Slashdot Mirror
Slashback: Subterfuge, Rejoinder, Caution
Good things come in hidden pictures. Intrepid strongman Dug Song writes, in reaction to the "fairly thin" piece earlier today on Steganographic anlysis:
"The only cutting edge, practical work being done today in steganalysis and steganography is by Niels Provos, who gave a talk at HAL2001, and is also presenting at the USENIX security symposium tomorrow: He's been developing several interesting tools to do steganalysis during the course of his universal stego engine development: (http://www.outguess.org/) including stegbreak (which can detect images produced by all popular stego tools -- except outguess), crawl (which he's used to download 2 million jpeg's from eBay to analyze), discern (his distributed computing platform), etc."
Hushing up is not such a good answer sometimes ... Reader Brian McWilliams <brian@pc-radio.com< notes regarding the thread on Slashdot about the costs of full disclosure, "you might want to add an update linking to this story Newsbytes did a couple days ago about the Richard Smith posting. Contains responses from eEye & full disclosure advocates, as well as some more ammo from Smith."
Smith doesn't take kindly to being blamed for damages caused by security holes he publically aired.
So you want to patent "bacon and eggs"? I guess that's OK then. You recently read about the McAffee patent on a seemingly overbroad stretch of computing transactions. Well, it's raised quite a few eyebrows among people interested in a fair computing marketplace. geoa points to this article in which "Neil McAllister in The Gate takes too long to say we shouldn't let another monopoly in the playpen."
It was soooo old ... For everyone enjoying the recent upswing in retro computing interest, Silicon Avatar writes with another tidbit: "Although not necessarily new news, I found a link today when someone mentioned Roland MT-32 to me. Starting with Space Quest IV, Sierra games were written to use either the Adlib soundcard or the Roland MT-32 'soundcard.' Quest Studios seems to have repository of MANY of those songs, including the 'lounge tape' I once had but lost!"
Put that in your souped up underclocked emulator and smoke it.
If you're looking for more than Sierra game music, check out the Videogame Music Archive for other 8,000 midis for NES, SNES, Genesis, and more. :-) Now that is nostalgia!
Arcade Tones
I'm not related to it, but it was the only place I could find the Megablast by Bomb the Bass from Xenon 2. Now all I need is someone to call me. Call, damnit!!
DD
"You can justify anything by putting it in quotes, adding a famous name and making it a sig" - Albert Einstein
The point is, this article and others have been doning some amazing work on provably good steganography and making some strides in really making stego fit to the information theory model in good ways.
A lot of the papers cited are less "practical" experiments in steganography but rather information theory which has similar issues. The two most interesting were "writing on dirty paper" and "capacity of memory with errors". These were all about similar problems in VERY different areas.
The great thing about theory is that it finds connections you'd never imagine.
If you want to talk about this, my email is dbentley at stanford (it's a university, guess what the TLD is)
Funny this should be brought up, I just finished getting my shoutcast stream working that plays exclusively Gameboy MIDIs. Tune in.
Watashi wa Amerika-jin desu.
Last week AT&T Broadband's solution to stopping port 80 was just to completely block all incomming packet going to port 80. See the 7/30 accouncement. Its to bad they had to cop out and filter this network wide. Its to bad I can't get speakeasy dsl in my area yet because I would have switch over in an instant.
Most of the later Squaresoft rpgs were released with full soundtracks, as well, most of which you can probably find on ebay.
---
"Full disclosure" is what your scenario 2 is. Ish. I don't think you'll find many people arguing for scenario 1.
eEye discovers a vulnerability and tells MS; then, assuming MS comes up with a patch in a timely manner, eEye and MS make the vulnerability and the patch public at the same time. The question is, do they release the full details of the hole, or just that it exists.
Odd for me to have seen much of the bones of his story already discussed at length in The Register, on the day before McWilliam's posted his Newsbytes contribution.
Still; I'm sure the slashdot effect will please his employers & increase his marketability.
Here, meanwhile, is what TheReg thinks of mcWilliams and his half-assed understanding of things technical.