Slashdot Mirror
The Rise and Fall of Napster
Jedi Paramedic writes "Boston.com has an interesting story about the rise and fall of everyone's favorite file-swapping service. Also the subject of a new book by Joseph Menn, the story goes into great detail about the unfortunate-but-heroic Shawn Fanning and his reluctance to admit that his uncle, who in the end masterminded little more than the lining of his own pockets, had taken advantage of him. From getting screwed in the original 70/30 split with his uncle to his uncle's refusal to loosen his iron grip on the company even at the expense of its very being, the article (and the book) go a long way in chronicling the rise and fall of Napster, and crediting Shawn for not airing the family's dirty laundry. An interesting and well-written read."
Repeat after me: fuck MD5.
MD5 is flawed
Given known current flaws in MD5, it is possible to produce bogus data that matches a given MD5, though no constraints can be placed upon the content. A trojan, for instance, cannot be placed in a MD5'd file, but the file can contain random data.
However, one of the fairly obvious ways to use MD5 is with a "tree" of checksums -- one for the whole file, one for each half, one for each quarter, etc, etc, etc. In this case, it is not possible to produce data that will pass validation.
eDonkey uses MD4 hashes -- which is significantly easier to attack than MD5 -- yet I haven't seen problems with forged chunks on eDonkey.
And while SHA-1 is nice -- and it might be just easier if everyone used it -- it is significantly slower. When I tested the md5sum and shasum implementations on my Linux box, I found that shasum ran at about a sixth the speed of md5sum.
May we never see th
Audiogalaxy... now that was a friggin' good filesharing service. Low-hassle, lots of rare stuff... excellent.
Daniel
Carpe Diem