to Gitmo.

Ad 5., The DMCA gives every right to Sony to protect its property of art.
They support fair use as defined by the law. An audio CD disc is listened
to in a discman, a hi-fi deck or a car stereo system, none of them
are affected by the XCP software at all. When you put it in the optical drive
of a computer you admit you want to copy it, because that is the only
explanation for not putting it in a deck or a portable CD player.

I have no sympathy for bootleggers. A good part of the money media giants
earn are flowing into the tax purse of the gov't and much of that supports
defence. Every single song fetched from P2P steals a cartridge from the
magazine of an M16 rifle as worn by an american GI. When Private Johnny
runs out of ammo and the fanatics cut him down, who will protect you and
your family from the wrath of is

umm dude, aparantly your hypocrite was right all along:

http://wired-vig.wired.com/news/technology/0,1282, 69615,00.htm

If by "lie detector" you mean polygraph tests, then you're right -- they are bunk. A machine that detects lies by some other means is not impossible though -- you can detect lies with an MRI machine, for example. How you would integrate that into an airport, I don't know.

Bruce didn't claim that he found it, he had something to say about it, and he did a fine job of writing about it for the non-technical audience that reads Wired.

If there is something in the crypto or security world happening Bruce is obviously an authority on it.

I'm so tired of that bullshit. You know for a fact the only reason he writes those bullshit cover articles is to get press for himself and his company.

If he was just a journalist I would tolerate it. He's not. And what's more he's not the only cryptographer out there. Why didn't Wired just contact people doing the actual research, oh wait they did that already.

I'm tired of reading articles by Bruce of which he's not the actual person doing the work.

Either quit counterpane and become an objective journalist or shut the fuck up once and a while.

Tom

I don't know about you, but the Sony rootkit has managed to turn me off completely to the PS3. I'm not going to make the mistake of believing that the general public would feel the same way, but I can't understand why anyone who reads /. would even consider sending money to Sony.

Right, that holds water.

You seem to think MS can be trusted to treat you any better? Sony's blunder is just dumb. MS plots this type of think while you sleep...day in and day out.

This is from the recent Wired article on the rootkit debacle: 'Microsoft I can understand. The company is a fan of invasive copy protection -- it's being built into the next version of Windows. Microsoft is trying to work with media companies like Sony, hoping Windows becomes the media-distribution channel of choice. And Microsoft is known for watching out for its business interests at the expense of those of its customers.'

Your ire should be 100 times larger over MS....yet you don't mention them - hmmm...MS troll smell?

this isn't one of those lightning-fast internet worms; this one has been spreading since mid-2004. Because it spread through infected CDs, not through internet connections, they didn't notice?

On Friday, the Milan-based (Association for Freedom in Electronic Interactive Communications - Electronic Frontiers Italy) filed a complaint about Sony's software with the head of Italy's cybercrime investigation unit...

The complaint alleges that XCP violates a number of Italy's computer security laws by causing damage to users' systems and by acting in the same way as malicious software, according to Andrea Monti, chairman of the ALCEI-EFI. "What Sony did qualifies as a criminal offense under Italian law,"

That would be Orin Hatch.

http://www.wired.com/news/politics/0,1283,59305,00 .html

http://www.doxpara.com/?q=sony/ Has some VERY interesting information as to just how far this little beastie has spread. You see it turns out this code actually phones home somehow and by doing so it touches DNS servers - and this information can be found out. The author of that page has done some VERY interesting things in the past with DNS and his sessions at DEFCON are always interesting. If his conclusions are true then this is FAR more than "thousands" and likely edging into the millions range. He has some nice pictures too thanks to the GeoIP folks but I wouldn't trust that the locations are tooo accurate

Since I'm whoring :-) Check out this Wired article concerning this as well http://www.wired.com/news/privacy/0,1848,69601,00. html?tw=rss.TOP/> This draws some pretty interesting conclusions regarding how fast the various anti-virus people and Microsoft responded to this piece of software. NOT COOL!

Actually Sony has decided to recall all of the CD with the rootkit on it and off a removal tool to get rid of the DRM software. So yes it is losses. They spent money to produce CD's that are now coasters. They have to pay to ship them all back and replace the ones purchased by customers. http://www.wired.com/news/technology/0,1282,69590, 00.html?tw=wn_tophead_9

http://www.wired.com/news/privacy/0,1848,68370,00. html

NASA seems to want to have us believe the dust is more deadly than the radiation on the surface of the moon. I found this article quite humorous, enjoy!

http://www.wired.com/news/space/0,2697,67110,00.ht ml

The "simulated" dust "sticks" the same way here as they claim in did on the moon. Cinderblock dust, Quickcrete(TM), etc which are high in silica. Read the warning label on Quickcrete(TM), or check out http://www.osha.gov/SLTC/constructionsilica/

The Moonwalkers found that the stuff clung to everything and on contact with the oxygen in the Lunar Module (LM), gave off a smell like gunpowder, due to the lack of normal oxidation on the Moon's surface.

The stuff was also fine and gritty and was like liquid sandpaper. It would scratch camera lens and wore away at lunar geology equipment. It could also cause fittings to not seat properly, a very important problem if you're counting on the seals on your spacesuit to remain airtight.

Of course if we're going to have people up there more or less permanently, they're going to working in the stuff every day, and the wear and tear on equipment may lead to some dangerous situations. The last thing an astronaut needs to have happen is to lose suit integrity when he/she is nowhere near shelter.

http://www.wired.com/news/space/0,2697,67110,00.ht ml A Wired article on the subject.

> So far, the US has been the only player who wants to maintain the free and open nature of the > internet, with little-to-no censoring. http://www.wired.com/news/infostructure/0,1377,685 45,00.html

To remind everyone what that asswipe Orrin Hatch said about copyright infringement:

"There's no excuse for anyone violating copyright laws,"

Microsoft wants us to think of code signing as a key security measure.

Customers don't benefit much from knowing that their malware came from Sony and wasn't tampered with afterward.

Years ago, Verisign at least used to reserve the right to revoke the signing certificate of malicious ActiveX controls. In one debatable case they did (http://wired-vig.wired.com/news/technology/0,1282 ,1532,00.html).

The Sony incident will be an instructive test of how well code signing protects the world against malicious software.

I, for one, have written the USDOJ and upon a little research have found someone that I will vote against in the next appropriate election: Orin Hatch. I live in Utah, and I hate to admit, I'm one of the people that voted for him last time but that was before I read this: http://www.wired.com/news/politics/0,1283,59305,00 .html

Yes, it is an old story, but he seems to be advocating what Sony has done. I only stumbled upon the article because I googled "Orin Hatch contact" to send a letter to him like I sent to the DOJ, but now I won't bother. As sick as I feel for voting for him in the first place, I a) will not make that mistake again and b) will tell everyone who will listen (especially those in Utah) how I feel about it.

Below is my letter to the DOJ. I urge others to write letters to whomever they feel would be appropriate. I hope this gets modded up enough for people to notice it and learn about Mr Hatch and his evil ideology.

JazzLad
(PS - Sorry I'm not logged in!)

**** Letter to DOJ follows ****

Dear Sir or Ma'am,

Thank you for taking the time to read my email. I know you are busy, so I will keep it brief. I am not a lawyer, politician, or any other important person, I am just a common ordinary American with a concern. I am concerned about the recent actions of Sony BMG. I do not feel that any corporation, regardless of their size, should be allowed to install 'back door' programs on my computer. I also believe that persons or corporations that do so should be sufficiently punished so as to deter them from attempting the practice in the future. I am not after any money, I am merely maintaining my privacy. Further, this particular case frightens me to the extent that terrorists can use the back door (http://antivirus.about.com/od/virusdescriptions/p /sonystinx.htm) to use my computer (and other computers) to plan attacks, communicate and other things that I honestly do not want to think about. I am a careful computer user. I do not download email attachments. I do everything in my power to not have software installed on my computer that could be bad. I thought I could trust a company as large as Sony.

Please help a powerless citizen send a message. Please use your power to keep my computer safe. I am but one person, but my situation is shared by millions of fellow Americans.

I sincerely thank you for your time.

[signed with my name, address and phone number]

A hash function is essentially a very lossy compression algorithm. Because it's lossy, there is no way to recreate the original file from the hash; thus, it is trivial to prove that there are multiple original files matching the same MD5 hash. Doing this in a brute force fashion may be easy to implement, but it would definitely be time consuming (for the CPU, anyway). What's truely fascinating here is that you can approach this from from the more "elegant" direct method; thus allowing the potential "masquerading" of malicious information as being legitimite. This is great work, even if it adds no real value (since it effectively breaks a working standard).

On a side note, I sure hope there aren't any standing copyrights on MD5; otherwise, this work will be quashed by the DMCA in short order, and we'll have to revert to printing this code in tiny print on t-shirts like we did DeCSS

The rootkit infections turned out to be more than half a million.

Probably not a bad idea - poke 'em in the eye: http://wired-vig.wired.com/news/digiwood/0,1412,69 559,00.html?tw=wn_story_top5/


MCI The URL - send it to your friends and family...

Apparently I'm not alone: a writer at wired has called for the same thing

In most cases, diesel-electric drivetrains are used when building a mechanical transmission for the vehicle in question (locomotive, giant mining truck, etc) is exceptionally difficult/expensive. In some cases (diesel submarines, some ships) the flexibility and control of electric propulsion is a compelling reason to go diesel-electric.

But the electric steps, like all energy conversions, always waste energy, and plain old mechanical diesel is usually more efficient. If someone developed a cheap, reliable mechanical transmission for locomotives, we'd probably eventually see a switch to diesel-only locomotives, just as we have diesel trucks and cars.

Rather than the automotive engineers following the lead of the rail engineers, the reverse is happening.

This article from Wired a few years ago actually sheds a lot of light on this issue. Sony has become a bit of a schizophrenic company, with the consumer electronics arm having interests which go against those of the content arm.

there was a wired article on this very topic several months ago.

Wired Article

I guess you still might be, but you're a complete kook at least. This looks like a really interesting project, which fellow-slashdotters would probably be interested in.

Cheers, R.

it will quickly be turned into a plug-in for Jack-FM style radio software to automatically create the playlists that they're shuffling through. how long until we've turned music creation into a million monkeys problem, where we randomly arrange notes, check it's favorability against this software, and roll it out into the market?

The Vision Quest in Wired 10.09 of September 2002.

The article, as well as the feasibility of Dr. Dobelle's (who has died in 2004) research, are sketchy at best. Apply truckload of salt.

I think this issue is ambiguous enough that it will be in the best interests of studios to sue independent "midi remixers". Who would be willing to risk losing enough money to retire on and a jail sentence by actually taking it to trial? No... settlements from this will just be one more revenue stream for the bad guys.

Don't confuse the standard Motorola UI with the OS it's running on, because Motorola is presently using something like three or four different operating systems running on several different cell phone chipsets. Supporting a common UI is akin to the work Apple has done porting Mac OS X to Intel. And you wonder why Motorola is so slow to change it?

Making an iTunes app that integrated into the existing OS wasn't as trivial as it sounds. Quote, "They had to deal with situations iTunes hadn't been designed for, like how to handle a text message and what to do when a call comes in while music is playing." RTF Wired article.

The article is wholly speculative; the article they linked to is more informative and fact-based.

With that said, I'm conflicted: if Apple really crippled it on purpose that's really shitty of them. But if that's what happened, is Motorola so daft that they didn't realize that's what was going o? They didn't have to accept Apple's terms.

Frankly, I'd be delighted if my phone had 512MB of RAM, 1/8" stereo headphone jack and a USB connection that would show up as a drive (much like my old Creative Muvo). I would choose a DRM-less MP3 phone like that over other phones the next time I get a phone, and if the price was good I'd even consider upgrading straight away. They could have a good music-playing phone without iTunes (and TFA indicates they already do in Europe...they should have put it out in the US!)

I call BS.

The Apple Blog isn't doing any original reporting of its own -- it's just riffing off an article from Wired about the business relationship between Apple and Motorola. And it doesn't seem like they read that article very closely, either.

The Apple Blog asserts:

Apple mandated the artificial 100 song limit on the ROKR.

... which makes it sound like Apple pulled the limitation out of thin air. Apple Blog goes on from there to speculate about Apple's motivation for doing so.

But if you read the Wired article, the actual claim made is nowhere near as conclusive as Apple Blog indicates it is:

The Motorola team soon discovered that working with Apple means making compromises. A key part of the iTunes package, for example, is FairPlay, Apple's digital rights management software. Ostensibly, DRM exists to benefit the music companies, but it's an equally handy control mechanism for the tech outfits that develop it - companies like Microsoft, Sony, and Apple. FairPlay would set limits on the new phone: It couldn't play music from any major online store but iTunes. It couldn't hold more than 100 songs.

The Wired article makes it sound like the 100-song limit was less an arbitrary business decision and more a decision based on limits inherent in Apple's FairPlay DRM. Apple's never going to allow an iTunes client that does not use FairPlay, so if there's something about FairPlay-for-mobiles that means you're stuck with 100 songs, that could mean that there was no predatory action on the part of Apple to "sabotage" the ROKR. It was just "the cost of doing business" for using FairPlay.

If Wired had conclusive proof that Apple made an arbitrary business decision to limit the ROKR to 100 songs, they would have sourced that allegation -- i.e. run a quote from someone who would be in a position to know. But they didn't. If they had inconclusive evidence that Apple might have done that, they could have sourced the assertion to someone more tangential via the old "A source who asked to remain anonymous told us..." approach. They did not do that either.

What that indicates to me is that either (a) Apple Blog knows something Wired does not, in which case they should source their assertion independently of the Wired article, or (b) Apple Blog's speculations are ungrounded. I leave it as an exercise to the reader to decide which is the case.

If he'd tried to keep it he would have been sued into bankruptcy and then lost by default anyway. Isn't that how MS got hold of the "Internet Explorer" product name that was already copyrighted or trademarked by someone else? http://www.wired.com/news/business/0,1367,13417,00 .html

Basically all the time. Furthermore, if you subscribe to the MAKE blog and WIRED news you'll find 90% of the interesting techie stuff is covered there before slashdot anyway.

The only source for the story is Thomas Reed's book, and his only source is some Reagan government official called Gus Weiss who died a few years before Thomas wrote the book. Even though the pipeline was based near several settlements in Siberia, no one there seems to have noticed anything. Vasily Pchelintsev, a former KGB officer in the region, said that there was only one pipeline fire in the area that year, caused by poor construction.

http://www.wired.com/news/infostructure/0,1377,628 06,00.html
http://nobsblog.blogspot.com/2001/03/vetrov.html

They also demand that 3D Realms turn over the source code for Duke Nukem Forever.

In fact, what MS products have goes beyond what the weak word "bug" transmit (check this movie poster for a small example) unless you put the Heinlein's Starship Troopers ones in that category.

Anyway, i would had put in that list when Windows NT killed a navy ship... maybe losing a rocket could have been more expensive, but windows NT is more widespread and probably still used in critical places.

For potential severity, this one's worse than a few they listed.

Basically, the Navy was running critical ship systems on a Windows NT platform, and a divide-by-zero in a database caused a buffer overrun that resulted in a shutdown of the engines, leaving the ship dead in the water for 2.5 hours.

Fortunately, it was on maneuvers off of Cape Charles, and not at war off the coast of Yemen or something. Scratch a billion-dollar destroyer and most of her crew because of an NT bug, in that case.

This article was ones of the ones on the sidebar when I viewed the main wired article. Just an isolated incident, but certainly if it were a symptom of a more widespread "bug" it could be serious enough to make the books (not that anyone would ever know)

http://wired.com/news/print/0,1294,69355,00.html

Sorry, not true. This particular kind of DRM doesn't break the CD spec. Other kinds of "copy protection", such as SunComm's MediaCloQ, do violate the CD specification and are technically not CDs. But schemes which are based on autorun trojans, like the scheme in the article or like SunComm's MediaMax, don't violate the CD specification at all.

He's been on the board since 1991. It's a startup? When are they going to start?

As to the scientific community not publishing reports saying he is a charlatan. Well, that's how the respectable scientific community treats crackpots. Now, as to you saying there isn't proof he's a total charlatan? How about a reaction that produces 100X more heat than it should? That's all the proof actual scientists need. They aren't going to give this man any respect by bothering to discuss his idiocy.

If this man is for real, let him prove it in the regular, scientific way. Not in the press and blogs.

I apologize over the lab thing, I looked at his website (and I feel unclean for it), but under the "science" link there wasn't anything about independent verification. I just couldn't find it. I'm sorry. I should have done a search (as I did below).

The major operative factor here is gullibility. Yours included. There is no scientific acceptance of Hydrinos. How you construe this as somehow not refuting what this man says, I dunno.

The real thing is that if hydrogen could assume this quantum state, it would in nature. I mean, it would be the lowest energy state of hydrogen, the rest state. How come we never find hydrogen in that state? No hydrogen atom never dropped to that state on its own? Or if it did, how did it get back out, as it requires a lot of energy to get back.

Here's a nice link http://www.wired.com/news/business/0,1367,51792,00 .html?tw=wn_story_related for you which both speaks of NASA spending $75K on Hydrions (but not with this man) and also two experts in the the field (whom you say have never attacked him) calling him a "crackpot" and his work "voodoo". It is significant to note that unlike what he says, NASA has not independently verified or proved Mill's statements. Well, at least we have no info that they did, since the link on their site http://www.blacklightpower.com/techarchive.shtml is 404.

What other areas are those? The PDA/cellphone area? No, I gotta say, I think they're losing there. The MP3 player area? No, I gotta say they're losing there, too - even though the majority of MP3 players use MS software, many still don't, and even MS employees agree that the iPod is better. The PC peripheral area? No, I think companies like Logitech and Kensington are still beating them there. The PC gaming area? No, id and Valve have got them beat - and if MS hadn't bought Bungie we'd never be able to make the comparison. Maybe you're talking about Microsoft Press? MS' history is fairly interesting, but I doubt they're making a killing off their books.

Name four areas where MS is "making so much money".

I'll help you out a bit. Let's see - there's the OS area, there's MS Office, there's IE. . . oh, wait, that's free. . . what about OE. . . wait, no, that's free too. . . hmm. . .

And Windows and Office are stolen quite often in other countries. Not to mention the fact that Linux, MacOS, Firefox, and OpenOffice.org are gaining ground. If they ever lose Windows and Office, MS won't last long unless they change their money-spending habits.