Slashdot Mirror


User: EventHorizon

EventHorizon's activity in the archive.

Stories
0
Comments
128
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 128

  1. IP Blacklisting Does NOT Work on BayTSP Provides Automatic DMCA Notices · · Score: 2, Interesting

    IP blacklisting is not technically viable. This fact should be obvious to slashdot readers, and we need to stop modding these posts up.

    BayTSP can trivially acquire new IPs. I bet they could even get a few in the same subnet as PeerGuardian's web server. Until you figure out what IPs your opponents use, you are fully exposed. In other words, PeerGuardian and others rely on continual sacrifice of their 'sheep' userbase to figure out what IPs are being used by the 'wolves' to prosecute illegal distribution.

    Another problem is that PeerGuardian blacklists a huge amount of the IPv4 space (~20% IIRC), which means there are many high performance "allied" nodes it won't be able to access.

    IP blacklists are not acceptable over the long term and basically doesn't even work over the short term. Please stop modding this stuff up.

  2. Closed BT Sites on BayTSP Provides Automatic DMCA Notices · · Score: 1

    Four problems:

    1. In a site with 150k or 200k users, at least some of them will be RIAA/MPAA spies, or exploitable into becoming spies (think MSIE holes, plaintext logins at defcon, etc).

    2. When you cap the site to 150k or 200k, you are locking out a huge potential audience ("friendly fire").

    3. Even if you want to run a site with more than 200k users, the web infrastructure these sites use simply does NOT scale much higher.

    4. The site is an obvious centralized target. The site owner is taking an enormous personal risk (especially since there is no legal precedent).

    So frankly the closed site scheme sucks. Far better to fix the p2p protocol to provide some level of anonymity (tor, MUTE, and many others are in the R&D stage).

  3. BT Must Upload To Leech Nodes on BayTSP Provides Automatic DMCA Notices · · Score: 1

    Anyone can download from a standard BT peer without first uploading to them. This behavior is required when new nodes join the network--they have to get their first few pieces 'for free' before tit-for-tat becomes viable. Otherwise, new users could never join the swarm.

    Also: a BT seeder by definition uploads to others for nothing in return. This does raise the issue of how to incentivize people to seed after their own download completes--often insecure web-site ratios are used based on what the client tells the tracker. This technique is like your parents asking you if you cleaned your room because they can't actually look inside. In that situation, smart kids tend to always say 'yes'

    Anyway, if you absolutely must use BitTorrent for illegal material, make sure you keep its TCP port closed. This prevents your node from showing up in the tracker peer list, which may slightly reduce your chance of a DMCA complaint. Better still though to not use BT. It's really designed to make it EASY to catch illegal traders (Bram Cohen covered his ass so he could get a real job).

  4. OT: valgrind on Firefox Reviewed in the Globe and Mail · · Score: 1

    Well, there is an experimental ppc32 port of valgrind:

    http://valgrind.kde.org/

    You can also use qemu to emulate x86 linux, then run valgrind inside of it... or even pick up a cheap x86 box just to use it... it's truly an excellent tool that will catch leaks, double frees, invalid access (with its security implications), etc. I don't know anything else that comes close.

  5. 'firefox --debugger valgrind' on Firefox Reviewed in the Globe and Mail · · Score: 4, Interesting

    I did some more research after that post. If you want to run firefox under valgrind you actually need to use 'firefox --debugger valgrind'. With 'valgrind firefox', the startup script causes valgrind to analyze the script, rather than the actual browser process.

    Anyway, results with a single blank firefox 1.0 window:

    ==6273== ERROR SUMMARY: 83 errors from 5 contexts (suppressed: 272 from 3)
    ==6273== malloc/free: in use at exit: 691499 bytes in 12633 blocks.
    ==6273== malloc/free: 163851 allocs, 151218 frees, 25635248 bytes allocated.

    which IMHO is rather unacceptable for a 1.0 release.

  6. Automatic Correctness From Day One on Firefox Reviewed in the Globe and Mail · · Score: 5, Interesting

    Tools such as 'valgrind' are great for catching memory problems like the one you described. However, it is best to use them continuously during development (ideally running automatic regression tests inside them). It's virtually impossible to clean up a huge amount of low quality code after the fact.

    Frankly the firefox codebase is the result of 7 years of development done largely without unit tests or even basic QA. As a result, they have leaks, bloat, and severe malformed HTML DoSes that lock up all browser tabs/windows.

    The key to good engineering is complete self-honesty, but these days it looks like firefox is being managed by a self-delusional marketing organization with no interest in fixing its serious technical problems.

    Linux users are encouraged to run 'valgrind firefox' prior to modding this post down for not towing slashdot's party line.

  7. MUTE/tor/freenet on MPAA Goes After More Bittorrent Site Operators · · Score: 1

    You have to build your own network, and it has to have moderately strong anonymity. Nothing else will work.

    Fortunately, you can build that network on top of the existing insecure, tracable internet. freenet/tor/MUTE are incubators for the next generation of fully anonymous, high performance p2p. It's a matter of time until one good coder puts all the pieces together.

    And then there's WiFi p2p, which is going to be unbelievable once we all have nodes in our cars, backpacks, etc.

    Nail, meet MPAA coffin. Slashdot, meet nail.

  8. Explain Why IP Blacklists Are Useful on BitTorrent Gives Hollywood a Headache · · Score: 1

    It sounds like PeerGuardian blacklists a huge portion of the IPv4 address space under the guise of providing protection from the RIAA/MPAA.

    Can someone please explain why that is useful, and not harmful?

    Given that PeerGuardian is freely availible, its address list is freely availible. What prevents the RIAA/MPAA from just obtaining addresses that are NOT on the list (I'm pretty sure they can afford a new cable modem each day)? How do you compensate for the false blocking of "legitimate" high performance peers which use one of the >1e9 blacklisted IPs (1/4 of the IPv4 space)?

    It sounds like PeerGuardian is just another troll security app, possibly designed to bundle spyware and/or whore itself out for attention, ad revenue, etc.

    Sigh. I guess self-delusion is as popular as ever.

    Be suspicious of all security software, especially if it lacks OpenBSD support

  9. Finally! on Half Life 2 Stuttering Bug Official · · Score: 5, Interesting

    This bug has been degrading an excellent game for many people--good to see Valve finally acknowledge it.

    Now if only they would fix the "Loading" delays that show up every 3 minutes... it's 2004 already, there has *got* to be some way to stream/cache/prefetch around having to break up the game experience so much.

  10. Automatic Detection of BT Addicts on BitTorrent Accounts for 35% of Traffic · · Score: 1

    Any competent CS student can write a bot to listen on the major torrent sites, connect to all the trackers, and scan for single IPs downloading multiple files. The RIAA/MPAA are many things, but they're probably not too stupid to develop or purchase that technology.

    Leave the bot running for a few months and they're bound to build a nice example-setting case against a few BT addicts.

  11. EFF's Opinion On BT TV Rips on BitTorrent Accounts for 35% of Traffic · · Score: 1

    I can see arguments both ways for this, but it's not a clear one in any direction, so lawsuits are quite unlikely.

    Since when does ambiguity prevent lawsuits? Aren't many lawsuits the RESULT of ambiguity? Is there anything that makes a lawyer happier?

    Anyway, this exact question was asked during one of the EFF sessions at Defcon 0xC. Wendy Seltzer (EFF intellectual property attorney) responded that downloading TV rips is very likely an infringing act; the copyright holder simply has not authorized their distribution over the internet.

  12. Re:Warning to Cox/Cable customers on BitTorrent Accounts for 35% of Traffic · · Score: 2, Insightful

    The cable Internet providers are much less respectful of customer privacy.

    And that, boys and girls, is why you should encrypt ALL traffic over your final hop, and only hit the plaintext internet from a remote box.

    For instance you can get a cheap virtual private server semi-anonymously and then route all plaintext traffic to/from it using IPSec [1]. Your ISP will be left with virtually no info about what you do online.

    This situation kind of beats exposing all traffic to cable/DSL companies, which are usually owned by major media conglomerates and have as much of your personal info as the IRS. Of course it won't stop the FBI if you do something massively illegal, but the MPAA/RIAA goons are, as you said, likely to pick on an easier target.

    [1] alternatively, google "tor"

  13. So Use The Source on NYT Firefox Campaign Raises $250,000 · · Score: 1

    Firefox is opensource. You could certainly pay someone a modest fee to disable the proxy/trusted domain options from the menus, meaning that most users won't mess with it. If you need "actual" rather than "apparent" security, why are you using Win32? Microsoft platforms have almost no legitimate local user security.

  14. Firefox Performance/Stability on NYT Firefox Campaign Raises $250,000 · · Score: 1

    If Microsoft see it as a threat... good. It may push them to fix their bloated and buggy browser.

    Mozilla has had significant performance and reliability problems since it's creation. I am saddened that their apparent "solution" to this problem is to remove functionality (mail, news, irc) and then launch a massive marketing campaign to rebrand saying "hey, it IS fast and stable now". When Microsoft uses that type of strategy, we all circle jerk about how lame it is.

    Firefox is still far slower than IE, especially under Linux and/or a five year old computer. The $250k would definitely be better spent fixing performance and stability issues--it's absurd that Halflife runs more responsively on many machines than Firefox.

    For all the fanboys and fangirls about to mod me as a troll, here are some tests you need to go run:

    1. Compare IE vs Firefox startup from cold boot. The "IE runs in the kernel!" argument is BS--both untrue and irrelevant.
    2. Compare IE vs Firefox "New Window" latency.
    3. Start Firefox under Linux. You will see a 5-10 second delay on most hardware. Sorry but Slackware, Gentoo,"-march=pentium4", etc, do not make much difference.
    4. Open a link in a new window in Linux firefox, and try to scroll in the original window while it loads. Note that it's unresponsive for two or three seconds--despite Firefox using 5-10 threads.
    5. Load a 16MB text file in Linux Firefox. Enjoy the kernel OOM killer and/or heavy swap thrashing.
    6. Load a ~25 byte malformed HTML file and watch Firefox crash (google "mangleme" for further info). Note how it takes out ALL browser windows when it dies.
    7. In terms of security: note the recent libpng problems (which are not really Firefox's fault, but the $250k could perhaps be used to fund an audit of the core libraries).
    8. In terms of performance: some of the problems may result from poor code generation in g++ etc. So dedicate some of the money to the compiler guys and get it fixed, or rewrite critical sections in assembly for major arches, etc.

    Anyway Firefox still has a long way to go. Given the complexity of their codebase I am afraid we may need to develop a new browser from scratch to have a truly high quality open browser. Otherwise I would love to hear a response from the Firefox devs about what is being done to address these problems.

  15. Re:Summer Vacation In Outer Space on SpaceShipOne Captures the X Prize · · Score: 1

    Drunk teenagers keep the road death statistics high, and the airlines in business.

    WTF? How many daily flights does JetBlue now offer between your home and your job?

    Airline transport usually serves a separate market from automotive transport. People fly cross-country because it's 90 hours faster than driving, not because they're afraid of death-by-teenage-DUI in mid-Kansas.

  16. Follow The Money on SpaceShipOne Captures the X Prize · · Score: 1

    For some odd reason I see the number of auto accidents being greatly reduced if that were the case.

    Accidents would be reduced. So would auto maker profits, oil company profits, car insurance profits, state and federal gasoline tax income, state license renewal profits, state emissions testing profits, garage repair profits, drive-through restuarant profits, MTV pimp-your-ride profits, ER profits, etc.

    American society is so heavily dependent on, and in love with, the automobile that your proposal will never happen--no matter how many lives it may save.

  17. Econ101: Deflation vs Inflation on The Jobs Crunch · · Score: 1

    "how would you like it if your boss gave you a timely drop in salary, to keep up with the drop in the cost of living?"

    I'd actually prefer it if my personal cost of living decreased faster than my income. Anyone in an inflationary area where expenses rise faster than income would agree... +30%/year LA housing market compared to +1% salary raise etc [1]

    The point is: what matters most is your income-expense delta, not the direction of prices.
    Prices can rise or fall either in your favor, or out of it (depending on which prices change, and by how much).

    So, based on your own definition, a depression is not necessarily worse than a recession. You may argue that the 1930s depression was worse than the 1990s recession, but the general argument is false.

    [1] Housing deflation would destroy the American consumer economy which is funded largely by home equity debt--separate topic though

  18. Re:XP BSOD == Cold Reboot on Bill Gates Gives $20M to CMU for New Building · · Score: 1

    Wow +5 back down to +1 in five minutes. Maybe the mozilla exploit actually took out more Linux mods than the IE exploit did Windows mods?

  19. Re:XP BSOD == Cold Reboot on Bill Gates Gives $20M to CMU for New Building · · Score: 1

    Heh. I guess it's good to hear that Microsoft finally "innovated" a software watchdog timer similar to what's been in Linux et al for five or six years.

    BTW chill out. I hate every OS.

  20. XP BSOD == Cold Reboot on Bill Gates Gives $20M to CMU for New Building · · Score: 1, Informative

    IIRC many of the errors which caused blue screens in Win2K/Win9X were changed in XP to just cold reboot the machine. This behavior change can make it seem to Joe User like the power glitched, a hardware fault caused an NMI, etc, instead of Windows just flaking out for some random reason.

    If the above is true, Microsoft has executed a brilliant act of market deception, even against highly technical users.

    [Disclaimer: I've never run WinXP. I will certainly accept factual corrections from someone with an accurate knowledge of its internals].

  21. The Best Justice Consumers Can't Buy on PayPal to Fine Gambling, Porn Sites · · Score: 1

    When you sue a major US corporation, the only people who win are corporate lawyers (well, and the corporation).

    Consumer power lies in taking business elsewhere, not in direct legal assaults. The economics of the American legal system are heavily weighted against individuals and even groups of individuals.

    Another minor point: your plan requires buying eBay stock, which means you are helping to fund the entity you intend to attack. One share may be economically insignificant, but the situation is still absurd. As an experienced American consumer^Wproducer, my advice is:

    1. Sell any eBay shares you may own (if you would rather decapitalize eBay than accept the risk/reward of continued investment).

    2. Don't feed the lawyers.

    3. Take your business elsewhere (google is your friend).

  22. WiFi Is Teh Solution!!1! on Broadband Envy: Fixing American Broadband · · Score: 1

    Many posts in this thread note that sucky US broadband is due to monopoly by a few megacorps with no profit motive to upgrade wired infrastructure. I agree. But, amazingly, nobody has mentioned why those corporations don't really matter...

    News Flash: you can get 10Mbps+ over 1-30 mile links using cheap ($200 per node) 802.11 gear and high-gain directional antennas. Instead of complaining, go contact your friends, climb a roof, and set up your own private wireless network. Learn RIP/OSPF, IPSec, etc. You will not be harassed by the RIAA/MPAA over a wireless network, there is no SMTP spam or worms (unless your friends are asshats), the price per byte is essentially zero, and the performance beats everything except local ethernet (though multihop latency may be a bit high for gaming).

    Anyway, quit bitching about DSL and go heat up the airwaves (short of violating FCC rules). WiFi can be the solution to, and the end of, America's backwards telco industry.

    References

    http://www.seattlewireless.net/
    http://www.pacw ireless.com/

    Wanna build out WiFi in the Los Angeles/SFV area? E-mail me: brane at sdf dot lonestar dot org

  23. Metasploit + Defcon on Apple Introduces New G5 iMac · · Score: 1

    The metasploit.org guys actually demonstrated a remote exploit in MacOS X during Defcon 0xC. IIRC it was samba based, but I guess the Apple fanboys will try to weasel out of counting it because samba is off by default, even though a large number of corporate users enable it to interoperate with Windows PCs.

    Also, I suspect you actually meant "... just as BSD itself is famous for dying". Slashdot does not tolerate low fidelity trolls, so please review your lines next time.

  24. PowerPC Emulation on Apple Introduces New G5 iMac · · Score: 1

    OK here's my +4 Informative to your +5 Funny:

    qemu has had ppc32 support for a while and has been able to boot a PowerPC Linux kernel on an x86 box since around April. They have also had basic PREP (PPC REference Platform) video support since May. Basically, booting a PowerPC Mac OS X CD on x86 has become a relatively straightforward matter of blackboxing Apple's low level firmware and hacking out video/network/etc stub drivers. From a performance point of view, it is very likely a modern x86 CPU (especially x86-64) can emulate a 600 MHz PowerPC G3 in near-real time (AKA faster than most java apps).

    qemu is not there yet, but it's very clearly headed in that direction.

    Obviously, whoever pulls MacOS X86 off first is going to need an Enron-sized legal team and maybe a few bodyguards. Should be fun to see how /. reacts to Apple weilding the DMCA against an emu hacker, maybe with an EFF countersuit in the fray, while the bootable x86 DVD of MacOS X floats around on BitTorrent with SCO claiming full ownership...

    At least maybe we can settle a few hardware wars when AMD executes PPC32 faster than Motorola.

  25. This Side Of Paradise on Surviving College With Gear And Sanity Intact? · · Score: 4, Interesting

    Compelling post mostly because I am in a similar phase of life. Since I was sitting here deep in self-analysis *anyway*, might as well contribute to the mass confessional (aka group circle wank).

    I spent virtually all of my college life nerding out at a highly technical university with very few girls. When not nerding out, I made periodic attempts to socialize (become involved with the rave scene etc) and, for a slashdot poster, I guess I made decent progress. However, I would quickly burn out and lose faith when I was trying to promote a party Friday night or whatever and walking around the dorms just found a bunch of guys playing counterstrike typing "pwn3d j00 m4mm1e b1tchz0r!!!1" or doing sets while all the girls were huddled in the library studying, or leaving for home to be with their parents, etc.

    I've heard the vast majority of colleges have active social scenes, but at least one tech school is mostly silent on Saturday night, aside from "Terrorists Win!". No lie.

    So eventually I just gave up, moved off campus, found a good part time job that rewarded me for hacking cool stuff 20-40 hours a week (on top of the 40 hour course load), and recently graduated knowing basically only the same five male friends I had freshmen year.

    Sometimes I adopt the mindset in your post and worry I just opted out of the best part of my life. The thought is profoundly depressing. No doubt it is difficult to develop the social skills girls/women require if you do not do so along with your peers--the vast majority of women obey a very specific, inelastic, social ruleset and many aspects of that ruleset are challenging for highly technical, introverted males.

    All of that aside, the last 10 years really have blown the lid off of some fscking awesome technology. I have deeply enjoyed thousands of hours spent on OSS, coding, etc, and draw spiritual satisfaction from my geek pursuits. As powerful as sex is, there are some people who just get off on technology (insert sticky kb jokes here), music, math, etc, more than on a skank sorroriety girl (which frankly is what most of the boring easy college girls classify as). Telling a technical person to drink/snort up and tag a skank is like telling a bunch of skanks to spend Saturday night optimizing a *BSD kernel (heh theres some fun for the ACs in that quote).

    Anyway part of becoming an adult is realizing that pop culture and modern society impose a lot of BS in the name of social conformance. You'll probably have to reject a metric ton of that BS to feel OK about your interests. I know first hand you will not agree from within the depths of depression, however: there are at least a few women who value uniqueness and will pull you into their world assuming you don't write them off as sluts, freaks, etc, or write yourself off as an inadequate social reject. I bet many women are potentially sympathetic but lack the social initiate to break rank with the Animal House hoards.

    So to wrap this post up... Modeling highly technical systems is an amazing talent for which you may be highly compensated. However using that talent to model your own mind quickly becomes counter-productive. Socialization demands empathy with another person; if you are stuck deep in self-analysis you will not have mental bandwidth for him or her. Also trying to force yourself into a value system inconsistent with your past is probably not going to work, instead you need to use your rational abilities to address emotional/social concerns, yet without violating the narcissism constraints. College and life are just a case of discovering the right tradeoffs, very similar to the art of hacking.

    Further Reading:

    "This Side Of Paradise" by F. Scott Fitzgerald. Go grab it on Gutenberg.

    Further Discussion:

    brane at sdf tod lonestar tod org