Slashdot Mirror
Audiophile Torrent Site What.CD Fully Pwnable Thanks To Wrecked RNG (theregister.co.uk)
Reader mask.of.sanity writes: Users of popular audiophile torrent site What.CD can make themselves administrators to completely compromise the private music site and bypass its notorious download ratio limits thanks to the use of the mt_rand function for password resets, a researcher has found. From the report (edited and condensed):What.CD is the world's most popular high quality music private torrent site that requires its users to pass an interview testing their knowledge of audio matters before they are granted an account. Users must maintain a high upload to download ratio to continue to download from the site. [...] "I reported it a year ago, and they acknowledged it but said 'don't worry about it,'" said New-Zealand-based independent security researcher who goes by the alias ss23.
What's this "CD" thing you speak of?
what's with that title?
News at 11.
This doesn't seem like particularly shocking news, nearly all torrent sites are poorly run.
I read the internet for the articles.
How can everyone maintain a high ratio. Doesn't having a high ratio require someone else to have a deficit?
These are the people who spend over $9,000 for an audio cable because it makes "warmer sound", or better yet, audiophile SATA cables.
Yeah not much in real good audio there. Sorry but a CD rip to FLAC is a joke. call me when you have found that rare japan release on SACD and then ripped that to FLAC....
Also their questionnaire is mostly Pseudo Knowledge and not real knowledge. Buddy of mine is an audio engineer with 2 degrees and he did not pass their test because he answered what was correct answers and not their audiophile misknowledge answers.
Do not look at laser with remaining good eye.
We are on a relatively tech-savvy site, right? Why is there a link explaining what an audiophile is (as if I couldn't have guessed from the context even if I didn't know), but there is no link explaining how the exploit actually works? (It's not mt_rand that's the problem, it's how you seed it) Why do I have to google after reading the summary? What's the point of having editors here at all?!
gold-coated, diamond-tipped network cables that would fix this. They would most likely give you higher quality sound on your digital downloads as well.
That does explain the very colorful album art.
0sec ftp 4 lyfe
catpcha: bitches
I read as:
Do we look like we're experts in pulseaudio?
If there were experts, we wouldn't have pulseaudio.
They need to run their server on an analog computer and install a special "real analog modem" that stretches the sound out to fit in the 20-2000Hz range and sends it directly over the phone line as a pure analog signal. Their customers will need to buy analog computers and analog recording devices and of course one of those special "modems." Only then will their users get the best sound possible coming out of their $10,000 home audio system.
Yea, it will be more expensive and keeping it temperature- and humidity-stable will be a pain in the rear, but it will be worth it.
As least that's what my friend's second cousin's son-in-law ex-con school chum says. He should know, he sells the stuff.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If I read you right, you are saying some audiophiles can tell the difference between a very expensive Ethernet cable and a normal-priced cable that meets the spec (with enough over-engineering so it continues to meet the spec after installation and in the face of environmental changes and normal levels of RF-noise)? I'm just not seeing how this is possible. Well, MAYBE if the cable is running through a very hostile environment well outside of what a "normal" Ethernet cable is designed to handle. But if that's you, then you've got bigger issues to worry about.
Oh, the audiophiles do have a point about cheap Ethernet cable: Every now and then, you will find cable that actually does not meet the spec. You will also occasionally find cable that barely meets the spec but as soon as you bend it a few time and the wire-strands start to break, it drop below spec. If you buy a reputable brand from a reputable vendor, you shouldn't have this problem. But in most markets you won't need to pay much if any premium to get a "known reputable" cable vs. "it tests okay out of the box but will it last over time" brand.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
A What.CD site administrator wrote in their forums that "We fixed this a few hours ago by using openssl_random_pseudo_bytes instead of mt_rand. This should have been done a long time ago, so thanks to the multiple users who reported this over the years."
The exploit was fixed before the news hit the waves. Check the github.
https://github.com/WhatCD/Gaze...
Slashdot is using 733t-Speak terms from a decade ago in its headlines, so why not CDs? I heard they were the Bee's Knees, at one time...
This was found and fixed last year. Nice timely journalism.
So how should a member maintain a ratio of 0.90 or higher when downloading a release that has 100 seeds and no downloaders other than himself?
To get an invite to use that site for years, still have no idea what the site actually looks like!
Michael
http://s1.sfgame.us/index.php?rec=58163
Sounds like a load of pretentious fucks to me. There's only two grades of audio quality worth talking about: recorded or live . No one give a flying fuck about your hi-fi other than yourself.
You get everything on other ones as well. And it even lasts longer, as a private tracker just disappears, while a magnet link keeps working (and brings several opentrackers in its meta informations).