But, of course, if a similar situation allowed the EU to take down Microsoft, well then screw ethics and what's right!
The EU hasn't shown a desire to prosecute MS for US actions, but I don't doubt they'll keep them in mind when determining motive and penalty.
And the worst the EU can do to MS is shut down their European branches, force them out. They could ask MS to pay so much that it'd break the US branch, but they wouldn't have the ability to enforce it, so MS would just close up and leave Europe.
It's not unreasonable to prosecute someone for something done while in another country, as long as your punishments include an option for deporting them back to that country. That way, if the EU doesn't want MS they could make them pack up and leave. If the US didn't want Skylarov, they could deport him back to Russia. (Or, at his option, he could serve a sentence in the US and be declared rehabilitated.) But, if Skylarov had broken a law here, it would be reasonable to look at his actions while in Russia to determine if his crime here was intentional or not.
Because Yoda was corny and Dobby was pathetically done.
Doing an unreal character is trivial. Jar-Jar looked good in a still, as would Dobby I suppose, but they both had such exagerated movements and facial expressions that a child could have animated them. They didn't appear human and as such, weren't judged as harshly as Gollum was.
A category for best mo-capped performance might not be a bad idea. We'll see a lot more of it in the future and it is different than on-camera acting. Easier in some ways, harder in others, at least as long as it's done in a studio instead of on-set and filmed over.
The special effects category needs rework too. Eventually 50% of a movie will be special effects, should they be only one award for it? When sets are built in a computer will we have a 3d-Architecture award, a Texturing award, Landscapes, Sunrise/Sunsets, etc? In many ways we should, they're all distinct skills. As different as costuming and set design are from each other.
What you missed is that before sending the digest, you XOR it with additional bits of the OTP.
I don't think that would work. If you have six keys, (k1-k6) and XOR them with the plaintext in order, you can extract the key (collectively) for that piece by XORing the cyphertext with the plaintext.
p ^ k1 ^ k2 ^ k3 = c. c ^ p = (keys). fp ^ (keys) = fc. (fp, fc - fake cypher/plain text.)
So, if Malory, the malicous attacker, feeds Alice a known message (or finds out about one she's sending) to Bob, he can calculate the message digest for it. Because he can calculate it, he can XOR it with the cyphertext (even if multiple keys were used to generate that cyphertext) and pull out the original digest. He then takes his new message, and plaintext, and XORs it with the key material he recovered.
Assuming the malicious attacker knows the whole message, and how to calculate the digest (a safe bet), he can always substitute his own message (and the appropriate digest).
You can get around this, in a hack, by using a property of the digest to select which piece of the one-time-pad to use to encrypt it. For instance, take the last two digits of the digest that you calculate for the message, use that as an offset into the OTP (throw the intermediate bytes away). This way, if the digest's last two numbers don't match the original, the intended recipient tries to use the wrong key material and of course doesn't decrypt the received digest properly, so they know something is wrong.
But, it's a hack. You'd be better off making sure you prevent the enemy from ever knowing a full plaintext by encrypting some OTP material with the message and stripping it off at the other end.
With all the weakness that can come from an incorrectly used OTP you're better off avoiding them unless you *need* absolute security that you'll lose if they invent a magical way to factor numbers tomorrow.
Please clarify. The first half of the sentence seems to refer to avoiding OTP, the second half seems to refer to PKI.
It is a bit convoluted, yes. I mean, using RSA depends of the difficulty of factoring long numbers. If you are afraid that this (and the equations other types of PK depend on) are going to become easy (like in _Sneakers_) you should look at one-time-pads, the non-mathematical system that can't be broken by cryptographic methods. But, OTPs are very sensitive to proper use. As has been demonstrated, even sending two messages with the same key destroys security for both. Not transmitting random data in the message makes them subject to MITM attacks, etc. While they are theoretically more secure, they are easier to use incorrectly which usually has a worse failure mode (less real security) than other methods of crypto. As such, you're better off avoiding OTPs unless you *need* that full theoretical strength, as it'll be such a pain achieving it.
More thoughts on OTP. The OTP can actually be made up of multiple parts XORed together.
That's a reasonable precaution against capture of the pad. You're more likely to notice one of three attempts to break in and steal the OTP, etc. But once they're XORed together, you're back to a single key. It doesn't matter how many keys you XOR the plaintext with, I can XOR the cyphertext with the plaintext, and seperate all the keys.
I'm sure someone imaginitive, [...] could even improve upon my hypothetical scheme here to securely transmit secrets between various installations.
If you want ideas on how to make OTPs more secure, how about taking each byte of the plaintext and skipping into the OTP based on the value of that character? Let's assume infinite pad material. Based on the ascii value of the first byte (encrypted with the first byte of pad material) you skip that many bytes of pad material. For instance, if the plaintext is 'A' you skip 65 bytes of pad material to get the "key" for the second byte. If the plaintext is known I can calculate what the "key" is for that block, but if I substitute a different message the key would change. (This is how many cyphers work, using either the plain or cyphertext in a feedback loop.)
This way, if the message is altered you won't use the same portion of the pad to decrypt it and it'll result in garbage.
You don't need to skip that much key material, maybe take the modulus 3 of the running md5 sum of the message. You still want a footer to the message to prevent the last character being changed; "Being Attacked!" to "Being Attacked?" for instance.
But, your best bet for using OTPs is to encrypt secret keys for 3DES or some strong cypher, use the cypher for the actual data transfer. Use OTPs 100% strength on short message where it's worth the time of hauling around key material, and use it sparingly so you don't make a mistake which is all too easy when using OTPs for real.
So do you still have any concerns about MITM attacks on an OTP based system?
Yes. They're pretty easy to implement improperly. I know everything I proposed is required to fix a flaw in the basic implementation, but I doubt that's anywhere near the end of the flaws.
No, I meant, if you're using a one-time-pad it's probably because you don't trust mathematical cyphering. OTPs are awkward and modern cyphers a very secure. So, you probably wouldn't use PK with your OTP because if PK was an option, you'd just use it from the beginning.
A partial known-plaintext can't be replaced without suspicion, if you don't know where your string is, in the cyphertext. Correct.
However, if the location is known (as in a standard message, or a packet of known type) you can easily change the plaintext to a string of your choice. So you propose the message digest, so that a change will be obvious.
This doesn't work though, in the situation where you know *the full, exact plaintext*. If you do, you can substitute any message of the same length and calculate your own message digest.
This means you need to prevent attacker ever knowing the full plaintext. You can't assume they'll never see it because they may feed the message to someone to transmit. So you need to pre/append random characters. This way, even if they know where in the string the plaintext is, they can't know the whole thing, and thus can never forge the message digest. Because the random header is based on the OTP itself, they can't just make it up.
If you're using PK this is irrelevant, but if you're using PK, why are you wasting your time sending OTPs around? With all the weakness that can come from an incorrectly used OTP you're better off avoiding them unless you *need* absolute security that you'll lose if they invent a magical way to factor numbers tomorrow.
Well, what if you changes "Allies bombing Berlin - send help!" to "Allies bombing Munich - send help!"? The fighters are sent off to the wrong city.
Your suggestion of using PKI only helps a bit. The discussions of OTPs suggests that you don't trust mathematical cyphers.
This is fixed by having a random message header and a message digest at the end.
Header generation is the only tricky part. You need to anticipate the case where the whole message is seen in plaintext and subject to a MITM attack. This means you can't let the enemy substitute his own random header (because the header plus the message are the whole thing, he could then forge the digest). So you base the header on the only thing you can assume is secret, the pad itself. Take the first sixteen bytes of the OTP and encrypt the first eight with the second eight. Use this as the header for the message. Then skip these bytes (of course) and start encrypting the message.
Using the OTP like this means that the attacker can't simply substitute any random garbage, it must be based on the OTP, and it's not fixed, so he can't forge the digest.
Of course, you should actually burn your OTP after using it. Not only does this keep the message from being decrypted after you're captured, but it also means that you'll never accidentaly receive the same message twice (a replay attack) because you won't have the key which would decrypt it anymore.
Fine, identify with the group. That's not the issue. The issue is claiming past events that happened to that group as if they happened to you.
You know they used to do nasty things to masturbators to keep them from "self-abusing". You likely feel as I do, that it was pointless, cruel, and misguided. But you shouldn't feel personally injured.
Ditto with WW2, many people of the classes Men, Women, German, English, Jewish, etc, died. While I am part of many of these groups, it's not a personal tragedy because I wasn't there. This doesn't mean I can't learn from it. I don't have to ignore history. In fact, my desire to have these *not* be my tragedy is a fairly effective teaching aid.
I agree, we should consider overthrowing out leaders more often, on both sides. If you really believe Bush is getting us into a terrible and needless war, surely it justifies trying to kill him before he gets us all killed. Seems reasonable to me, he's no better than Saddam, just another ruled sending his people out to die.
Secondly, no, most US citizens didn't get a choice of leader. The US voting system is broken. They got to express a preference, but then that preference was ignored.
I am not from India and therefore not an Indian. Do you still refer to people of African decent as "Niggers"? On has to assume so since the term "Indian" is just as insulting and poisonous.
Oh grow up. I am white, but I grew up with a half indian sister and full-indian step-mom and they used the term "Indian". The whole town, of both colors, used the term. It's technically incorrect but that doesn't make it in any way offensive. Unless you wish to get into tribe name it's actually pretty reasonable.
As for insulting and poisonous. Wow, you are *exactly* one of the people I was referring to. If there's a negative stereotype attached to Indian, it'll be there regardless of term. Does the KKK hate blacks less now that society uses the term "African American". Did anyone's life change when "black" fell out of use and that awkward title started being used, or "People of African Descent" as you seem to prefer.
Indian wasn't originally coined as in insult, And it's at least as accurate as "Native American". Hell, I'm a Native American. Born and raised here.
Your ancestors weren't harmed at all by "American Culture". They were harmed by men with guns who wanted their land. Happens all the time. You need to get over it. Various of my ancestors were killed by other people's ancestors. Neither I, nor my Danish friends (as one example of many) had anything to do with it, so it seems a little silly to be offended by it. In fact, I recognize your ancestors tragedy to be as tragic as my ancestors tragedy. If they were here right now, they'd deserve the right to bitch about how terrible their life is because of it. Neither of us would though.
And you are simply another racist appologist trying to justify your inability to accept diversity.
Oh grow up. You're not being diverse, you're being whiny. And I'm not being racist, I'm being insensitive. I'd say this even to someone of my own skin color, or to a woman who felt personally slighted by gender-related issues that never happened to her, and so on.
Isn't the rule about black and white rules 100% wrong then?
This is pretty simple. Are you allowed to claim something as a great personal trajedy and be *personally* offended? I'm not Jewish, nor was I alive during WW2, but I can realize the holocaust was tragic. That doesn't mean though, that I find it offensive to me, when someone mentions it in what I feel is too light a tone.
I don't think you can claim something to be personally offensive unless you yourself lived through it, are otherwise very closely connected. If not, you aren't much more strongly affected than anyone else.
There's a relatively simple test to determine how much you right-to-be-offended you deserve based on how close you are to a trajedy.
1) Did it happen before you were born? Y: 0%
2) Did it happen to someone you've never met? Y: 0%
You can choose either to be an individual, or just a part of a larger stereotype.
You can either be you, SalesGeek, an unique person, who has his own hobbies, his own skills, his own friends, or you can be "An Indian". If you accept the first, you aren't allowed to claim any trajedy that didn't directly affect you. If you choose the second, you're entitled to claim Little-Big-Horn as a personal trajedy, but you also accept whatever other racial stereotypes someone wants to heep on you.
You *can't* have it both ways. What do you want to be, you, or "just another indian"?
Are you on crack? What is "technically fast" supposed to mean? If anything, the actual 3Ghz processor that only performs on par with the actual 2.2Ghz CPU is the one playing technicality games.
Ignore the numbers, buy based on performance, which from the FS benchmarks is within 5% either way.
I'd buy a 200Mhz system if it'd play Doom3 faster than a P4-5Ghz. It's all about what it can do, not what the specs are.
No it wasn't [the last laugh]. If they keep using it you'll get a regular laugh, every six months or so. Until someone writes a nasty payload for once and wipes every Windows machine from the planet.
So the Iraqi citizens are responsible for Saddam? 100% of them voted him in. He's got a mandate from the people that you wouldn't believe! (I mean that. You literally would not believe it...)
Less than half the US population votes for Bush, even less than half the voters who voted. And many of the ones who did voted for him simply because they were voting anti-democrat. Ditto with many Gore votes.
In a broken system that doesn't allow you any real choice, you can't be held responsible for your vote. Especially when, like in Florida, it's pretty clear than many people's votes never were counted.
In a country that actually allowed proportional representation and approval voting (or some other similar system) can claim that their elected leaders are representative of the population. In the USA (and Canada, and many other countries) you vote only to try to keep the leader who's the farthest from your viewpoint getting from getting "elected".
> To take your example, a date conversion could be done by regex, [...]
But, for some things there are obivous ways to do things. A patent forces you to reinvent the wheel, a copyright does not. Ten different programers can all have identical code in their program because it's just the way a skilled programer implements such a thing, and they can all have copyright on their own identical code.
That means you can't just copy the code and call it yours, but if you look at it and it's the obvious way to do things, you can rewrite it and end up with identical results which you can call your own.
Obviously that depends on your intentions. Looking at something and realizing it's the easiest way to do something produces identical results to copying and pasting, one's allowed, the other isn't. If you were already in court for other copyright violation I imagine things would go badly, if this was the sole case against you it would very likely be dismissed.
Reading a Hemmingway story and writing one very much like his, but without his identical characters or his words, isn't a violation. Copyright is all about the form of the expression, not the substance behind it. It's why country music is all under copyright, yet they all thing about the dog being hit by a truck and their wife leaving them.:)
Assuming they did nick GPLed code, and released a product using it, there are two possible outcomes. (Assuming no court weirdness.)
1) They don't accept the GPL, so they violated standard copyright laws. They could be sued for up to some large ammount of money, plus all the proceeds off the sales of their product, plus potentially, some punative damages.
2) They realize that the easiest way out of this is to accept the GPL, which means they GPL the latest version of their OS. Then they probably go back to the non-GPLed version and start again. Which would mean than v1-4 are theirs, v5 is GPLed, and v6+ (the new stream based on 4.x) are theirs.
They have to accept the GPL for their work to be GPLd. If they don't, it's a standard copyright battle. However, if it's clear they knew about the GPL and ignored it, a judge might rule that they did implicitly accept and then violate the contract. It's unlikely, but it could happen.
Realistically though, they'll make sorry, cough up a little code, and promise not to do it again.
Copyright doesn't involve contamination like patents do. You can look at my code when writing your own, as long as you don't copy mine, but merely write something that does a similar thing, you're fine. (And, where a situation is basic enough that there's really only one way to do things, you can't enforce copyright on it because it's not a creative work at that point.)
Clean-room reverse engineering is done because trade secrets are often claimed to be involved, and because it's a perfect defense against claims of copying. "No, your honor. Here's twelve months of logs between two seperate engineering groups showing how we arrived at each piece of code." It's not technically required.
As for GPLing, versus LGPLing; yes, it can be a pain. But, you're still free to use it. It's only your desire to then release (not under GPL) your results which prevents this.
This is why pretty much everyone (even Stallman, though he does so for practical reasons, not philosophical) supports BSDLing source code for implementing standards. (TCP/IP, FTP, etc...)
>No, you get a page which works perfectly fine in Navigator 4.7, if you identify yourself as anything other than IE6 and above, or Netscape 6 and above.
That's not that Opera corp. says. They say you get a different page identifying as "Opera 7" and "Oprah 7". You claim the MS only checks for one of three options, 1) IE6+, 2) NS6+, 3) Other.
In this case, "Opera" and "Oprah" should both return the style sheet for #3 (Other). Microsoft *MUST* have had a fourth option in the code, because if they were looking for Only IE6+ and NS6+ they would have sent all versions of Opera the same code.
This fourth option may no longer exist, but MS has a long history of silently sabotaging the competition and then pretending it never happened. If it doesn't happen now the safe money is that MS saw Opera was onto them and they changed it.
It's DR-DOS all over again. Microsoft was, is, and will be, a criminal organization.
In the sense of duplicating other work instead of creating new software, don't 99% of all programs duplicate, almost exactly, another previous program?
Should we all be using NCSA Mosaic, or whatever was before that, simply because nobody should code a new web browser? Many GNU tools are better than the early versions. They standardized them and made many more powerful.
Also, some people say there are only seven (or twelve, or twenty-seven, etc) basic plots. Man vs Man, Man vs Nature, and so forth. Does this mean that once a book is written with a human protagonist and antagonist, that there are now only six (or eleven...) valid topics to write about? How close does something have to be to be a copy?
Basically, it's not only silly to accuse free-software authors of being derivative, but incorrect. Every OS needs a web browser, so writing one for every OS, or one that works substantially differently, isn't derivative, any more than the desire to write a poem, or go on a hike is derivative because your neighbor does those things. As for incorrect, all you need to do is point to a GPLed program that fits a niche not filled by other programs. PHP is one, Perl (though not strictly GPL), Apache (it's the best), Mozilla (completely scriptable, cross-OS, multi-language, development platform). There's a ton of innovation, but only so many recognizable categories. It's unfair to lambaste Microsoft for developing a file browser (Explorer) or a IDE (Visual Studio) (both quite good products) and it's unfair for attack the developers of Mozilla for trying to advance the state of the art.
Can each company afford to write a spreadsheet from scratch, just because they want a customized one? No. But if the source code was available, there'd be a job for an in-house programming making that software work better for that company.
I've had jobs like this. Theirs users complain that process X takes forever, or is very error-prone. I either modify the software to fix this, or code a front-end which gives them a faster or less quirky interface. Then every transaction they process is 30s faster, times ten operators, and 120+ calls per day, each. That quickly pays for itself, and for me. But those additions would be mostly useless to anyone else, so they'd never find them in off-the-shelf software, nor could they afford to code the whole thing from scratch, or even the fairly small subset they use.
They'll definately switch to Open Office's Calc from Excel or Paradox because it escapes vendor lock-in and allows them to modify on their own.
Someone has to write Open Office, but that's not an issue. They'd pay quite a bit for it, as long as it gave them the freedom they need.
What double-talk. The GPL merely prevents you from using my program and not letting someone see the results. The "user" is just as free as ever. The only party who isn't is the greedy "Developer" (do they actually develop anything) who wants to repackage a successful GPLed app as their own. The user, who wants to use the program, and perhaps build a new program based on it, is perfectly free to do so.
You know the story of the tragedy of the commons right? A public resource, if freely exploitable, gets exploited (and eventually destroyed) by a few abusers, and everyone suffers. A cap on unreasonable usage keeps the resource from going away and everyone benefits much more, even, in the long run, the abusers.
There's no supportable reason for basing your work on mine, but being unwilling to let other users base their work on yours. If your work is so much more important than mine, don't use mine. If mine is important enough to use, let other people discover it and use it too.
This isn't philosophy to me. This is practicality. I got into programming by being able to examine the source code of the programs on my Apple// DOS3.3 system disk. If that code wasn't available, I might not have learned to program. I want to create a world where current, real, working, code is available to people to learn from and base new advancements on. If every little advancement was locked away the open source code, which would be 95% of most apps, would be hidden (not distributed widely) and people would suffer. By making sure that new applications continue to be freely available to the users, you ensure that the software that's relevant to them is accessible.
And really, who does this hurt. Just the greedy assholes. No loss at all, imho.
How does your taking a GPLed program and releasing a non-GPLed version make anything more free? Perhaps one person feels more free, but everyone who gets their software later will feel less free. And you're greedy, there's no other motive for taking something produced by someone else and making a non-free version of it. You want to profit off of someone else's work, without sharing.
I think the world is more free if we restrict your ability to profit off of the commons which you and yours would soon destroy.
Anyways, your argument is lacking. You can usually just code your addition, however small, as a seperate program and call GPLed utilities to perform the background work. The only reason people hesitate to do this is that people can see how little their code really does. But, it's acceptable. Transgaming largely does this. You can achieve the same results with Wine, but painfully. People think their interface and installer is worth paying for. You're allowed to distribute GPLed applications with your closed-source program.
Talk about "freedoms" which don't involve you taking advantage of people, and we'll accomodate you.
Most people's problem with patents isn't the idea of paying to use Teflon, it's paying to use "Music, transfered over an electronic network" or letting companies patent discovered genes, instead of patenting the use of that gene, for a specific task.
The real problem is that patents used to be on a very specific process. A hundred people could patent ways of sending music over a network and not conflict. Now, they're granting patents on the idea of sending the music over a network. You can't just come up with an easier way to it.
Patents also don't allow for independent discovery. Let's say I develop a process to, paint plastic for instance, and am slowly developing it. If you were doing the same thing and you patent it, I can't point to my years of research, notes, and prototypes, as proof that I didn't use your patent. If I want to use the method I developed, I'd have to pay you. Like the story of Alexander Bell and the telephone, supposedly beating Elisha Gray to the patent office, and Antonio Meucci supposedly had invented it twenty years earlier but was unable to commercialize it properly for various reasons.
I feel patents should have to 1) be useful, and 2) be used, for you to have to pay royalties. The mere idea of sending music over a network is useless, ideas are a dime a dozen. And the telephone patent. Why should Elisha or Antonio have to pay Bell when they didn't get anything for his patent?
Not all problems with patents are from people who simply don't want to pay for what they use.
Even worse. You can't sue them. They lobbied for, and recieved, immunity to prosecution because "we just report the data". As long as they take steps, incredibly small ones, to correct the data, they're off the hook.
Basically, if the problem is theirs, (a typo) they have to fix it, if you can prove it. If the problem is that you disagree with a company, the bad data stays on your report until the company says otherwise. If the company is badly run, out of business, or dislikes you, it may not be possible to get this data corrected.
There is a procedure for this too, but it's even longer. Basically, you're hosed. Credit-Reporting agencies are essentially prosecution immune and the burden of proof lies with you.
Thank "political donations" that made this possible. Never vote against "campaign contributions", you'll be voting against free speech!/sarcasm
I'd agree, Financial independence is very important. Moreso than raw income. I'd rather be debt free than have a new car, a 50" TV and monthly payments.
Slashdot Mirror
But, of course, if a similar situation allowed the EU to take down Microsoft, well then screw ethics and what's right!
The EU hasn't shown a desire to prosecute MS for US actions, but I don't doubt they'll keep them in mind when determining motive and penalty.
And the worst the EU can do to MS is shut down their European branches, force them out. They could ask MS to pay so much that it'd break the US branch, but they wouldn't have the ability to enforce it, so MS would just close up and leave Europe.
It's not unreasonable to prosecute someone for something done while in another country, as long as your punishments include an option for deporting them back to that country. That way, if the EU doesn't want MS they could make them pack up and leave. If the US didn't want Skylarov, they could deport him back to Russia. (Or, at his option, he could serve a sentence in the US and be declared rehabilitated.) But, if Skylarov had broken a law here, it would be reasonable to look at his actions while in Russia to determine if his crime here was intentional or not.
Because Yoda was corny and Dobby was pathetically done.
Doing an unreal character is trivial. Jar-Jar looked good in a still, as would Dobby I suppose, but they both had such exagerated movements and facial expressions that a child could have animated them. They didn't appear human and as such, weren't judged as harshly as Gollum was.
A category for best mo-capped performance might not be a bad idea. We'll see a lot more of it in the future and it is different than on-camera acting. Easier in some ways, harder in others, at least as long as it's done in a studio instead of on-set and filmed over.
The special effects category needs rework too. Eventually 50% of a movie will be special effects, should they be only one award for it? When sets are built in a computer will we have a 3d-Architecture award, a Texturing award, Landscapes, Sunrise/Sunsets, etc? In many ways we should, they're all distinct skills. As different as costuming and set design are from each other.
I don't think that would work. If you have six keys, (k1-k6) and XOR them with the plaintext in order, you can extract the key (collectively) for that piece by XORing the cyphertext with the plaintext.
p ^ k1 ^ k2 ^ k3 = c. c ^ p = (keys). fp ^ (keys) = fc.
(fp, fc - fake cypher/plain text.)
So, if Malory, the malicous attacker, feeds Alice a known message (or finds out about one she's sending) to Bob, he can calculate the message digest for it. Because he can calculate it, he can XOR it with the cyphertext (even if multiple keys were used to generate that cyphertext) and pull out the original digest. He then takes his new message, and plaintext, and XORs it with the key material he recovered.
Assuming the malicious attacker knows the whole message, and how to calculate the digest (a safe bet), he can always substitute his own message (and the appropriate digest).
You can get around this, in a hack, by using a property of the digest to select which piece of the one-time-pad to use to encrypt it. For instance, take the last two digits of the digest that you calculate for the message, use that as an offset into the OTP (throw the intermediate bytes away). This way, if the digest's last two numbers don't match the original, the intended recipient tries to use the wrong key material and of course doesn't decrypt the received digest properly, so they know something is wrong.
But, it's a hack. You'd be better off making sure you prevent the enemy from ever knowing a full plaintext by encrypting some OTP material with the message and stripping it off at the other end.
Please clarify. The first half of the sentence seems to refer to avoiding OTP, the second half seems to refer to PKI.
It is a bit convoluted, yes. I mean, using RSA depends of the difficulty of factoring long numbers. If you are afraid that this (and the equations other types of PK depend on) are going to become easy (like in _Sneakers_) you should look at one-time-pads, the non-mathematical system that can't be broken by cryptographic methods. But, OTPs are very sensitive to proper use. As has been demonstrated, even sending two messages with the same key destroys security for both. Not transmitting random data in the message makes them subject to MITM attacks, etc. While they are theoretically more secure, they are easier to use incorrectly which usually has a worse failure mode (less real security) than other methods of crypto. As such, you're better off avoiding OTPs unless you *need* that full theoretical strength, as it'll be such a pain achieving it.
More thoughts on OTP. The OTP can actually be made up of multiple parts XORed together.
That's a reasonable precaution against capture of the pad. You're more likely to notice one of three attempts to break in and steal the OTP, etc. But once they're XORed together, you're back to a single key. It doesn't matter how many keys you XOR the plaintext with, I can XOR the cyphertext with the plaintext, and seperate all the keys.
I'm sure someone imaginitive, [...] could even improve upon my hypothetical scheme here to securely transmit secrets between various installations.
If you want ideas on how to make OTPs more secure, how about taking each byte of the plaintext and skipping into the OTP based on the value of that character? Let's assume infinite pad material. Based on the ascii value of the first byte (encrypted with the first byte of pad material) you skip that many bytes of pad material. For instance, if the plaintext is 'A' you skip 65 bytes of pad material to get the "key" for the second byte. If the plaintext is known I can calculate what the "key" is for that block, but if I substitute a different message the key would change. (This is how many cyphers work, using either the plain or cyphertext in a feedback loop.)
This way, if the message is altered you won't use the same portion of the pad to decrypt it and it'll result in garbage.
You don't need to skip that much key material, maybe take the modulus 3 of the running md5 sum of the message. You still want a footer to the message to prevent the last character being changed; "Being Attacked!" to "Being Attacked?" for instance.
But, your best bet for using OTPs is to encrypt secret keys for 3DES or some strong cypher, use the cypher for the actual data transfer. Use OTPs 100% strength on short message where it's worth the time of hauling around key material, and use it sparingly so you don't make a mistake which is all too easy when using OTPs for real.
So do you still have any concerns about MITM attacks on an OTP based system?
Yes. They're pretty easy to implement improperly. I know everything I proposed is required to fix a flaw in the basic implementation, but I doubt that's anywhere near the end of the flaws.
No, I meant, if you're using a one-time-pad it's probably because you don't trust mathematical cyphering. OTPs are awkward and modern cyphers a very secure. So, you probably wouldn't use PK with your OTP because if PK was an option, you'd just use it from the beginning.
A partial known-plaintext can't be replaced without suspicion, if you don't know where your string is, in the cyphertext. Correct.
However, if the location is known (as in a standard message, or a packet of known type) you can easily change the plaintext to a string of your choice. So you propose the message digest, so that a change will be obvious.
This doesn't work though, in the situation where you know *the full, exact plaintext*. If you do, you can substitute any message of the same length and calculate your own message digest.
This means you need to prevent attacker ever knowing the full plaintext. You can't assume they'll never see it because they may feed the message to someone to transmit. So you need to pre/append random characters. This way, even if they know where in the string the plaintext is, they can't know the whole thing, and thus can never forge the message digest. Because the random header is based on the OTP itself, they can't just make it up.
If you're using PK this is irrelevant, but if you're using PK, why are you wasting your time sending OTPs around? With all the weakness that can come from an incorrectly used OTP you're better off avoiding them unless you *need* absolute security that you'll lose if they invent a magical way to factor numbers tomorrow.
Well, what if you changes "Allies bombing Berlin - send help!" to "Allies bombing Munich - send help!"? The fighters are sent off to the wrong city.
Your suggestion of using PKI only helps a bit. The discussions of OTPs suggests that you don't trust mathematical cyphers.
This is fixed by having a random message header and a message digest at the end.
Header generation is the only tricky part. You need to anticipate the case where the whole message is seen in plaintext and subject to a MITM attack. This means you can't let the enemy substitute his own random header (because the header plus the message are the whole thing, he could then forge the digest). So you base the header on the only thing you can assume is secret, the pad itself. Take the first sixteen bytes of the OTP and encrypt the first eight with the second eight. Use this as the header for the message. Then skip these bytes (of course) and start encrypting the message.
Using the OTP like this means that the attacker can't simply substitute any random garbage, it must be based on the OTP, and it's not fixed, so he can't forge the digest.
Of course, you should actually burn your OTP after using it. Not only does this keep the message from being decrypted after you're captured, but it also means that you'll never accidentaly receive the same message twice (a replay attack) because you won't have the key which would decrypt it anymore.
Fine, identify with the group. That's not the issue. The issue is claiming past events that happened to that group as if they happened to you.
You know they used to do nasty things to masturbators to keep them from "self-abusing". You likely feel as I do, that it was pointless, cruel, and misguided. But you shouldn't feel personally injured.
Ditto with WW2, many people of the classes Men, Women, German, English, Jewish, etc, died. While I am part of many of these groups, it's not a personal tragedy because I wasn't there. This doesn't mean I can't learn from it. I don't have to ignore history. In fact, my desire to have these *not* be my tragedy is a fairly effective teaching aid.
I agree, we should consider overthrowing out leaders more often, on both sides. If you really believe Bush is getting us into a terrible and needless war, surely it justifies trying to kill him before he gets us all killed. Seems reasonable to me, he's no better than Saddam, just another ruled sending his people out to die.
Secondly, no, most US citizens didn't get a choice of leader. The US voting system is broken. They got to express a preference, but then that preference was ignored.
I am not from India and therefore not an Indian. Do you still refer to people of African decent as "Niggers"? On has to assume so since the term "Indian" is just as insulting and poisonous.
Oh grow up. I am white, but I grew up with a half indian sister and full-indian step-mom and they used the term "Indian". The whole town, of both colors, used the term. It's technically incorrect but that doesn't make it in any way offensive. Unless you wish to get into tribe name it's actually pretty reasonable.
As for insulting and poisonous. Wow, you are *exactly* one of the people I was referring to. If there's a negative stereotype attached to Indian, it'll be there regardless of term. Does the KKK hate blacks less now that society uses the term "African American". Did anyone's life change when "black" fell out of use and that awkward title started being used, or "People of African Descent" as you seem to prefer.
Indian wasn't originally coined as in insult, And it's at least as accurate as "Native American". Hell, I'm a Native American. Born and raised here.
Your ancestors weren't harmed at all by "American Culture". They were harmed by men with guns who wanted their land. Happens all the time. You need to get over it. Various of my ancestors were killed by other people's ancestors. Neither I, nor my Danish friends (as one example of many) had anything to do with it, so it seems a little silly to be offended by it. In fact, I recognize your ancestors tragedy to be as tragic as my ancestors tragedy. If they were here right now, they'd deserve the right to bitch about how terrible their life is because of it. Neither of us would though.
And you are simply another racist appologist trying to justify your inability to accept diversity.
Oh grow up. You're not being diverse, you're being whiny. And I'm not being racist, I'm being insensitive. I'd say this even to someone of my own skin color, or to a woman who felt personally slighted by gender-related issues that never happened to her, and so on.
Isn't the rule about black and white rules 100% wrong then?
This is pretty simple. Are you allowed to claim something as a great personal trajedy and be *personally* offended? I'm not Jewish, nor was I alive during WW2, but I can realize the holocaust was tragic. That doesn't mean though, that I find it offensive to me, when someone mentions it in what I feel is too light a tone.
I don't think you can claim something to be personally offensive unless you yourself lived through it, are otherwise very closely connected. If not, you aren't much more strongly affected than anyone else.
There's a relatively simple test to determine how much you right-to-be-offended you deserve based on how close you are to a trajedy.
1) Did it happen before you were born?
Y: 0%
2) Did it happen to someone you've never met?
Y: 0%
You can choose either to be an individual, or just a part of a larger stereotype.
You can either be you, SalesGeek, an unique person, who has his own hobbies, his own skills, his own friends, or you can be "An Indian". If you accept the first, you aren't allowed to claim any trajedy that didn't directly affect you. If you choose the second, you're entitled to claim Little-Big-Horn as a personal trajedy, but you also accept whatever other racial stereotypes someone wants to heep on you.
You *can't* have it both ways. What do you want to be, you, or "just another indian"?
Are you on crack? What is "technically fast" supposed to mean? If anything, the actual 3Ghz processor that only performs on par with the actual 2.2Ghz CPU is the one playing technicality games.
Ignore the numbers, buy based on performance, which from the FS benchmarks is within 5% either way.
I'd buy a 200Mhz system if it'd play Doom3 faster than a P4-5Ghz. It's all about what it can do, not what the specs are.
No it wasn't [the last laugh]. If they keep using it you'll get a regular laugh, every six months or so. Until someone writes a nasty payload for once and wipes every Windows machine from the planet.
So the Iraqi citizens are responsible for Saddam? 100% of them voted him in. He's got a mandate from the people that you wouldn't believe! (I mean that. You literally would not believe it...)
Less than half the US population votes for Bush, even less than half the voters who voted. And many of the ones who did voted for him simply because they were voting anti-democrat. Ditto with many Gore votes.
In a broken system that doesn't allow you any real choice, you can't be held responsible for your vote. Especially when, like in Florida, it's pretty clear than many people's votes never were counted.
In a country that actually allowed proportional representation and approval voting (or some other similar system) can claim that their elected leaders are representative of the population. In the USA (and Canada, and many other countries) you vote only to try to keep the leader who's the farthest from your viewpoint getting from getting "elected".
Misrepresentation of a competitors product. Lying. Can be illegal is done for your benefit.
> To take your example, a date conversion could be done by regex, [...]
:)
But, for some things there are obivous ways to do things. A patent forces you to reinvent the wheel, a copyright does not. Ten different programers can all have identical code in their program because it's just the way a skilled programer implements such a thing, and they can all have copyright on their own identical code.
That means you can't just copy the code and call it yours, but if you look at it and it's the obvious way to do things, you can rewrite it and end up with identical results which you can call your own.
Obviously that depends on your intentions. Looking at something and realizing it's the easiest way to do something produces identical results to copying and pasting, one's allowed, the other isn't. If you were already in court for other copyright violation I imagine things would go badly, if this was the sole case against you it would very likely be dismissed.
Reading a Hemmingway story and writing one very much like his, but without his identical characters or his words, isn't a violation. Copyright is all about the form of the expression, not the substance behind it. It's why country music is all under copyright, yet they all thing about the dog being hit by a truck and their wife leaving them.
Assuming they did nick GPLed code, and released a product using it, there are two possible outcomes. (Assuming no court weirdness.)
1) They don't accept the GPL, so they violated standard copyright laws. They could be sued for up to some large ammount of money, plus all the proceeds off the sales of their product, plus potentially, some punative damages.
2) They realize that the easiest way out of this is to accept the GPL, which means they GPL the latest version of their OS. Then they probably go back to the non-GPLed version and start again. Which would mean than v1-4 are theirs, v5 is GPLed, and v6+ (the new stream based on 4.x) are theirs.
They have to accept the GPL for their work to be GPLd. If they don't, it's a standard copyright battle. However, if it's clear they knew about the GPL and ignored it, a judge might rule that they did implicitly accept and then violate the contract. It's unlikely, but it could happen.
Realistically though, they'll make sorry, cough up a little code, and promise not to do it again.
Copyright doesn't involve contamination like patents do. You can look at my code when writing your own, as long as you don't copy mine, but merely write something that does a similar thing, you're fine. (And, where a situation is basic enough that there's really only one way to do things, you can't enforce copyright on it because it's not a creative work at that point.)
Clean-room reverse engineering is done because trade secrets are often claimed to be involved, and because it's a perfect defense against claims of copying. "No, your honor. Here's twelve months of logs between two seperate engineering groups showing how we arrived at each piece of code." It's not technically required.
As for GPLing, versus LGPLing; yes, it can be a pain. But, you're still free to use it. It's only your desire to then release (not under GPL) your results which prevents this.
This is why pretty much everyone (even Stallman, though he does so for practical reasons, not philosophical) supports BSDLing source code for implementing standards. (TCP/IP, FTP, etc...)
>No, you get a page which works perfectly fine in Navigator 4.7, if you identify yourself as anything other than IE6 and above, or Netscape 6 and above.
That's not that Opera corp. says. They say you get a different page identifying as "Opera 7" and "Oprah 7". You claim the MS only checks for one of three options, 1) IE6+, 2) NS6+, 3) Other.
In this case, "Opera" and "Oprah" should both return the style sheet for #3 (Other). Microsoft *MUST* have had a fourth option in the code, because if they were looking for Only IE6+ and NS6+ they would have sent all versions of Opera the same code.
This fourth option may no longer exist, but MS has a long history of silently sabotaging the competition and then pretending it never happened. If it doesn't happen now the safe money is that MS saw Opera was onto them and they changed it.
It's DR-DOS all over again. Microsoft was, is, and will be, a criminal organization.
In the sense of duplicating other work instead of creating new software, don't 99% of all programs duplicate, almost exactly, another previous program?
Should we all be using NCSA Mosaic, or whatever was before that, simply because nobody should code a new web browser? Many GNU tools are better than the early versions. They standardized them and made many more powerful.
Also, some people say there are only seven (or twelve, or twenty-seven, etc) basic plots. Man vs Man, Man vs Nature, and so forth. Does this mean that once a book is written with a human protagonist and antagonist, that there are now only six (or eleven...) valid topics to write about? How close does something have to be to be a copy?
Basically, it's not only silly to accuse free-software authors of being derivative, but incorrect. Every OS needs a web browser, so writing one for every OS, or one that works substantially differently, isn't derivative, any more than the desire to write a poem, or go on a hike is derivative because your neighbor does those things. As for incorrect, all you need to do is point to a GPLed program that fits a niche not filled by other programs. PHP is one, Perl (though not strictly GPL), Apache (it's the best), Mozilla (completely scriptable, cross-OS, multi-language, development platform). There's a ton of innovation, but only so many recognizable categories. It's unfair to lambaste Microsoft for developing a file browser (Explorer) or a IDE (Visual Studio) (both quite good products) and it's unfair for attack the developers of Mozilla for trying to advance the state of the art.
Can each company afford to write a spreadsheet from scratch, just because they want a customized one? No. But if the source code was available, there'd be a job for an in-house programming making that software work better for that company.
I've had jobs like this. Theirs users complain that process X takes forever, or is very error-prone. I either modify the software to fix this, or code a front-end which gives them a faster or less quirky interface. Then every transaction they process is 30s faster, times ten operators, and 120+ calls per day, each. That quickly pays for itself, and for me. But those additions would be mostly useless to anyone else, so they'd never find them in off-the-shelf software, nor could they afford to code the whole thing from scratch, or even the fairly small subset they use.
They'll definately switch to Open Office's Calc from Excel or Paradox because it escapes vendor lock-in and allows them to modify on their own.
Someone has to write Open Office, but that's not an issue. They'd pay quite a bit for it, as long as it gave them the freedom they need.
What double-talk. The GPL merely prevents you from using my program and not letting someone see the results. The "user" is just as free as ever. The only party who isn't is the greedy "Developer" (do they actually develop anything) who wants to repackage a successful GPLed app as their own. The user, who wants to use the program, and perhaps build a new program based on it, is perfectly free to do so.
// DOS3.3 system disk. If that code wasn't available, I might not have learned to program. I want to create a world where current, real, working, code is available to people to learn from and base new advancements on. If every little advancement was locked away the open source code, which would be 95% of most apps, would be hidden (not distributed widely) and people would suffer. By making sure that new applications continue to be freely available to the users, you ensure that the software that's relevant to them is accessible.
You know the story of the tragedy of the commons right? A public resource, if freely exploitable, gets exploited (and eventually destroyed) by a few abusers, and everyone suffers. A cap on unreasonable usage keeps the resource from going away and everyone benefits much more, even, in the long run, the abusers.
There's no supportable reason for basing your work on mine, but being unwilling to let other users base their work on yours. If your work is so much more important than mine, don't use mine. If mine is important enough to use, let other people discover it and use it too.
This isn't philosophy to me. This is practicality. I got into programming by being able to examine the source code of the programs on my Apple
And really, who does this hurt. Just the greedy assholes. No loss at all, imho.
How does your taking a GPLed program and releasing a non-GPLed version make anything more free? Perhaps one person feels more free, but everyone who gets their software later will feel less free. And you're greedy, there's no other motive for taking something produced by someone else and making a non-free version of it. You want to profit off of someone else's work, without sharing.
I think the world is more free if we restrict your ability to profit off of the commons which you and yours would soon destroy.
Anyways, your argument is lacking. You can usually just code your addition, however small, as a seperate program and call GPLed utilities to perform the background work. The only reason people hesitate to do this is that people can see how little their code really does. But, it's acceptable. Transgaming largely does this. You can achieve the same results with Wine, but painfully. People think their interface and installer is worth paying for. You're allowed to distribute GPLed applications with your closed-source program.
Talk about "freedoms" which don't involve you taking advantage of people, and we'll accomodate you.
Most people's problem with patents isn't the idea of paying to use Teflon, it's paying to use "Music, transfered over an electronic network" or letting companies patent discovered genes, instead of patenting the use of that gene, for a specific task.
The real problem is that patents used to be on a very specific process. A hundred people could patent ways of sending music over a network and not conflict. Now, they're granting patents on the idea of sending the music over a network. You can't just come up with an easier way to it.
Patents also don't allow for independent discovery. Let's say I develop a process to, paint plastic for instance, and am slowly developing it. If you were doing the same thing and you patent it, I can't point to my years of research, notes, and prototypes, as proof that I didn't use your patent. If I want to use the method I developed, I'd have to pay you. Like the story of Alexander Bell and the telephone, supposedly beating Elisha Gray to the patent office, and Antonio Meucci supposedly had invented it twenty years earlier but was unable to commercialize it properly for various reasons.
I feel patents should have to 1) be useful, and 2) be used, for you to have to pay royalties. The mere idea of sending music over a network is useless, ideas are a dime a dozen. And the telephone patent. Why should Elisha or Antonio have to pay Bell when they didn't get anything for his patent?
Not all problems with patents are from people who simply don't want to pay for what they use.
Even worse. You can't sue them. They lobbied for, and recieved, immunity to prosecution because "we just report the data". As long as they take steps, incredibly small ones, to correct the data, they're off the hook.
/sarcasm
Basically, if the problem is theirs, (a typo) they have to fix it, if you can prove it. If the problem is that you disagree with a company, the bad data stays on your report until the company says otherwise. If the company is badly run, out of business, or dislikes you, it may not be possible to get this data corrected.
There is a procedure for this too, but it's even longer. Basically, you're hosed. Credit-Reporting agencies are essentially prosecution immune and the burden of proof lies with you.
Thank "political donations" that made this possible. Never vote against "campaign contributions", you'll be voting against free speech!
I'd agree, Financial independence is very important. Moreso than raw income. I'd rather be debt free than have a new car, a 50" TV and monthly payments.