Slashdot Mirror

← Back to Stories (view on slashdot.org)

Exploit Found in Seti@Home

Posted by CmdrTaco on from the i-wanna-find-an-alien dept.

Jamie noted that an Exploit was found in Seti@Home and there is code exploiting the hole actually running about in the wild. Patches are available for those of you not interested in running a public warez server or DoS client ;)

266 comments

  1. Early post for Ashish by Anonymous Coward · · Score: -1, Troll

    This early post is for AXJ!

    r0x0r

  2. Aliens exploiting? by Anonymous Coward · · Score: 5, Funny

    I wonder whether aliens are exploiting this to control us /me screams and runs in fear.

    1. Re:Aliens exploiting? by matttastic · · Score: 1, Redundant

      I wonder whether or not you're an alien putting the fear into the human race and bringing about our own downfall through panic!

      Damn those infinately clever aliens!

    2. Re:Aliens exploiting? by gthug · · Score: -1, Troll

      its not aliens, is those fags that run /. god damn queers that live in their mom's basement.

    3. Re:Aliens exploiting? by Waffle+Iron · · Score: 5, Funny
      I wonder whether aliens are exploiting this to control us /me screams and runs in fear.

      Of course they are exploiting SETI. They obviously hack in to all systems that find positive results and surreptitiously replace them with random noise.

      They are covering their tracks. How else could you explain this suspicious lack of alien signal evidence after all of these years of searching? This is a coverup of galactic proportions.

    4. Re:Aliens exploiting? by mickwd · · Score: 1

      Good God - 70% Insightful, 30% Interesting ?

      Where's the +1 Funny ?

      Looks like these aliens have been going around stealing peoples' senses of humour.

    5. Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      Either that or it is just geeks that lost all touch with reality.

    6. Re:Aliens exploiting? by JudgeFurious · · Score: 4, Funny

      A little aluminum foil over the ports in your computer will take care of this just as easily and with less effort then downloading some suspect "patch" that's probably nothing more than a way for "them" to get control of your box and then eventually of course you.

      --
      Appended to the end of comments you post. 120 chars.
    7. Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      /me screams and runs in fear

      I am always both gratified and horrified to see references to MUD telnet client macros in the wild...

      TinyFugue rules! --er, nevermind.

    8. Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      Where's the +1 Funny ?

      exactly where it should be... not attached to the post. zing!

    9. Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      Do you think that's air you're breathing?

    10. Re:Aliens exploiting? by vsprintf · · Score: 0, Offtopic

      Good God - 70% Insightful, 30% Interesting ? Where's the +1 Funny ?

      The 12-year-olds are moderating again today. Expect to see lots of redundant mods as well.

    11. Re:Aliens exploiting? by The+Monster · · Score: 4, Funny
      Naah. When we finally decode data from an ETI site, it will probably be something like
      • 100% Guaranteed Stamen Enhancement - not only have users reported gains in length and girth of up to 50% or more, but enhanced spectral response as well - have the iridiescence that impresses females....
      • Larvae gone wild - See these hot young females in action - catch them quick before they pupate....
      • I am writing to you on a matter of utmost importance, which must be treated with the highest delicacy. My name is T'Jek, senior wife of the recently deceased Ska-al-ath, Subprefect for Industrial Development for Remnalon. Prior to his death, he was able to set aside in a special account the sum of 5 trillion Kalkaks, but due to banking regulations it will be necessary for me to move the money to an account in a different Prefecture in order to access it...
      • Please forward this message to as many sentient entities as possible. As G'iarc D'log-rerh-s lies dying of the incurable Andorian Wasting Disease, he has but one wish - to set the record for having a message forwarded to the highest number of sentient beings in the known galaxy....
      • Check out network channel 904753cx for a 'buffer overrun'
      • In Teivos Empire - your computational device exploits h4x0r5!
      • FR157 P057!
      --

      [100% ISO 646 Compliant]
      SVM, ERGO MONSTRO.

    12. Re:Aliens exploiting? by quantaman · · Score: 1

      Looks like these aliens have been going around stealing peoples' senses of humour.

      Well yours at least.

      --
      I stole this Sig
    13. Re:Aliens exploiting? by k-0s · · Score: 1

      They are getting back at us for Jeff Goldblum "hacking" their computers with a Powerbook. The simple answer is to sacrifice Jeff Goldblum to the aliens and call it even.

      --

      Visit www.seriouslythough.com

    14. Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      Vulcans stole my mod points.

    15. Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      The 12-year-olds are moderating again today. Expect to see lots of redundant mods as well.

      Have to say that a lot of those redundant mods are usually right... half the posting crowd doesn't even read the damned article, ask questions answered therein, just repeat one piece of it or add some obvious joke. Oh, I forgot the trolls, of course. The obvious Natalie Portman goatse hot grids Soviet evil bit f1rst p0st pimpled teen repeating jokes I've learned to ignore...

      Insightful posts are usually limited to one or two per story, if any.

      It's Slashdot... the stories are fun, some of the comments are too, and there's the crowd that sucks ass while they're always the first to complain...

      And since you read this, you know this, so you can mark this comment as redundant too!

    16. Re:Aliens exploiting? by SpaceLifeForm · · Score: 1

      So Bill *is* an alien then!

      --
      You are being MICROattacked, from various angles, in a SOFT manner.
    17. Re:Aliens exploiting? by gotacap · · Score: 1

      Very Good one, I agree tho, wouldn't it be lovely to open up the net to the spam of the ENTIERE galaxy...

    18. Re:Aliens exploiting? by mahler3 · · Score: 1
      They are covering their tracks. How else could you explain this suspicious lack of alien signal evidence after all of these years of searching? This is a coverup of galactic proportions.

      Does this remind anyone else of Bush's justification for invading Iraq?
      </troll>

    19. Re:Aliens exploiting? by Grizzlysmit · · Score: 1

      Nah all you get is random noise because that's all there is, what you want dumb alien's radio is to slow, a 10, 000 year lag between send and recieve make talking hard, they all use sub-space comunicators, ofcourse I saw it on "Trek".

      --
      in my life God comes first.... but Linux is pretty high after that :-D
      Francis Smit
  3. Linux/Solaris client is there, if you dig around by Saint+Aardvark · · Score: 4, Informative
    Looks like the links haven't shown up yet on the Unix download page, but the 3.08 client is available if you dig around a bit:

    ftp://alien.ssl.berkeley.edu/pub/setiathome-3.08.i 686-pc-linux-gnu.tar

    ftp://alien.ssl.berkeley.edu/pub/setiathome-3.08.s parc-sun-solaris2.6.tar

    Can't seem to find 'em on wcarchive.cdrom.com, the other mirror site -- anyone got a link?

    --
    Carousel is a lie!
  4. Firings... by Anonymous Coward · · Score: 2, Funny

    Something tells me that this exploit is going to lead to a lot more people getting fired than, say, that OpenSSH one a while back.

    1. Re:Firings... by fadeaway · · Score: 5, Insightful

      Why is there always an assumption that exploits=firings? If it was intentionally added, yes, but if it's an honest mistake why do heads have to roll?

      Coders make mistakes. That's why they put a backspace key on keyboards.

    2. Re:Firings... by kiltedtaco · · Score: 3, Insightful

      I believe he was refering to people who run SETI without their employer's permission getting fired for doing so, as it now may be more of a problem.

    3. Re:Firings... by Anonymous Coward · · Score: 2, Insightful

      I'd think the problem is more with people who installed Seti on a bunch of company machines(like desktops) to run in non business hours. Each one of these is now a security risk, and if only one is compromised - leading to other sorts of data loss - the person who allowed this policy might lose their job. The extra expense to patch such a non critical might be enough for management to say enough.

    4. Re:Firings... by Anonymous Coward · · Score: 5, Funny
      >coders make mistakes. That's why they put a backspace key on keyboards.


      No, the backspace is there for the users. We allow it on our keyboards because it is cheaper than having separate keyboards for programmers!

    5. Re:Firings... by caino59 · · Score: 1

      good coders don't

      we dint have a bavkspCE key. ;o)

    6. Re:Firings... by Anonymous Coward · · Score: -1, Flamebait

      WOO! I wanna be cool too, lemme put some spelling mistakes in my message on purpose too PLEASE!

    7. Re:Firings... by Anonymous Coward · · Score: 0

      Um... Isn't SETI a volunteer/academic organization? Aren't they like, Berkeley people, or something? Long-haired, crazy hippies? I have a hard time imagining a SETI guy sitting in an office yelling, "you're fired!"

    8. Re:Firings... by Alomex · · Score: 2, Funny

      Coders make mistakes. That's why they put a backspace key on keyboards.

      That's only there for PC wimps.

      Everybody knows that pressing backspace in the original Emacs brought up the help page (I'm not making this up).

    9. Re:Firings... by Anonymous Coward · · Score: 0

      I think you missed the point. There are numerous cases of people using the spare cycles on critical servers at work to boost their SETI/dnetc ranking.

      When all those machines get exploited, management is going to find out, and heads will roll.

    10. Re:Firings... by Anonymous Coward · · Score: 0

      Arithmetic according to C: float x = 3.14159; float y = 1/2 * x; Value of y? zero.

      And you're surprised? 1/2 is integer division. How do you expect it to be anything other than 0? Don't bitch, just make at least one of the operands to / a float/double: 1.0/2 for example. Don't make the stupid comment "the compiler should know what I want", either, because many times integer division is wanted.

    11. Re:Firings... by Anonymous Coward · · Score: 0

      "Everybody knows that pressing backspace in the original Emacs brought up the help page (I'm not making this up)."

      Maybe you didn't hear, but that same guy was fired for making the space bar quit the app.

    12. Re:Firings... by AintTooProudToBeg · · Score: 1

      No, the people who were running Set@Home at work are going to get fired for screwing up the network.

    13. Re:Firings... by Anonymous Coward · · Score: 0


      Look, if the code looks like standard schoolbook arithmetic the outcome should be a resonable approximation of it.

      People are so used to this design flaw that they can no longer tell that it is there. What would you say if I wrote a language in which the name of rebooting subroutine was say, "print"?

      You would say that is a pretty screwed up language. The only difference with C is that you've gotten used to it...

    14. Re:Firings... by Istealmymusic · · Score: 1
      Everybody knows that pressing backspace in the original Emacs brought up the help page (I'm not making this up).
      If you set your backspace key to ^? instead of ^H this shouldn't happen. Control-H is logically enough, help, while character 127 is the delete (DEL) character at the end of the ASCII table. Just do "stty erase ^?".
      --
      "The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
    15. Re:Firings... by Anonymous Coward · · Score: 0

      If you set your backspace key to ^? instead of ^H this shouldn't happen. Control-H is logically enough, help, while character 127 is the delete (DEL) character at the end of the ASCII table. Just do "stty erase ^?".

      Another one of those "it's easy to fix if you just type the following cryptic commands". I know how to fix it, but look if the key is distinctively marked backspace it should do backspace. Yes Control-H would have been nice for a help page but guess what? It was already taken!

    16. Re:Firings... by Anonymous Coward · · Score: 0

      Wrong. C has two distinct arithmetic types; integral and floating. These types are directly mapped to hardware types. Floating types are inherently imprecise, thus we have a need for integral types, which are precise but can't be anything other than integers.

      You're making the assumption that some braindead idiot needs to understand C. What you're missing is the fact that integral division can be extremely useful, and many programs rely on it for proper behavior.

      If 1/2 provided floating division, any time you wanted integral division, you'd have to do (int)(1/2). Instead, 1/2 is integral division and if you want floating, you just do 1.0/2. Why is your tradeoff better, when it doesn't make sense to a programmer?

      Once you understand programming a bit more, you'll see why integral division is used, and preferred.

    17. Re:Firings... by Anonymous Coward · · Score: 0

      You're making the assumption that some braindead idiot needs to understand C. What you're missing is the fact that integral division can be extremely useful, and many programs rely on it for proper behavior.

      To the contrary, you are missing the fact that integer division could have been provided with a character other than "/" which already had a well established meaning. Other languages use div, for example.

    18. Re:Firings... by Istealmymusic · · Score: 1
      Another one of those "it's easy to fix if you just type the following cryptic commands". I know how to fix it, but look if the key is distinctively marked backspace it should do backspace. Yes Control-H would have been nice for a help page but guess what? It was already taken!
      What are you complaining about? If you don't like cryptic commands, unreasonable key bindings, ambigious configuration options - Emacs is not for you. How about vi? Its a model editor so ^H in text edit mode won't be misinterpreted as a command, in any case; you have to enter command mode to enter commands. For this reason and this reason alone, vi is infinitely superior to emacs or its forks.
      --
      "The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
    19. Re:Firings... by Anonymous Coward · · Score: 0

      Good lord that would be annoying. 1$2 maybe? 1@2? 1!2? Or perhaps you think a function should be used? div(1,2)? The fact that you don't understand integer division doesn't mean those of us who do should be deprived of it.

    20. Re:Firings... by Anonymous Coward · · Score: 0

      There is a div(1,2) function, that gives you a struct, quotient and remainder, in this case, {0,1}.

    21. Re:Firings... by Anonymous Coward · · Score: 0

      Good lord that would be annoying.

      Oh god yes,

      x = div 2;

      would soil what is otherwise the crystal clear pristine syntax of C.

      The fact that you don't understand integer division doesn't mean those of us who do should be deprived of it.

      I don't think you know the meaning of the word "deprived". I suggested renaming integer division to div, not doing away with integer division.

    22. Re:Firings... by Anonymous Coward · · Score: 0


      So your suggestion is that we never go back and fix previous mistakes? And here I was thinking that one of the cool things about software is that we can release new and improved versions.

    23. Re:Firings... by Mr.+McGibby · · Score: 1

      To the contrary, you are missing the fact that integer division could have been provided with a character other than "/" which already had a well established meaning. Other languages use div, for example.

      Do you know the history of C? Do you know why it was created?

      It was created in a time when all the hardware programmers were using assembly, and only assembly to write code because none of the other languages out there let you talk to the hardware in a semi-efficient way.

      So along came C, which assumed you knew something about assembly in the first place and you didn't need hand holding to get through some integer arithmetic. It assumed that you knew what integer division was, and used it when you wanted to. And didn't when you didn't. Back in that day, integer division was often the only kind available natively (and still is in some embedded situations). You wouldn't want to accidently activate the whole set of floating-point division routines unless you really wanted to.

      --
      Mad Software: Rantings on Developing So
    24. Re:Firings... by Alomex · · Score: 1

      Do you know the history of C? Do you know why it was created?

      Of course. Algol and Pascal were introduced at the same time yet do not have this obnoxious behaviour. I bet you didn't know that.

      You wouldn't want to accidently activate the whole set of floating-point division routines unless you really wanted to.

      Let's assume for the sake of the argument that is true, why not fix it now? For example, sqrt(2) used to evaluate to garbage. The latest version of C does the proper casting to float and returns 1.41...

      I really don't see why so many /.ers have come to assume that C/Unix/whatever are written in stone and cannot possibly be improved (contrast this with perl apocalipsis and python 3, which are efforts starting from the assumption that lots of things could be fixed).

  5. DDoS this baby!!! by Anonymous Coward · · Score: -1, Troll

    First POST!
    I 0w/\/ j0o a1l!

  6. FP!!! by Anonymous Coward · · Score: -1, Offtopic

    Got an FP!

    cool.

    this is great.

  7. Too late... by Anonymous Coward · · Score: 5, Funny

    But I already run a public warez server!

    1. Re:Too late... by Anonymous Coward · · Score: 2, Funny

      it's always you damn Anonymous Coward bastards.

      oh wait...

  8. Must be by Anonymous Coward · · Score: 1, Funny

    Must be because of evil bits sent by menacing aliens!

  9. So there weren't really 18 new jupiter satellites? by Anonymous Coward · · Score: 2, Funny

    Just a bunch of h4x0rs having fun again? Dang.

  10. YOU FAIL IT by Anonymous Coward · · Score: -1, Troll

    You win... at the game of losing! LOL ROTFLWTFBBQ!!111

  11. Everyone knows its... by Chris_Stankowitz · · Score: 5, Funny

    the Aliens doing this. Not to worry though. I will use my I-Book to hack into their systems and upload a virus.

    1. Re:Everyone knows its... by matttastic · · Score: 1

      I can fly you up to the mothership in an alien craft i can, oddly, fly with no prior training whatsoever!

    2. Re:Everyone knows its... by heXXXen · · Score: 1

      Hey, he was a fighter pilot. He could fly some form of aircraft! Give the man some credit.

    3. Re:Everyone knows its... by edgrale · · Score: 1

      Remember to wear your tinfoil hat :)

      --
      09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
    4. Re:Everyone knows its... by unborracho · · Score: 1

      WILL SMITH = B3ST 4cT0|2 EV4|2!!!

      Seriously, that was the worst movie ever.

      --
      "You had this look that of an angel, it was such a bad disguise" --Dishwalla
    5. Re:Everyone knows its... by mog · · Score: 1

      I guess you've never seen "The People Under the Stairs"...

      *shudder*

    6. Re:Everyone knows its... by Anonymous Coward · · Score: 0

      This is a UNIX system ... I know this!
      (starts up VRML fly-through)

    7. Re:Everyone knows its... by DarkKnightRadick · · Score: 1

      I thought both movies were pretty good. :)

      --
      "There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
    8. Re:Everyone knows its... by Anonvmous+Coward · · Score: 1

      "Seriously, that [Independence Day] was the worst movie ever."

      In light of Episode 1, I think not.

    9. Re:Everyone knows its... by jpkunst · · Score: 1

      I will use my I-Book to hack into their systems and upload a virus.

      Are you sure it will be compatible? Jeff Goldblum used a Powerbook 5300.

      JP

    10. Re:Everyone knows its... by Anonymous Coward · · Score: 0

      What you forget it that the guy saw the craft in action. In a combat situation, no less. That's half the battle, knowing the limits, where you find the envelope edges. Planes crash when you bust through the envelope, and the thing stops flying.

  12. YOU FAIL IT by Anonymous Coward · · Score: -1

    You suck worse than the last wanna-be frist proster, who was also a failure.

    You are a failure as a slashdot poster and human being, even more so than usual.

  13. exploited by Anonymous Coward · · Score: 0

    Of course, they're secretly using our cycles now. It must stop.

  14. Omigod!! by Anonymous Coward · · Score: 1, Funny

    There are illegal aliens in my computer!#!@

  15. Sounds like a case for Mulder and Scully by slashmonkey · · Score: 1

    Who am I kidding, no-one watches the X-Files anymore/

    1. Re:Sounds like a case for Mulder and Scully by diesel_jackass · · Score: 1

      more like a case for the lone gunmen.

      --
      THERE IS NO DATA. THERE IS O
    2. Re:Sounds like a case for Mulder and Scully by p00ya · · Score: 1

      pity they got killed :/

  16. Alien Fury by Flamesplash · · Score: 3, Funny

    I'm sure the Aliens will love it when we try to DoS attack them. That's one way to make friends with a new species. "Oh sorry about that, yeah were a smart world, REALLY!!"

    --
    "Not knowing when the dawn will come, I open every door." - Emily Dickinson
    1. Re:Alien Fury by Anonymous Coward · · Score: 0

      The S in DOS stands for service. In orde for a DOS attack to work, the attacked must first have service. Or are you saying that we're searching for aliens in the wrong spot, because they obviously already have some interstellar DSL or something and all we have to do is a traceroute?

    2. Re:Alien Fury by corvi42 · · Score: 2, Insightful

      I wonder how you'd manage such a DoS?
      I suppose you could set up hundreds of transmitters around uninhabitted star-systems that spew meaningless signals. If the alien race was running a program comparable to our SETI, they would start detecting these "false positives". The signals would look like they were meaningful, patterned signal coming from inhabitted worlds, when in fact they are meaningless rubbish ( produced say from some pseudo-random function ). This would tie up a large amount of the computing & scientific resources of the alien world trying to decode these mysterious signals. Perhaps if you created enough of these false ones you could cloud out the alien civilisations abilities to search for legitimate signals, hence effectively DoS'ing their entire world in this regard.

      It's an interesting possibility, particularly if you happened to be a reclusively civilisation that is afraid that it might be found and visited by ( potentially warlike ) alien races. You could "hide in the noise" so to speak of hundreds of such false-positives. If you were lucky, you might convince the aliens to just give up looking about in your area of the galaxy.

      Of course it's not exactly a very "friendly" thing to do, and you might just incur the wrath of aliens who would otherwise have been of a much nicer disposition.

      Another strategy that I've thought would be effective if you wanted to actually attract the attention of distant worlds, would be to set up a legitimate transmitter somewhere in the vicinity of a pulsar. Pulsars are natural beacons in space, they transmit a regular radio pulse out to the universe, and act somewhat like a lighthouse in space. Such strong natural beacons would likely be of interest to any civilisation studying the cosmos, and so setting up a transmitter nearby to one ( not so close as to be overshadowed by the pulsar, but say in a starsystem nearby ) could be a perfect strategy for having yourself found.

      --

      There are a thousand forms of subversion, but few can equal the convenience and immediacy of a cream pie -Noel Godin
    3. Re:Alien Fury by Anonymous Coward · · Score: 0

      While we stuff the packets with the data "We come in peace!"

    4. Re:Alien Fury by budgenator · · Score: 1

      If we set up the transmitters as an phase array, we could make it look like the signal was coming from cold empty space; imagine them trying to figure that out

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    5. Re:Alien Fury by corvi42 · · Score: 1

      Heh - you could have the signal act as "the voice of God" and tell the aliens all kinds of rubbish. That would be a laugh - until they come and kill you with religious fervour.

      --

      There are a thousand forms of subversion, but few can equal the convenience and immediacy of a cream pie -Noel Godin
    6. Re:Alien Fury by thebes · · Score: 1

      lol@ "WERE a smart world" Yeah...I think we are getting dumber and dumberer as time goes on.

    7. Re:Alien Fury by salimma · · Score: 1

      These pseudo-random jamming signal would still be located around your real home system, so there is no stopping the alien intelligence from realising what you are doing and home in on the real system.

      This happens in real life too; I believe some anti-aircraft missiles have a backup mode where they home in on the source of the jamming signal.

      --
      Michel
      Fedora Project Contribut
    8. Re:Alien Fury by Anonymous Coward · · Score: 0

      If they were clever enough with their receivers they could figure that one out.

  17. Re:Linux/Solaris client is there, if you dig aroun by attemptedgoalie · · Score: 1

    Thank you!

    I could have dug around, but now I don't need to.

    It's good to be lazy.

    --
    My mom says I'm cool.
  18. Alien pr0n by Fulkkari · · Score: 3, Funny
    I wonder whether aliens are exploiting this to control us /me screams and runs in fear.

    If the aliens would be exploiting that, our computers would be full of alien pr0n, which it isn't the case... Right? RIGHT?

    --
    I demand the Cone of Silence!
    1. Re:Alien pr0n by usr122122121 · · Score: 1
      If the aliens would be exploiting that, our computers would be full of alien pr0n
      So, let me get this straight... you're talking about aliens exploiting themselves by way of exploiting a programming oversight? :-)
      --

      -braxton
    2. Re:Alien pr0n by Anonvmous+Coward · · Score: 1

      "If the aliens would be exploiting that, our computers would be full of alien pr0n, which it isn't the case... Right? RIGHT?"

      Uh oh... I think the invasion started in Japan... Damn tentacles!

    3. Re:Alien pr0n by C0LDFusion · · Score: 1

      It's bigger than that! It's like a really bad fanfiction. Aliens are planning to cross-breed humans. Tentacle pr0n was Phase One. They planned to get the nerdiest (and thus smartest) members of humanity attuned to tentacle based sexual stimuli. Now, Phase 2, h4x0r their computArz. Phase 3 is the murder of jocks, preps, and other genetic failures, followed by tons of alien sex with nerds.

      --
      Only in slashdot are posts of solidarity modded at -1 Redundant, while posts of antagonism are modded as -1 Flamebait.
  19. ROTFLWTFBBQ by Flamesplash · · Score: -1, Offtopic

    mmmmmm BBQ *drools*

    --
    "Not knowing when the dawn will come, I open every door." - Emily Dickinson
    1. Re:ROTFLWTFBBQ by Anonymous Coward · · Score: 0

      Ah. You're going for the Homer/aliens reference, eh?

  20. /. = fat cock suckage by gthug · · Score: -1, Troll

    /. can suck on deez, god damn fags.

  21. That's why I only give my extra cycles to by Anonymous Coward · · Score: 2, Funny

    distributed.net in support of Team Slashdot. Let's crack that RC5-72 so that we can move on to RC5-128! Only 657,374 days (~1800 years) left to go!

    1. Re:That's why I only give my extra cycles to by error0x100 · · Score: 2, Insightful

      Honestly, why do people feel the need to be snobbish about how they use their spare CPU cycles?

    2. Re:That's why I only give my extra cycles to by T'aZ+007 · · Score: 1

      well, 600K days left using a linear approximation, but the cpu power grows exponantially ,so (from someone on irc in their chan) it should be done in ~9 years.

      --
      T'aZ |Jabber:taz-007@jabber.org|GPGkeyID:E051925D|http: //taz.prout.be
    3. Re:That's why I only give my extra cycles to by error0x100 · · Score: 0, Flamebait

      Uh, how the hell is this "flamebait"? There is nothing inflammatory in there, its just a passing comment. Grow up, moderators.

    4. Re:That's why I only give my extra cycles to by Anonymous Coward · · Score: 0

      It's flamebait because I'M TOTALLY ON FIRE AND I EAT YOUR POST

      i put this in all caps because its important!!!

    5. Re:That's why I only give my extra cycles to by TeknoHog · · Score: 1

      It doesn't matter, as long as you devote the spare cycles to something. But running a computer without doing any work is like hiring a person to twiddle their thumbs. Computers are practically free labour (for certain tasks) and there's plenty of work left for computers in this world.

      --
      Escher was the first MC and Giger invented the HR department.
    6. Re:That's why I only give my extra cycles to by jafuser · · Score: 1

      It was my understanding that newer Operating Systems will actually put the CPU into a state where it consumes less power when the CPU is idling.

      If this is true, then it is not completely "free" to run these number crunching background programs when the computer is idle.

      --
      Please consider making an automatic monthly recurring donation to the EFF
    7. Re:That's why I only give my extra cycles to by Anonymous Coward · · Score: 0

      There is a special task called Idle on NT machines (NT/2000/XP) which send special idle instructions to the CPU, so that it consumes less power, instead of running it in a loop or doing power intensive calculations.

  22. somebody post a fucking mirror already by Anonymous Coward · · Score: 0

    where are those karma whores when you need them?

  23. In the wild or not? by Theodore+Logan · · Score: 4, Informative
    The site is Slashdotted so I can't get through, but the write up contradicts Seti's official version which states that
    • There was a potential buffer overrun in the networking code of the client that is fixed with version 3.08. Note that to exploit this vulnerability, a potential attacker would have to trick the client into contacting a fake server rather than the actual SETI@home server. To our knowledge,
    • no SETI@home client has ever been attacked in this manner.
    Whereas Jamie claims that
    • an Exploit [sic.] was found in Seti@Home and
    • there is code exploiting the hole actually running about in the wild.
    Can anybody help clear this up until the linked site get back online?
    --

    "If you think education is expensive, try ignorance" - Derek Bok

    1. Re:In the wild or not? by Anonymous Coward · · Score: 1, Funny

      Um, lets see... Believe the actual page... or believe what a Slashdot "editor" writes... Hmm, tough call.

    2. Re:In the wild or not? by stevejsmith · · Score: 0, Flamebait

      Well, you know that supposed fourth dimension, time? Could it be possible that at the time of the writing of the first one there wasn't one but now there is? Over time things change...I'm sure you can find it in a book somewhere.

      Oh, and then there's the "to our knowledge" clause. Maybe they're just not as knowledgable?

    3. Re:In the wild or not? by brundlefly · · Score: 5, Funny

      Where is the wild? Anyone have the address?

      I'd like to run about there also.

      TIA!

    4. Re:In the wild or not? by Anonymous Coward · · Score: 0

      Well, you know that supposed fourth dimension, time? Could it be possible that at the time of the writing of the first one there wasn't one but now there is? Over time things change...I'm sure you can find it in a book somewhere.

      This is one possibility. There are others. There's no need to be an ass, though I suspect you can't help it.

      Oh, and then there's the "to our knowledge" clause. Maybe they're just not as knowledgable?

      Now you have a second hypothesis yourself right there. Anyway, could you please explain how that clause could be different? Whatever you know is only as certain as "to your knowledge."

      You don't need to pretend you're so fucking clever just because you got your first Slashdot account last week. Especially not when you are obviously just trolling.

    5. Re:In the wild or not? by grazzy · · Score: 2, Informative

      you have to spoof and take over a connection to be able to exploit this vuln.

      ie, you could only do it on a local net.. however i guess pretty many people are running seti in the doorms around me..

    6. Re:In the wild or not? by daveaitel · · Score: 1
      There IS an exploit. It's not completely simple to use, but it does exist.

      Dave Aitel

      Immunity,Inc.

    7. Re:In the wild or not? by diesel_jackass · · Score: 4, Funny

      i don't know where it is but according to the late night commercials, girls go there to get videotaped by snoop dogg. it sure looks like a fun place though.

      --
      THERE IS NO DATA. THERE IS O
    8. Re:In the wild or not? by dillon_rinker · · Score: 3, Informative

      Both agree there's an exploitable bug in SETI@home

      Jamie states exploit code exists and is in the hands of people who are not guaranteed to be friendly. SETI states that there are difficulties in exploiting the bug and they know of no clients that have been compromised. Sounds to me like someone has written and distributed the code but has not actually been able to use it.

      There is no contradiction. Jamie doesn't say clients have been exploited; SETI doesn't say there's no code. Granted, reading only Jamie's statement, I'd infer that the exploit has been used at least once. Given the context of SETI's statement, however, I'd reinterpret Jamie's.

      Of course, you could choose to believe that one of them is lying. I have not enough experience with either of them to make such a choice and prefer to give them the benefit of the doubt.

    9. Re:In the wild or not? by Anonymous Coward · · Score: 0

      An exploit can be found on the first linked site. Granted, not easy to use over an internet connection, but very do-able on a local segment.

    10. Re:In the wild or not? by Anonymous Coward · · Score: 0

      So you mean I would have to hack someone's dns server and fake the address of a seti server...?

      Wow, its a good thing there aren't any BIND exploits going around....Oh, wait...

    11. Re:In the wild or not? by Anonymous Coward · · Score: 0

      Hey Dave, didn't know you lurked here :)

      Give some details. Why isn't it completely simple to use?

      -brock (on a friend's computer, slashdot name is "btellier")

    12. Re:In the wild or not? by White_Lightning · · Score: 1
      DUH!

      It's www.inthewild.com

      www.thewild.com

      www.wild.com

      is that so hard?

      And if you go to that last one, amke sure your dental insurance is paid up.

  24. Interesting by MC68040 · · Score: 1, Flamebait

    Seems a lot of people freaked over this, understandable, but aren't they aware that running any software leads to security risks?

    - Oh my bad, I guess it's mostly the windows client users that have experienced that before...

    (I was also always sure there was a little man inside my computer doing all the work, little did I know that it was a little alien). /040

    1. Re:Interesting by Anonymous Coward · · Score: 0

      Yeah, like Sendmail. Oh wait, that's not for Windows.

  25. Buffer Overflow stupidity by jtdubs · · Score: 4, Insightful

    Well, let's see here. I'm going to be reading data from an untrusted source. So, I feel it's safe to assume that this data will be no longer than, oh, let's say 100 characters. Yeah, 100. I mean, who would send more than that. That'd be crazy!

    That'd be about as crazy as wasting cycles on checking the length of my input. Or, dynamically allocating buffers. Or, using safe, bounded copy/read instructions. What kind of wacko would do that! Hah!

    Justin Dubs

  26. that is wrong by Anonymous Coward · · Score: -1, Flamebait

    No you dumb moron coders never make mistakes. At least i never make mistakes and i write Windosw and that is why Windows is perfect. You have obviusly never been to Seatle. Come here and we will show you that the backspase key was aded for dumb users not for coders.

  27. This IS being used! by Adler · · Score: 5, Funny

    Look! Their site is down! Someone must have used this exploit to launch a Dos on them! Oh wait... damn you slashdot!

    --

    Everybody denies I am a genius--but nobody ever called me one!

  28. Making it run a warez server would mean by noogle · · Score: 5, Funny

    at least its doing something useful... rather than just pointlessly scanning some random data with no hope of finding anything.

    --

    I'm smarter than the average bear.

    1. Re:Making it run a warez server would mean by Anonymous Coward · · Score: 0

      It's funny 'cause it's true.

  29. Mirror (no pics or downloads) by Theodore+Logan · · Score: 4, Informative

    over here.

    --

    "If you think education is expensive, try ignorance" - Derek Bok

  30. Aliens want warez too by LemurShop · · Score: 5, Funny

    running winxp on the spaceship woo -.-

    --

    This sig was cut off by the sla
    1. Re:Aliens want warez too by Echnin · · Score: 1

      Yeah right. I don't think they'd want the spaceship crashing (I made a PUN!) all the time.

      --
      Lalala
    2. Re:Aliens want warez too by TeknoHog · · Score: 1

      Hey, you should watch Star Wreck V, where humans attack the Borg cube by installing Windows 95 on it.

      --
      Escher was the first MC and Giger invented the HR department.
  31. Of Course It's Slashdotted by 1alpha7 · · Score: 5, Informative
    Affected versions

    Confirmed information leaking:
    This issue affects all clients.

    Confirmed remote exploitable:
    setiathome-3.03.i386-pc-linux-gnu-gnulibc2.1
    setiathome-3.03.i686-pc-linux-gnu-gnulibc2.1
    setiathome-3.03.i386-pc-linux-gnulibc1-static
    setiathome-3.03.i686-pc-linux-gnulibc1-static
    setiathome-3.03.i386-winnt-cmdline.exe
    i386-unknown-freebsd2.2.8 (Special thanks to Niels Heinen)
    SETI@home.exe (v3.07 Screensaver)

    Confirmed DoS-able using buffer overflow:
    The main seti@home server at shserver2.ssl.berkeley.edu

    Presumed vulnerable to buffer overflow:
    All other clients.

    PATCHED VERSION

    Are available

    BACKGROUND INFORMATION

    From "http://setiathome.berkeley.edu/" :
    "SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data. "
    "The SETI@home program is a special kind of screensaver. Like other screensavers it starts up when you leave your computer unattended, and it shuts down as soon as you return to work. What it does in the interim is unique. While you are getting coffee, or having lunch or sleeping, your computer will be helping the Search for Extraterrestrial Intelligence by analyzing data specially captured by the world's largest radio telescope. "
    "The client/screensaver is available for download only from this web page - we do not support SETI@home software obtained elsewhere. This software will upload and download data only from our data server here at Berkeley. The data server doesn't download any executable code to your computer. All in all, the screensaver is much safer than the browser you're running right now!"

    There are currently over four million registered users of seti@home. Over half a million of these users are "active"; they have returned at least one result within the last four weeks.

    THE VULNERABILITIES

    The seti@home clients use the HTTP protocol to download new workunits, user information and to register new users. The implementation leaves two security vulnerabilities:

    1) All information is send in plaintext across the network. This information includes the processor type and the operating system of the machine seti@home is running on.

    2) There is a bufferoverflow in the server responds handler. Sending an overly large string followed by a newline ('\n') character to the client will trigger this overflow. This has been tested with various versions of the client. All versions are presumed to have this flaw in some form.

    3) A similar buffer overflow seems to affect the main seti@home server at shserver2.ssl.berkeley.edu. It closes the connection after receiving a too large string of bytes followed by a '\n'.

    THE TECHNIQUE

    1) Sniffing the information exposed by the seti@home client is trivial and very usefull to a malicious person planning an attack on a network. A passive scan of machines on a network can be made using any packetsniffer to grab the information from the network.

    2) All tested clients have similar buffer overflows, which allowed setting eip to an arbitrairy value which can lead to arbitrairy code execution. An attacker would have to reroute the connection the client tries to make to the seti@home webserver to a machine he or she controls. This can be done using various widely available spoofing tools. Seti@home also has the ability to use a HTTP-proxy, an attacker could also use the machine the PROXY runs on as a base for this attack. Routers can also be used as a base for this attack.

    3) Exploitation of the bug in the server

    --
    Live to be Moderated
  32. Hold On by Lucas+Membrane · · Score: 0, Offtopic

    Wasn't this SET@home thing programmed in Ada? Ada isn't supposed to allow buffer overruns. What gives?

    1. Re:Hold On by shadowjk · · Score: 1

      SETI@home is programmed in Ansi C.

    2. Re:Hold On by Anonymous Coward · · Score: 0

      That is ANSI C. Get the case correct, it is an acronym.

    3. Re:Hold On by Lucas+Membrane · · Score: 1

      I guess I was fooled by this: Announcement in comp.lang.ada of SETI@home client

  33. Offtopic but out of curiosity by Timesprout · · Score: 2, Interesting

    Are many individuals (on their own machines and not he company hardware) actually running the SETI client? I started it back in 1999 but gave up when I discovered that it took about 24hrs to process one unit on my 366 Toshiba laptop making it rather unlikely that at that rate I would live long enough to find anything. To be honest I had pretty much forgotten about the project altogether.

    --
    Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
    What truth?
    There is no dupe
    1. Re:Offtopic but out of curiosity by Anonymous Coward · · Score: 0

      I have a 450 MHz Pentium II that I am using as a Linux firewall. I leave it on all the time. Since it has plenty of spare CPU cycles I have been running Seti@Home on it continuously for over two years. It takes 12-13 hours to complete a work unit. I'm now in the 97th percentile of contributors, with almost 1500 work units turned in.

      I don't think I have found any aliens, though!

      I also have a 800 MHz laptop, but I only rarely use it to run Seti@Home. It does a work unit in eight hours. The laptop gets really hot when it's at 100% CPU. Nevertheless, if I'm offline for a few hours I can use the laptop to make up the time. (I have SpeedStep; at 650 MHz it takes about ten hours to do a work unit, and the laptop runs cooler. Sometimes I've let it run overnight.)

      Of course with news of this exploit, my instance of Seti@Home is temporarily stopped. I'll have it back up as soon as I download the new version.

    2. Re:Offtopic but out of curiosity by attemptedgoalie · · Score: 1

      I have it running in the background on some non-essential machines.

      I've got it running in the background on my main box. It has no effect on my use of my machine. I'm listening to MP3s, reading several websites, and have 4 SSH terminals open, etc.

      Once every several hours, it grabs 340K.

      My machines have to be on, but aren't heavily hit most of the time. While they're not being hit, they're pumping out seti data.

      Hope that helps your curiosity.

      --
      My mom says I'm cool.
    3. Re:Offtopic but out of curiosity by Rooney444 · · Score: 1

      I have found that a Pentium 4 2.4GHz can chew threw a unit in under 4 hours.

      Disabling the screen saver feature vastly improves the speed at which a unit is completed.

    4. Re:Offtopic but out of curiosity by Anonymous Coward · · Score: 0

      On a Dual 533 MHz under OS X I can do two units at once in about 10 hours. (Unix command line client).

    5. Re:Offtopic but out of curiosity by Anonymous Coward · · Score: 0

      I've been running it off and on since around 1998-99 as well. I also stopped running it for awhile as my machines were a little behind the times. But now with an Athlon 2000 XP, it runs packets in 3-4 hours. Even my slowest machines, a P3-500 and Dual P2 Xeon 400mhz w/ 1mb cache run at about 10 and 12 hours, respectively, on average. Keep in mind that for dual machines, SETI does not run on multiple CPU's at once - it uses 50% of each by default, or you can only run it on 1 CPU at a time. Also make sure you run the command line version if you are looking for good times. Last I used it, the screen saver version seems to run a hell of alot slower than command line. Even though it has the graphics that come on when the screen saver does, I believe you can disable it, but don't think it does much to the overall speed. Regardless, I would still suggest going with the command-line version unless you really need pretty graphics to look at. I personally find looking at my SETI statistics pretty enough ;)

    6. Re:Offtopic but out of curiosity by santos_douglas · · Score: 1

      I run it on a P4 384MB laptop, with the CLI version it crunches a WU every 3.5 hours which is a big improvement. SETI still claims a base of about 4 million users so I'd say at least a few of those must be slashdotters. I know here at MSU a lot of the lab rats run it on university machines. I run it pretty much 24/7 set to low priority so it has almost zero affect on my usage. It may be a long shot, but it's still a better use of my cycles than most of the other things my machine does such as running Win2k and Office.

    7. Re:Offtopic but out of curiosity by MightyDrake · · Score: 1

      The SETI@Home users stat page shows over 600,000 distinct users have returned at least one result in the last four weeks.

      I'd say it's still pretty popular.

  34. If you're asking people for their cycles... by cperciva · · Score: 0, Flamebait

    wouldn't it make sense to at least allow people to know what they're running?

    I'm not saying that open source is the best solution in all circumstances, but when you're asking people to run your code it seems that the least you could do would be to provide them with the source code.

    --
    Tarsnap: Online backups for the truly paranoid
    1. Re:If you're asking people for their cycles... by corvi42 · · Score: 2, Informative

      This is in the SETI@home FAQ ( http://setiathome.berkeley.edu/faq.html#q1.9 ), it reads:

      Why don't you release the source code?

      We decided not to make source code available for security reasons and for science reasons as well. We have to have everyone do the exact same analysis, or we can't have any control over our research and be confident in our results. We were also worried that there may be a few people that want to deliberately try to screw up our database and server.

      --

      There are a thousand forms of subversion, but few can equal the convenience and immediacy of a cream pie -Noel Godin
    2. Re:If you're asking people for their cycles... by cperciva · · Score: 3, Insightful

      Yes, that's a good answer, except that it completely ignores the facts that
      1. People have turned in fake results
      2. People have deliberately tried to screw up their database and server
      3. There are apparently security holes in the client which would have been noticed much sooner if the code was open.

      --
      Tarsnap: Online backups for the truly paranoid
    3. Re:If you're asking people for their cycles... by budgenator · · Score: 2, Interesting

      That would seem to be a reasonable request but if fulfilled, it would lead to people using the source code and applying the own optimizations to it. Many people view Seti@home in a compeatative way; there have been contests, and people have cheated by saving a work-unit that was all but done and repetativly re-processed and submitted it to artificialy inflate there stats or win.

      The problem is Seti@home is science, and a primary requirement for science is that results must be repetable. If I were for example to recompile to program for athlon optimisation, it probably wouldn't be too big a deal and might gain me an advantage of of 20 min to an hour for each work-unit, which are averaging about 27 hours on my older machine. Sooner or later somebody is going to take apart the program and start change the math involved which would increase the advantage but absolutly kill reproducability.

      I think that this exploit would be pretty hard to exploit because you would have to intercept the IP address of the seti@home server, and redirect to a malicious server to exploit it. It would be easier to just exploit one of the many other easier to exploit security holes out there.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    4. Re:If you're asking people for their cycles... by Anonymous Coward · · Score: 0

      Yes, but releasing the source code would probably increase the number of instances of fake results/attacks on the server by a huge factor.

      Just because someone can break into your house using a lockpick, it's still a good idea to keep your front door locked.

    5. Re:If you're asking people for their cycles... by cperciva · · Score: 1

      There's a simple solution to that problem: Don't give people credit for returning incorrect results.

      As long as people are returning the correct answers, it doesn't really matter how they get there.

      --
      Tarsnap: Online backups for the truly paranoid
    6. Re:If you're asking people for their cycles... by corvi42 · · Score: 1

      Well it's their decision, not mine. However despite the facts that people have already turned in fake results & tried to screw with their servers, I think a pretty convincing case can be made that this could be much exacerbated by open sourcing the client.

      However, using a system of certificates & digital signatures, it should be very difficult to spoof a data result. Such a client could legitimately be open sourced. In the end, who knows - its their project, their problem, and their decision.

      --

      There are a thousand forms of subversion, but few can equal the convenience and immediacy of a cream pie -Noel Godin
    7. Re:If you're asking people for their cycles... by GMontag451 · · Score: 1

      If you already know what the correct result is, why the hell are you having the client programs compute it? If you don't know what the correct result is, how are you going to ensure that people return the correct result?

    8. Re:If you're asking people for their cycles... by John+Hasler · · Score: 1

      > Sooner or later somebody is going to take apart
      > the program and start change the math involved
      > which would increase the advantage but absolutly
      > kill reproducability.

      And they are going to do that to the present closed source client. Nothing about releasing the client source would require them to accept results from clients not downloaded from their site.

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    9. Re:If you're asking people for their cycles... by cperciva · · Score: 1

      That's why they hand out the same work to several different machines.

      --
      Tarsnap: Online backups for the truly paranoid
    10. Re:If you're asking people for their cycles... by budgenator · · Score: 1

      Actualy they rework a lot of stuff routinely just to make sure that if anything interesting is reported its verified and not due to a glitch like a bad write to the disk or a currpted packet and stuff. If Linux machines found something and windows didn't it might represent a port problem that would need to be looked into. Also if a WU isn't recieved back after a while it re-sent to another user so two people may return the same wu results naturaly. If you're using seti@home in screensaver only mode on a 75Mhz Pentium it can take quite a while to complete.

      The credit system isn't realy robust like it would have to be say if they were paying for the work done, so they are pretty leinient about credits for doing the work, but very strict about results

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    11. Re:If you're asking people for their cycles... by Anonymous Coward · · Score: 0

      How, exactly, would digital certificates and digital signatures help prevent spoofing data?

    12. Re:If you're asking people for their cycles... by GMontag451 · · Score: 1

      Yeah, but that only works in a homogenous environment. If you start letting people optimize the math and stuff like the parent thread was suggesting, you can no longer tell which result is the correct one just by comparing the results from a bunch of different computers working on the same data.

    13. Re:If you're asking people for their cycles... by corvi42 · · Score: 1

      well you can't prevent the spoofing of data, but you can prevent one user from impersonating another. SETI@home already issues the same data unit to several clients so that they can compare the results & weed out corrupted results or results that have been spoofed. If you allow for this kind of redundant processing as well as making it nigh impossible for one user to impersonate another, then you can be reasonably sure that none of the results have been tampered with.

      --

      There are a thousand forms of subversion, but few can equal the convenience and immediacy of a cream pie -Noel Godin
  35. moron having a georgewellian nightmare by Anonymous Coward · · Score: 0

    or, us vs. us.

    now you see IT? now you DOWt.

    pay attention, that's cheap enough.

    lookout bullow. the daze of the Godless greed/fear/murder based payper liesense hostage ransom stock markup frauds is upon US.

    the creator is participating lookout bullow.

    check with yOUR creator to discover what yOUR role might be in the rescue of the planet, from those who would hold IT hostage.

    gooed 'job' there robbIE, turning off va lairIE's patentdead PostBlock(tm) device. that didn't cause a flareup of trust/cohesion in the 'community' buy the weigh. everIE 'man' for himself dooing the 'hard times'?

  36. Bad net behavior by MrWa · · Score: 0, Offtopic
    /. is made up of various populations - that is why oen post will say the MPAA is bad while the next will praise the new geek movie coming out. One thing we all have in common is the Internet.

    Being part of a community involves give and take. /. has done its fair of giving, so far as links to news and a place to comment is concerned. This has also involved more than a fair share of taking.

    As a responsible net-citizen, though, the editors need to be far more considerate of other people. This is a clear case of inproper net behavior, something I would expect the newest AOL-newbie, spam producing, weenie to do.

    Instead of complaining about how much spam you get everyday, Taco, why don't you do the community something useful and mirror the websites that you link to. We whine and complain about bad patents, spam, copyright abuse, monopolies, and then treat the net community with disrespect by effectively dos'ing random servers? It isn't funny anymore.

    1. Re:Bad net behavior by DarkKnightRadick · · Score: 1

      I think it's funny. And for it to be a dos attack, it'd have to be with the intention of killing the server(s).

      If the hosts were halfway decent /.ings would never happen in the first place.

      --
      "There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
    2. Re:Bad net behavior by LFS.Morpheus · · Score: 1

      Or you could read the FAQ on this issue; then accept the /. effect, and either prepare for it, don't care about it, or don't put up a web site.

      --
      The space unintentionally left unblank.
  37. Less wastefull by Guspaz · · Score: 1

    How about using your cycles on something that isn't a complete waste of time, like folding@home, or some other project?

    1. Re:Less wastefull by 10Ghz · · Score: 2, Informative

      Let me think about that for a second.... Ummmm... No.

      I just hate the people who go around saying "Your distributed computing project sucks! You should run instead!". Why don't you run whatever you want to run, and let others run whatever they want to run? Sounds reasonlable? That's what I thought. Now: Shut the fuck up.

      --
      Lesbian Nazi Hookers Abducted by UFOs and Forced Into Weight Loss Programs - -all next week on Town Talk.
    2. Re:Less wastefull by Dirtside · · Score: 1

      Well, fundamentally, there's nothing wrong with trying to convince people of something... as long as you're using logic and reason, not emotion or insults. Saying things like "Your project sucks" isn't likely to win me any converts if I want people to run project A instead of project B, but as long as I'm polite about it, there's nothing wrong with it.

      I personally run Folding@Home because I think it will, overall, be more useful than (for example) SETI@Home or PrimeNet. Why? Well, PrimeNet will find large prime numbers, true, but the numbers themselves aren't all that useful. The only other result is an increased understanding of distributed computing projects. Now, that's a good thing, of course, but F@H provides that as well, and the research done by F@H is exactly the kind of large-scale, brute-force scut work that many medical advances are built on.

      With regards to SETI@Home, the goal is admirable, but from what I know, it seems far less likely to have any useful output than F@H. Again, it has the "increased understanding of distributed computing" aspect, like most distributed computing projects do, but the chance of any other reward is exceedingly slim. Finding aliens would be a tremendously important achievement, but I think that the likelihood is so small that it more than compensates for any advantage.

      Anyway, that's why I run F@H, and encourage others to do so as well. Obviously, the choice is up to the individual--but this is what I think, and I hope it will encourage others, as well.

      --
      "Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
    3. Re:Less wastefull by Anonymous Coward · · Score: 0

      We can either conclude from your posting that (1) you don't believe that there's life on other planets (and thus refute the ideas of just about every legitimate scientist, most of whom will at best say "I don't know"), or (2) you are in fact an alien, and attempting to cover up your existence in preparation for the alien invasion fleet. So, which is it, Guspaz? Or should I say, ZIM!?!?!?

    4. Re:Less wastefull by cduffy · · Score: 1

      ...or he could believe that SETI@Home's methods aren't likely to find alien life even if it *does* exist. I've heard it critiqued quite harshly -- though not being an expert in the field I'm not about to take either position myself.

  38. Is my box owned? by bcrowell · · Score: 2, Interesting

    Can anyone give any practical advice on how to figure out if your own system has been compromised? No, I don't have any tripwires installed :-(

    --
    Find free books.
    1. Re:Is my box owned? by arget · · Score: 2, Informative

      From the seti site:
      Note that to exploit this vulnerability, a potential attacker would have to trick the client into contacting a fake server rather than the actual SETI@home server. To our knowledge, no SETI@home client has ever been attacked in this manner.

      So it's unlikely you're owned from this. Some general tips to check your box's health:
      On linux, run `lsof -i` as root to see what kind of connections your box is listening for/has established.
      On windows, run `netstat -an` to see much the same.
      As always, monitor log files and bandwidth usage for suspicious activity or traffic spikes you didn't initiate.

    2. Re:Is my box owned? by Anonymous Coward · · Score: 5, Funny

      I went in and took a look around your system. All the files seem fine. I guess you're okay.

    3. Re:Is my box owned? by joedavis123 · · Score: 1

      "Note that to exploit this vulnerability, a potential attacker would have to trick the client into contacting a fake server rather than the actual SETI@home server. To our knowledge, no SETI@home client has ever been attacked in this manner.

      So it's unlikely you're owned from this. Some general tips to check your box's health:
      On linux, run `lsof -i` as root to see what kind of connections your box is listening for/has established.
      On windows, run `netstat -an` to see much the same.
      As always, monitor log files and bandwidth usage for suspicious activity or traffic spikes you didn't initiate."

      Another thing to check out if you think your box might be compromised, is your hosts file. Make sure you dont have a dummy hosts file that was put in your system that might redirect you to a different SETI@home server. Also if you run your own DNS server (or access one that is run by a friend, etc.) make sure all the security updates/precautions are in place to not allow someone to either poison your DNS cache (essentially rerouting your seti client to wherever they want). Or even easier, just use your ISPs DNS. Of course its not impossible that the same could happen to the ISPs DNS server, but I'm sure its much less likely.

  39. SETI fatal error by rebelcool · · Score: 1

    I got up this morning and SETI was reporting a fatal error i've never seen before - coincidence?

    --

    -

    1. Re:SETI fatal error by Anonymous Coward · · Score: 0

      I had that error, too, and I suspect that it was partially due to the fact that the server was done, causing a backlog and subsequent multiple collisions, and the fact that it was probably down so that they could put new server software up.

      I'm rather ticked that they didn't post a link on the web site to the new Linux executable; I had to come to Slashdot to read all about it. I regularly read Slashdot anyway, but it's very annoying that I'm being treated like a third-class citizen because I run Linux. I just started running setiathome about 3 weeks ago, and have already contributed over 120 units; I think they could have done a slightly better job at notifying us. After all, we are volunteers donating our time, and our electricity usage. I never used to leave my home systems on overnight, but started to when I decided to run setiathome. I may revisit that decision if things like this continue to happen.

    2. Re:SETI fatal error by Anonymous Coward · · Score: 0

      But you are a thirdclass citizen, you dirty smelly hippie.

    3. Re:SETI fatal error by rembo · · Score: 1

      Please consider again if you want to leave your computer on just for seti. This is contibuting to global warming. Is that worth a few extra packets? Of course you can do whatever you do, but running setiathome is at a cost of the enviroment in this way.

    4. Re:SETI fatal error by J3M · · Score: 1

      I also had an error, but everything see$#^&%&*$

      Greetings Earthlings. All your base are belong to us!
      Na-Nu, Na-Nu! Shazbot!

      --
      Aych tea tea pea colon slash slash slash dot dot org slash
  40. Time to retire C by Alomex · · Score: -1, Offtopic

    Seriously, with the kind of computational power that is now available even in a bottom-of-the-line gray-box PC the time has come to retire mainstream languages that do not have array bounds checking built-in.

    <rant>
    We are placing the entire computing infrastructure of the nation at risk in the name of a few measly clock cycles that would be spent performing bounds check.

    Engineers know that the only way to have realiable systems is to have substantial safety margins and backup systems. This is a lesson that we software developers ignore at our own peril.
    </rant>

    1. Re:Time to retire C by Anonymous Coward · · Score: 0

      If we retire "C", then we will be forced to change the entire language. Truly we will be left with the inability to spell "can't", "can", "copy-protection". Our lexicon will forever be altered. besides..b and d would look funny next to each other a.b.d.e. hahaha

    2. Re:Time to retire C by corvi42 · · Score: 1, Interesting

      There is nothing wrong with languages such as C, you just have to be aware of what you're doing. Good, safe, secure and efficient code is generated by educated programmers who are aware of what they're doing. You can't replace that with any computer generated stuff. Perhaps you'll be able to patch one security hole with something like this, but others will go unnoticed. The only solution is to make sure that coders are aware of what they're doing. IMHO languages that do more for you automatically create a sense of false security in that you assume that you can let the compiler / interpreter worry about what you should be thinking about yourself. It acts as a crutch for good programming habits, and so actually encourages sloppy programming. I think this is the opposite of what is needed for secure code.

      --

      There are a thousand forms of subversion, but few can equal the convenience and immediacy of a cream pie -Noel Godin
    3. Re:Time to retire C by Alomex · · Score: 1

      Good, safe, secure and efficient code is generated by educated programmers who are aware of what they're doing.

      Ah the typical real men need no bounds check argument. This is, of course, a bogus argument.

      In real life, people cannot be expected to be extra careful day in and day out. It's just not humanly possible. The long history of buffer overrun exploits proves this.

    4. Re:Time to retire C by Anonymous Coward · · Score: 0


      We need new moderation categories:

      Score +1: Takes gratuitous sideswipe at Microsoft

      Score -1: Claims that C/Linux is other than perfect.

    5. Re:Time to retire C by Jerk+City+Troll · · Score: 1

      Arithmetic according to C: float x = 3.14159; float y = 1/2 * x; Value of y? zero.

      You seem to hate this language quite a bit -- when it is just a language. A tool.

      Let me explain to you why y is zero. When performing math operations in pretty much any language, it casts to the operand of the lowest precision. Otherwise, you start dealing with arbitrary, unknown data. 1 and 2 are both integers, so they have no precision greater than what is defined. The computer cannot represent 0.5 as an integer value, so it becomes zero. Zero multiplied by any number is zero. See? :-)

      What amuses me about your post is your knocking a tool you don't really understand.

      --
      Join Tor today!
    6. Re:Time to retire C by Abcd1234 · · Score: 4, Insightful

      BTW, your sig makes perfect sense if you understand that, in C, straight numeric constants are assumed to be integers, and hence 1/2 is equal to zero. The obvious fix is to change that to 1.0/2.0. Gotta love it when people complain about non-issues...

      Incidentally, Java has similar rules, it's just more verbose when warning about type mismatches and loss of precision.

    7. Re:Time to retire C by corvi42 · · Score: 1

      I'm not saying that real men don't need a bounds check. What I'm saying is that a smart programmer will make appropriate use of a bounds check, or design objects / structures that handle this appropriately.

      In real life, people cannot be expected to be extra careful day in and day out, this is absolutely true. Because of this, they need reminders, and one very good reminder is when you get lots of errors and warnings during compilation & testing. If you become habituated to a programming environment which warns & gives errors often, you will develop better habits because you are used to seeing these everyday. Programming environments which are more flexible and allow sloppy code to go without warnings means that more code will be allowed to be in use before the problems that exist come to the attention of the coder.

      Essentially I'm saying that the sooner it breaks, the sooner it will be fixed. If it can go for weeks without breaking, then it is unlikely to be fixed, and this allows more security vulnerabilities to go on into production code, not less.

      I agree that intelligent systems which look for potential buffer overflows and report them to the coder are a good thing, and I fully advocate using such in development & testing, but languages and environments which hide the internals beneath a veneer of smooth operation are not a good substitute for knowing what you're doing.

      --

      There are a thousand forms of subversion, but few can equal the convenience and immediacy of a cream pie -Noel Godin
    8. Re:Time to retire C by Anonymous Coward · · Score: -1, Offtopic

      I also suggest another moderation category:

      -2, Another post that protrays Microsoft as the victim and claims to be holier than thou

    9. Re:Time to retire C by Alomex · · Score: 1

      People are so used to this design flaw that they can no longer tell that it is there. What would you say if I wrote a language in which the name of rebooting subroutine was say, "print"?

      Well the code in my .sig is no different. It looks like standard schoolbook arithmetic, hence the outcome should be a resonable approximation of it.

      Yes, Java has the same flaw as it inherited several C/C++ design flaws. In fact the bug can be traced back to Fortran.

      Pascal and the new version of Python, algol, modula and others don't have this flaw as they use div for integer division.

    10. Re:Time to retire C by Anonymous Coward · · Score: 0

      Let me explain to you why y is zero. When performing math operations in pretty much any language, it casts to the operand of the lowest precision. Otherwise, you start dealing with arbitrary, unknown data. 1 and 2 are both integers, so they have no precision greater than what is defined. The computer cannot represent 0.5 as an integer value, so it becomes zero. Zero multiplied by any number is zero. See? :-)

      Oh gee, thanks. I _didn't_know_that_.

      No siree bob. My comment could have nothing to do with the cognitive dissonance caused by elementary-school ingrained arithmetic rules being gratuitously subverted by C... By the way, the python designers identified this bug and are fixing it in the new version: integer division will be called "div" and "/" will behave like the standard arithmetic "/" (up to finite precision issues).

    11. Re:Time to retire C by Anonymous Coward · · Score: 0

      Huh? This is a crock.

      Operands are always (or should be) cast to the HIGHEST precision possible: float * double = double, int * long = long, etc etc.

      1/2 is zero because in C, the '/' operator is overloaded to mean floating-point division for floating-point operands, and integer division for integral operands. Many other languages use different names for these operators (eg, in Pascal, its '/' for floating-point divide and 'DIV' for integer divide).

      This is arguably a case of misleading overloading, for people not familiar with C. It has nothing to do with typecasts.

    12. Re:Time to retire C by Anonymous Coward · · Score: 1, Interesting
      Actually, I think he has a point. There are too many "programmers" out there who think that writing obscure code in C is somehow macho. It's not - it's geeky, and damn geeky, too - and not in a "good" way, but in a pocket-protector kind of way. While you can do some truly funky stuff in C, and that in turn is useful if you're writing Doom 3, how much of it is really necessary when you are coding a backend for an RDBMS?

      As someone else points out, careful programmers catch their mistakes in C. Unfortunately, most programmers aren't careful. So we can either institute an apprenticeship system for programmer wanna-bes, or do the cheap and less political thing, and use better tools for the job. C is just a tool, and it's not always the best. I write in C, and Pascal (well, Delphi/Kylix these days), and COBOL, and Perl, and sometimes even Visual Basic if I need to knock off some proof-of-concept prototype in Windows. I've worked in Java, C++, four or five statistical languages, several variations of assembler and machine language, and dabbled in Ada, Turing, APL, Fortran, and several scripting languages. And when I go to write a new program, my first instinct is not to fire up GCC. Too many people do, though, and that's why we get crap programs that do stupid things like allow buffer overruns.

  41. It's a sign of alien intelligence by fastdecade · · Score: 1

    How do we know aliens don't communicate by propogating buffer overruns throughout the planet? Has anyone analysed this code, if it is indeed out in the wild?

    There's gotta be more to extraterrestial life than mutilating cows and doing donuts in crop fields.

  42. Folding@home by hoagieslapper · · Score: 2, Insightful

    Does anyone know if this exploit effects folding@home clients? I do not know if they use the same engine or if the '@Home' name is the only thing they have in common.

    1. Re:Folding@home by arget · · Score: 3, Informative

      Folding and Genome have the same codebase as each other, which is separate and distinct from Seti's.

      They may or may not have similar vulnerabilities, but since none are open source, there's no way for us to know. All the same, I wouldn't worry about Folding or Genome any more because of the seti exploit. I'm still genoming.

  43. Whew! by Faust7 · · Score: 4, Funny

    Good thing the 20 computers I'm running it on aren't even mine!

    --
    The coolest voice ever.
    1. Re:Whew! by LucidityZero · · Score: 4, Funny

      I've found that high-priority, production government web servers process my SETI data much quicker than at home!

      --
      Sig.i>
    2. Re:Whew! by Loki_1929 · · Score: 1

      I find myself wondering if any of the machines involved in Echelon are running Seti or Distributed.net.

      --
      -- "Government is the great fiction through which everybody endeavors to live at the expense of everybody else."
    3. Re:Whew! by Anonymous Coward · · Score: 0

      That's because at home your running Echelon Crackmaster 4.6b. If you remove it from your system, you will be "disappeared", following the rules set up in the USA PATRIOT Act.

  44. Arrgh! by Anonymous Coward · · Score: 0

    It's not I-Book - it's iBook.

  45. besides... by 10Ghz · · Score: 1

    What gave you the idea that Seti@home is "waste"? It could bring humanity the greatest revelation there is. And besides, S@H-data is used in variety of scientific projects, not just hunting aliens. And finally: S@H was the forerunner of these kinds of projects. It showed what could be done and how to do it. Without S@H your precious folding@home wouldn't even exist. S@H was the first, it showed others the way.

    --
    Lesbian Nazi Hookers Abducted by UFOs and Forced Into Weight Loss Programs - -all next week on Town Talk.
    1. Re:besides... by Guspaz · · Score: 1

      Oh please. Do you really think if your precious seti@home hadn't come along, nodody else would have tried to create a distributed computing client? Don't fool yourself.

      As for your supposed revelation, I'll believe it when I see it. I think it more likely that we'll all be dead before it produces any results.

    2. Re:besides... by 10Ghz · · Score: 1
      Oh please. Do you really think if your precious seti@home hadn't come along, nodody else would have tried to create a distributed computing client? Don't fool yourself.


      propably. But the fact is that S@H was first. That alone makes it worthwhile project: for the sole reason of showing that distributed projects of this nature could be done. Whether you like it or not, Folding@home and others owe their existence to Seti@home.

      As for your supposed revelation, I'll believe it when I see it. I think it more likely that we'll all be dead before it produces any results.


      That may be. So? Seti@home will propably never find aliens. But I don't care. There still is a possibility that they will succeed. Odds are against them, but if they pull through, it is the most important discovery there could be IMO. And that is the reason I do it.

      And where are the benefits from Folding@home? I haven't seen any headlines saying "Internet-project finds cure for cancer!". It could very well be that F@H will never achieve anything. Seti@home has acvieved something: it brought projects like these to the limelight and showed that it could be done. And that's alot more than what F@H has achieved.

      I don't go around telling others that they should drop the projects they are involved at, and run Seti@home instead. and I would appreciate if you did the same.
      --
      Lesbian Nazi Hookers Abducted by UFOs and Forced Into Weight Loss Programs - -all next week on Town Talk.
    3. Re:besides... by GMontag451 · · Score: 1

      If the SETI project as a whole was going to succeed, it should have succeeded in the first 10-15 years or so. It didn't. The only two likely possibilities for alien life is that it is either everywhere or nowhere. Anything else would mean that the alien life happened to develop at just about the same time that we did, which is exceedingly unlikely. Since we have scanned a statistically significant portion of the sky for signals and found nothing, either the techniques we are trying to use for detection won't work (i.e. the aliens use some form of communication other than RF), or the aliens simply aren't out there. Either way, SETI is pretty much useless, and should at the very least take a backseat to other more important scientific projects.

    4. Re:besides... by 10Ghz · · Score: 1
      Either way, SETI is pretty much useless, and should at the very least take a backseat to other more important scientific projects.


      Let me guess: you personally run one of those "scientifically more important" projects? And like I said, S@H is used on other projects besides hunting aliens. If I recall correctly, Stephen Hawking uses their findings in his Black Hole research.
      --
      Lesbian Nazi Hookers Abducted by UFOs and Forced Into Weight Loss Programs - -all next week on Town Talk.
    5. Re:besides... by Jonathan_S · · Score: 1
      propably. But the fact is that S@H was first. That alone makes it worthwhile project: for the sole reason of showing that distributed projects of this nature could be done. Whether you like it or not, Folding@home and others owe their existence to Seti@home.

      As far as I can tell by looking at the Seti@home history page the project started in October 1998.
      Distributed.net began their first distributed project, the brute force discovery of an RC5-56 bit key, on January 28, 1997.

      So it appears that Seti@home was not the first of the distrubuted computing projects; however I will grant you that it is by far the best known.

    6. Re:besides... by GMontag451 · · Score: 1

      I don't run *any* scientific projects, as I am not a scientist. I was talking about SETI, not S@H. They are two different things, you know.

    7. Re:besides... by Anonymous Coward · · Score: 0

      Well then, you're offtopic, both on the article and the thread, so shut your pie hole. No one's talking about SETI-the-org here.

    8. Re:besides... by Anonymous Coward · · Score: 0

      Adn that's the point. It brought distributed computing to the masses. It did so with pretty graphics, press coverage, and no fuss install and running. Perhaps one day they will be credited with enabling the widespread usage of such technology for commercial or other purposes it's not currently used in, making it accaptable, as opposed to a fringe theory no one takes seriously.

  46. you know what we need... by blankmange · · Score: 1

    and just where is Jeff Goldblum when we need him; we could ask him to write up a virus on his Mac and just let it sit there on our hard drives and when the aliens get to that file: BOOM!

    --
    ...we are from the government - we are here to help...
  47. Where can I get such a server? by rice_burners_suck · · Score: 3, Funny

    Where do you download the software for warez servers and DoS clients? I know some people who have old DOS programs that they need to run for their business, and they also need a warez server to search for stock quotes online and tell them "ware" they are.

  48. Just what we have searching for: by blankmange · · Score: 1
    Now that we have all these distributed computers running the same software that can be hacked/exploited... we can now stop looking for our Beowulf clusters -- just rewrite...

    nevermind, that was stupid....

    --
    ...we are from the government - we are here to help...
  49. Funny their latest email didn't recommend update by redwoodtree · · Score: 1

    I got spam from seti@home encouraging me to run the client again on March 21st, but nowhere did it mention this security problem even though they knew about it back in December or Janauary.

    This seems pretty irresponsible to me. Notice they say in the email, you "can" download the software, they should have really said you _should_ download it!

    This is an exciting time for SETI@home. On March 18-20 2003 we travel to the Arecibo radio telescope to re-observe the most promising "candidates" produced by our search so far. There is a chance that these new observations will yield the first real evidence of extraterrestrial life. Thanks for being part of this history-making effort! According to our records, you have processed 44 work units, the most recent on October 27, 1999. Your contribution of computer time to SETI@home is greatly appreciated. If you have taken a break from SETI@home, now is a great time to start up again; you can download the latest software ...

  50. Re:Linux/Solaris client is there, if you dig aroun by babbage · · Score: 1

    Is it safe to assume that the command line version for other platforms will take similar URLs? The presumed OSX version at ftp://alien.ssl.berkeley.edu/pub/setiathome-3.08.p owerpc-apple-darwin1.2.tar, and the presumed WinNT version at http://wcarchive.cdrom.com/pub/setiathome/setiatho me-3.03.i386-winnt-cmdline.exe, both don't work yet. (I got these urls by hand editing the links on the Unix download page to replace 3.03 with 3.08, so I'm assuming that the new versions will be consistent with what was already there.) Maybe these links will work by the time you read this, but as of now (2:30 pm EST) they haven't been updated yet.

    --
    DO NOT LEAVE IT IS NOT REAL
  51. Mother of all exploits... by lildogie · · Score: 1

    As I've commented before, I'm intrigued that we have our planetary computer network hooked up to an open port on a radio-telescope. Hoping for a superior alien race to send us e-mail. What if they also have alien computer viruses?

    Gives new meaning to the honeynet concept.

  52. Four months.... by Anonymous Coward · · Score: -1, Redundant
    checkout the "Timeline" in the linked article (I'll repeat it here in case it gets slashdotted)

    2002/12/05 Information leakage discovered.
    2002/12/14 Bufferoverflow in client discovered.
    2002/12/31 Seti@home team contacted through their website http://setiathome.berkeley.edu/help.html.
    2003/01/07 Seti@home team contacted again.
    2003/01/14 Bufferoverflow in server discovered.
    2003/01/21 Seti@home team contacted again, this time through email.
    2003/01/21 Seti@home team confirmed the problem.
    2003/01/25 Seti@home team promissed fixed version are being build.
    2003/02/03 Seti@home team informed me about problems with the fixes for the win32 version.
    2003/04/06 New Seti@home clients available, advisory released.


    This advisory came 4 months late. While I'm glad this person contacted Seti first before releasing the advisory, I cannot believe that it took them two months to fix a bufer overflow! While seti@home isn't a mission critical app, I would think the seti people would want to release a new version very quickly, at the very least so that they know that their personal omputers can't get exploited.
  53. Re:So there weren't really 18 new jupiter satellit by Ciderx · · Score: 1

    Yep, see that news story? "NASA were proud to announce the finding of 18 more satellites around Jupiter. They said, It is thought that 3 of these, w00t, l33t and h4x0r, may be capable of sustaining life. Soon after the announcement, analysts were sceptical that whilst these planets may contain life, they would not be socialable creature who use a similar form of communication to humans"

  54. timeline by Gaccm · · Score: 4, Informative
    checkout the "Timeline" in the linked article (I'll repeat it here in case it gets slashdotted)

    2002/12/05 Information leakage discovered.
    2002/12/14 Bufferoverflow in client discovered.
    2002/12/31 Seti@home team contacted through their website http://setiathome.berkeley.edu/help.html.
    2003/01/07 Seti@home team contacted again.
    2003/01/14 Bufferoverflow in server discovered.
    2003/01/21 Seti@home team contacted again, this time through email.
    2003/01/21 Seti@home team confirmed the problem.
    2003/01/25 Seti@home team promissed fixed version are being build.
    2003/02/03 Seti@home team informed me about problems with the fixes for the win32 version.
    2003/04/06 New Seti@home clients available, advisory released.


    This advisory came 4 months late. While I'm glad this person contacted Seti first before releasing the advisory, I cannot believe that it took them two months to fix a bufer overflow! While seti@home isn't a mission critical app, I would think the seti people would want to release a new version very quickly, at the very least so that they know that their personal omputers can't get exploited.

    Bah, forgot about a username.
    --

    Only dead fish swim with the stream...
    1. Re:timeline by John+Hasler · · Score: 2, Insightful

      > This advisory came 4 months late. While I'm glad
      > this person contacted Seti first before releasing
      > the advisory, I cannot believe that it took them
      > two months to fix a bufer overflow!

      Shrug. Closed source: what do you expect?

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    2. Re:timeline by Anonymous Coward · · Score: 0

      That also explains why the client works so well, and has clearly labelled error mesages, and a help file.

  55. You have no idea what you're talking about by BlackTriangle · · Score: -1

    Go chase some girls.

  56. No: the government is! Re:Aliens exploiting? by Anonymous Coward · · Score: 1, Funny

    They are covering their tracks. How else could you explain this suspicious lack of alien signal evidence after all of these years of searching? This is a coverup of galactic proportions.

    I am risking my life by sharing this with you, but someone must speak out before it's too late!

    There ARE no such things as aliens. The real coverup is that the government has been manipulating the public to accept that there may be aliens, and is using that to get funding and public support for sinister military projects that, otherwise, would be difficult to run.

    Seti@Home is the most recent, and diabolical, of them all. Hundreds of thousands of people have been conned into believing that they're actually searching for "alien communications." The truth is that they're processing massive amounts of data, fed directly to the Arecibo dish by the military as part of a massive attempt at global mind control / thoughtcrime detection.

    The signals being processed are actually brainwaves of the billions of people on the planet. Currently, they are researching normal brainwave activity in the global population and experimenting on a select group of individuals using weather satellites to beam mind control signals directly into their skulls. Once phase 1 has been completed, they will being experimenting with lightly controlling the minds of a whole country or continent. Finally, total control of the world population will take place.

    1. Re:No: the government is! Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      Weather satellites? Most mind control does happen with satellites, but they're more along the lines of C and Ku band. You know, the ones that carry CNN, Fox News, NBC, ABC, CBS, and so on.

      If you doubt me, watch a randomly-chosen hour of prime-time programming and see what happens.

      Note: I'm not a 'kill your TV' wacko. I'm merely a 'network television sucks a big one' wacko.

    2. Re:No: the government is! Re:Aliens exploiting? by Anonymous Coward · · Score: 1, Funny

      Frighteningly, I find the prospect of mass mind control more comforting than the idea that people are really this stupid on their own...

    3. Re:No: the government is! Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      Weather satellites? Most mind control does happen with satellites, but they're more along the lines of C and Ku band. You know, the ones that carry CNN, Fox News, NBC, ABC, CBS, and so on.

      You're misunderstanding... Communications satellites and aiwave broadcasting stations merely transfer audible and visual mind control data from one location to another using a harmless signal. Without a decoding device (television, radio) the signal has absolutely no way to control you.

    4. Re:No: the government is! Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      I find the prospect of mass mind control more comforting

      So, they've gotten to you already? You are willing to accept your lot in life: slave to the Great Overlord and Protector of the Freedom Under the Controlling Kakistocracy Society. Surely, it is a sad, sad day.

    5. Re:No: the government is! Re:Aliens exploiting? by Anonymous Coward · · Score: 1, Funny

      that'll teach me to buy store-brand tin foil...

    6. Re:No: the government is! Re:Aliens exploiting? by C0LDFusion · · Score: 2, Funny

      Thoughtcrime?! More newspeak. Your duckspeak betrays total blackwhite to the prolefeed-quality conspiracy theories. There is no cabal. Crimestop immediately for masshappy.

      --
      Only in slashdot are posts of solidarity modded at -1 Redundant, while posts of antagonism are modded as -1 Flamebait.
    7. Re:No: the government is! Re:Aliens exploiting? by Anonymous Coward · · Score: 0

      Personally, I always travel in a Faraday cage...

  57. ODDS? by saskboy · · Score: 0, Offtopic

    The odds of my computer being tricked into contacting a fake SETI@home server, are about as slim as they are of me finding alien life.

    --
    Saskboy's blog is good. 9 out of 10 dentists agree.
  58. Ever reuse code? by iamacat · · Score: 1

    Then you might write a quick and dirty function that calls sprintf to format a message (snprintf is not portable, so you might not have a simple fix). Then after a while you forget that it was quick and dirty and use it in a client that will only connect to your own server. I think its a very easy mistake to make. It gets more interesting. Say you are reading a 1024 bit number that is supposed to be a product of two 512 bit primes. Your code has a hand-optimized assembler loop that will not violate bounds of a fixed-length array if the number is what it's supposed to be. But if it has small factors, the loop might blow away the memory. On the other hand, checking the bounds would make your performance-critical loop twice slower. Still think it's easy to validate the input?

    1. Re:Ever reuse code? by ComputerSlicer23 · · Score: 5, Informative
      Curious, this reminds me of the story about Cray computers. Seymour Cray put in a very, very fast circuit to do additions I believe (specifically to add 1). The circuit also gave the wrong answer if the input was one specific value, he could have fixed it, but it would have been a longer delay, and well being right in all but one case was acceptable to him. Well eventually people reported this as a bug, but he claimed it was a feature. It was such a well known bug, that everyone coded around it. They put the check in, and put the special case code in to handle it. Turns out this took much, much longer to do then if Cray had just put in a correct circut.

      I suppose if it's documented to only work in certain cases, that's acceptable, however, the the code that calls it without checking for the input is then broken, and buggy. It should be fixed. If it can't be checked before calling the functionality, then the functionality better work for all inputs. That's good software. Stuff that just assumes that unsafe input will never, ever be put in, is a bug. A security hole. It's not reusable code. Reusable code, checks inputs. Reusable code fails gracefully. Reusable code, returns error codes indicating invalid inputs. Reusable code doesn't have security flaws in it.

      Distributing code that won't handle all input cases for use in a public distributed computing project for the sake of speed is irresponsible, and stupid. Now, I'm a lot more likely to just never run one of the distributed projects then to risk security flaws if they are willing to sacrifice security for their speed. Security should be the winning factor in all concerns when writting software. When trading security for speed, is an option don't take it. Security or ease of use, take security. Security or correctness, re-write the software using a new protocol, or new algorithm, but still take security and document the correctness flaw. Right now I only run them on machines that don't have any valuable information on them, but I'd prefer they not be used in a DDos, so it'll probably get stripped off all my machines.

    2. Re:Ever reuse code? by HiThere · · Score: 1

      I suspect that this is obvious, but...
      You advice is good, within limits. Even Eiffel, with all it's DBC constructs, and nigh unto paranoid type checking allows you to turn off the security checks to produce optimized code. Of course, it also allows you to specify just which modules you will optimize, and which you will leave full error checking enabled in. This seems, to me, a reasonable compromise. The stuff that is only called by your code, you can be reasonably sure of, after you finish you debug cycles. The code that takes input from outside you never can be sure of.

      But reasonably isn't a well defined term, so I can understand you use of the universal. It's just that people are so likely to write something like that into stone, and ignore the costs. You made a good case that Cray made the wrong decision, but this doesn't mean that that *kind* of decision is always wrong. You just need to bound it more carefully. (OTOH, this is like the year 2000 crisis. Most people never expected their code to live that long. So they didn't guard against it. So this argues your case. But there are *real* tradeoffs here.)

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    3. Re:Ever reuse code? by Anonymous Coward · · Score: 0

      Holy crap, "Eiffel" and "optimized" in the same sentence.

      LOL. Eiffel has no performance, there is not point in "optimizing" it... pffft, that's like "optimizing" a shell script.

    4. Re:Ever reuse code? by cduffy · · Score: 2, Insightful

      pffft, that's like "optimizing a shell script.

      Don't laugh too loud.

      There's always room for optimization, particularly in terms of the algorithms used. Sure, one may lose 3x the speed due to the implementation details -- but if one gets back 10x the speed by switching to a more efficient algorithm, it's still a net win. (In particular, I recall writing a clever Python implementation of a function which outperformed a naiive C implementation by about a hundredfold).

      Further, just because bash is slower than dirt doesn't mean that's true of all shells -- ash, for instance, is much faster.

      To get back on track, btw, I'm inclined to agree with the call that code with bugs or unhandled corner cases introduced for purposes of performance, footprint or whatever should never be considered reusable unless each of those unhandled cases is reviewed before each reuse -- and only rarely even then.

  59. setiathome-3.08.i386-winnt-cmdline.exe? by diesel_jackass · · Score: 1

    anyone know if there's a new version of the windows command-line client? all i could find is the ancient setiathome-3.03.i386-winnt-cmdline.exe. i tried exploring a couple of the ftp servers with no luck.

    anyone able to locate a newer version or am i stuck running the crappy gui?

    --
    THERE IS NO DATA. THERE IS O
  60. lmao, gotta love it by ziplux · · Score: 1, Insightful

    If this was a microsoft hole, slashdot would be jumping all over it. "MS sucks! Look at these security holes! Waa! I'm gonna go cry about it now, even though they patch them quickly!"

    I know a lot of people hate MS, especially the slashdot/open source community. But at least be fair....why is it so egregious for MS to have a few security holes where any other company would be cut some considerable slack? Like Seti@Home for example. No piece of software is perfect, open or closed.

    1. Re:lmao, gotta love it by Anonymous Coward · · Score: 0

      SETI@Home isn't a company and you didn't pay anything for it.

      Troll score: D+

  61. That's not how Seti@home works by Treeluvinhippy · · Score: 1

    The client connects to Seti@home's servers and downloads a 'work packet'. This packet is stored locally and when analysis is complete the results are uploaded to Seti@home.

    --
    >
  62. On the other hand by xenocide2 · · Score: 1
    First, a small note: I find it conforting that even GCC ignores the compiler warnings offered by gcc. Very rarely does anything useful come of these warnings.

    I'd rather have a program that defaults to an uncaught exception and program crash to one that is instead vulnerable. One is somewhat more dangerous than the other, though an uncaught ArrayOutOfBounds or whatnot exception isn't perfect and still results in program crashes.

    Indeed the sooner it breaks the sooner it will be fixed in normal applications distributed to society at large. And if you know what you're doing and are ever vigilant you can perhaps avoid these sorts of errors. But its becoming increasingly clear that few and fewer know what they're doing behind that veneer, while still choosing C/C++ because its the standard. To fix this, we can either educate these people in the way of the code warrior or they can select another language. There's an entire body of information on the way of the warrior, so perhaps another language is indeed a viable option. Java actually implements an array class that throws your suggestion of an intelligent object/class built into the library.

    Microsft has chosen C#, or Managed C(++). Universities have chosen Java. I'd love to see enterprise level support for OCaml personally, but I think that's doubtful. Stateful inspection of possible overflows is a long way from being complete. It seems a lot of research at my university is focused on such stuff.

    --
    I Browse at +4 Flamebait

    Open Source Sysadmin

    1. Re:On the other hand by Anonymous Coward · · Score: 0

      The problem with O'Caml is the awful syntax. It would have been much better if they had just stuck with SML syntax. But that's what often happens with things that come out of academia. Real-life use is usually not the primary goal of such projects, mostly due to lack of experience on the part of the developers.

      And the "object" part of O'Caml is painfully slow compared to the rest of the language constructs. I'm not even sure if they really need object oriented stuff in there at all. I've seen some really nice and large functional programs that use no object oriented items.

      Yes, I know you can change O'Caml's syntax, but as we all know, they default is what gets used. Nobody is going to change the syntax because then you'll be integrating code from all over and everything looks different. Not good.

    2. Re:On the other hand by xenocide2 · · Score: 1

      What is wrong with OCaml? A small note: Caml came before SML of NJ, so INRIA didn't break the mold intentionally. I haven't written any SML code but from what I've seen there isn't much difference. And it's not like SML is somehow nonacademic, being handled by Princeton, Yale, Lucent and AT&T Research.

      I agree that the OO part is kludgy, but in reality rarely used. Its there, but nobody's forcing you to use it (well, maybe a PHB). I personally use tuples and sum types to mimic the important part of polymorphism. Next semester I anticipate finding out more of SML, as the Formal Language Theory teacher came from Princeton. But a somewhat inclusive programming language comparison done by Doug Bagely suggests that OCaml is somewhat faster on most occasions.

      Of course, if such languages are going to be widespread, its because it has a decent IDE. Perhaps F# should be the guy to bet on then ;)

      --
      I Browse at +4 Flamebait

      Open Source Sysadmin

  63. And a very special... by JemalCole · · Score: 0, Flamebait

    And a very special "fuck you" to Taco for complaining about there being nothing worth posting today.

  64. Manager's case of "told me so!" by Chester+K · · Score: 5, Insightful

    This is the reason employers have problems when their employees run Seti@Home (and indeed, any unauthorized software) on their machines.

    As an IT professional, you talk and talk and talk and talk trying to warn your superiors of the danger of running unnecessary network services -- why you can't just open the firewall wide up to let them use their proprietary stock-tracking application; hell, why you even have a firewall in the first place.

    And then Seti@Home, the ultimate nonessential network service, comes along and validates everything you've been saying. But you're running it anyway, because it's "cool". And now your network is compromised.

    Should have taken your own advice.

    --

    NO CARRIER
  65. Re:Linux/Solaris client is there, if you dig aroun by Thomas+Wendell · · Score: 4, Informative

    You can just FTP to ftp://alien.ssl.berkeley.edu/pub/ and see for yourself what's there.

    When I checked, the only 3.08 versions available were the GUI versions for Windows and Mac OS 9 (not OS X), and the two command line versions mentioned above (x86 Linux and Sparc Solaris). The ones I personally care about, the command line versions for WinNT and OS X, were not there yet.

  66. patch stole my workunits! by Anonymous Coward · · Score: 0

    before installing the patch, I had 441 workunits. now it says I have 240. Anyone else experiencing this?

    1. Re:patch stole my workunits! by Anonymous Coward · · Score: 0

      damn, nevermind, just logged out and back in and it was restored to 441. still kinda curious why that happened...

  67. Public Machines by mikeage · · Score: 4, Insightful

    So... for those people who installed Seti on 100 machines at school/work, are you updating them RIGHT NOW? One guy where I am put Seti on a bunch of cluster machines because, after all, no one else is using them. I certainly hope that he's working unpaid overtime patching his (against the rules) pet project.

    --
    -- Is "Sig" copyrighted by www.sig.com?
  68. Possible alternative... by burns210 · · Score: 1

    For thouse looking for an alternative, there is always distributed.net.

  69. Just link to them by wbean · · Score: 1

    I shouldn't think we'd need anything very elaborate for a DoS attack on the aliens. Just link /. to them.

  70. I know what's really going on, Stuart by dillon_rinker · · Score: 0, Flamebait

    It's the queers. They're in it with the aliens. They're building carefully crafted packets to remote control the SETI client for gay martians. I swear...

    1. Re:I know what's really going on, Stuart by Anonymous Coward · · Score: 0

      And have you seen what they're doing to the soil?

  71. Not as bad as it might sound by eheien · · Score: 2, Insightful

    This exploit really isn't as bad as people here like to make it out to be. In order to perform this buffer overrun, you would have to trick the S@H client to connect to a different server. Short of actually breaking into the host computer of the client, I believe this would prove extremely difficult (anyone know how to do this?).

    And as was mentioned in the advisory, there has been no reported case of this actually being exploited (outside of proof of concept of course, where the discoverer changed the S@H server address in the client itself).

    1. Re:Not as bad as it might sound by Anonymous Coward · · Score: 0

      poison the arp tables.

      easy on a lan, not so easy on the internet.

  72. Why choose? by gad_zuki! · · Score: 1

    I've contributed lots of cycles to many DC projects. A little while ago the people from UD and SETI were talking about making one screensaver that allows you to pick and choose what projects you want to contribute to.

    Some of the proposed features were switching to another project after finishing a WU, auto updates, ad hoc teams, simultaneous DC use with custom priority, etc.

    I wonder what ever happened to that idea. It sounded great. It would also give not so famous groups a chance to write their screensaver using the API, script, or however the one-screensaver-to-rule-them-all DC client works.

    It would be nice to be able to see a list of projects from students asking for a group to do the math for them. How cool would offering your team's PC power to the local high school doing a simple DC experiment?

    In the meantime the big boys rule. That's not bad, but it could be better.

  73. "instant Wi-Fi community" software (P2P) by napsterposter · · Score: 0

    interesting concept, anyone tried this out? http://www.trepia.com/

  74. Re: 366 Toshiba synchronicity by TeknoHog · · Score: 2, Interesting
    This is pretty awesome. I too started S@H in 1999 on a 366MHz Toshiba laptop (Satellite 2060CDS, K6-II), which was also my first Linux machine. I managed to crunch about 200 workunits until I got tired of the fan noise. It's worse than any desktop fan or HD noise.

    In addition, I noted how the S@H team seemed to neglect optimizing the client, so I got into other projects. S@H sucks particularly on the K6. My P2-350 runs it over twice as fast as the K6-2 of similar MHz, partly because it can use the 686 optimized version.

    I still prefer S@H over things like distributed.net; the latter poses purely mathematical problems, which IMHO should not be bruteforced. The RC5 crack is plain silly, and the OGR is something that might be 'solved' by other means some day. In addition, things like protein folding could use a proper theory, as you can only bruteforce individual cases. But there's no scientific shortcut in SETI, you just have to keep looking.

    --
    Escher was the first MC and Giger invented the HR department.
  75. Command Line uneffected by digitalgimpus · · Score: 1

    I guess the command line versions are uneffected... They are still at version 3.03 AFAIK.

    1. Re:Command Line uneffected by diesel_jackass · · Score: 1

      Confirmed remote exploitable:
      setiathome-3.03.i386-pc-linux-gnu-gn ulibc2.1
      setiathome-3.03.i686-pc-linux-gnu-gnulib c2.1
      setiathome-3.03.i386-pc-linux-gnulibc1-stati c
      setiathome-3.03.i686-pc-linux-gnulibc1-static
      setiathome-3.03.i386-winnt-cmdline.exe
      i386-unkno wn-freebsd2.2.8 (Special thanks to Niels Heinen)
      SETI@home.exe (v3.07 Screensaver)

      --
      THERE IS NO DATA. THERE IS O
  76. Another odd point... by Cyno01 · · Score: 1

    After 50 years the aliens hadn't inovated at all. The craft that crashed at roswell in '47 was the same ones they used to attack earth with in the late '90s(i dont remember what year the movie came out). We have new fighters every few years, wouldn't the aliens have made some progress over 5 decades?

    --
    "Sic Semper Tyrannosaurus Rex."
  77. ET Phone Home by melangeboi · · Score: 2, Funny
    More like ET DoS home!

    THE SLANT

    --
    The Slant
  78. Lightbulb by bedouin · · Score: 1

    You've actually sparked a great idea.

    A kind of software book exchange club. A client (kind of p2p in nature) that randomly uploads and downloads a new piece of software every couple days. You never know what you're gonna get, and you have no say in what you send the other person. There's no personal interaction at all. You could get an mp3.. or an iso. However, you could limit your downloads to say, Mac, PC, or Linux.

    Anyway, I think this would be cool. p2p, but with no say in what you send or receive. Open your "received" folder every morning and look at what you got. Maybe it's an mp3 that absolutely sucks -- or maybe a really cool app you never knew existed. Or maybe just a really funny picture.

    1. Re:Lightbulb by Taos · · Score: 1

      [flips on computer in the morning]
      "Oh my god! Why is my hard drive full of geriatric lesbian donkey porn!?!?"

      I'm going to shoot this idea down right now. Go to the back of the line. Please try again.

    2. Re:Lightbulb by bedouin · · Score: 1

      That's the thing, since it only happens once a day, you don't get a bunch of crap. C'mon, you wouldn't find that amusing, at least once? You wouldn't see the comedy in getting like, a Rob Zombie mp3 one day, then one from Barbara Streisand? Then the next day get a picture of some dork's turbocharged Dodge Neon with really (what he perceives to be) cool spoilers? Then the next day you get UT2k3.

      Think of it as digital dumpster diving.

  79. Re:Linux/Solaris client is there, if you dig aroun by bluephone · · Score: 1
    Soemone mod this guy up. I couldn't find the CLI version for Win32, looked at the comments, and this guy answered my question. This is why we have mod points. Rather than mark that next lame joke as "Funny" toss this guy a point for "Informative".

    Sadly, when I have mod points, I can't find these informative posts. :)

    --
    jX [ Make everything as simple as possible, but no simpler. - Einstein ]
  80. Will they start rejecting the older clients? by Anonymous Coward · · Score: 0
    Quite frankly, that would be the best way to clean this up. They did this once before for one of the older versions... after a certain date the server won't supply the client any new data.

    If they do this, then all those unpatched clients will stop working, and people running them will have to either (a) figure out how to get a new client or (b) stop running the existing client, both of which fix the exploit problem.

    Does the client have facilities for informing the user of things like this? Like, can the screensaver replace the graphic with "please download a new client"? Otherwise if people get "cannot connect to server" over and over they might just get stupid and give up.

    Of course, if they do this, SETI@HOME might actually lose half the current number of computers giving them data, if they would actually consider that useful or not.

  81. MODERATORS ON CRACK AGAIN? by Anonymous Coward · · Score: 0

    How is talking about SETI@home offtopic in this story?

  82. SETI@work by rjamestaylor · · Score: 1
    It's bad enough that a remote hole in SETI@home, but this client is not intended to run on production servers; ergo, SETI@home.

    Worse is the reality that, in an effort to help the SETI find an extraterrestrial Yeti (or just to rack up points for geeky ego-boost) it is not too uncommon for junior admins to install SETI clients on fat production servers (I'm confident of the 'junior' status of such admins because even if they are otherwise 'senior' admins this busts them back down to junior status).

    In fact, I recall being hired in July of 2001 by a small web design/ecommerce company to work on a new project for a pharmaceutical company to lead their development team. Now, anyone who knows me knows I'm not a sys admin, but I know enough to crash really big systems ;). So, having been entrusted with root on the firms production servers I snooped around and, you guessed it, found SETI@home running on them racking up points for one of the members of the firm.

    These servers were being used for credit card processing for ecommerce sites and were scheduled to be used for processing prescriptions and HIPAA-sensitive patient data (they weren't at this point; remember, I was hired for that project and found SETI during an initial server assessment--but these admins knew the purpose of these servers).

    So, without ceremony or fanfare I killed and deleted SETI along with this admin's user account. Being new I didn't outright fire the moron but I did recommend strongly that this loser be tossed, which he was within a month.

    • SETI@Home -- Don't try this at work
    --
    -- @rjamestaylor on Ello
    1. Re:SETI@work by Anonymous Coward · · Score: 0

      Oh aren't you just so '1337?

      Fuck you

    2. Re:SETI@work by rjamestaylor · · Score: 1

      "1337"? Hey! I'm not a day over 40!

      --
      -- @rjamestaylor on Ello
  83. its Monday and still no patches for non gui client by rednuhter · · Score: 1

    its Monday and still no patches for non gui clients.
    "Oh sh*t there goes the the planet"

    --
    ERR 411[Max number of witty sigs reached]
  84. Re:Linux/Solaris client is there, if you dig aroun by AvitarX · · Score: 1

    I thought we had them to moderate posts like your as redundent or offtopic.

    and posts like this one (mine) as trolls.

    oh well, to each his own.

    --
    Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
  85. Well, if you want something noble... by Theaetetus · · Score: 1
    Honestly, why do people feel the need to be snobbish about how they use their spare CPU cycles?

    Well, if you want a noble goal for your spare cycles...

    Give 'em to Google!

    Seriously, though - this is a distributed program to find protein folding solutions, that could eventually be used for creating new medicines... Plus, it's run by everyone's favorite search engine!

    -T

  86. Re: 366 Toshiba synchronicity by Anonymous Coward · · Score: 0
    distributed.net; the latter poses purely mathematical problems, which IMHO should not be bruteforced.

    That's a rather narrow viewpoint. You don't think finding, say, primes, even one at a time, has any value, and we must wait for a mathematical solution for calculating any given one?

  87. Re: Yep, it took 2 months to fix. by SETIGuy · · Score: 1
    I cannot believe that it took them two months to fix a bufer overflow!

    Shrug. Closed source: what do you expect?

    Actually, much of the delay was due to the fact that all of our non-Solaris clients are ported and tested by volunteers whose available time to put toward such things is limited. (On a properly set up SPARC solaris machine, the bug doesn't result in a vulnerability by the way.)

    The primary bug was fixed by me prior to 1/25/03, at which point the code was sent to the porters of the Win32 versions. The Win32 versions continued to show a segfault on overflow. The porters eventually tracked down a more subtle bug. Not every buffer overflow is as simple as "he used gets() rather than fgets()." The buggy was far uglier than it needed to be for the job it was doing. Given the time, I probably would have reimplemented it from scratch. I'm not going to reveal who wrote the flawed code other than to say it wasn't me.

    Meanwhile, the main team was in panic mode getting ready for the trip to Arecibo. I was out of town on business for much of that two months. (2.5 weeks in Korea, 1.5 Weeks at Arecibo). Maybe we weren't pushing hard enough on our volunteers, but hell, they are volunteers with real jobs that they get paid for.

    As has been said, so far as we know at this point no client has been comprimised by exploiting this hole. In order to break the client, an attacker would need to set up a machine to act as a proxy or pretend to be the server. That's not the easiest thing in the world to do without access to the local network (or a security breach at your ISP). And if an attacker has access to your local network or routers and proxies at your ISP, holes the in SETI@home client are the least of your worries.

    At any rate, if you're worried, get the upgrade. Given I haven't upgraded my machines yet, you can see how concerned I am about it.

    --
    Support SETI@home
  88. WinNT Command Line Version 3.08 by Thomas+Wendell · · Score: 1

    The WinNT command line version is now available.

    Still no OS X version.

    You can check check to see what's avaiable here: ftp://alien.ssl.berkeley.edu/pub/

  89. Re:Bad net behavior - Mirroring sites by infonography · · Score: 1

    Can't do it, simple fact that it's the property of the pubisher not slashdot. If Slashdot went a did make copies of all the pages they were going to refer to they would get sued. Google does is as a cache. It's dicey, but if you refer to the google cache then google takes the hit. Most pages on the web with interesting content have banner ads. If you sent slashdotters to google then the ads don't get seen, the site loses money. Damned if you do, Damned if you don't.

    --
    Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
  90. Something more terrestrial by Anonymous Coward · · Score: 0

    The Grub project is a distributed method of crawling the internet. You download the client and you help Looksmart( their search engine wisenut is pretty good but not the best ) crawl the web.
    In my opinion it is better to help contribute your spare bandwith and cpu to help make sure more of the internet is crawled and more frequently instead of something more pie in the sky like SETI. Grub has a more down to earth use. Help make sure all of cyberspace can be crawled.
    Download the grub client:
    http://www.grub.org/html/downloads.php?PHPSESSID=a a2b3b639ab6f4b92965e132a1418df9

    There is a linux version. Get crawling, forget seti, helping crawl all the internet is more of an attainable goal.

  91. Last Post! by alpg · · Score: 0

    A manager went to the master programmer and showed him the requirements
    document for a new application. The manager asked the master: "How long will
    it take to design this system if I assign five programmers to it?"
    "It will take one year," said the master promptly.
    "But we need this system immediately or even sooner! How long will it
    take it I assign ten programmers to it?"
    The master programmer frowned. "In that case, it will take two years."
    "And what if I assign a hundred programmers to it?"
    The master programmer shrugged. "Then the design will never be
    completed," he said.
    -- Geoffrey James, "The Tao of Programming"

    - this post brought to you by the Automated Last Post Generator...