Stephenson has written an article that touches on the rivalry between two engineers in the Victorian age. It is available at Mother Earth Mother Board at Wired.
Still, telegraphy, like many other forms of engineering, retained a certain barnyard, improvised quality until the Year of Our Lord 1858, when the terrifyingly high financial stakes and shockingly formidable technical challenges of the first transatlantic submarine cable brought certain long-simmering conflicts to a rolling boil, incarnated the old and new approaches in the persons of Dr. Wildman Whitehouse and Professor William Thomson, respectively, and brought the conflict between them into the highest possible relief in the form of an inquiry and a scandal that rocked the Victorian world. Thomson came out on top, with a new title and name - Lord Kelvin.
The UNIX world has lagged far behind the Microsoft world (including both
MS-DOS and MS Windows) in the twin realms of binary protection and reverse
engineering.
The variety and types of binary protection are a major area of difference.
MS Windows PE binaries can be encrypted, packed, wrapped, and thoroughly
obfuscated, and then decrypted, unpacked, unwrapped, and reconstructed.
Conversely, the best that can be done to a UNIX ELF binary is stripping the
debugging symbol table. There are no deconstructors, no wrappers, no
encrypters, and only a single packer (UPX [12], aimed at decreasing disk
space, not increasing protection) for the ELF. Clearly the UNIX ELF binary
is naked compared to the powerful protections afforded the Windows PE binary
format.
The quantity and quality of reverse engineering tools are other key areas
of significant gulf. The runtime environment of the PE binary, and indeed
the very operating system it executes on, is at the mercy of the brilliant
debugger SoftICE. Meanwhile the running ELF can only be examined one word
at a time via the crippled system call ptrace(), imperfectly interfaced via
adb and its brain dead cousin: gdb. The procfs, on those systems on which
it is present, typically only provides the ability to examine a process
rather than control it. Indeed, the UNIX world is an unrealised nightmare
for the UNIX reverse engineer. Unrealised because up until now no one has
bothered to protect an ELF binary.
Inspiration strikes for JonKatz!
on
The Rise of CSI
·
· Score: 1
Jon Katz's (note the apostrophes, please!) latest ramble seems to be inspired by a recent article at the Laissez Faire Electronic Times:
Show Me the Evidence, by Russell Madden
Some comparisons between the texts might prove instructive:
LFET article:
"graphic visual recreations of what happens to a human body when, for example, a bullet slams through a chest wall"
JonKatz:
"the path of a bullet will be illustrated graphically"
as well as: LFET article:
""Follow the evidence" is the dictum he drills into his coworkers. How the investigators "feel" about the clues they uncover does not matter"
JonKatz:
"Grissom and Willows [...] believe nothing anybody tells them, and they only trust solid evidence."
Maybe Jon had a little help on his Slashdot writing assignment from Junis in Afghanistan......
With the limited bandwidth they have (~2-4 Mbps last count), and the limited space in the various labs, it doesn't take much porn-surfing and mp3-downloading for everything to start working pretty slowly. Some of the labs already had time-limited access for non-UCT sites (ie no access during work hours). Of course, not all of the labs have 24hr access.
Specifically filtering the site because it is a porn site seems a bit rash, especially given that other sites can chew up much more bandwidth (mp3s, mpgs/DivX, etc). And there is the issue of UCT now having taken it upon themselves to filter the network content: They could now be responsible if any illegal content is found (this argument has been put forward on/. before).
There is more information available at the URL mentioned above.
Of course, there is also the whole definition of "public universities". Attending UCT is not free. They do, however, receive certain government funding. I do not if this could force them to suspend the filtering. They do classify the traffic according to academic relevance, sorta.
big fat pipe going from western europe to east asia
You may want to check out SAT-3/WASC/SAFE, which is actually two cables: one goes from Europe, down the West Coast of Africa to South Africa; the second goes up from South Africa past Mauritius to Malaysia. [NB: Don't confuse this cable with Africa One, which was referenced in this Slashdot story a while back.]
Telkom and the international companies behind SAT-3/WASC/SAFE are pushing them as a fully wet (and therefore, presumably safe) backup route for FLAG (WIRED article). Now FLAG is pretty old (and only ~5 Gbps, last time I checked), but there are a few other cables traversing the same route (eg SEA-ME-WE 3 (or is it 5?),) which is right through the currently-unstable Middle East. Some people like to be assured of the stability of any links they may buy - backup [wet] links are one of the answers.
And hey, it's great for [South] African [Internet] bandwidth!:)
I am not taking sides on the Microsoft NSA-key issue. For more information on the issue, please check out Cryptome
However, your comment:
"Show me any proof that MS has installed any backdoors "
is quite funny: FreeBSD and Linux and other OSS CAN be proven to not have any back-doors. Microsoft software cannot.
China, Japan, and militia-men (and anyone else that wants) can audit the software they run for anything they want to.
-Al
Encryption of structured data (eg text, pictures, etc) increases its randomness (ie lowers the entropy)
It is rumoured that the [NSA|GCHQ|etc] can search for encrypted data on a hard drive by computing a sort of "entropy index" for blocks of data.
Similarly, one of the reasons for using long keyphrases to protect your secret key in PGP is that English has about 1.3 bits of entropy ("key strength") per character:
Many keys are generated from passwords or passphrases. A system that accepts 10-character ASCII passwords might require 80 bits to represent, but has much less than 80 bits of entropy. High-order ASCII bytes won't appear at all, and passwords that are real words (or close to real words) are much more likely than random character strings. I've seen entropy estimates of standard English at 1.3 bits per character; passwords probably have less than 4 bits of entropy per character. This means that a 6-character passphrase is about the same as a 32-bit key, and if you want a 128-bit key you are going to need a 98-character English passphrase.
I highly recommend the Crypto-Gram newsletters. Also, searching cryptome.org (use host:cryptome.org on Altavista et al) for information on detecting low-entropy information (no URLs handy, sorry!) should yield some useful pointers / links.
Sony had been in the electronics market for decades, and still partnered with Nintendo to come up with the PSX design
Nintendo initially asked Sony to develop an add-on for the SNES so that it play CD-based games. At the last minute, Nintendo decided no thanks and Sony decided to further develop and market the box themselves, calling it the PlayStation (PSX).
Did Sony have any game-box experience before this?
Concerning consoles, Carmack said that an Xbox version of the Doom game will be a "no brainer", since it will be so easy to port the code to the PC-like console.
However, on the topic of the Playstation 2 and the Dreamcast Carmack was much less optimistic, since the technologies those consoles use don't support many of the "cool things" he wants to do with the new game. The consoles also lack the 128 MB or RAM[emphasis mine] that Carmack anticipate will be required to run the game. Porting the game would require a major rewriting and reworking of many of its parts, and if such ports happen at all they will happen several months after the PC/Linux/Mac/Xbox release.
So on the one hand we have the great Carmack, seemingly confirming the 128MB rumours (by implying that the X-Box is somehow immune from the 128MB problem - either by actually having 128MB, or some other method), and on the other hand we have Mike Abrash's DDJ article, seemingly confirming the 64MB configuration.
Hmmm, that's actually quite amusing: Carmack & Abrash together again (albeit pointing in opposite directions).
Of course, the DDJ article could be MS misdirection. Of course, the rumours could be MS misdirection.:)
>example: how do you prove that Win2K doesn't use some modified Linux IP stack? Nobody's allowed to >see the source so nobody will ever find out right?
TCP Initial Window -- This simply involves checking the window size on returned packets. Older scanners simply used a non-zero window on a RST packet to mean "BSD 4.4 derived". Newer scanners such as queso and nmap keep track of the exact window since it is actually pretty constant by OS type. This test actually gives us a lot of information, since some operating systems can be uniquely identified by the window alone (for example, AIX is the only OS I have seen which uses 0x3F25). In their "completely rewritten" TCP stack for NT5, Microsoft uses 0x402E. Interestingly, that is exactly the number used by OpenBSD and FreeBSD.
-----------------
Interesting indeed! Hmmm, looks like MS has been caught with their pants down and their finger in the pie and their hand in the till.:)
First of all, performance won't be terribly stellar for applications that thrash the K7's cache. Main memory isn't cooled, and still has a _latency_ in the 6-10ns range (bus speed notwithstanding).
OTOH, things like Quake that fit within the cache will run more quickly.
Just remember that the K7 has the ability (with the extra [tag?]-RAM added) to use up to 8 MB of cache. Now, granted, things can still thrash 8 MB, but it's a lot less likely than with Xeon's 2 MB maximum.
my 0.4c (hey, Rands don't go as far these days:) )
Slashdot Mirror
On the contrary.
Have a look at Phrack 58, phile 0x05
(From the introduction to the article:)
Jon Katz's (note the apostrophes, please!) latest ramble seems to be inspired by a recent article at the Laissez Faire Electronic Times: Show Me the Evidence, by Russell Madden
Some comparisons between the texts might prove instructive:
LFET article: "graphic visual recreations of what happens to a human body when, for example, a bullet slams through a chest wall"
JonKatz: "the path of a bullet will be illustrated graphically"
as well as:
LFET article: ""Follow the evidence" is the dictum he drills into his coworkers. How the investigators "feel" about the clues they uncover does not matter"
JonKatz: "Grissom and Willows [...] believe nothing anybody tells them, and they only trust solid evidence."
Maybe Jon had a little help on his Slashdot writing assignment from Junis in Afghanistan......
Phrack Volume 57 article 0x0a was all about this.
This was released back in August. I can see the marketing now:
Phrack - it only comes out once a year, but it's still ahead of the times :)
Apparently the next issue is to be released in time for Christmas. Read it now and you'll have read the 'sploit headlines for the next year.
The original is at http://www.bovine.com/text/pooh.txt
It was written by a (now-deceased) regular of alt.tasteless...
The Macintosh and OSX are made by....Apple.
Steve Jobs is the CEO of Apple.
Steve Jobs is also the CEO of Pixar.
Dreamworks and Pixar are competitors.
(Of course, Pixar uses a Sun-hardware-based renderfarm, of all things - something to do with CPU-power per volume)...
Listen Up also wrote
That's properly known as an OS tax...when Microsoft does it.
Well, Microsoft did ROT+1 VMS to get WNT...
Actually this is from the University of Cape Town, a South African university.
With the limited bandwidth they have (~2-4 Mbps last count), and the limited space in the various labs, it doesn't take much porn-surfing and mp3-downloading for everything to start working pretty slowly. Some of the labs already had time-limited access for non-UCT sites (ie no access during work hours). Of course, not all of the labs have 24hr access.
Specifically filtering the site because it is a porn site seems a bit rash, especially given that other sites can chew up much more bandwidth (mp3s, mpgs/DivX, etc). And there is the issue of UCT now having taken it upon themselves to filter the network content: They could now be responsible if any illegal content is found (this argument has been put forward on /. before).
There is more information available at the URL mentioned above.
Of course, there is also the whole definition of "public universities". Attending UCT is not free. They do, however, receive certain government funding. I do not if this could force them to suspend the filtering. They do classify the traffic according to academic relevance, sorta.
- Al
It's already been done :)
- Al
You may want to check out SAT-3/WASC/SAFE, which is actually two cables: one goes from Europe, down the West Coast of Africa to South Africa; the second goes up from South Africa past Mauritius to Malaysia. [NB: Don't confuse this cable with Africa One, which was referenced in this Slashdot story a while back.]
Telkom and the international companies behind SAT-3/WASC/SAFE are pushing them as a fully wet (and therefore, presumably safe) backup route for FLAG (WIRED article). Now FLAG is pretty old (and only ~5 Gbps, last time I checked), but there are a few other cables traversing the same route (eg SEA-ME-WE 3 (or is it 5?),) which is right through the currently-unstable Middle East. Some people like to be assured of the stability of any links they may buy - backup [wet] links are one of the answers.
And hey, it's great for [South] African [Internet] bandwidth! :)
Just thought you'd like some background
-Al
I am not taking sides on the Microsoft NSA-key issue. For more information on the issue, please check out Cryptome
However, your comment:
is quite funny: FreeBSD and Linux and other OSS CAN be proven to not have any back-doors. Microsoft software cannot. China, Japan, and militia-men (and anyone else that wants) can audit the software they run for anything they want to. -AlEncryption of structured data (eg text, pictures, etc) increases its randomness (ie lowers the entropy)
It is rumoured that the [NSA|GCHQ|etc] can search for encrypted data on a hard drive by computing a sort of "entropy index" for blocks of data.
Similarly, one of the reasons for using long keyphrases to protect your secret key in PGP is that English has about 1.3 bits of entropy ("key strength") per character:
From October 15, 1999 Crypto-Gram:
I highly recommend the Crypto-Gram newsletters. Also, searching cryptome.org (use host:cryptome.org on Altavista et al) for information on detecting low-entropy information (no URLs handy, sorry!) should yield some useful pointers / links.
Al
Quick! Someone port DeCSS for Mobile Devices!
Remember, it's our right to watch DVD on whatever platform we want (even if it is crappy B&W 160x120 Palm displays)
Al
Sony had been in the electronics market for decades, and still partnered with Nintendo to come up with the PSX design
Nintendo initially asked Sony to develop an add-on for the SNES so that it play CD-based games. At the last minute, Nintendo decided no thanks and Sony decided to further develop and market the box themselves, calling it the PlayStation (PSX).
Did Sony have any game-box experience before this?
Al
(from the 3D Action Planet story about half-way down)
So on the one hand we have the great Carmack, seemingly confirming the 128MB rumours (by implying that the X-Box is somehow immune from the 128MB problem - either by actually having 128MB, or some other method), and on the other hand we have Mike Abrash's DDJ article, seemingly confirming the 64MB configuration.
Hmmm, that's actually quite amusing: Carmack & Abrash together again (albeit pointing in opposite directions).
Of course, the DDJ article could be MS misdirection. Of course, the rumours could be MS misdirection. :)
Al
>example: how do you prove that Win2K doesn't use some modified Linux IP stack? Nobody's allowed to
:)
>see the source so nobody will ever find out right?
Someone's already thought of that.
An excerpt from http://www.phrack.com/search. phtml?view&article=p54-9 which describes nmap, an OS fingerprinting-by-TCP/IP-stack-details tool:
TCP Initial Window -- This simply involves checking the window size on
returned packets. Older scanners simply used a non-zero window on
a RST packet to mean "BSD 4.4 derived". Newer scanners such as
queso and nmap keep track of the exact window since it is actually
pretty constant by OS type. This test actually gives us a lot of
information, since some operating systems can be uniquely
identified by the window alone (for example, AIX is the only OS I
have seen which uses 0x3F25). In their "completely rewritten"
TCP stack for NT5, Microsoft uses 0x402E. Interestingly, that is
exactly the number used by OpenBSD and FreeBSD.
-----------------
Interesting indeed! Hmmm, looks like MS has been caught with their pants down and their finger in the pie and their hand in the till.
mentaldent
First of all, performance won't be terribly stellar for applications that thrash the K7's cache. Main memory isn't cooled, and still has a _latency_ in the 6-10ns range (bus speed notwithstanding).
OTOH, things like Quake that fit within the cache will run more quickly.
Just remember that the K7 has the ability (with the extra [tag?]-RAM added) to use up to 8 MB of cache. Now, granted, things can still thrash 8 MB, but it's a lot less likely than with Xeon's 2 MB maximum.
my 0.4c (hey, Rands don't go as far these days