Slashdot Mirror


User: mea37

mea37's activity in the archive.

Stories
0
Comments
1,556
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,556

  1. Re:"Obscurity" tag is misleading on Cryptographically Hiding TCP Ports · · Score: 1

    The currently active port is derived from the key, via the algorithm.

    Yet the set of possible active ports is not (and cannot be), and that's all one needs to get into the system. The entire point is that the key can be circumvented unless other secrets are kept.

    As evidenced by your other comments here, you are ignorant of many cryptographic and networking fundamentals.

    Do you always interpret disagreement about how concepts apply as ignorance, or are you just being particularly arrogant today?

  2. Re:"Obscurity" tag is misleading on Cryptographically Hiding TCP Ports · · Score: 1

    Please read up on Kerckhoff's principle

    I have, in fact.

    From the first sentence of the article you linked: "a cryptosystem should be secure even if everything about the system, except the key, is public knowledge".

    The shimmer system is secure only if elements of the system other than its key -- such as the port list, the rotation timing, etc. ... or ideally the fact that Shimmer is in use at all -- are unknown to the attacker. It is security through obscurity.

  3. Re:Interesting... on Cryptographically Hiding TCP Ports · · Score: 1

    It's a little more complex than that. Say the listening ports are 1001 to 1016, and the real port is 1008. A real user connects to 1008. Fine, but he's going to disconnect from it right away anyway, because that's the daemon's listening port (which needs to be freed back up so it can keep listening). If the service is session-based, then the daemon is going to assign the session to another arbitrary port.

    However, you are correct that by watching traffic you could quickly identify the "right" port. It's just a little harder than watching for long-standing connections; you have to actually watch someone connect.

  4. Re:"Obscurity" tag is misleading on Cryptographically Hiding TCP Ports · · Score: 1

    Re-read my post. I'm making no such assumption.

  5. Re:More or less obscure than password encryption? on Cryptographically Hiding TCP Ports · · Score: 1

    Well, the experts in cryptography say it is different, but suit yourself.

  6. Re:"Obscurity" tag is misleading on Cryptographically Hiding TCP Ports · · Score: 3, Insightful

    There are substantial differences. Enough so that, while the sound similar, they are really nothing alike.

    Frequency hopping has a much broader domain to "hop" across.

    Frequency hopping requires the communication to keep hopping even after it's established. Not only can't you connect without the key, you can't even keep a conversation going without the key. You can't hear or be heard at all, in fact.

    To someone without the key, frequency hopping "looks like" random noise. This works becuse there is random noise on the RF spectrum for the FH signal to "look like". There is no such "noise' in the domain of IP port connections.

  7. Re:"Obscurity" tag is misleading on Cryptographically Hiding TCP Ports · · Score: 1

    Nope. The key is what tells you what port to connect to. I can connect to the right port by brute force, never discovering the key. In other words, I can circumvent the true shared secret. (By "true shared secret", I mean the only "secret" that has any level of associated security. "I'm thinking of a number from 1 to 10" isn't a shared secret in any useful sense of the term.)

  8. Re:More or less obscure than password encryption? on Cryptographically Hiding TCP Ports · · Score: 1

    There are 16 possible ports; I can try all of them independently. The blacklisting tries to block brute force, but it won't work against a hacker who knows what's going on (which is why this is security through obscurity).

    In any good password scheme, there are at least billions of possible passwords. Even so, passwords are not as good as dual-key schemes, which have even more possiblilities.

    The analysis is completely different for shimmer vs. password-based authentication.

  9. Re:"Obscurity" tag is misleading on Cryptographically Hiding TCP Ports · · Score: 1

    I'm not too sure about that.

    Ok, if it's not security through obscurity, then the attacker is allowed to know everything but the shared secret (i.e. doesn't know how to determine the correct port). We're testing for added security, so any authentication built in to the underlying service doesn't count (unless it interacts with Shimmer in a way that creates even more security than the sum of the parts; but I assert that it doesn't).

    So the attacker knows that there are 3 sets of 16 ports. He knows what ports are in each set and when each set became active and when it will expire. He knows that one port from each set is good, and the other 15 are bad; but he doesn't know which one.

    So what are you going to do if your attacker has access to 16 IP addresses on 16 different networks? Hackers have been known to arrange that kind of thing. So I run 16 parallel attempts to connect, and 15 of them get blacklisted. I still win.

    Alternately: What are you going to do if the attacker is in a position to watch traffic to and from your box for a while? It would be pretty easy to find the real port if you could watch connections by legitimate users.

    Looks to me like it is, indeed, security through obscurity.

  10. Re:I'm sure... on Mathematician Theorizes a Crystal As Beautiful As A Diamond · · Score: 1

    In that natural diamonds are fungible, this is true. I wouldn't quite say that buying a Canadian diamond is morally equivalent to buying an Affrican diamond, but realistically short of a global boycot of the latter the two acts have the same effect.

    In that those who sell "natural" diamonds go to great lengths to make lab-created diamonds a separate market, and could not keep their prices up if the two were traded as equivalents, I don't see the same problem with fake diamonds.

  11. Re:Doesn't make sense on Scientists Recycle CO2 with Sunlight to Make Fuel · · Score: 1

    Maybe. Or maybe the means we have of converting sunlight directly to electricity aren't as efficient, once practical concerns are taken into account, as a multi-step process that uses a hydrocarbon fuel battery.

    There's also the matter of leveraging existing infrastructure, which (sad but true) is more significant than anyone thinks it should be.

  12. Re:perjury ? on RIAA's 'Misspeaking' May Have Affected Verdict · · Score: 2, Informative

    There are two people talked about in the article.

    One is a Sony spokesperson who testified under oath. She is not a lawyer, so cannot be disbarred. She could be tried for perjury, but the question would be whether she willfully broke her oath. If she is allowed to claim that she misunderstood the question, then it would be very hard to prove. It seems like the court record of the question being clearly asked should stand as evidence that such misunderstanding were unlikely or unreasonable, but I'm not sure how comfortable I am with the idea that a personally is legally required to know if they've understood someone else correctly.

    The other person -- the lawyer mentioned -- was not testifying under oath. She asked a line of irrelevant questions which the defense failed to either derail or address/debunk. The lawyer's conduct may raise ethical questions, but if so they are questions about the expected behavior of all lawyers, not just this one. By today's standards, we allow a lawyer to chase down lines of questions to which they want the jury to hear answers (even if the reason is to prejudice or to take advantage of implied context), and if the other side doesn't want those answers heard, they object. Had there been an objection, had the judge sustained it, and had the lawyer persisted in pursuing the question anyway, then there could be disciplinary action.

    Should there be sanctions for asking a question with the expectation that the answer will prejudice the jury? That sounds like a tall order to me.

    But I'm curious how much impact this had on the jury. Would the jurors really take the RIAA at its word as to what is or isn't copyright infringement? Were the jury instructions really vague enough that the jury was allowed to incorrectly interpret the law? Or was the jury assessing the verdict based on her placement of files on a P2P share, as previously reported, without regard to her irrelevant act of ripping CD's for her own use?

    This story doesn't impress me. The spokesperson strikes me as a weasle and I'm not inclined to believe her, but if there was a miscarriage of justice, it was due to several agents of the court (including the defense lawyer and the judge) doing a poor job, not singly to one person's biased testimony.

    (To be fair, I have relatively little sympathy for the defendant, as I believe her own less-than-upstanding behavior has hurt all potential defendants in RIAA lawsuits.)

  13. Re: it's programmed to be this way on Scientist Suggests We Explore 'Universe is a VR Simulation' Theory · · Score: 1

    GP says that DI's notion of ID is not strictly Christian

    No, that isn't what he said. What he said is that ID and Christianity are not interchangeable terms. Specifically, he said that a previous comment that spoke against ID was not speaking against Christianity, and that the response (which defended Christians in general, not ID supporters) was based on a failure to recognize that distinction.

    I'd suggest you go back and read the exchange again.

  14. Re:Occam's Razor on Scientist Suggests We Explore 'Universe is a VR Simulation' Theory · · Score: 5, Insightful

    Trying to reason about whether the universe is real or simulated is only useful as entertainment. Not only is it philosophical, it's philosophically meaningless. The guy proposing the theory claims there's a way to test it, but he's merely given a name to the type of test he thinks will work, without considering whether such a test is theoretically conceivable. (And the author of TFA, in his zeal to discredit the theory, conflates the concepts of "describing" an algorithm and "executing" it, in an attempt to suggest such tests have already been run.)

    Some of the speculation around the theory - possible ties to quantum physics and relativity, etc. - is entertaining and might make good sci fi. I've found myself wandering down similar lines of thougth at idle times. But I don't believe any true reasoning on the topic is possible.

    In that spirit, here's what's wrong with your attempts to reason on the topic :)

    Occam's Razor already negates the need for testing if the universe is real or not . . . the universe must be real, because they are equally capable of explaining what goes on in the universe, and one requires fewer assumptions.

    For all the times I've seen Occam's Razor referenced on Slashdot and/or in pop culture, I've never once seen it used correctly in either place. This is no exception. Occam's Razor does not prove anything; it merely give guidance as to which of two competing theories is preferable to work with.

    Or to rephrase that. Science is about the how, not the why.

    That would be a false (or at least oversimplified) dichotomy. Speculative "why"s are often steps in reasoning that lead to more complete models of "how".

    Further, if the universe was a simulation there would be no random numbers, only pseudo-random numbers.

    If our world is a simulation, then you cannot know what technology exists in the "real" world. Just because we (in this world) haven't invented a true random number generator for a computer (yet) doesn't mean one can't exist, especially since we'd have no baseline for knowing basic physics in the "real" world.

    Quantum physicists have to work with statistics and effectively random numbers

    I question whether we know that variables in quantum physics are truly random vs. pseudorandom, but I'm a bit rusty in that field. But ironically, if they are truly random, then that suggests a perfectly sound procedure for making a truly random number generator for a computer...

    with our current view of the universe, we can know every detail of every thing in the whole universe, and still not be able to predict the future

    Yes, but if the universe is a simulation then any random number seeds would not be included in "every thing in the whole universe".

  15. Re:Trade Associations Gone Wild! on Investors, "Beware" of Record Companies · · Score: 1

    Ripping CD's to MP3's is authorized by the fair use exception of the copyright law

    That's not what "authorized" means in this context. Ripping to mp3 is legal, but it is not necessarily authorized. It is, in fact, legal without authorization -- a category the existance of which the RIAA would like everyone to forget.

  16. Re:FPFPFPFP on Intel Resigns from One Laptop Per Child Project · · Score: 1

    If you want to debate capitalism vs. whatever system you'd like to replace it with (I notice you didn't offer an alternative), then we probably need to look at the broader effects of each system rather than one case where you don't like what happened.

    But anyhow, you're saying that in your view Intel is the bad guy?

    I'd say the OLPC is to blame for failing to keep Intel's support. They claim to take steps to not compete commercially against their own backers, yet here they try to control a product segment by fiat -- which has the same net effect as competition from Intel's point of view. "I won't compete with you, as long as you don't offer the products we'd compete on?" Please. Why shouldn't Intel withdraw from that kind of relationship?

    If OLPC is really a beneficial project, then Intel's entry into the low-cost laptop market should be no threat to OLPC.

  17. Re:Trade Associations Gone Wild! on Investors, "Beware" of Record Companies · · Score: 1

    They don't have cause an effect reversed, and neither do you. It's a cycle.
    [. . .]
    Suing your customers really will result in fewer customers


    Well, if you are perceived to be suing your customers indiscriminately, that will result in fewer customers. What the labels are trying to do is to sue a small minority of customers while convincing the rest that (1) the ones they're suing had it coming, and (2) any "good" customer won't become a target later. If you do that successfully it has at most a negligible effect on your customer base. The PR is the thing. And yes, if you look only at slashdot, it appears as though they're losing the PR angle; but if you look at the market as a whole... I can't say I've seen any mass market reaction against the legal campaign.

    Regardless, in human activities even cycles start somewhere. The sales drops came first, so that is the cause.

  18. Re:Shared Folder? on Investors, "Beware" of Record Companies · · Score: 3, Insightful

    And Atlantic V. Howell is the context of this story. See how neatly that works out?

    It's also been the definition they used in other cases. I don't know whether they think the term explains itself, or whether they're deliberately using vague wording for some reason... or maybe they do define their meaning clearly somewhere and I haven't seen it.

    In any case, I think in the long run it's in their own interest to be clear and to use a narrow definition that requires not only shared access but also indexing / notification of availability that facilitates unauthorized copying (in the "actually illegal because it's unauthorized" sense).

  19. Re:Trade Associations Gone Wild! on Investors, "Beware" of Record Companies · · Score: 5, Interesting

    Or rather the columnist believes that's the business model they're now in and predicts it won't work well for them.

    The inference people here seem to be drawing (that the labels are in trouble because of the lawsuits) resonates well -- we want to believe that kind of justice works in the market -- but really it has the cause and effect reversed. Sales dropped first, then the law suits started.

    Now, the thesis is correct in so far as "sue the customer" is not a productive response to an adverse market. They continue to spiral not because they file the lawsuits, but because meanwhile they do nothing to address the orignal failure of their position in the market.

    The "ripping mp3s is unauthorized" angle is FUD all around, though. FUD on the RIAA for using that wording in the first place (yes it's unauthorized, in the same sense that I'm not authorizing you to disagree with my post), and FUD on everyone who cites this as the moment where the RIAA calls all users thieves.

    Now, sure, the bad press from the lawsuits doesn't help the RIAA... among the small part of the market that sees what's going on and cares. Don't get me wrong, I'm among that small part of the market (not anti-copyright, not convinced that everything the RIAA says is wrong, but on the whole opposed to their actions over the past few years); but don't be fooled into thinking that slashdot is the world.

    As to the investment point of view... yeah, to a point, I wouldn't want to be putting money behind the major labels right now. But Sony? What would be the total impact on Sony if their record label arm spun off or died out completely?

  20. Re:Finally! on Official DTV Converter Box Coupons for Americans · · Score: 2, Insightful

    I disagree. A better solution would have been to mandate that analog-only sets start carrying a warning/explanation starting 4 or 5 years ago. (Actually 15 years in advance would be better; unless you buy crap TV's, it might easily have been over 10 years since you last bought one.) Or by some other means ensure that people know what they're buying -- you know, acually enforce the assumptions that make a free market work rather than telling the consumer what decisions he is or isn't allowed to make, thereby negating any kind of free market.

    Don't get me wrong; there are cases where government standards and bans are called for -- such as when the cost of a consumer's decision are born by others instead of by the consumer himself, though often a tax is a suitable and less intrusive solution even then. This is not one of those cases.

    Maybe I, as a consumer, want a cheap analog-only TV because I don't care about over-the-air broadcasts. Maybe I'll use it with my DVD collection (the player can still send an analog signal), or with a cable converter. Regardless, my decision affects nobody but me and there is no reason the government should impose a ban that keeps me from buying one.

  21. Re:Distorted picture of corporations. on Copyright Cutback Proposed As RIAA Solution · · Score: 1

    There are millions of small businesses in the USA today. And these are also "corporations".

    Some are. Many aren't. I'm currently involved in two limited liability companies, for example. They are not corporations, and it would be illegal for them to represent themselves as corporations.

    A corporation is a specific type of business entity, not merely a name that can be applied to any business. As you note, it doesn't directly imply a large company (but it does carry requirements that tend to keep 1-or-2-man shops from bothering to be corporations).

    an agreement between a group of people and the state government, which allows those individuals to work together toward a certain end while guaranteeing certain group property rights

    Actually, that describes "partnership" better than it describes "corporation".

    That said, copyright terms should have nothing to do with the class of entity holding the copyright. That just encourages gamesmanship. So regardless of how well people understand what is or isn't a corporation, the whole issue is really just a distraction. The point is whether copyright is in need of reform, and if so how to reform it.

    (And for the record, the answers are "yes" and "well, cutting the term would be a good start".)

  22. Re:Flaming to get hits. on Copyright Cutback Proposed As RIAA Solution · · Score: 1

    Meh.

    Copyright is the wrong tool to control future use of Mickey Mouse the character anyway. If anything that should be an issue for trademark.

  23. Re:Flaming to get hits. on Copyright Cutback Proposed As RIAA Solution · · Score: 2, Informative

    If you can't make a profit within a short time, it is referred to as a hobby, not a business

    Actually, U.S. tax law does not say that. It says that to take business deductions, you have to be trying to make a profit; and it says that if you make a profit in a short time, that is considered conclusive proof that you are trying to make a profit. If you don't turn a profit, the IRS has the right to question whether you're truly "in business", but failing to make a profit is not conclusive proof that what you're doing is a hobby.

    Now, it is true that you don't want to have your tax status depend on the vauge, arguably subjective criteria that the IRS will apply to decide if you're "trying" to make a profit, so (at least from the standpoint of the small business owner) your best bet is to make a profit often enough that the IRS can't raise the question, but the law does allow that you could be a business and yet never turn a profit.

  24. Re:Easy Credit on US To Extinguish (Most) Incandescent Bulb Sales By 2012 · · Score: 1

    An interest-only loan could make a lot of sense for someone who is planning to move in a few years.

    Yes, sort of.

    It is true that interest-only (or other non-traditional) loans, if properly understood by the borrower, could present an opportunity; but they also present a risk. An informed consumer has every right to weigh that risk, as long as the consumer is willing and able to bear the downside if things don't go his or her way. Those aren't the borrowers I think were wronged (in fact I don't even think they should be bailed out), but I also don't believe they were more than a small minority of borrowers.

    I often would have debates over the past few years with less financially-conservative-minded friends who took the position that a knowledgable borrower could take advantage of non-traditional loans, and my argument was always this: What if the market takes such a turn that you can't sell the house or refinance in a few years? Which, for many borrowers, is exactly what happened when the subprime collapse hit.

    But since the bank is out half the value of the house at that point, it is not in their long term interest to push such loans to the point of default. As the motto goes, never attribute to malice what is adequately explained by incompetence.

    Generally I agree, but there are grey areas you're not considering. I'd like to see how the aggregate numbers line up before dismissing malice.

    To the extent that large numbers of loans went into default, I agree this isn't what the lenders wanted. But then, they surely had models of what they thought would happen when they started pushing nontraditional loans, and do you really think those models didn't predict a fractional increase in defaults? "Hey, a few loans will default and we lose money on them, but it's more than offset by all this extra business."

    Yes, the lenders were short-sighted, just like many of the borrowers. But then, the lenders pulled the wool over their own eyes.

  25. Re:awww jeez, not this $#!^ again on TSA Limits Lithium Batteries on Airplanes · · Score: 2, Insightful

    Funny, I tend to think that allowing motorized vehicles under the control of minimally-trained individuals onto the roads was a mistake.

    If you really believe motorists are just trying to get around bikes, you haven't seen what's really going on. Unless and until there's a separate bike trail infrastructure, any discussion of restricting bikes from the roads is unreasonable. But those points are both off the topic.

    The question was about how people behave, and the current situation (bikes sharing the road with cars) is a perfect example of how people, out of anger whether specific or general, will put others' lives at risk when they have no right to do so. They may not be first-degree murderers, but they're perfectly willing to become manslaughterers.

    The same will hold true for guns on planes.