Slashdot Mirror


User: WaywardGeek

WaywardGeek's activity in the archive.

Stories
0
Comments
819
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 819

  1. Re:Hear me out: Locally Generated Entropy Pool on Linux RNG May Be Insecure After All · · Score: 1

    No, a 120MHz radio signal cannot bias my generator unless the signal is so strong that the noise signal goes outside the ADC input range. Simply adding non-random bias to a random signal does not reduce the randomness in the signal. Simply XORing all the ADC output bits together for 80 cycles, where the low 4 bits correlate sample-to-sample less than 1%, and you get an error of less than 1 part in 10^50 of non-randomness. Add any signal you like to the noise, and it wont make any difference, so long as you don't clip.

    You're thinking of a primitive hardware RNG that amplifies the signal to a single bit. Such generators are far slower (1 bit per sample, rather than 8, and you have to wait for the entire signal to become uncorrelated) and susceptible as you suggest to bias. Why would anyone waste most of the randomness in a signal by amplifying it to the rails?

  2. Re:Random number generators are hard on Linux RNG May Be Insecure After All · · Score: 0

    Here's the math I did to prove to myself that the non-randomness error is tolerable.

    I saw 1% correlation between successive samples of the 4th lowest bit of the ADC (the upper bits, were worse, the lower are even more random). So, model the low 4 bits probability of being 1 as 0.5 + e, where e is an error of 0.01. XORing two together, the probability of being 1 is (.5 + e)(.5 - e) + (.5 - e)(.5 + e) = 0.5 - 2e^2, so the new error is 2e^2, or 0.0002. Merge again, and it's 80*10^-9. Once more and it's 12.8*10-18. Then 327*10-30, and finally 215*10-57. That's what I'd get merging 32 of the low 4 bits , but I actually merged 40, and while the high bits are highly correlated, they still do add randomness.

  3. Re:Random number generators are hard on Linux RNG May Be Insecure After All · · Score: 1

    I built this in the mid 90's, and at the time the old DOS-based Diehard tests were the best I could find. Certainly the stream should be whitened before used in cryptography, but the data directly from the board passed the Diehard tests without whitening. However, the board XORed 80 bits from the A/D to produce a single output bit (or more - this was software controllable). Since the 8-bit randomness accumulator was rotated 1 bit every sample, each bit was XORed 10 times with each of the A/D outputs. I did some simple correlation analysis on the raw A/D output, and found that the 4th lowest bit had significant, but small correlation - I forget now, but something like less than 1/128th bias to the previous bit. The lowest 3 bits were even more random, and I did not detect correlation other than what I could explain through non-linearity of the ADC. I also looked at the analog signal, and it was a best described as biased random walk, where the signal prefers to return to 0 more the further from 0 it got. It had strong random components at the limit of my scope's frequency: 100MHz.

    While it was based on zener avalanche noise, real zeners are designed to minimize this noise. I used the reverse Vbe breakdown of a cheap NPN transistor instead, which was a far superior noise source. I had a couple clever tricks In my design, but frankly saving a transistor or two isn't going to make the world a better place. There's nothing wrong with the designs I find with Google, like this one.

  4. Re:Hear me out: Locally Generated Entropy Pool on Linux RNG May Be Insecure After All · · Score: 3, Informative

    Yes. Hardware high-speed super-random number generators are trivial. I did it with amplified zener noise through an 8-bit 40MHz A/D XORed onto an 8-bit ring-shift register, generating 0.5MB/second of random noise that the Diehard tests could not differentiate from truly random numbers. XOR that with an ARC4 stream, just in case there's some slight non-randomness, and you're good to go. This is not rocket science.

  5. Re:Random number generators are hard on Linux RNG May Be Insecure After All · · Score: 5, Interesting

    No, RNGs are easy. Super easy. Just take a trustworthy source of noise, such as zener diode noise, and accumulate it with XOR operations. I built a 1/2 megabyte/second RNG that exposed a flaw in the Diehard RNG test suite. All it took was a 40 MHz 8-bit A/D conversion of amplified zener noise XORed into an 8-bit circular shift register . The Diehard tests took 10 megabytes and said if it found a problem. My data passed several times, so I ran it thousands of times, and found one test sometimes failed on my RNG data. Turns out the Diehard tests had a bug in that code. Sometimes the problem turns out to be in the test, not the hardware.

  6. Even more confused on Java Spec Compatibility Weakened Android's TLS Encryption · · Score: 4, Informative

    RC4 (aka ARC4) is not "broken". Unknown Lamer is confused. WEP is broken because it had a flawed implementation of ARC4. Just hash the key, drop the first 1K bytes of output, and no known program can even differentiate ARC4 output from truly random numbers with less than a megabyte of data. If the NSA can crack ARC4, then they've beaten a huge collective effort of the world's cryptography community.

    But... md5? Surely that's just for non-secure CRC, right? Android wouldn't do anything as dumb a signing document MD5 hashes, would they?

  7. Re:$5000 gets you... on Cadillac Unveils Pricier Alternative To Tesla Model S · · Score: 2

    One more example - not from Silicon Valley! Why are the big cell service providers so dumb? Coverage sucks everywhere, yet it takes tiny Republic Wireless in North Carolina to figure out that cell phones should switch to VoIP when WiFi is available? Why is it so hard for big companies to do the obvious right thing?

  8. Re:$5000 gets you... on Cadillac Unveils Pricier Alternative To Tesla Model S · · Score: 3, Insightful

    Why can't cell phone companies make good cell phones? Why did Apple and then Google have to show them how? Why didn't Sony build iPods? How did they let Apple do it first, years after Sony should have dominated the market? Why can't big car companies make a good electric car? Why did Tesla have to show them how? Why is GM even offering this stupid model, and why did BMW offer an even dumber one? Is it to prove to themselves that electric cars are a bad idea? Why are all of these examples Silicon Valley innovations?

    Honestly, I just can't figure out whats wrong with GM, BMW, Motorola (before being bought - the Moto-X rocks), Sony, and so many other large iconic corporations. It's one thing to lack a marketing genius like Steve Jobs. It's another to be so incredibly stupid that even the average slashdot geek can see your product will be a dismal failure. There is simply no way that this car, or BMW's freak-show of an electric car will succeed. Why are they wasting their time and money? Why are they so stupid?

    Honestly, I don't know. I know a bit about business, but I can't make sense of corporations acting so illogically.

  9. Re:Maybe so but it is American Made on Cadillac Unveils Pricier Alternative To Tesla Model S · · Score: 2

    Thanks for the link. The batteries, which are a pretty major component by cost, are made in Japan by Panasonic. I was really hoping Tesla would find a way to work with an American battery vendor, but that didn't work out so well for Fisker, so I can't say I blame them. The steering column and maybe a handful of other stuff is made by Mercedes, who owns a small percentage of Tesla. This probably accounts for why it has a lower percentage made in the US/Canada.

  10. Re:You can buy a computer with Ubuntu preinstalled on Battlefield Director: Linux Only Needs One 'Killer' Game To Explode · · Score: 1

    I agree they need to put philosophy aside, and more funding would do wonders. However, it's the philosophy of most Linux distros that make Linux a difficult market to sell pre-compiled binary games, or any other application. Pre-compiled binaries work. Just look at Java as an example. I install the Oracle JRE, and host Minecraft on Linux 24/7 with no issues. If I try to use OpenJDK, forget it. Updates break it, whether it's a Minecraft update or an OpenJDK update.

    I'm currently working on a Linux port of a text-to-speech back-end for use with applications like Orca, which is a screen reader for the blind in Linux. The first version was super-easy. It's just a self-extracting shell script with the jar files pre-built. All the TTS engine interfaces are written in C, but they don't rely on any shared libraries. I ship both the compiled binaries and jar files in the self-extracting shell file. This think works on every version of every distro I've tried it on so far. This is especially important for the blind, who cant easily fix their system after an update breaks something in the TTS stack. As a result, most blind guys who use Linux simply avoid updating.

    So, I've got something here blind Linux users want and need, and all I want to do is share it for free, including source code. Given the open sharing and caring community we have in Linux land, getting it to blind users should be very easy, right? Nope. There is simply no distribution channel for pre-compiled binaries in Linux land that is anything like Android's Play Store. Instead, most blind guys use some flavor of Debian derived distro, where the only TTS engine that reliably works after an update is espeak. To reach these guys, I'll have to go through a ridiculous process to build a .deb and .rpm package, find a sponsor, get into Unstable releases, and wait a couple years until most blind guys update their distro.

    It's not a whole lot better for game developers, who also have to typically build stand-alone binaries and post them to their web site, with no standard channel for Linux distribution.

  11. Re: YOLD! on Battlefield Director: Linux Only Needs One 'Killer' Game To Explode · · Score: 1

    I just install the Oracle binary for JRE7 in my home directory in Ubuntu, and then don't bother updating it unless there's another Java scare. It seems to run forever, without a hiccup, update after update. I'd prefer to use OpenJDK, and I do for all my own Java projects, but after experiencing exactly what you are describing, I just hold my noise and install the closed-source binary. Java is *so* close to write-once, run anywhere, but in the end, evil marketing geniuses at Sun Micro put in just enough poison pills to make it a Sun-only system for the big Java titles. I often find it easier to port C code from Linux to Windows than Java from Oracle JDK to OpenJDK on the same version of Linux.

  12. Re: YOLD! on Battlefield Director: Linux Only Needs One 'Killer' Game To Explode · · Score: 1

    Don't feel bad. It's a common trait among many of the best programmers I've known. For example, at one point my wife was working on a web site for helping angel investors find entrepreneurs they want to invest in, and entrepreneurs to find angels they want as investors. She called it a "dating site for angle investors and entrepreneurs", and everyone always understood what she meant. Except my hard-core algorithm geek co-workers. They just stared at here with blank expressions, and then one of them asked, "Why would angel investors want to date entrepreneurs?"

  13. Re:Overall right but unlikely to happen on Battlefield Director: Linux Only Needs One 'Killer' Game To Explode · · Score: 3, Interesting

    I think the poster is not correct. He said:

    it is not hard to get your hands on Linux, for example, it only takes one game that motivates you to go there.

    First, he means GNU/Linux, not Linux. There are tons of games for Android/Linux. For GNU/Linux, he's dead wrong. I built a machine yesterday with my son with parts from Newegg, and installed Ubuntu 13.04. The motherboard was DOA. Is the average gamer going to figure that out? The Samsung SSD wouldn't come up and talk to Ubuntu until I initialized it in Windows, and even then I had to set the SATA controller in BIOS to use "IDE" mode so Linux would find it. Installing GNU/Linux remains solidly in the domain of geeks. Will Average Joe Gamer buy a $1,500 "gaming rig", wipe Windows, and install Linux? Yeah, right. Maybe Dell and HP will start selling GNU/Linux gaming rigs so our poor gamer wont have to deal with figuring out how to deal with Linux? And they'll do that because there's so much demand? Unfortunately, GNU/Linux remains solidly a hacker OS. Now, as a hacker, I quite like it :-) GNU/Linux is what it is, and if you like it like I do, then great. However, we don't have to spread it like religion to the masses.

    The GNU/Linux graphical desktop has been mostly dead for a while now, in terms of main stream adoption. Ubuntu bug #1 remains very much unresolved. It's not the fault of Linux, but of GNU/Linux. Linus won the OS kernel war, even against the great and powerful Microsoft, with his "Bazaar" approach. However, GNU lost the application war because GNU never accepted the hacker culture, where everyone is can create whatever hackish apps they like, and share them without friction. Instead, the Debian priests continue to maintain the purity of their "Cathedral" through exclusion of unworthy apps, and the process to publish an app is literally harder than getting married or getting a loan for a house. Arch is a good attempt to save GNU/Linux, but it's too little, too late, IMO. I hope I'm wrong...

  14. Re:YOLD! on Battlefield Director: Linux Only Needs One 'Killer' Game To Explode · · Score: 1

    Linux already dominates the gaming market. There are hundreds of thousands of games available for Android/Linux. If Debian/Linux and friends have trouble attracting the gaming crowed, it's quite simply not the fault of Linux.

  15. Re:Ring = Long Building on A Peek At Apple's Planned $5B HQ · · Score: 1

    If you aren't willing to cross the courtyard, like when it's raining, L/2 is correct. He define L as the length of the building, which when warped into a circle is still L. If you are willing to take a shortcut through the courtyard, then it's only L/pi.

  16. Re:But, but, but... on DOJ Hasn't Actually Found Silk Road Founder's Bitcoin Yet · · Score: 1

    I would be very surprised if there were no NSA plants on slashdot. Ever get into a back-end-forth on slashdot over some scary thing China has done? My understanding is the Chinese government makes no secret of paying people for positive comments, and the longer you argue with a guy who is unreasonably pro-Chinese, the more money he makes.

    If I were a policy maker for the NSA, I would certainly fund shills to help guide the development of secure communication architectures. I do believe I've run into these shills a couple of times, for example when discussing if BitTorrent should switch to SHA-256, which I was advocating. Some dick won the debate to stay on SHA-1 by being so annoying that everyone dropped out of the thread. Whether or not the NSA can currently defeat SHA-1, they have to believe that they will develop such an ability long before they can do so with SHA-256, so keeping BitTorrent on SHA-1 makes sense for the NSA. For example, if someone in Iran is downloading a pirated copy of Microsoft Windows using BitTorrent, the NSA might have some very interesting ideas of what they could do with an NSA-modified copy. They could subvert the torrent if they could defeat SHA-1. I suspect an NSA shill whenever I see someone arguing in an unreasonable fashion for a less secure architecture, or one that is secure, but centrally controlled, or spreading paranoia about developing yet-another-encryption algorithm.

    In the end, I trust the algorithms that have been proven through trial by fire. Ecliptic curve cryptography has gone way up in my esteem for it's success in Bitcoin. If it could be cracked for a few million dollars by any technically inclined geek out there, it would have been cracked already. If the NSA can crack it with a multi-billion dollar computer, who cares, other than serious criminals?

  17. Re:But, but, but... on DOJ Hasn't Actually Found Silk Road Founder's Bitcoin Yet · · Score: 2

    No, that's not what people have been saying at all. No one is saying that the NSA can create SHA-1 collisions at will, or decrypt AES at will. Geeks on slashdot should be able to succeed in protecting data they really want hidden, such as a bitcoin wallet. It sounds like this guy did just that. No reasonable interpretation of the 5th amendment would allow the government to force him to give up his passwords.

    The "Privacy Chicken Littles" have been complaining about the NSA tracking their locations, analyzing their social network connections, reading their emails, and generally sticking their electronic surveillance in every orifice. Personally, I'd have much less of a problem with this if they fessed up to what they're doing to spy on us. It's secret police that really scare me.

  18. Re:How about on California Outlaws 'Revenge Porn' · · Score: 3, Interesting

    It's nice to see some politicians passing a law that may actually help a few people...

  19. Re:Sounds like.. on NSA Abandoned Project To Track Cell Phone Locations · · Score: 2

    I would be somewhat surprised if the NSA does not already know nearly every person's activity down to who they had lunch with every day for the last few years, what they ordered for lunch, and whether the waiter reported the tip as income. They should have software that guesses pretty well who is sleeping with whom, and who's a drug dealer. If you carry a phone in your pocket, all they need is the SSID data your phone has seen to know where you've been. If they get GPS data, they can probably de-fuzz it, turning off the military obfuscation of your position, and track you to with about a yard. Combined with knowledge of all your credit card purchases, and they should have a decent idea of what you've been up to. Even cash should be pretty well tracked by now. Every machine capable of detecting a $5 vs a $20 should also be capable of scanning the bill's serial number, and that includes ATM machines. Combine that with the coming trend of web-cams aimed at license plates on all major roads connected to the internet...

    If the NSA does not do this, then how incompetent are they?

  20. Re:ROCK STAR DEVELOPER NON-EXISTANT on Ask Slashdot: Are 'Rock Star' Developers a Necessity? · · Score: 1

    "Finding a bug and fixing it is trivial" - Wow, if that's true for you, you've got a hell of a future. Debugging distributed system? While I often have to do this, I'd rather bang my head against a wall, and that's how I feel debugging code I wrote. I am guessing you feel this way about debugging other people's code. In all sincerity, if you find such work easy, I envy your ability and would not suggest you worry about developing new code. The world needs you just as your are.

    I do almost exclusively new code. I didn't ask for that job, but it's what I've been given, and I'm not complaining. Even so, I spend about as much time debugging my code as writing it.

  21. Re:ROCK STAR DEVELOPER NON-EXISTANT on Ask Slashdot: Are 'Rock Star' Developers a Necessity? · · Score: 1

    If our labor is truly no longer needed, then the natural solution is to pay people more for fewer hours worked. Work less, and enjoy more. It's all good!

    However, I do not believe that we have less need for labor in this country. With a huge retiring Baby Boom generation, cheap oil behind us, and a growing world population that will likely send food prices skyrocketing, I'm afraid every able bodied working-age person is going to need to lend a hand to keep the economy moving. We need more people working longer, which is the opposite of the unemployment situation we see now. We're not seeing this yet partially because the elderly are simply working longer, and not retiring. In a more fair economy, we'd give these older Americans a well earned retirement in reasonable comfort and let the new generation of workers take over. The problem is our economy is messed up.

    Why aren't we employing all the younger people and letting a lot of 70+ people retire? I see women working who must be in their 80's now days. We can point to the financial collapse of 2008 as a major culprit since it wiped out a lot of would-be retirees' savings. However, money is just how we keep score. Clearly, our score keeping got screwed up, and we're now not driving the economy in a way that makes sense. The same thing is happening to people who lose their jobs, either to off shore factories or better automation. There's no lack of need for working-age people's labor in this country, but because of a screwed up economy, a lot of people are suffering, out of work, under employed, and under paid. Change is always hard, and that's a major factor, but any person willing to relocate and retrain for a decent job should be able to find one.

    What is "profit based growth"? The opportunity to profit from your own labor is the driving force that enables a well-regulated free market economy to outperform communism. People need incentives to be highly productive. However, profits by themselves do not generate growth. I would rather see our country with companies growing 10% and not making a dime than not growing at all and making 10% in profit.

    Compare the USA median net worth to Austrailia's: Our $38K vs their $193K is pretty shabby. Do they work harder, and simply deserve more? I doubt it. The answer seems to have more to do with their far more progressive tax and wealth transfer system. If we could magically transfer some of the enormous wealth the richest old people have to the the rest of the old people, they'd all retire and we'd hire all those unemployed young guys. If we could also magically transfer some of that wealth to younger people who would use it to build businesses, we could solve our employment problem. It's simple to do. Simply tax assets the way we tax property, and use the money to eliminate the deficit, pay down the debt, increase Social Security and health benefits, and subsidize behavior that creates jobs with our tax dollars (we do the opposite today). Alternatively, do what we used to do, and tax high incomes at a much higher rate and don't let rich people leave obscene wealth to kids who never earned a dime. Pick your method of wealth transfer, but you have to pick one. Since money naturally can be used to make more money, you have to put something in the system to keep all money from eventually belonging to just one person. It's how we keep America from becoming a Banana Republic.

  22. Re:libertarian leanings on Open Source, Open World · · Score: 1

    First, let's congratulate Brazil for doing more than it's fair share in the open source community. We have a ton of open source people here in the US (RMS for example), and obviously Linus makes Finland an open source Mecca all by himself. I've dealt with several excellent open source devs from Brazil, many countries in Europe, and a ton in South America, yet I have yet to meet a decent open source developer from the entire content of Asia. What's up with Asia?

    Libertarian leanings? This comes from the basic principle that if I'm doing something that hurts no one then the government shouldn't interfere. I'm personally straight, but if my buddy and I were gay, the government shouldn't judge what we do in our own homes. The place where I disagree with a bunch of open source devs I know is heroin. I've seen that drug turn people into monsters, willing to pimp themselves as sex toys in scary neighborhoods for the next high. The Libertarian in me says let them do what they want, but the human in me says don't let them destroy their lives. I draw the line at free will. If two people do something that would get them stoned to death in the Middle East, but they both enjoy it and hurt no one, then fine. If they take heroin, crack, meth, or any new fangled drug that overrides free will, then we need to take away their freedom and help them recover.

    Libertarian leaning? Yes, we're all in favor of freedom.

  23. Re:Relative on Ask Slashdot: Are 'Rock Star' Developers a Necessity? · · Score: 1

    I totally agree. I don't know where this concept of the anti-social rock start coder comes from. Sure, most of us big geeks spend too much time on the computer, and by society norms maybe we're anti-social, but there are also plenty of coders who became coders specifically because they have a difficult time relating to people. Their abilities as coders does not seem to be any higher on average than coders with solid social skills. If anything, it may be lower.

    We currently have an opening for either a rock-star algorithms coder or a rock-star web developer (preferably with the Microsoft stack), so if you are a US citizen and live in the Raleigh/Durham area, feel free to ping waywardgeek in gmail land. I do the algorithms evaluation, and others do the works and plays well with others evaluation, and we try to hire people who ace algorithms and do well working with others. We don't have a solid web coder, and would be interested in someone who can lead our web effort, but it's still a team position. Lone wolf coders can be valuable, but that's not what we need.

  24. Re:Relative on Ask Slashdot: Are 'Rock Star' Developers a Necessity? · · Score: 5, Interesting

    I've known a lot of top programmers, and consider myself among them. Personally, I like to hire rock-star coders right out of college, before they have a chance to develop all those bad anti-social habits. I love it when a team of awesome programmers all work together effortlessly.

    Unfortunately, the typical experience for an awesome coder is to find that he's carrying the load by himself and getting help from coworkers that's slightly worse than no help at all. There's no mentor to show him how to work with his team, and he quickly becomes a lone wolf coder. Once a lone wolf coder develops his style of coding all by himself, it's pretty darned hard to ever get him integrated into an efficient team.

    The "best" coder I ever met, and this by the way is the only person I have ever met I have to admit can code circles around me, is Ken McElvain, founder and genius coder behind Synplicity's rapid IPO. The guy has an amazing mind. He's not only a Mozart with code, he's brilliant in business, and if he has an ego at all, you'd never know it from talking to him. He is definitely a lone wolf coder. There was simply no other path for him.

  25. Re:Nasty doc recovery bug fixed? on SUSE's LibreOffice Core Team Moves To Collabora · · Score: 5, Informative

    I figured a libre-office hater would be the first post. Just to counter it, here's my Open/Libre Office experience. In 2000, I started a software company in NC, and bought every employee (we were all big geek programmers) Linux laptops. I didn't pay for a single Windows Office license (though we paid for a bunch of Visual C++ pro seats). It's been 13 years, and even though I have been in a CTO role all that time, I've not once had to install Windows Office. I see co-workers, mostly in biz-dev, marketing, sales, or management roles who get squished by people who send them documents in a more recent Office format. Management hates paying for new software simply to load new file formats. LibreOffice has loaded and edited every file I ever had to deal with since 2000, for free, while my Office addicted co-workers have put out a lot of $$ just to keep up. You're upset about bugs in file recovery?!? Get a real job!

    Now I have to give Microsoft some kudos. They've actually managed to continue to innovate in this space, and the PowerPoint presentations I see from co-workers who are PowerPoint fan-boys beat anything I've seen from the LibreOffice geeks. From a visual presentation point of view, they win. That's worth some $.