Slashdot Mirror
VIA Releases Source To Custom WASTE Client
daten writes "VIA has released the source code to their Padlock SL product, based on the Nullsoft WASTE code previously pulled by AOL. Padlock SL offers encrypted chat, instant messaging and file sharing over a private peer-to-peer network. Unlike WASTE, which is still under active development, the VIA client offers a graphical interface for both Windows and Linux users and simpler configuration."
Some security for chatting.!! -SMaharaj
"Unlike WASTE, which is still under active development..." More like passive development on sourceforge
You don't need to sign your AC posts
Does anyone know how private this network is? Do you have to get a key from a member? Does it just use encryption? Any details on this?
Evolution or ID?
You need to update your cut and paste source. Half of the links are dead.
Very lame FP...
Doesn't Nullsoft's page on WASTE say " An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website ... Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright" ?
There are 2 kinds of people in this world: Those who write in decimal and those who don't
I said it when Napster came out, I said it when Audio Galaxy came out, I said it when Kazaa came out, I said it when Bittorrent came out, and I'm saying it now: USENET r teh rox. Wanna swap files? Stop innovating, you idiots, you've already got perfection in the p2p area.
for those that don't want to fill out the questionnaire
Windows XP Version
Red Hat Verion 9.0
Installation Guide
User Guide
Encrypted chats via VIA!
NOTICE OF UNAUTHORIZED SOFTWARE
An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website on or about Wednesday May 28, 2003. The software was identified as "WASTE" (the "Software") and includes the files "waste-setup.exe", "waste-source.zip", "waste-source.tar.gz" and any additional files contained in these files.
Nullsoft is the exclusive owner of all right, title and interest in the Software. The posting of the Software on this website was not authorized by Nullsoft.
If you downloaded or otherwise obtained a copy of the Software, you acquired no lawful rights to the Software and must destroy any and all copies of the Software, including by deleting it from your computer. Any license that you may believe you acquired with the Software is void, revoked and terminated.
Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright in the Software as well as a potential violation of other laws.
Thank you.
Nullsoft
Doesn't Via make chipsets? I don't understand where this is coming from...
/.er will enlighten me :))
Linked page is useful for figuring it out too: "Here you go, if you download it, give us feedback."
(I admit, I'm lazy and hope some fellow
From the description this is a sample application using their "Padlock" hardware
Is there a muted horn in their logo somewhere?
sic transit gloria mundi
I used to work programming software that basically transmitted information between banks. I learnt one very simple thing that I think could be really helpful for the OSS community: Separate the message from the method of delivery.
Banks are obviously really paranoid about security. They also really need messages to get through, quickly. In the software that I worked on, you would basically configure it with a priorty list of methods that it could use to transmit the message. So the most secure and failsafe method would be the one it tried first. If that didn't work it would try other methods, gradually going down the list, which usually ended with Fax being the most primitive method.
So how is this relevant to the OSS community? Well, we all know email is pretty much broken. Businesses want message delivery that is 1) secure and 2) reliable. Email is neither. With OSS email clients, we should change our mentality a bit and treat them instead as messaging clients, with email being just one of the methods it might use to send the message. The first thing it might try would be a secure, peer-to-peer connection with the recipient of the message. If all OSS email clients followed the same standard - perhaps based on this WASTE code? - soon most messages might be sent by a better manner than email.
One day very soon, Microsoft is going to come out with a "better email". The OSS community will bitch about it, and then if it takes off they will try to copy it. I'd much prefer we did the innovating and MS had to copy... Come on guys!
Browsed over their website, but I must say I'm disappointed. How well can we trust this client to be secure (and flawless) until the public has audited their source code?
If I'm going to chat with my friends "securely", I'd want to know exactly _how secure_ it is... to know whether I really can trust the application or not..
Security by obscurity doesn't cut it for me, and usually, the slashdot-crowd doesn't seem to be too fond if it either..
You need to update your cut and paste source. Half of the links are dead.
Very lame FP...
I know there are dead links. I don't have the latest version handy right now, but FP is still FP.
Ceren for ever!
Does anybody know if this can interoperate with Waste networks? I tried to get it into our waste network, and after changing the key header I got the keys to import into the waste clients, but connections still failed.
Anybody had more luck? Waste runs under wine, but there are a lot of annoying issues, and the port seems dead in the water.
This is another example of the OSS community wasting time duplicating their efforts. IM? We've got at least 3 networks out there already, and hundreds of clients. File sharing? FTP, HTTP, Kazaa, Bit Torrent, etc. Who cares abuot yet ANOTHER of the same thing. Is there are OSS coders with free time on their hands (and there obviously are plenty), how about a usable Point of Sale system? How about wirting *anything* that hasn't been done 1000 times already?
If their chipsets are anything to go by, this thing will crash / lockup every chance it gets! I personally won't touch anything to do with VIA...
Then again maybe I just had a bad experience with their AMD chipsets. Once bitten....
I believe this will be the future of file sharing when the RIAA and Movie RIAA (can't remember name) finally gets all the rest of the networks taken down. It reminds me of days before Napster when the easier way to get stuff was to goto IRC and download from a very limited selection (for backup purposes only ;) ).
Off topic: Anyone know a way to open a quickbooks database across the Internet using Quickbooks Professional, I got legal copies (amazing for me)of Quickbooks Professional and I wanna be able to use it in two locations at the same time. Linux looks like the route to go, but how? *Lamer Aura*
Also, bandwidth is an issue, 256k DSL on both ends. I don't wanna buy anymore software either
I mean seriously. It bundles in plausible deniability into the network protocol. Stuff that into your pipe and smoke it.
If you want to do skunkworks-style development, collaboration, or your just an 'ARRRRR net pirate then WASTE is a tasty morsel of goodness that is hard to find in other products.
Point of sale system, right. You don't do that open source because there's no point. Who'd use it that doesn't have a purchasing department and thus can be expected to outlay a little dough?
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
That's quite a class:
The Army reading list
I'm trying to set up a VPN at home mostly so I can get at South Park eps on my Tivo and so my girlfriend can access her documents from school. How difficult would it be to implement either WASTE or PADLOCK on a Mandrake 9.2 system? I know Mandrake has some RH based architecture...
Please bear in mind in any advice that I'm a complete server n00b.
Winamp Unlimited covered the complete story yesterday, for those of you who are interested. There are some links/information on there that haven't been mentioned with this discussion.
How does this get in the way of the story from 13 April about needing both sides to contsent to chat recordings? If the solution to that is to allow 3rd party "wiretapping" of IM sessions, this would limit it severly.
-Patrick
"They never stop thinking about new ways to harm our country and our people, and neither do we."
You can get the source code here....
http://www.viaarena.com/?PageID=401
Have fun!
They say it, but that doesn't make it true. An agent of the company posted the software under the GPL. AOL/Nullsoft's dispute is with Justin Frankel if they contend the release was unauthorized. But released it was, and it is under the GPL.
It doesn't necessarily make it false, either. The GPL's legality and enforceability have yet to be tested in court. Also, Frankel may have been bound by prior contracts which nullify any attempt to GPL any code created while employed. You can't take code someone else legally owns and release it validly under a license of your choosing.
Anyone care to comment on how this fits in with all that palladium / DRM crap ? is it related in any way and / or is this a bonus that its under the GPL ?
nick...
Electronic Music Made Using Linux http://soundcloud.com/polyp
It's really easy to compile Padlock on Mandrake 9.2. First install libqt3-devel, the QT deveoper package. Then, call /usr/lib/qt3/bin/qmake and make, that's all.
Also, off topic but amusing, when I was browsing around their site for more information I found this: http://www.viaarena.com/?PageID=306
WebDAV -- a standard part of Apache 2 -- is the replacement for FTP. It only uses one TCP connection (HTTP extension), goes anywhere HTTP goes, can be used over HTTPS and thus be as secure as you like.
On the client side, it is already supported by KDE (use URLs like webdavs://server/dir/file.txt), GNOME, and MS Windows. There are also a few command-line clients, such as neon.
In Soviet Washington the swamp drains you.
So it's a P2P version of "Hotline". That's neat! It really is.
However, what I would like to see done with this project is someone tack some kind of version control system onto it. Once you do that, this could be the perfect "floating development board" system for projects such as PlayFair which cannot find shelter elsewhere due to legal problems and/or harassment.
Then all you have to do is move the transport layer from being straight P2P to the data being stored on FreeNet, and you've got a way to have totally public yet totally anonymous development of an "illegal" software application...
At the least, it could be interesting.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
Drifting a little OT, but look to Pynchon's "The Crying of Lot 49", IIRC the muted horn is a logo associated with an underground mail system known as *drumroll* WASTE.
The story certainly reduces my confidence in VIA. What a mess they are making of things.
At least the c3 has a hardware random number generator for better encryption. Sadly you need stepping 03 of the Nehemiah core, as I discovered when I got my motherboard and got Linux compiled to use it. I had a 01 stepping so it was no-go. Felt kinda cheated.
(as well as the low-noise really isn't all that lown noise)
We have seen the results of CAN-SPAM act. That should clue you in on the first point.
Next, you want a government specified secure mail protocol? I hate to be rude, but that is like asking for government specified quality literature. Any attempt at that would come out of committee dripping with pork fat, backdoored by every TLA in the country, overseen by a new agency that would tax it, and likely incapable of functioning in the real world.
Please step away from the crack pipe.
I forget what 8 was for.
"If WASTE's release was unauthorized, you have no rights to do anything with the software. I am not certain what you could be required to do, by law, should you be found to possess a copy."
"Unfortunately, there is no good way to determine whether or not the release was authorized or not. We are currently presuming that it was unauthorized, until we see convincing evidence otherwise."
Here's what I do: Bitty Browser & Andromeda
I don't see the advantage of this over any other P2P app that already exists. Encryption strikes a dissonant chord with me in this case. If you want the advantage of public file sharing, what is the benefit of encryption, since you purposefully want to share information with the public already? There are plenty of encrypted chat programs already out there. I know Hushmail has an encrypted chat program, and I believe there are encryption plugins that exist for ICQ, etc. If I am missing something here, I welcome anyone to explain what the hoopla is all about.
Computers are useless. They can only give answers. --Pablo Picasso
Most current chat clients have had various encryption options for some time now...
---- Booth was a patriot ----
WASTE is meant for a small, trusted group of peers to be able to share content securely without having to worry about eavesdropping. If you want the latest hot music and warez then this definitely isn't the program you should be looking at.
now people could haxor gunbound.
lose != loose
If you want to try and get waste running, try joining up with an existing network. Very painless 4. step process. I like these guys, they have a 50-75 person network that welcomes newbies.
Well stated and very correct with an exception.
I can't take a copy of the leaked Windows code, put a GPL notice at the top of every file, and claim then claim it has been GPLed.
Also correct so long as MS takes prompt legal action to protect their claim to said copywritten work(s). And we all know they would in a "New York Minute".
AOL owned the source code [...], and if they never OKed it to be released, then it is not under the GPL.
Here's the rub: AOL could be guilty of "laches" or negligent in claiming their legal rights in a "prompt" time and fashion, and not due any relief.
For example:
BigSoftCo has a product called BigSoftApp.
BigSoftApp's source code gets released with GPL copyright tags on all the source files.
Even though BigSoftApp's source code is "notoriously" and publicly available, BigSoftCo takes no legal action against those distributing said source code.
LittleSoftCo releases LittleSoftApp under the GPL using some or all of BigSoftApp's source code.
BigSoftCo complains and files suit claiming copyright infringment against LittleSoftCo.
BigSoftCo loses the suit because they didn't exercise their rights in a timely manner even though it can be proven that they knew of said code being distributed and took no action.
IFAIK nullsoft hasn't filed one legal motion to stop the distribution of the WASTE code and IMO has could've lost their rights to retract the GPL placed on said code. IMO this could be tantamount to de facto permission to use the WASTE code under the GPL. If the WASTE code contains any code previously released under the GPL it would only further weaken any claims they may make.
Again, IMO it might be too late to stop the spread of the WASTE code under a GPL license. This is in a way similar to the problem SCO will face in court. They distributed what they claim is SCO code in Caldera GNU/Linux under the GPL and now claim someone else added it. Even if they didn't add said code since they did distribute it under the GPL for years they're almost totally screwed.
Imagine building a house that partly sits on some else's property. Years go by and the property owner says nothing even though it can be proven he knew of the problem. You go to sell your house, the title search shows the problem and the owner wants to sell you the property in question. You can claim that since he didn't take prompt action when he knew of the problem that the property should belong to you. Legally you have a case.
As a supporter of the GPL I personally don't like seeing code being used in such a "muddy" way but VIA should be in the clear.
"I hate to advocate drugs, alcohol, violence or insanity but they've always worked for me" - HST
"If WASTE's release was unauthorized, you have no rights to do anything with the software. I am not certain what you could be required to do, by law, should you be found to possess a copy."
"Unfortunately, there is no good way to determine whether or not the release was authorized or not. We are currently presuming that it was unauthorized, until we see convincing evidence otherwise."
But the thing is, I doubt anybody even cares. The logic in the P2P debate is always "I believe whatever supports my position, and I don't believe anything that speaks against my position."
In this case the FSF themselves say that they are presuming it to be unauthorized, and that therefore others have rights to do anything with the software.
But who cares what the FSF says, right?
Here's what I do: Bitty Browser & Andromeda
But what NineNine "expects" is unreasonable. I think the combination of paid support/access with ability to see and modify the source for a POS system is great! But no one should be expected to develop such a monstrosity just to do it, especially when there's no reasonable way the developer can test or deploy it!
I mean, do you have POS cash registers in your basement just waiting to be endowed with such an application? Come on.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
SILC is exactly like IRC, but with added encryption. That means encrypted chat, and file sharing via DCC.
The hoopla is that you can encrypt all your network communications for "free" if you use AES, even on an otherwise "slow" CPU. OpenBSD will automatically take advantage of this CPU, if present. Not need to patch a Linux kernel if you want to test it.
Shouldn't this be moderated Hobbit, or maybe Halfing?
Having worked with these chips for a while (since they're pretty much the new pet CPU for the x86 set-top box crowd...) I can say that your claims aren't accurate in the slightest.
Integer performance on a Nehemiah (key word there- previous incarnations of the C3 CPU were good low-power offerings for embedded designs, and showed poorer performance...) core is on a par with a comparably clocked Celeron (i.e. it's in the ballpark of a 1GHz Celeron with the chip on the EPIA M10000 board...) and it's FP performance is somewhere in the ballpark of a 750MHz Celeron- give or take. If it were like you claim, you'd not be able to play DivX streams on the M10000 (You can...). The chips just aren't ball-busters like P4's, Athlon XP/64's, or Opterons are.
Now, had you been talking about a Samuel or Ezra core C3, you'd be closer to the mark. They have an integer performance similar to a identically clocked Celeron- with a FP performance that is abyssmal at best (FP portion of the core is clocked at 1/2 the clock speed of the CPU...)
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
VIA's incorporation of random number generators
into the CPU core is a boon for user privacy.
Software-based psuedo-random number generators
use entropy gathering to furnish a seed number.
Poorly implimented software-based RNG have the
problem of being more statistically predictable
than desired. Problems with RNG negatively
effect encryption, including SSH and even TCP/IP.
Recent releases of the GNU/linux kernel can
make use of the VIA RNG for better security.
Palladium can make use of hardware-based RNG,
but the Secure Computing Platform actually
uses firmware beyond today's BIOS to restrict
software and hardware replacement or additions.
Firmware-based DRM, by design, must retain the
encryption keys as well as the code to generate
them.
So long as VIA does not impliment a change in
the current BIOS capabilities, the Palladium/
DRM nightmare can be avoided. However, the
latest incarnation of the C3 processor does
give VIA a head-start on DRM adaptation.
It is all a question of degree (currently).
The WASTE code in Sourceforge still violates GPL. It still includes a bunch of RSA code that isn't GPL'ed. Some of it is explicitly under a license that is imcompatible with GPL, and the rest simply gives an RSA copyright notice and says nothing about licensing.
WASTE is real strong in being the first in several areas: purep2p, anarchistic (WASTE is the most anarchist p2p because it implements security culture, free association and mutual aid. This is thanks to it's Decentralization, Encryption and preferences/features) , passive to passive transfers (via [sic] unique routing), & in being 'illegal' open source I think more Open Source projects should reclaim proprietary ideas that were developed/discovered in places like public schools and return the knowledge to the public so we can be more self-sustainable and sharing. shutting down lifeless entities control over our intellect. padlock is not compatible I've tried. it's also got allot of disabled features. it's like a whitewash. my hope is that the sourceforge open source WASTE team http://sf.net/projects/waste/ kicks into action to make a mockery of this via project much like has been done to neomodus dc over dc++ , but this is a reverse hijacked fork protocall type thing. not that i think it even matters much. i value having a network name/ID and full control of options that are in WASTE and not in Padlock. there interface is kinda weak ,with huge buttons and striping?
i guess just watch and see if they add the rest of wastes advanced features or make a more restricted program from the most anarchistic p2p i love and call WASTE.
Last time I checked, I don't think WASTE supported multi-source downloads (aka "swarming"). I'd love to use WASTE technology in a couple of applications, but I really want people downloading from multiple sources simultaneously instead of having to get the whole file from a single source.
Anyone know if this (or any other) WASTE-derived P2P solution supports this?
-Zak
By: Hollywood at monkeysvsrobots.com - zonk3r
RE: Nullsoft: NOTICE OF UNAUTHORIZED SOFTWARE
2003-07-23 12:22
so, here's the deal. i've been thinking about this thread a lot and figured it would be good to get an authoritative repsonse from someone 'in the know' about the gpl and law. so i decided to write rms himself and see what his take is on the matter. here's my email to him (7/21):
mr. stallman,
i've got a question for you regarding a certain application of the gpl. first i want to give a little background story to catch you up if you weren't aware of the situation...
you may be aware of an application that was released by nullsoft (www.nullsoft.com), a subsidiary of aol, called waste. justin frankel, author of waste and ceo of nullsoft, released it several weeks ago with its source code licensed under the gpl. however, it seems he didn't have the necessary privilege to do so, and aol forced nullsoft to remove the software and post this notice later in the same day it was released (http://www.nullsoft.com/free/waste/):
NOTICE OF UNAUTHORIZED SOFTWARE
An unauthorized copy of Nullsoft's copyrighted software was briefly posted on this website on or about Wednesday May 28, 2003. The software was identified as "WASTE" (the "Software") and includes the files "waste-setup.exe", "waste-source.zip", "waste-source.tar.gz" and any additional files contained in these files.
Nullsoft is the exclusive owner of all right, title and interest in the Software. The posting of the Software on this website was not authorized by Nullsoft.
If you downloaded or otherwise obtained a copy of the Software, you acquired no lawful rights to the Software and must destroy any and all copies of the Software, including by deleting it from your computer. Any license that you may believe you acquired with the Software is void, revoked and terminated.
Any reproduction, distribution, display or other use of the Software by you is unauthorized and an infringement of Nullsoft's copyright in the Software as well as a potential violation of other laws.
Thank you.
Nullsoft
shortly after the release of the source, several projects started popping up trying to pick up where waste fell short. the one in particular that i have a question about, is this one: http://sourceforge.net/projects/waste/ . in the discussion groups a thread has arisen as to the legality of continuing the project since nullsoft and aol have 'voided, revoked and terminated' any such license it was released under. many people in this thread seem to believe that once a piece of code is released under the gpl, it can not be revoked no matter what. however, in this case the software was released illegally and the gpl was applied to it. it is my opinion that the gpl can't protect someone from this. you can't license something you don't own in the first place. it doesn't matter who the person was that licensed and released it even if they were ceo, if they didn't have the authority to do so (which frankel's contract apparently doesn't give him), then the license is null and void and any further development would be as well. the argument for the opposition is that the licensor can not retract the license (http://www.gnu.org/licenses/gpl-faq.html#CanDevel operThirdParty). in a court case, i don't think that the folks who want to develop on the source would have a leg to stand on since the originator stated, in essence, that the code was leaked and a license was applied to the leaked code which they had no authority to license in the first place.
please take a look at the discussion thread: http://sourceforge.net/forum/forum.php?thread_id=8 96863&forum_id=281189 my posts are under the screen-name 'zonk3r'.
i suppose i feel it is rather naive of them to assume that they can hide behind the gpl and everything will be okay. that enti
VIA's release has only one real feature, that of the ability to use AES on their hardware, and possibly the linux client that actually works. The interface has been made gawd ugly, filled with blue and white crap, with a push button icon size of nearly 60x60 pixels each. It also sticks the huge disgusting logo beneath the main window, instead of a clean dialog box.
It is significantly less usable than the current WASTE client from waste.sourceforge.net . Further, it takes keys in a slightly different format, requiring you to change the header "WASTE_PUBLIC_KEY" to "PADLOCKSL_PUBLIC_KEY". The networks are otherwise fairly interoperable, although troublesome because of the key import thing. So if you really want to use padlockSL on an existing waste network, this is fine, AS LONG AS YOU'RE NOT USING A NETWORK PASSWORD.
For some inexplicable reason, VIA removed the network password feature, which immediately makes it worthless for connecting to any passworded WASTE network.
Summary, this thing is useless, except for those with VIA hardware, a strong urge to use their linux client, or if you have problems seeing certain icons, and need them about ten times larger.
Tired of legitimate data sources? Try UNCYCLOPEDIA
Ok, the binaries are at http://padlocksl.viaarena.com/. They have downloads for Win NT/2k and RH Linux 9.0. Maybe some debs can be made from them. :-) Still can't get to the sources. :-(
Mirrors?? Any mirrors available? It seems VIA has taken the page down ... ?
Thanks (to all of the above) for the replies, this makes a bit more sense now.
I can definitely appreciate the part about "[no] need to patch a Linux kernel." Very schweet.
Computers are useless. They can only give answers. --Pablo Picasso
What happens when you run it? :)
Seriously though, this seems like a coincidence. I have already installed it on 2 machines with no sudden extra activity. You might want to install a bandwidth monitor to see what is eating it up.
VIA has removed all traces of the VIA Padlock SL application as of about 9:00am EST today. Interesting.
WASTE - The Secure P2P
Could someone out there PLEASE do the usual /. thing and produce an ftp or a .torrent of this app?
Thanks In Advance ! ! !
Download PADLOCK-WASTE the p2p way:
H XF 2TI5O7.XGGLWGAAMO3T2Z7DWZI5XLO7RLBO246FRLMHLJA&dn= sqrville_org%20projects%20-%20VIA%20PadLockSL%20Li nux%20HOWTO.htm
2 0P adLockSL%20Linux%20HOWTO.htm|26105|b4e2ade39634b47 d7c34524fcf33d726|/
3 3AYLFI NJ3N5Z.DOXF3JQGJMAWYO2FZ5C2HKDSG2H5AP2CAA7FRUI&dn= PadLockSL.src.zip
c b7 465cde4250fbd1c28635a|/
4 ZZ JBQ557.2Y3QPT57UJ6GXMBECQLFJZEO27SAL4VGUBOKQSA&dn= PadLockSL.win.01.09.040315.zip
6 48 2|cb434021755eaa34d7399d396165a804|/
B 2M YIETZQ.4V2IXDUUCYHN4WETATZKGLZL5EVVDEE6IIXCW7I&dn= PadLockSL-UG-001_20040311.zip
7 3| 7c446c26d07cc97fd0239bff38aec5cc|/
THE WEBSITE
magnet:?xt=urn:bitprint:472PCY5U2WAUBIMOI6WCFZF
ed2k://|file|sqrville_org%20projects%20-%20VIA%
THE SOURCE CODE
magnet:?xt=urn:bitprint:T4EDIJIPGMQR65W3V3E
ed2k://|file|PadLockSL.src.zip|1375870|3422c73c
THE WINDOWS INSTALLER
magnet:?xt=urn:bitprint:XEQMCYDA4J5TR53IIWI7ADP
ed2k://|file|PadLockSL.win.01.09.040315.zip|401
REST
magnet:?xt=urn:bitprint:3LUXE2FP67SF6FHKJJEY6UY
ed2k://|file|PadLockSL-UG-001_20040311.zip|9984