Slashdot Mirror


User: merlin_jim

merlin_jim's activity in the archive.

Stories
0
Comments
1,176
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,176

  1. Re:But then on Build A Darknet To Capture Naughty Traffic · · Score: 1

    I'm thinking of making an implementation that heads off to our forest and deactivates the computer account when it gets a couple bad packets, while paging our admin. Might be a pretty simple way to stop worms before they get to far...

    Of course this is for internal computers, but we have a DMZ to take care of external baddies...

    The problem with what you propose is that you need a firewall between you and the bad computer for it to be effective. Our problem has been the internal worms once activated. And more often than not those get in through ways and means that can't be protected against. Like that time I let SQL Slammer in by hooking up to the net at home, hibernating, and taking my laptop in to work the next day. Sure I use a firewall at home now (I didn't care enough to do so before), and sure all our laptops have personal firewalls on them by default now, but still... the damage was done once it got into the network...

  2. Re:Really . . . on Build A Darknet To Capture Naughty Traffic · · Score: 1

    Snail mail just can't drop packets on the floor as easily...

    Quite the contrary; it's far easier to drop a letter on the floor. A letter has mass. ;-)


    Not to be nitpicky...

    oh fuck it, yeah I'm being nitpicky.

    Mass does not allow you to drop something on the floor. Weight allows you to drop something on the floor.

    And packets do have weight. We would just need to be orbitting a black hole at the event horizon (impossible, I know) in order to drop a packet far enough to hit the floor. I guess you COULD put the packet on a fiber line and cut the fiber and aim that at the floor, but that would be more like throwing it at the floor than dropping it...

  3. Sound familiar? on Netgear's Amusing "fix" for WG602v1 Backdoor · · Score: 3, Interesting

    Was anyone else reminded of some of Mitnick's work where he'd call the manufacturer of the equipment to get the backdoor password? That most of the people using it didn't even know it had? And they gave it to him over the phone...

  4. Re:Coeur d'Alene has an apostrophe on Native American Wireless ISP Launched · · Score: 1

    The apostrophe isn't a mistake: it's "Coeur d'Alene" (it's French).

    I live there, and it's really annoying when web forms try to "correct" it:


    Ditto here.

    I live in Winston-Salem... you wouldn't believe how many websites I can't shop on because they won't accept an apostrophe in the name, and my bank says it has an apostrophe in it...

    Oh and if the name sounds like two cigarette brands with an apostrophe between them, it's actually the opposite. The two cigarette brands are half of this city's name... RJR lives here.

  5. Passport, not Hotmail!!!! on Hotmail Loses Customer Files · · Score: 1

    Hotmail lost nothing. Passport lost user files.

    How do I know?

    I tried to sign onto my MSDN subscription yesterday with my passport... this passport is linked to my work e-mail address and has never been used at Hotmail (nor could it), and I got the same error mentioned in the story.

  6. Re:My first question on First Science From A Virtual Observatory · · Score: 1

    the universe appears to be experiencing? One would think that the black holes would actually help things collapse, but if they're at the outer fringes, might they be pulling things outward?

    There is no outer fringe; only an outer fringe as observable by us. We are not at the center of the universe; just because something is far away does not make it towards the outside, as there is no outside. There is no center of the universe, Einstein proved that mathematically, that's what Relativity means, that everything is relative and there is no central reference point to the universe.

    Now, the antigravity effect you mention may be one of two things; it may be a way of measuring the expansion of the universe; expanded a universe is like blowing up a balloon. All points on the balloon move away from each other, and the curvature of the balloon decreases. Because gravity is the measurement of the curvature of the universe, this expansion could be seen as an antigravity effect.

    I'm assuming that the physicists who have been considering the problem thought of that and ruled it out, in which case it is almost certainly a new twist on gravity. We know we don't know everything there is to know about gravity (wow do I feel like Rumsfeld)... there are two barriers to creating a grand unified theory of everything, one is unifying the very small with the very large, or in technical terms, merging the laws of quantum physics with the principles of relativity. The other barrier is understanding how gravity is related to the other fundamental forces of the universe. It is inevitable that there are things we don't know about how gravity works until we do that, just as we didn't know how light worked until we understood how the electrical and magnetic forces are related.

  7. Re:Great... on Brew Your Own Auto Fuel For 41 Cents A Gallon · · Score: 1

    Any restaurant that does frying has used oil. (Even that mom'n'pop boutique place you like to frequent)

    FYI, oil in which meat has been cooked has a significantly different chemical composition than that in which only vegetables have been cooked, and the difference is important to the biodiesel process (it takes a lot more processing to wash out the animal proteins)

  8. For everything else there's /. on LA to Oregon at Mach 9 · · Score: 1

    Burger and fries in Sacramento: 23 dollars
    Video Camera and VCR from Fry's: 52 dollars
    Watching your server melt: priceless

  9. Just like to point out on Worst Explanation From Tech Support? · · Score: 1

    that for various reasons, 8 bits may not equal a byte.

    Due to the tcp/ip overhead and whatnot, you end up actually transmitting 12 bits for every byte of data; this is straight off a Microsoft exam, so take that with a grain of salt.

    A more accurate example is serial with parity protocols. Basically, a serial communication requires some kind of error checking built in. Some serial standards do it with checksums, as in "I'll send you 32bytes and then expect one byte of hash data. If your hash matches mine, let me know and I'll send the next block. Otherwise I'll just keep sending this one..."

    But some serial protocols use parity and mark. Basically, parity are extra bits inserted into the stream as error checks. Parity can have values of odd or even; I forget exactly what that means, but I know that it takes 2 bits per byte... that makes the protocol require 10 bits to send every byte. Mark (or space) is simply having a standard-sized pause in between bytes; kind of like the retrace interval on a monitor. In my old RS-232 days, mark could be anything between 0 and 2, in half-integer increments; that was the number of bits to not send either 0s or 1s.

    Point being, ethernet is also a serial standard... so is DSL... so your bits and bytes rates might differ due to protocol overhead...

  10. Re:Anonymous or not opinions count. on JBoss Caught in Anonymous Posting Scheme · · Score: 1

    It does indeed matter whether they're an 18 year old hot chick, or a 50 year old fat guy.

    Just FYI, lest any slashdotter think otherwise, the chances of the person actually being female are small enough, let alone 18 and hot...

  11. Re:I hope've you misquoted him. on Attacking WinZip AES Encryption · · Score: 1

    The perfect/provable security of a one time pad is that you *can't* keep guessing until you happen to hit on it. Since for a given N-bit ciphertext, there exists some N-bit key that maps to *any* N-bit plaintext, there is no way to distinguish a correct answer from an incorrect one.

    And thus my statement "As long as the best way to recreate the pad is by randomly guessing until you happen to hit on it, then the pad is secure"

    In other words, as long as there is no way to determine the OTP than to try every single possible N-bit pad, then it is impossible to determine which one is correct.

    As for the other part, let me say that there are secure algorithms that have been proven to be secure. I'm not an expert; I don't know precisely what that means. I do know that it means that someone has taken a mathematical look at it and determined that certain assumptions on which the crypto system relies on are actually true.

    The method to prove a cryptosystem relies on its keystream to be reversible. We don't yet have a method to prove any cryptosystem, only ones that have a reversible keystream. Thus I am inclined to believe that the proof relies on the mathematical principle of induction or some similar principle. So there are some cryptosystems that have been proven to be secure as long as certain base assumptions hold (i.e. the shortest time to factor a number is n log n, etc)... the original poster was saying that RSA hasn't been proven secure and therefore all crypto systems are hash.

  12. Re:The crawl is hard, too on How Hard Is It To Write Your Own Search Engine? · · Score: 1

    politeness (don't bring down someone's site by crawling too fast), redirects, content you can't handle (Flash, Javascript).

    I wrote my own crawler once. A just-for-fun-how-do-the-spammers-do-it kind of thing...

    I got around redirects and content by going straight via the network socket and looking at the response as pure text. Anything that fit the regex pattern for an email address got harvested.

    As far as politeness... I kept a circular growable queue (technically a linked list) of sites to visit. Each queue entry is current site - links deep - sites deep (I would ordinarily start with a google search and do 3-4 sites deep, 5-6 links deep)... if the crawl engine saw a link with the same server it had just visited, it would randomly change its link index. This kept it from hammering on a particular server too hard...

  13. Re:How does Google make it look so easy? on How Hard Is It To Write Your Own Search Engine? · · Score: 1

    those employees work hard and smart and put in 40-60 hour work weeks

    This is an excellent opportunity to point out that 8 hours of those every week, mandatory, must be spent on a personal project not related to google's line of business.

    That one perk is the absolute best.

  14. Re:I hope've you misquoted him. on Attacking WinZip AES Encryption · · Score: 1

    I know that it is widely believed [although I don't know whether an infrastructure is in place within which it could be proved] that one time pads are secure,

    If the pad is random then it is secure. As long as the best way to recreate the pad is by randomly guessing until you happen to hit on it, then the pad is secure. The security of a one time pad comes from the fact that it can't be duplicated. And there are tests for how regular or random a particular piece of data is...

    but I don't know of anyone who's proposed a way secure means for the distribution of one-time pads,

    Well there's the tried and true method of carrying the pad to the destination. Banks are using quantum cryptography to make one time pads to exchange session keys for traditional encryption. There's two secure distribution methods

    and, for that matter, there's a rather old and rather contentious controversy as to whether one-time pads can even exist in the first place

    I don't know if you've heard, but quantum mechanics is pretty well proven these days. Atomic events really are random and probabilistic in nature. There are well known ways to collect random atomic events and make a one time pad out of them. I'm not going to argue whether anything is truly "random"... that doesn't matter. What matters is that its chaotic enough to be indistinguishable from random, and there's ton of stuff that is...

    As for the rest of your concerns, they are right on... encryption analysts should be concerned with accurately representing their field. However, that doesn't mean you have to caveat every expression either. RSA has been extensively reviewed and is believed to be secure, except for a few known holes that are easy to close in the implementation (most of them have to do with keys that are easily guessed)

    Even better, there are encryption algorithms that ARE provably correct. We don't yet have a general way to prove any crypto system secure or not, but for special cases we can do it (the most important criteria is that the keystream is reversible in the implementation; that is, that, given the entire state of the system one can go forward or backward in the keystream arbitrarily)

    So there are options. And, as always, a bigger keyspace is better. I'm pretty confident that, if they haven't found a glaring hole in RSA yet, any future holes will be minor, and that having a larger keyspace will therefore make it more difficult to crack in any case...

  15. Re:Security? on Build Your Own Stun Gun · · Score: 1

    Yea, god forbid they ever hear of capacitors. Because, you know, there aren't any electronics in the middle east.... I'm sure nobody East of Greece has ever gotten shocked by a TV capacitor or anything. Nope, they've never heard of such things.

    You know I wonder sometimes about such things...

    I mean, they obviously could have thought of this plan at any time. But they either haven't thought of it or haven't done it yet for some reason. At least some of these plans, some people believe, have some chance of success.

    I will certainly admit that the success of me using a nail file to take over a whole plane is quite small. But someone somewhere apparently thought it still a good idea to prevent...

    Is it that these scenarios are simply so unlikely to work that they are discarded, if thought of at all? Or could it be that some of them might just work, that as some people seem to believe if you give a terrorist the slightest opportunity he will have some mystical power to exploit it into THE WORST SITUATION POSSIBLE and then you're screwed.

    In that case, why hasn't a terrorist tried this whole flash camera trick? I believe that it may be that the plan itself is so unlikely that it could only have been imagined by a person at this most paranoid, most fearful, and that therefore it does not become part of their overall planning and strategy until it has been voiced, BY US...

    There was a period of time when not many people had pondered the possibility of being held hostage by a nail file. However, I'm sure with the popularity of that particular warning outside every airport terminal, that many people have now considered it. How long before the public considers or envisions a scenario that is truly devastating that is then put into action?

  16. Re:Explosive Capacitors on Build Your Own Stun Gun · · Score: 1

    I wonder if you could make an EMP cap using this effect...

    When Dielectrics fail, they spot fail. A small piece cooks and becomes conductive, and the lowered resistance in that spot keeps the failure from ocurring elsewhere. Some metal to spread that discharge area out and decrease it's resistance could cause a quicker discharge, as well as serving as an EMP antenna.

    Make a cap with a dielectric with a specific breakdown voltage. Make an ultrasmall charging circuit that runs off a watch battery. Make a switch that discharges a small cap backwards across the other cap to cause dielectric breakdown.

    Hmmm... how do I handroll a cap again? :D

  17. Re:NOT a problem on Build Your Own Stun Gun · · Score: 1

    The article talks about "holding it on someone for 5 seconds" - well, that won't do a damn thing; this is a capacitor, it discharges and that's it. There's a charging circuit, but it's very wimpy; it takes the circuit 5 to 10 seconds to put that much energy into a cap for a few millisecond shock.
    You want a deterrent? Learn to run fast. You're going to need it, ESPECIALLY if you try to use one of these things.


    Yeah I was thinking the same thing reading that comment...

    Of course the problem is that the capacitor can store far more power than the charging circuit can deliver at a time. What if you added several batteries in parallel? I was thinking, this thing runs off 1.5V (or thereabouts)... if you got a ton of watch batteries at 1.5V, you could build a big parallel battery to supply equivalently more power...

    Just a thought :)

  18. Re:This is dangerous on Build Your Own Stun Gun · · Score: 3, Interesting

    Problems here:
    - NEVER touch power supply caps, they can store 10x - 20x the energy of flash caps. Lethal!
    - Discharge the CAPs from the power supplies before salvaging.
    - Discharge the unit after use with an *isolated* gripper, better yet, a high-wattage resistor (few kOhms) hold by an *isolated* gripper.


    I deal with high voltage power caps in my hobbies of railgun and coilgun design. Whenever building a prototype, I know I'm going to be monkeying around with it, and I know I'm going to get shocked accidentally...

    So I take a high ohm resistor and put it across the cap leads. Put it as close to the cap as possible; if it's after you in the circuit, the high frequency nature of the cap discharge can cause it to not affect the circuit.

    How big? Well the resistor here is serving two purposes; one as a bleed resistor. In that case, you want it's rating high enough that it doesn't put a strain on your charging circuitry, but still low enough to bleed power relatively quickly. From that standpoint something between about 10 KOhm and 1 MOhm should be good; caps don't have a ton of storage capacity so even a high value resistor can bleed voltage relatively quickly. And 50V, while impressive, just isn't as dangerous as 1000V... Batteries usually have an internal resistance of about 80 Ohms (the battery appears to resist the flow of electricity like an 80 Ohm resistor would, when it is in short circuit)... depending on the efficiency and design of the charging circuit, low resistances might significantly affect its performance.

    Of course the other side of the equation is that the resistor is the last line of safety in case of accidental short circuit during charging; during a short circuit, the resistor will absorb some portion of the power. My trusty voltmeter says that my resistance from terminal to terminal (that is, one hand to the other) is above 1 MOhm when lightly touching the terminals, and hovers near 47 KOhm when I am.

    I'd like the bleed resistor to be significantly more conductive than I am; if it's before me in the circuit and I'm lucky enough, it might save my life... I usually choose about 10 KOhm.

    Oh and I'm experimenting with putting it in series with an open-core inductor. From a power perspective, an open-core inductor is a magnetic energy storage device. And for fast spikes, an inductor ends up having far more energy storage than a capacitor. By having it parallel to the capacitor but series with a large resistance, I shouldn't affect the discharge time total as I would with an inductor in series with the cap. The inductor shouldn't affect the circuit inductance enough to matter (typical circuit inductance in a coilgun might be 100-2000 mH)

    But that's all beside the point. The point is: bleed resistors don't have to be held in place. For maximum safety, make them permanent...

    Of course, that's assuming that your charging circuit will provide charge constantly, and isn't on some sort of timer or level sensor...

  19. Re:Back me up on "backing up" on Two Congressmen Push for DMCA Amendments · · Score: 1
    Re:Back me up on "backing up" (Score:-1, Troll)
    by merlin_jim (302773) on Thursday May 13, @02:21PM (#9142163)
    My favorite quote:
    "It's against consumers' interests to permit devices that make backup copies," he added, "because there is no way that a device can distinguish between a backup copy for personal use and making a copy for friends, family acquaintances or even selling on the street corner."
    (rollseyes)


    Oh yeah, that is definately against my interests.

    What if my interest is in making bootleg copies to sell on the street corner?


    Just goes to show... one man's funny is another man's troll...
  20. Re:Backing up vs. Piracy on Two Congressmen Push for DMCA Amendments · · Score: 1

    "Maybe we should have open sourced movies now? ;)"

    check out the creative commons license.


    Who are you quoting? I didn't say that...

  21. Re:Backing up vs. Piracy on Two Congressmen Push for DMCA Amendments · · Score: 2, Insightful

    I do think that allowing backups does lend itself to piracy, but that is a side-effect that will not go away. People will pirate movies and music no matter what you do.

    Legislation requiring easy DVD decoding and copying will help the average consumer. In terms of piracy, I don't think the MPAA is really worried about you buying a disc and giving a copy to your friend. They're worried about the guys that push out a couple thousand discs a day through automated machines and sell them...

    Those guys are willing to invest in the machines to make DVDs, they're willing to invest in the software to copy them... its that simple. And obviously, they don't really care about the legality of their actions. Making the law tougher on them at the restriction of consumer rights isn't helping anyone out...

  22. Re:Back me up on "backing up" on Two Congressmen Push for DMCA Amendments · · Score: -1, Troll

    My favorite quote:
    "It's against consumers' interests to permit devices that make backup copies," he added, "because there is no way that a device can distinguish between a backup copy for personal use and making a copy for friends, family acquaintances or even selling on the street corner."
    (rollseyes)

    Oh yeah, that is definately against my interests.


    What if my interest is in making bootleg copies to sell on the street corner?

  23. Re:Chicken Little on OptInRealBig Wins Restraining Order On SpamCop · · Score: 1

    I'm not disclaiming that what you say is true; I'm merely saying that they are involved in unethical behaviour. Their STATED behaviour is unethical; their actual behaviour may be more unethical, but I didn't need to go there as what they claim to do legitimately is unethical enough for my purposes...

  24. Re:80% accuracy can be useless... or not on The Security Risk of Keyboard Clicks · · Score: 1

    One of the problem I have with this technique is that the guy had to record the sound of each key 30 times before starting to try to recognize keystroke. This is time consuming and requires physical access to the keyboard.

    No, it requires physical access to a same model keyboard.

  25. Re:Great... on The Security Risk of Keyboard Clicks · · Score: 1

    We have that system at one of our facilities

    It's not ADA compatible... blind users don't use it...