Slashdot Mirror


User: jonathanclark

jonathanclark's activity in the archive.

Stories
0
Comments
349
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 349

  1. Re:Pandora's box was opened *way* back guys on Ask Slashdot: Using SSH on non-US Sites for Crypto Development? · · Score: 1

    heh. so much misinformation, so little time.

  2. Re:Secure Web mail PATENT PENDING on Hotmail Cracked Badly · · Score: 1

    I did check out your web site, and I did not see any indication of this. Your domain record list an Austin Texas address and your FAQ makes no mention of legalities. I would think this is a fact you would want to make well know. I even wrote one of the email addresses on your web site about this particular question and recieved no reply.

    Even with the precautions you have taken, I see you running into trouble with the law if you become popular. Make sure you put some money aside for the lawyers.

  3. what's next? on The Ottoman PC · · Score: 1

    - Toilet PC. With PowerSaving mode there is no more having to remember to put the lid down.
    - Pillow PC. What are doing wasting 6-8 hours a day sleeping for? Cooling fan will keep you warm on cold winter nights.
    - Table top PC. Remember those pacman games in 80s? With integrated cameras you can now sit down to a "family dinner" even if you family is in another city, with volume control for grandma.
    - Lawn ornament PC. Realistically modeled to look like a plastic pink flamingo, this PC acts as a security camera and wireless repeater. If you have a big lawn, put lots of flamingos up!
    - PC PC. Just when you thought no one used real PCs anymore, this PC is a all in one microchip placed inside a 90s "retro" box. The extra space can be used to store clothing or small pets such as hamsters and gerbils.

  4. Re:G4 is NOT fast as hell on Apple announces the G4 · · Score: 1

    I'm not totally up on the latest photoshop developments, but it's my belief that many of the high CPU task performed by photoshop are not paralellized.. The site you pointed out demonstrated only 2 functions. Anyone have an idea of how much of photoshop has been redesigned for dual/quad systems?

  5. Re:Company Resources, so... on Ask Slashdot: Privacy in the Workplace · · Score: 1

    I agree with this for the most part. There 18 billion free web based email accounts you can get for your personal mail, so why not seperate your work email from your personal email?

    One problem with this is that it is inconvenient to have to check mail in multiple place. Also, If you work 16hrs a day, you can't really seperate your work life from your personal life... they blur together. Your friends are your workmates and vice versa. An email might contain both personal information and biz activity.

    On other thing.. Biz cards are often the most convient way to give new people your email address, but few people have "personal" biz cards. (Perhaps they should, you can buy 2000 for around $80).

    If people used their biz email account only for business then there would be no conflict scanning their account. But it's always personal information that the company is interested in. (who's thinking of quiting, sueing, etc).

  6. Re:Windows open source on Feature: Is Open Source for Windows Less Important? · · Score: 1

    On the other hand, some of the advantages of open source don't apply to Windows, because the OS itself is closed. One of the greatest advantages to open source is that the open source community can fix bugs from the kernel level upward, which allows us to avoid kludges and workarounds from bugs in the OS.

    I want offer an opposing opinion to balance the conversation here. I would say 99% people like Linux because it's free, not because it's open source. It's becoming more and more rare that people even compile the kernel, let alone look at source code... And I don't want a kernel that I need to compile, that shouldn't be a needed function of the end user. I'd also say the number of Linux users who have fixed bugs or improved the kernel is insignificant (in the last few years anyhow). And again, I don't want to fix kernel bugs. At this stage in the game, there shouldn't be any that are significant... if there were I wouldn't be using Linux. Now, it's very questionable if linux could have gotten to the state it's in if it were closed source... but now that it's here, being open source doesn't matter to the majority of it's users.

    As far as making work arounds at the near OS level, I see this as a Bad Thing. Take mac versus Windows for a second. Mac originally had a description of the internal data structures in the header files with the stern warning that you shouldn't access them. They were helpful to people who were trying to understand what was going on inside the box, however many popular applications disregarded the warnings and accessed the data structures directly so they could be "faster, better, smarter". When mac moved to the PPC they were stuck with what amounted to emulation of much of the old operating system to maintain backwards compatibility. As a result, today's mac UI blows and it's impossible (?) to separate processes into protected spaces.

    On a separate track, Windows decided to hide their internal data structures. This made it a little harder for people to understand what was going on down at the metal, but for the most part people didn't want to know. Several people reversed engineered this information and published books, but it wasn't easily accessible like it was on the mac and anyone doing weird things thought twice about backwards compatibility. When Windows moved to a 32bit world, they were able to maintain most of their backwards compatibility and still create a stable environment (compared to MacOS, anyway!). Granted Intel's primary goal was to make the 16->32 change as painless as possible while Mac had a total change of processors.

    Now enter Linux. You have the source to almost everything. While this can be great for engineers, it's a curse to users. Backwards compatibility in Linux is mostly accomplished by : "here's the source, type make and pray it works". Also many engineers get lazy when they know the end user can compile. They structure features that can be toggled with #ifdefs. They also have the attitude "if it broken, someone else can fix it - since they have the source". Software becomes less modular and more a big blob that gets harder and harder to compile and make work together. Anyone who has tried to compile apache with SSL, PHP3, and some database support knows what I mean here.

    In Linux most apps talk to Libc - which is sort of the "Standard API" whereas Windows has the Win32 API. So linux, the source to libc is more important that the source to the kernel. The exceptions to this is when you need to talk to system dependent devices like sound. Looking at the kernel source was the only way I could determine how the sound and joystick drivers worked when I made Abuse. But that was because there was no documentation available at the time. While it was cool that I could do that, looking at the kernel is a terrible replacement for documentation. An API should be well defined and not guessed at or you will introduce bugs and backward compatibly problems. In Win32 (and other closed source OSes) documentation is better because it has to be.

    I've realize my entire thread is slight off topic from Qt, but I think it does suggest a reason that Qt is open source for linux and not Windows. Linux is built on the "make and pray." In order to get Qt working with all the distros out there (seems a new one comes out every week) it helps to be open source. By this I'm refering to the many generations of libcs and the kernels needed by libc. Windows has a more standardized platform so it's less important to have the source.

    well this is already too long.. must get back to work. :)

  7. It might be in your area already. on Microwave T1 Service · · Score: 1

    I'm in San Jose and I've been using Microwave for about 1/2 a year now. The fastest I've seen it go is 800K/sec (that's K as in Kilobytes not Kilobits). Not too bad. I had to put a 30ft pole on my house to get line of site to the transmitters. DSL is cheaper ($50 versus $150/month), but it's not available in my area.

    I had a problem last month because someone was trasmitting in the same frequency band (which is licensed) and screwing up communication. It took almost a week before FCC tracked them down and shut 'em up.

  8. Re:Secure Web mail PATENT PENDING on Hotmail Cracked Badly · · Score: 1

    The idea is pretty obvious if you ask me. I thought about doing it years ago, but IT'S ILLEGAL in the USA. They are located in Austin Texas, so my guess is that it won't be long before uncle sam shuts them down.

  9. Re:Why this is not a problem on 512-bit RSA Key Cracked. · · Score: 1

    uhh. you are absolutely right. :) Sorry, I was thinking of the RC4 key which is 128 bits sent partially in the clear to get around export regulations. Thus even though only 40 bits are encoded, the other bits serve to make cracking dictionaries very large.

    If someone managed to crack your private RSA key, then they would have a free run (big assumption here is that they could watch all of your traffic). From what I can tell most 512 bit RSA keys have expired already. VeriSign established a minimum requirement of 1024-bit keys for Class 1 through 4 Digital IDs in 1996. The 1024-bit key is 300-trillion times more difficult to break than a 512-bit key.

  10. Why this is not a problem on 512-bit RSA Key Cracked. · · Score: 3

    a bit of an over reaction?

    1) Who has every considered 512 bit RSA secure? It's been on the export list precisely because it is not considered secure. This article states 25 years ago it was considered virtually unbreakable. 25 years ago computers were barely around! The first personal computer was the MITS Altair 8800, released at the end of 1974 (25 years ago). Anything other than XOR would have seemed virtually impossible to crack with that!
    In 1974, IBM's fastest mainframe ran at ~1-2MIPS.

    2) You can't "steal" credit card numbers, like you can steal cash. If you had every number under the sun, there is no way you could spend it without getting caught. Many sysadmins have access to millions of credit card numbers. If that really translated to a billion dollars they would be living in the Bahamas. Credit cards numbers != currency.

    3) The cost of breaking a single SSL message would not be worth the cost gained by getting a credit card number. Each connection has a different key and there is no way to know if there is actually anything useful in the message until you break it. Just because someone makes a SSL connection doesn't mean there is anything valuable in the data. If you pick a SSL message at random and spend 3 months cracking it, chances are you'll come up with an banner ad image.

    4) The internet isn't as insecure as people make it out to be, even without encryption. The government can't monitor most of the internet traffic, how is someone else supposed to collect all of the data to crack? Sure you can break into random machines here and there and do some small time sniffing, but nothing wide spread. It's not like you can take a laptop out to a fiber line somewhere and splice it in... you'd have to setup a big data center. If you could tap into a backbone, you'd *have* to use filters to reduce your data set size, but with encryption this is impossible. Even 64 bit RSA would be secure for this reason.

    5) Cracking 512 bit RSA with plaintext available is not the same as breaking a SSL message. It's much much hard to break SSL (see below for a description of the SSL connection algorithm).

    6) All banks that I know of offering online banking, either a) require 1024 bit RSA, or b) don't allow the transfer of money to an outside account (unless you count bill-payment systems).


    ---SSL connection description---
    For the initial connection, when a client wishes to establish a secure connection, it sends a CLIENT-HELLO message, including a challenge, along with information on the cryptographic systems it is willing or able to support. The server responds with a SERVER-HELLO message, which is connection id, its key certificate, and information about the cryptosystems it supports. The client is responsible for choosing a cryptosystem it shares with the server.

    The client then verifies the server's public key, and responds with a CLIENT-MASTER-KEY message, which is a randomly generated master key, encrypted or partially encrypted with the servers public key. The client then sends a CLIENT-FINISHED message. This includes the connection-id, encrypted with the client-write-key. (All these keys are explained separately, in the next section.) The server then sends a SERVER-VERIFY, verifying its identity by responding with the challenge, encrypted with the server write key. The server got its server-write-key sent to it by the client, encrypted with the server's public key. The server thus must have the appropriate private key to decrypt the CLIENT-MASTER-KEY message, thus obtaining the master-key, from which it can produce the server-write-key

  11. Re:Sex and the single geek on Hope for the Valley's Single Men · · Score: 1

    This is probably a fault of the geek personality, but elementary human mating rituals can be as bewildering to your average geek as sendmail.cf is to a non-geek - often it's just not apparent where to start.


    heh. sendmail.cf is bewildering to anyone, period.

  12. Ladies: where to find 'em on Hope for the Valley's Single Men · · Score: 1


    Computer Literacy bookstore in Sunnyvale and San Jose (my favorite real-world store). And... they charge so much for their books (compared to online), you have to have a decent income to even walk in there. :) Of course, striking up a conversation there is pretty hard if you aren't the engineer type.

  13. Re:Hard drives? on Canada Taxing Blank CDs? · · Score: 1

    IIR, this approach has already been tried and the court has ruled that HDs are not subject to the legal limitations placed on other recording devices. That is, in the US anyway. I can't recall for sure, but I believe this was one of the arguments in the Rio case.

  14. Re:Well...The real problem is on Microsoft Bites It On 64-bit Microprocessors · · Score: 1

    sigh. I posted this without actually reading the story... It appears it is Compaq that is dropping 64bit NT support not microsoft. Another case of MS bashing run amuck, and me believing the headline posted on /.

    Future Plans for 64-bit Versions of Microsoft Products
    This announcement does not affect our plans to develop and support 64-bit versions of our products on the Intel platform. Compaq, as well as our other OEM partners, will continue to work with us to deliver a 64-bit version of Windows for our enterprise customers based on the IA64 architecture.


    Microsoft is still working on 64bit ports.

  15. Re:You just don't get it Scott, do you? on Microsoft Bites It On 64-bit Microprocessors · · Score: 1

    Sounds like Apple when they moved to the PowerPC. Everyone had to write native version.. but since the core OS ran under emulation it made everything that used it butt-ass slow.

  16. Re:Well...The real problem is on Microsoft Bites It On 64-bit Microprocessors · · Score: 1

    If you subscribe to MSDN, you'll note that there are 10X this number because many of these have to be translated into every concievable language (which is no small task). I have a new MSDN CD for each cup of Java I drink. Microsoft has a lot of work on their plate with new OS.

    But your list is deceptive. The service packs are generally just minor cosmetic or bug fixes and addition of user mode programs.. not kernel changes. Also Workstation and Server use identical kernels, the only difference between the two is only a single registry setting a a few extra user level programs.

    But, supporting 4 different executable formats and 16/32/64 bit drivers is no small task. While I doubt microsoft will drop 64bit support for long, from what I've seen Windows CE is the most important new market right now, so it makes sense to focus on that. Consider how many palm computers were sold last year versus 64bit alphas!

    The other problem they are probably facing is a lack of qualified engineers to work on 64bit ports. There are only so many people in the world who know the internals of the NT and 98 kernels.. and most of them already work at MS doing other stuff! Releasing the OS code to universities could help out with this problem... but it would create some new, perhaps worse, problems.

  17. Promiscuous mode in 98/NT? on l0pht develops Sniffer Sniffer · · Score: 1

    I was under the impression you couldn't go to promiscuous mode under 98/NT, but this article seems to indicate you can. Can someone point me on info on how to do this? Perhaps people hook into specific ethernet card drivers? Is there a general solution like linux?

  18. Re:NT 5 on Install Linux in 4 Minutes · · Score: 1

    There's an article about NT5's new filesystem in Dr.Dobbs this month (or maybe last month). The filesystem keeps a database of every change that is made to the filesystem, so it know exactly what happened where. This could be really nice for fighting viruses and trojan horse DLLs that are becoming more common.

  19. Re:512 already not safe on Shamir reveals more about optical 512-bit cracker · · Score: 1

    Sorry, I didn't mean to imply that Shamir needed to make a name for himself, nor those working in the field of optical computing. But this idea has been demonstrated back in 1997 as well Shamir's implementation has already been covered on slashdot at. for more info:

    http://www.rsa.com/rsalabs/html/twinkle.html

    Also, not to reduce the work of R,S, and A but they didn't invent the field of public key encryption. It was actually invented by the British Secret Service during WWII (even before Diffie-Hilleman), but this fact wasn't made known until fairly recently.

    http://www.cesg.gov.uk/about/nsecret.htm

  20. 512 already not safe on Shamir reveals more about optical 512-bit cracker · · Score: 1

    512bit RSA keys have not been safe for a long time and it's legal to export it in software from the US because of the ease at which it can be cracked.

    The more interesting part of this article is that the computer is optical in nature. For $2 mil you could build a much cheaper distributed PC network that has more cracking power. Perhaps someday this device will become more economical/useful, but for now it's just a play toy for researchers trying to make a name in a field that is now fairly mature.

  21. Re:He oughta get the jet... on No Harrier Jet for Pepsi Points · · Score: 1

    If he got the jet, everyone with $700k would want one as well. Heck, I'll take one for that price! I could turn around and sell it for 25x that easily.

  22. Re:My Biggest Problems with X on Ask Slashdot: Comparing the GUIs · · Score: 1

    X does support hardware scrolling, assuming you have a decent driver. If the card doesn't support VRAM to VRAM copies, but supports DMA, you will notice a problem when listening to MP3s because the hardware scroll causes huge DMA burst to occur on the bus is unavailable to the sound card for a short period of time.

  23. Re:The Fallacy of Cracking Contests on Microsoft /asks/ "Crack this machine" · · Score: 1
    The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic reasons why this is so.

    You'd think Bruce didn't read his own book. Cracking contest have always been an important part of cryptography and security. All of the major crypto algorithms have been through a cracking contest of some sort or another. Initially these contest remained amoung peers and had values of $10 or $1000 attached. Today many of them are still going with prizes of $1,000,000 (for ECC). Until the recent string of contest with actual prizes, there has been very little incentive in the private/research sector to create special devices for DES. There would be no "group cracking" attempts, which, while not advancing the science of cryptography, have been usefully in show the need for crypto-ban relaxation.

    Contest are about getting people interested. There are lots of things to try to break. In order to entice people study your system you have to have a great value in breaking it because it's widely used. But for new system, there is little reason to try because most people want to spend their time on something else with more value attached to it. Announcing a contest and marketing it, creates that needed value. If someone breaks W2000, they will no doubt get some play in the press and be heralded as the ultimate cracker by some... which is exactly why crackers crack. It's an ego thing not a money thing.

    When someone announces a contest, everyone screams snake oil and that no good will come of it. Though some "contest" have no value other than a marketing device, many of them are genuine attempts to improve security. I will be introducing my own "cracking contest" later this year. I'd rather have someone break it than not, because that shows me that people are actually putting real thought and effort into it.

  24. Re:Weren't they doing this back in the 80's? on Robotic Butler available for $800 · · Score: 1

    I don't think you can look at this project and compare it with the robots of the 80s. This robot is an exercise in cost reduction, not a demonstration of today's technology. Also you seem to equate robotics with AI. IMO, they are 2 separate fields, and the intersection is much smaller field.

    Today's robots may not be anywhere nearer to being useful in a household environment, but they have been used in many new applications in the industrial world. Believe it or not, on my block the trash is collected by a garbage truck operated by a human driver and a robotic arm that picks up trash cans and dumps them in back. Robots are slowly taking over the manufacturing process and being applied to new labor intensive task, but as with other sciences, advances are incremental and breakthroughs are seldom. IMO computer chip industry probably has some of the most sophisticated robots and they continue to push the envelope, but most people just call them machines.

    AI is also alive and strong. It's hard for me to think of something that hasn't gotten better in the last 10 years because of AI applications. Weather prediction, speech recognition, natural language processing and translation, fraud prediction, crime analysis, traffic flow and city planning, CAD work (EE or otherwise), marketing and data mining, and on and on.

    Also, I don't think people are leaving the AI field as you say, but just stopping research and starting to put it to practical use. I know several people who have left lucrative fields to go work on AI-like problems at large companies. This is a sign that AI is picking up steam and has practical use. Previously almost all AI work happened universities and the results had very little real world use, now you can make $150K+ a year and there are recruiters specifically for AI professionals.


  25. Best MB per dollar? on 420 Gigabyte Hard Drives · · Score: 1


    I'm looking into setting up a data center for home use (MP3's and DVD's) and I'm trying to find the best price per MB. I'm sure other people here have researched this far better than I have. Any comments?

    I'm looking to store 1 terabyte or more. Here are the prices I came up with for 1 terabyte.

    HDs - ($10/Gig) cheapest ratio seems to be 17Gig IDEs for $160. That's about $10K for 1 TB when you add all the IDE controllers.

    tapes - ($7/Gig) 35Gig tapes themself are only about $2/Gig, but a robotic tape changer is about $5k (anyone see any cheaper ones?) Draw back of tapes is the seek time. 30-60 seconds for a seek and at least double that for tape changes. But, caching/preseek solves this problem for music, and movies are rarely watched so a 2 minute setup time is ok by me.

    Cd - More than tape and no better seek time (with changer) and it's a big hassle to burn CDs. I didn't look into for that reason.