You could initially set this all up in person, using published airline schedules. There's no evidence that they altered their plans due to circumstances: the president wasn't in washington but rather was at a public appearence in Florida; the pentagon and the WTC don't move around much. The extent of coordination needed at the time would probably be determining if the flights were going to be sufficiently on time. But that's not hard to determine without any direct communication, and even if you communicated directly, you don't have to say anything particularly suspicious; people in airports probably call each other to ask if planes are on time pretty frequently.
All of the planning involved would be about the same as planning a family reunion or a business meeting on the west coast: you have to get a bunch of people from different locations on planes at the same time.
The encouragement would come from within each group; this is what has to be well coordinated. But these people will be in the same place, and can talk to each other in person. We don't, at this point, know if there were groups that chickened out and didn't try to hijack the planes they were on. Additionally, each group probably wouldn't care too much whether the other attacks worked. It could easily have been that they wanted 4 chances to succeed, and planned for different targets so that they wouldn't get in each other's way.
For novices, Linux is more than sufficient already. There are a number of email clients that work, basic documents are easy in LaTeX, HTML, or plain text, and web surfing is about equally broken on all platforms; I'm not clear that spreadsheets are actually useful to novices. What novices need isn't software with any particular features, but software that is understood by the more experienced people they get help from.
Daily users are similar, but instead need the same software they used the day before. Daily users would use Linux software is that were what they found on their machine and they could figure out how to use it.
What a lot of software could really use is the ability to detect that the user has just done the same thing six times and ask if the user would like to create a macro. Of course, this would depend on a sensible scheme of detecting repeated
actions and a way of not getting in the way of users who actually don't want to do the same thing again.
Well, if you do one of those things, you should find a similarly straightforward program to do it with, and use that. But you'll probably be much more efficient if you don't have to scroll past programs for all of the tasks that you don't normally do to get to the program you actually use. Furthermore, you shouldn't lay out memos or presentation slides as if they were magazines, or sketch diagrams as if they were commercial art.
You certainly shouldn't use a set of programs that's insufficient for your tasks, but it's just as bad and more common to use a program that's excessively complicated for your tasks.
It seems that they're mainly looking for calls from victems to other people, which might describe the events better or differently than the recipients remember. If I were making such a call, and encryption was an option but not automatic, I'd probably leave it off.
I know that ground support for most such things would be very important, but it really seems like these people wouldn't have needed any help once the planes were in the air, and wouldn't have needed more people in advance.
People have sited the close timing of the attacks, but that would only take an afternoon with a set of flight schedules. Getting groups of people on a set of planes at the same time is the sort of thing that anyone planning, say, a family reunion can pull off, and get on one of the planes themselves.
The weapons seem to have been small blades attached to plastic handles. These are neither hard to come by, nor hard to get in sufficient quantity, nor hard to get by security (someone clean-shaven who doesn't want to check luggage?), nor hard to assemble.
The hard part really would be getting a group of people who could fight effectively with knives and could frighten people into obeying with some people who could fly airliners, who were willing to die intentionally, without tipping off any intelligence agencies; but if the group has formed, there's no need for more people left behind (aside, perhaps, from a spiritual leader; but the leader doesn't need to have any idea what's going on).
Probably the hardest thing would be thinking of the attack in the first place-- noticing that it would be easy to take control of an airplane, and that an airplane would make a very effective weapon. But again, there's no reason that the person who realized this couldn't have been one of the people who went along.
We will probably find out that the terrorists had families and friends, and that some of these had some idea about the plans, because even determined terrorists can't always keep a secret. But, for instance, bin Laden probably actually didn't know what the plans were, or exactly who was involved, even if the terrorists turn out to be from his group, precisely because he wouldn't want to be vital as a living person to the success of this and other acts; he'd want to be able to say that the reason it worked was simply because there are people who are both clever and sufficiently angry at the US, and that, as long as the US behaves badly, this is certain to happen every once in a while, even without any obvious leaders.
It really seems like this is the sort of thing that you could most effectively plan by having a group of people in a room figure out what they're going to do and then actually do it, without any communications in the field.
The US has been preparing for the wrong threat for a long time. All of the airport security we've had, all of the encryption-breaking technology, even Echelon can't really do anything against a well-organized group using forceful behavior and common household instruments.
If anything, this proves that we've been relying too much on technology; someone can find a situation in which all of our technology doesn't apply, and we find that we've been really skimpy on simple security and paying attention.
So people are spending money to get an advantage in a game, buying items that are essentially just bits on a server. A few years ago, people were spending about that much money buying items that were images on cardstock. It's not that different, except that the games of today weren't designed with the collectability and sale value of items in mind.
Obviously, even if his first 8 moves were to advance each of his pawns, he presumably did it in a relatively sensible order, and also didn't say beforehand what he was doing. Most of the ways to checkmate in under 8 moves (at least the really short ones) involve the loser blocking himself in significantly without any real defense; just moving all of the pawns around the king forward one makes it a bit less likely to lose quickly (although it makes it much more likely you'd lose eventually...).
Short probably played a standard openning planning for a middle game win, discovered a few moves in that his opponent was doing essentially nothing, but Short hadn't planned for that particular situation, so he essentially got to put his pieces anywhere he wanted on his side of the board before his opponent started playing. It's not like anyone thinks about what they'd do if their opponent plays E3, G3, B3, D3, A3, C3, H3, F3; 3 minutes would probably be long enough to think of something, but if you only figure out what's going on after 4 moves or so, and you don't really know the person will play the next 4, you might not want to spend the time figuring it out, considering that, if you think for 3 minutes and then the person doesn't just move pawns, you won't have time to think later.
I think he didn't exactly give up a dead-easy win, since he didn't know in advance that it would be like that. More that he got a huge positional advantage at the beginning and then lost anyway. I think that's somewhat plausible if he were playing someone as good as Fisher who had thought a lot about playing against a great positional advantage.
I bet Andrei Agassi could beat you in a tennis match even if he just stood there for the first few games. Not that tennis is all that similar, not being positional, but still...
I'd guess that he wanted to throw Short off (it sounds like that game was the first), and possibly get him to be careless, and also to make 8 quick moves at the beginning, saving his time for later. Also, while they're lousy moves to start with, they don't lead to any obvious attacks, so Short probably didn't have time to figure out how to take advantage of his ability to develop an attack without being bothered.
Although this is a very impressive robot (dealing with anything non-Lego with Legos is tough), I'd be much more impressed if someone built the part that figures out the solution out of Legos...
Microsoft Research comes up with brilliant new ideas and techniques. Then the rest of Microsoft re-implements them badly and in annoying ways, and incorporates technology stolen from other places.
It's kind of silly to have such a good research lab and then barely pay attention to it. On the other hand, they don't ignore it quite as much as Xerox ignored PARC. The real issue is that pure research, while very important for the quality of future software, is generally too far ahead of it's time to be useable by anything the parent company is doing.
I suspect that, in ten years, people will be as impressed by the work that was done at MS Research as people today are with the work done at PARC.
The particular problems that MS is facing currently aren't really interesting to the research people, because they're all tied to the particular set of products that are currently in the process of being phased out. They're interested in things that will still be useful after the commercial implementation gets botched by the inexperienced programmers and mangled by marketting and then the industry moves to the next concept; by the time their work is done, NT will be totally gone and multi-media will be done in dedicated memory on FPGA boards.
I know that MIT's CS and EE programs have been accredited for a long time, and their half-and-half program got accredited about 6 years ago. So I believe their programs are generally accredited, although new programs probably don't get accredited until they've worked out all the details and had them around for a bit.
Practically, it probably doesn't matter much, because MIT itself is so well known.
That sounds to me like the method of gaining access needs to have a secret process or information (i.e., key); otherwise the "with the authority of the copyright owner" bit fails.
That is, I can't release a version of gv that checks whether you're the authorized person, release a normal PDF document, and sue Adobe because their program breaks my scheme. Although, in the normal course of operation (of my program), you need my permission to access the document, you don't need to use information or a process or a treatment that requires my permission.
It's not so much that eBooks are easily broken as that there's nothing particular novel about the way to do it. Breaking CSS, for instance, requires a specialized program, whereas eBooks can be broken without anything specialized.
Actually, it's not entirely clear that the DMCA applies. The DMCA only applies if the copy-protection is "effective", whatever that means. Possibly encrypting the document with a key which is stored in a constant string in a large binary reader is "effective", but using pkzip and then xoring each byte with 102 (IIRC) is very possibly not.
It's also not clear that Acrobat doesn't circumvent the copy-protection; after all, even after using Dimitry's program, you need a PDF reader. A PDF reader is much much more complicated and difficult to write than xor. It's even more complicated than trying all of the possible bytes to xor with. Since Adobe hasn't even been raided yet, one might guess that what Dimitry did is fine, too.
The law may be unjust, but it's not so bas as to actually apply to what seems to have happened. After all, I can't sue all US computer companies for breaking my copy-protection method of XORing every byte with 0.
What they can do with this is precisely measure the weight of the kilogram hunk of metal, and define the kilogram to be the mass of anything that gives the same result. They're basically replacing the balance with the special cylinder on one pan with a one-pan scale that will stay calibrated.
I'm not entirely clear on how they intend to deal with the mass vs weight issue, though. If the experiment has to be done in Earth's gravity at that particular spot, we'd have to throw the aliens the whole planet to explain anything...
For a US company vs the US government, that would be the least of their worries... "We've decided to dissolve you. Now you can't sue anyone."
But foreign governments would have a bit of a harder time with MS, possibly. Plus it probably wouldn't be wise for them to bomb something on US territory...
The reasonable thing is instructions/second (clock rate/CPI). This is only at all valid for comparing the same architecture (RISC will have many more instructions/second, but take many more instructions to get anything done). Assuming the chips actually have the same ISA, a given program will have a certain number of instructions in a given section, and the time spent in that section will depend on how fast they get executed.
Of course, this ignores a number of issues (branch mispredict penalty, branch prediction rate, relative speeds of different instructions, etc) and also the fact that, much of the time, the processor is just waiting for memory anyway.
I think one interesting effect could be the creation of government contractors who produce free software: the government pays to have the software they need created, with the requirement that the result be released as free software, or the rights given to the government.
(aside from the details of the legislation: proprietary software is okay if no free alternative exists; it only applies to govt agencies)
This legislation isn't trying to promote freedom. It's trying to save money and reduce the influence of foriegn corporations. The idea is that it's bad for the country for the government to depend on the private sector for vital services.
Consider if some company held a patent on anti-counterfeiting techniques that you used in making your cash. If they felt like it, they could cancel your license, and you couldn't print any new cash. Clearly this would not be good for your economy. In general, it's a bad idea for governements to use anything that locks them in to a single vendor; best is if the government owns everything it needs to switch vendors whenever it wants.
The US wants to have emergency oil reserves, and these countries want to have the source and rights to the software they depend on.
It seems from the X18 architecture and the general format of Forth that it would be efficient at executing java bytecodes or at least as a good target for on-the-fly translation, since the JVM is also a stack machine. Java even has enough multithreading that it might be able to make use of having 25 processor cores on a chip.
Have you looked at Java as a high-level language for these systems or at Java bytecodes as a way to make common software available to users?
Didn't we just hear that wireless security was broken and an exploit published? I'm all for limits on law enforcement, but it's a bit silly if some guy driving by in a car can monitor your network, but the FBI can't...
The issue with carnivore is that it will be put at ISPs on parts of the network where most people can't listen; for this reason it can invade privary, and thus requires a court order (in theory). But wireless networks can be passively sniffed without any government powers, so it's much less of an issue.
The idea of "practical obscurity" is that you can find out individual records that you're looking for, but you can't just go and get all of the records. This effectively prevents data mining while allowing access to direct information of public record.
The real-world implementation is that you can go and ask for a record, and get a copy of it. But you have to ask for the record you want; you can't just say, "give me all the records you have". I'd be fine with a site that made public records available online in such a way as to prevent someone from sending it all the names from the phone book or something.
SSH sends the whole password at once (in SSH 1.2.31, sshconnect.c, lines 1786-1794). The issue is when you are typing something over an SSH connection. At this point, each keystroke (approx) gets sent in a separate packet to the machine you're connected to. So an attacker gets ~1 bit of info/character as you type.
If the attacker knows when to look, they have some chance of guessing a password you type over an SSH connection, either for the next hop, for su, or for something else like that.
In the case of connecting to a 3rd host, they get tipped off as to when to look by the 2nd connection; you form the 2nd connection, and then type your password over the 1st connection. Note that this attack requires that they detect both connections, and make timing measurements on the 1st one to get the password on the 2nd.
Slashdot Mirror
You could initially set this all up in person, using published airline schedules. There's no evidence that they altered their plans due to circumstances: the president wasn't in washington but rather was at a public appearence in Florida; the pentagon and the WTC don't move around much. The extent of coordination needed at the time would probably be determining if the flights were going to be sufficiently on time. But that's not hard to determine without any direct communication, and even if you communicated directly, you don't have to say anything particularly suspicious; people in airports probably call each other to ask if planes are on time pretty frequently.
All of the planning involved would be about the same as planning a family reunion or a business meeting on the west coast: you have to get a bunch of people from different locations on planes at the same time.
The encouragement would come from within each group; this is what has to be well coordinated. But these people will be in the same place, and can talk to each other in person. We don't, at this point, know if there were groups that chickened out and didn't try to hijack the planes they were on. Additionally, each group probably wouldn't care too much whether the other attacks worked. It could easily have been that they wanted 4 chances to succeed, and planned for different targets so that they wouldn't get in each other's way.
For novices, Linux is more than sufficient already. There are a number of email clients that work, basic documents are easy in LaTeX, HTML, or plain text, and web surfing is about equally broken on all platforms; I'm not clear that spreadsheets are actually useful to novices. What novices need isn't software with any particular features, but software that is understood by the more experienced people they get help from.
Daily users are similar, but instead need the same software they used the day before. Daily users would use Linux software is that were what they found on their machine and they could figure out how to use it.
What a lot of software could really use is the ability to detect that the user has just done the same thing six times and ask if the user would like to create a macro. Of course, this would depend on a sensible scheme of detecting repeated
actions and a way of not getting in the way of users who actually don't want to do the same thing again.
Well, if you do one of those things, you should find a similarly straightforward program to do it with, and use that. But you'll probably be much more efficient if you don't have to scroll past programs for all of the tasks that you don't normally do to get to the program you actually use. Furthermore, you shouldn't lay out memos or presentation slides as if they were magazines, or sketch diagrams as if they were commercial art.
You certainly shouldn't use a set of programs that's insufficient for your tasks, but it's just as bad and more common to use a program that's excessively complicated for your tasks.
It seems that they're mainly looking for calls from victems to other people, which might describe the events better or differently than the recipients remember. If I were making such a call, and encryption was an option but not automatic, I'd probably leave it off.
I know that ground support for most such things would be very important, but it really seems like these people wouldn't have needed any help once the planes were in the air, and wouldn't have needed more people in advance.
People have sited the close timing of the attacks, but that would only take an afternoon with a set of flight schedules. Getting groups of people on a set of planes at the same time is the sort of thing that anyone planning, say, a family reunion can pull off, and get on one of the planes themselves.
The weapons seem to have been small blades attached to plastic handles. These are neither hard to come by, nor hard to get in sufficient quantity, nor hard to get by security (someone clean-shaven who doesn't want to check luggage?), nor hard to assemble.
The hard part really would be getting a group of people who could fight effectively with knives and could frighten people into obeying with some people who could fly airliners, who were willing to die intentionally, without tipping off any intelligence agencies; but if the group has formed, there's no need for more people left behind (aside, perhaps, from a spiritual leader; but the leader doesn't need to have any idea what's going on).
Probably the hardest thing would be thinking of the attack in the first place-- noticing that it would be easy to take control of an airplane, and that an airplane would make a very effective weapon. But again, there's no reason that the person who realized this couldn't have been one of the people who went along.
We will probably find out that the terrorists had families and friends, and that some of these had some idea about the plans, because even determined terrorists can't always keep a secret. But, for instance, bin Laden probably actually didn't know what the plans were, or exactly who was involved, even if the terrorists turn out to be from his group, precisely because he wouldn't want to be vital as a living person to the success of this and other acts; he'd want to be able to say that the reason it worked was simply because there are people who are both clever and sufficiently angry at the US, and that, as long as the US behaves badly, this is certain to happen every once in a while, even without any obvious leaders.
It really seems like this is the sort of thing that you could most effectively plan by having a group of people in a room figure out what they're going to do and then actually do it, without any communications in the field.
The US has been preparing for the wrong threat for a long time. All of the airport security we've had, all of the encryption-breaking technology, even Echelon can't really do anything against a well-organized group using forceful behavior and common household instruments.
If anything, this proves that we've been relying too much on technology; someone can find a situation in which all of our technology doesn't apply, and we find that we've been really skimpy on simple security and paying attention.
So people are spending money to get an advantage in a game, buying items that are essentially just bits on a server. A few years ago, people were spending about that much money buying items that were images on cardstock. It's not that different, except that the games of today weren't designed with the collectability and sale value of items in mind.
Obviously, even if his first 8 moves were to advance each of his pawns, he presumably did it in a relatively sensible order, and also didn't say beforehand what he was doing. Most of the ways to checkmate in under 8 moves (at least the really short ones) involve the loser blocking himself in significantly without any real defense; just moving all of the pawns around the king forward one makes it a bit less likely to lose quickly (although it makes it much more likely you'd lose eventually...).
Short probably played a standard openning planning for a middle game win, discovered a few moves in that his opponent was doing essentially nothing, but Short hadn't planned for that particular situation, so he essentially got to put his pieces anywhere he wanted on his side of the board before his opponent started playing. It's not like anyone thinks about what they'd do if their opponent plays E3, G3, B3, D3, A3, C3, H3, F3; 3 minutes would probably be long enough to think of something, but if you only figure out what's going on after 4 moves or so, and you don't really know the person will play the next 4, you might not want to spend the time figuring it out, considering that, if you think for 3 minutes and then the person doesn't just move pawns, you won't have time to think later.
I think he didn't exactly give up a dead-easy win, since he didn't know in advance that it would be like that. More that he got a huge positional advantage at the beginning and then lost anyway. I think that's somewhat plausible if he were playing someone as good as Fisher who had thought a lot about playing against a great positional advantage.
I bet Andrei Agassi could beat you in a tennis match even if he just stood there for the first few games. Not that tennis is all that similar, not being positional, but still...
I'd guess that he wanted to throw Short off (it sounds like that game was the first), and possibly get him to be careless, and also to make 8 quick moves at the beginning, saving his time for later. Also, while they're lousy moves to start with, they don't lead to any obvious attacks, so Short probably didn't have time to figure out how to take advantage of his ability to develop an attack without being bothered.
Although this is a very impressive robot (dealing with anything non-Lego with Legos is tough), I'd be much more impressed if someone built the part that figures out the solution out of Legos...
Microsoft Research comes up with brilliant new ideas and techniques. Then the rest of Microsoft re-implements them badly and in annoying ways, and incorporates technology stolen from other places.
It's kind of silly to have such a good research lab and then barely pay attention to it. On the other hand, they don't ignore it quite as much as Xerox ignored PARC. The real issue is that pure research, while very important for the quality of future software, is generally too far ahead of it's time to be useable by anything the parent company is doing.
I suspect that, in ten years, people will be as impressed by the work that was done at MS Research as people today are with the work done at PARC.
The particular problems that MS is facing currently aren't really interesting to the research people, because they're all tied to the particular set of products that are currently in the process of being phased out. They're interested in things that will still be useful after the commercial implementation gets botched by the inexperienced programmers and mangled by marketting and then the industry moves to the next concept; by the time their work is done, NT will be totally gone and multi-media will be done in dedicated memory on FPGA boards.
I know that MIT's CS and EE programs have been accredited for a long time, and their half-and-half program got accredited about 6 years ago. So I believe their programs are generally accredited, although new programs probably don't get accredited until they've worked out all the details and had them around for a bit.
Practically, it probably doesn't matter much, because MIT itself is so well known.
[IANALE]
That sounds to me like the method of gaining access needs to have a secret process or information (i.e., key); otherwise the "with the authority of the copyright owner" bit fails.
That is, I can't release a version of gv that checks whether you're the authorized person, release a normal PDF document, and sue Adobe because their program breaks my scheme. Although, in the normal course of operation (of my program), you need my permission to access the document, you don't need to use information or a process or a treatment that requires my permission.
It's not so much that eBooks are easily broken as that there's nothing particular novel about the way to do it. Breaking CSS, for instance, requires a specialized program, whereas eBooks can be broken without anything specialized.
Actually, it's not entirely clear that the DMCA applies. The DMCA only applies if the copy-protection is "effective", whatever that means. Possibly encrypting the document with a key which is stored in a constant string in a large binary reader is "effective", but using pkzip and then xoring each byte with 102 (IIRC) is very possibly not.
It's also not clear that Acrobat doesn't circumvent the copy-protection; after all, even after using Dimitry's program, you need a PDF reader. A PDF reader is much much more complicated and difficult to write than xor. It's even more complicated than trying all of the possible bytes to xor with. Since Adobe hasn't even been raided yet, one might guess that what Dimitry did is fine, too.
The law may be unjust, but it's not so bas as to actually apply to what seems to have happened. After all, I can't sue all US computer companies for breaking my copy-protection method of XORing every byte with 0.
What they can do with this is precisely measure the weight of the kilogram hunk of metal, and define the kilogram to be the mass of anything that gives the same result. They're basically replacing the balance with the special cylinder on one pan with a one-pan scale that will stay calibrated.
I'm not entirely clear on how they intend to deal with the mass vs weight issue, though. If the experiment has to be done in Earth's gravity at that particular spot, we'd have to throw the aliens the whole planet to explain anything...
For a US company vs the US government, that would be the least of their worries... "We've decided to dissolve you. Now you can't sue anyone."
But foreign governments would have a bit of a harder time with MS, possibly. Plus it probably wouldn't be wise for them to bomb something on US territory...
The reasonable thing is instructions/second (clock rate/CPI). This is only at all valid for comparing the same architecture (RISC will have many more instructions/second, but take many more instructions to get anything done). Assuming the chips actually have the same ISA, a given program will have a certain number of instructions in a given section, and the time spent in that section will depend on how fast they get executed.
Of course, this ignores a number of issues (branch mispredict penalty, branch prediction rate, relative speeds of different instructions, etc) and also the fact that, much of the time, the processor is just waiting for memory anyway.
I think one interesting effect could be the creation of government contractors who produce free software: the government pays to have the software they need created, with the requirement that the result be released as free software, or the rights given to the government.
(aside from the details of the legislation: proprietary software is okay if no free alternative exists; it only applies to govt agencies)
This legislation isn't trying to promote freedom. It's trying to save money and reduce the influence of foriegn corporations. The idea is that it's bad for the country for the government to depend on the private sector for vital services.
Consider if some company held a patent on anti-counterfeiting techniques that you used in making your cash. If they felt like it, they could cancel your license, and you couldn't print any new cash. Clearly this would not be good for your economy. In general, it's a bad idea for governements to use anything that locks them in to a single vendor; best is if the government owns everything it needs to switch vendors whenever it wants.
The US wants to have emergency oil reserves, and these countries want to have the source and rights to the software they depend on.
It seems from the X18 architecture and the general format of Forth that it would be efficient at executing java bytecodes or at least as a good target for on-the-fly translation, since the JVM is also a stack machine. Java even has enough multithreading that it might be able to make use of having 25 processor cores on a chip.
Have you looked at Java as a high-level language for these systems or at Java bytecodes as a way to make common software available to users?
Didn't we just hear that wireless security was broken and an exploit published? I'm all for limits on law enforcement, but it's a bit silly if some guy driving by in a car can monitor your network, but the FBI can't...
The issue with carnivore is that it will be put at ISPs on parts of the network where most people can't listen; for this reason it can invade privary, and thus requires a court order (in theory). But wireless networks can be passively sniffed without any government powers, so it's much less of an issue.
The idea of "practical obscurity" is that you can find out individual records that you're looking for, but you can't just go and get all of the records. This effectively prevents data mining while allowing access to direct information of public record.
The real-world implementation is that you can go and ask for a record, and get a copy of it. But you have to ask for the record you want; you can't just say, "give me all the records you have". I'd be fine with a site that made public records available online in such a way as to prevent someone from sending it all the names from the phone book or something.
All of this activity continues to show the passion of the consumer for music and the need for both legal protection and legitimate alternatives.
There are plenty of legitimate alternatives to RIAA-owned music. I agree, though, that consumers need legal protection...
Somehow, I think dancing on your motherboard is bad for your computer, even if it is a DDR motherboard...
SSH sends the whole password at once (in SSH 1.2.31, sshconnect.c, lines 1786-1794). The issue is when you are typing something over an SSH connection. At this point, each keystroke (approx) gets sent in a separate packet to the machine you're connected to. So an attacker gets ~1 bit of info/character as you type.
If the attacker knows when to look, they have some chance of guessing a password you type over an SSH connection, either for the next hop, for su, or for something else like that.
In the case of connecting to a 3rd host, they get tipped off as to when to look by the 2nd connection; you form the 2nd connection, and then type your password over the 1st connection. Note that this attack requires that they detect both connections, and make timing measurements on the 1st one to get the password on the 2nd.