Slashdot Mirror


User: ajs318

ajs318's activity in the archive.

Stories
0
Comments
4,821
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 4,821

  1. Re:Pretty sure the reporter has it wrong... on European Commission Reverses its Views on Patents · · Score: 1

    Yes, but some other device that intercepted and decrypted communications would not necessarily infringe on your patent. The patent doesn't cover the underlying mathematical operation. You can patent a new type of toaster, but they all depend on the same underlying principle: that carbohydrates, when heated, decompose to give carbon and steam. That's a law of nature and can't be patented. So, just changing a few superficial details of the device would be enough to get around the patent.

    By the way, prime numbers already can be factorised in linear time. If p is any prime number, its factors are 1 and p, and this always takes the same time to determine regardless of p {though the time required to announce the factors is proportional to log p, since it depends upon the number of digits}. I think you meant determining the factors of numbers which are known to be products of two primes.

    BTW, need you do the factorisation in isolation?

  2. Re:Sounds like that's good for open source... on European Commission Reverses its Views on Patents · · Score: 2, Informative

    Hey, who ever said there was a living to be made selling software?

    You won't earn much money running a pay toilet in a forest. And the people who used to fit oil lamps to horse-drawn carts have had to find something else to do. In 30 years time, there won't be any oil left in the ground.

    Fact: you don't have an automatic right to get paid for whatever you do. Get over it.

  3. Re:Pretty sure the reporter has it wrong... on European Commission Reverses its Views on Patents · · Score: 1

    Well, 2(a) specifically excludes mathematical methods from the scope of patentability. A computer program that does something useful is almost certainly based around a mathematical method. In fact, things like compression and encryption algorithms are mathematical methods. A person with crayons, graph paper and plenty of time on their hands could look at a hex dump of a GIF file and draw the picture it described. There is no doubt in my mind that they would be performing a mathematical operation, which is rightly unpatentable. A person with enough paper and enough patience might even be able to study a hex dump of an MP3 file and write out a set of numbers which would form a corresponding raw PCM file. Writing it out in musical notation would be pushing it some.

    Likewise, encryption is a mathematical operation and so not patentable. Look at Bruce Schneier's Solitaire for an example of non-computerised data encryption.

  4. Re:I think RMS is bang on on The Curious Incident of Sun in the Night-Time · · Score: 1

    You can read the Source Code to Java, for sure; but if you do, you have to sell your soul and you can never, ever program again. That's not Freedom. It's an unacceptable ultimatum.

  5. I think RMS is bang on on The Curious Incident of Sun in the Night-Time · · Score: 2, Insightful

    I think RMS is right here.

    The new Java licence does not preserve the Four Freedoms. If you use Java under the standard binary licence, you are at the mercy of Sun. And although they might be playing nice today, the fact remains that they could change their minds at anytime in future, potentially leaving you up a certain well-known waterway without an implement of propulsion.

    I can see why Sun want to protect Java, but I don't think keeping the source code locked up is the best way to do it.

    The Java brand name is undeniably strong. So what would be wrong with keeping Java as a registered trademark; and then licencing the use of the trademark on separate terms from the copyrighted software? Then, if you changed the functionality beyond what Sun would permit, you would no longer be allowed to call it Java. The GPL, para. 7, is explicit that you can't distribute software it covers if some other restriction stands in the way. They obviously meant this to cover software idea patents, but a condition regarding unauthorised trademark use would also fit with this. If you just removed all mention of the word "Java", then you would be beyond the scope of trademark law -- so nothing would then prevent you from complying with the requirements of the GPL.

    That, then, is my proposal. Experimenters get a GPL'ed and extensible Java-alike. Meanwhile, the likes of Microsoft can't subvert Java and squeeze Sun out of the market. Everyone should be happy!

  6. Re:That doesn't follow at all. on Dan Geer's Monoculture Bomb Goes Off · · Score: 1

    Yes, malware in source form sounds like a risk; but at least you can make sure that the compiler only runs when the administrator wants it to run. That should cut down the risks at least some.

  7. breaking monoculture part II on Dan Geer's Monoculture Bomb Goes Off · · Score: 1

    How about this to break monocultures?

    Give every processor a different instruction set. So if you want code to run on a particular machine, it has to be compiled for that particular machine. In practice that's likely to mean compiled on that machine. Then there's next to no chance of "foreign" code {viruses, worms, trojans, whatever} running on your machine.

    This would mean it would be very difficult to sell closed source software, but that's no great loss IMHO. Remember, before Windows, software for the various Unix versions and VAX/VMS often was supplied in source form but without a licence permitting distribution. And anyway, the lack of source code never prevented anyone from copying Windows or Office.

  8. Re:Did any bombs go off... on Dan Geer's Monoculture Bomb Goes Off · · Score: 1

    Well, Slashdot seems to do OK with MySQL!

    It's my conservative estimate that half the people using Oracle or some other proprietary database server aren't using any features that aren't available in MySQL, and half the rest aren't using any features that aren't available in PostgreSQL.

  9. Re:What does this mean for eavesdropping? on Company Makes Inconspicuous Secure Cellphone · · Score: 1

    Before you can have a shared secret, you need a secure backchannel over which to communicate that secret. The initial key exchange system allows two parties to exchange some data, without the need for a shared secret: nobody intercepting the data in transit can decipher it on any of the three passes it takes. However, it does require that you can be sure of who you are talking to - a "Man in the Middle" who can decrypt, re-encrypt and retransmit the messages can break the system. You can guard against this by having a secure backchannel; but if you have a secure backchannel then you can share a secret anyway. See other posts by me in this thread for how I now think there may be a backchannel anyway with this method .....

  10. Re:What about authentication? on Company Makes Inconspicuous Secure Cellphone · · Score: 1

    So, then; as long as the key Mallory generates for Bob has a different hash to the one Alice sent to Bob in the first place, Bob will know that someone is playing S.B.'s. Right. And Mallory doesn't find out the key till too late, because he must have already sent out the first message to Bob -- and that is the only one that can usefully be tampered with, because Mallory never knows how to encrypt anything using Bob's original key, at least not without doing a known plaintext inversion, which isn't even certainly possible -- before Alice sends the real key, which is on the third pass.

    That actually makes sense.

    But -- could Mallory complete the key exchange with Alice before starting the key exchange with Bob, and then repeat the key exchange with Bob, now sending him the real key {it doesn't matter that it is the same key; in fact, it saves a re-encryption stage, since Mallory now only has to decrypt the message and let the encrypted version straight through to Bob}? I'm tempted to say no, because it would muck up the timings. But on the other hand, without knowing how long a "fair" key exchange should take, I can't say how noticeable a "foul" one would be -- if it's all done in fractions of a second, then it may well be undetectable.

  11. Re:That's a book cipher, not OTP. on Company Makes Inconspicuous Secure Cellphone · · Score: 1

    Yes, indeed. Although, as long as no portion of the keystream is reused, the book cipher and OTP are effectively equivalent. Even knowing which CD was used, there are between 27 and 28 bits of space for the offset -- so a three or four character message encrypted using a known CD would be provably undecipherable! And it's not at all unreasonable for a person to own several hundred CDs, adding another 8-10 bits of space; so a message of four or five characters would be provably undecipherable. As long as the message is short and the useful life of the message is also short {it doesn't matter if the enemy decipher it after the event} I think this method is fairly safe.

  12. Re:What about authentication? on Company Makes Inconspicuous Secure Cellphone · · Score: 1

    OK, that's a bit of a simplification. The Diffie-Hellmann method really goes like this.

    Alice sends a message to Bob, encrypted against some key; only Alice knows the decryption key. Bob encrypts the same message against a key of his own and sends it back to Alice, doubly encrypted against both Alice's and Bob's keys. Alice decrypts the message with her decryption key, leaving it still encrypted against Bob's key, and sends it back to Bob. Bob decrypts it with his decrypting key and now has the message in the clear. {Note, this will only work if the encryption scheme is commutative, i.e. if A'(B(A(x))) == B(x), but that is really a detail. There are plenty of algorithms that have this property.}

    Physical analogy: Alice locks a message inside a steel box with her padlock and sends it to Bob. Bob cannot remove Alice's padlock because he does not have the key. He puts his padlock through the hasps on the box and sends it back to Alice with both locks in place. Alice removes her padlock, leaving Bob's padlock, and sends the box to Bob. Bob removes his padlock and opens the box. At no time was the box transported in an unlocked state, yet neither Alice nor Bob have keys to each other's padlocks.

    Now in three passes Alice has sent something to Bob without either one ever knowing the other's keys. Bob can similarly send a message to Alice in three passes. But this will take three times the bandwidth if it's done for every message; so what is usually done instead is for Alice to send a "session key" to Bob, and Bob similarly to send a session key to Alice. All subsequent conversation is encrypted against the session keys.

    Unfortunately, the three-pass system still is vulnerable, as the following shows:

    Alice sends a locked box to Bob. Mallory intercepts the box with Alice's padlock, and sends Bob a fake box {but he has no way to know that it isn't the real one} with Mallory's padlock which Bob thinks came from Alice.
    Mallory returns the real box to Alice, with Alice's and Mallory's padlocks. Bob sends Mallory the fake box with Mallory's and Bob's padlocks.
    Alice sends Mallory the real box. It is now locked with only his own padlock, so he unlocks it and gets whatever Alice was trying to send to Bob. Bob gets Mallory's fake box with just his own padlock, unlocks it and gets the contents of the fake box.

    Now, it doesn't matter that Bob did not receive exactly what Alice was trying to send. Bob cannot talk to Alice directly, only via Mallory; who now has all the encryption and decryption keys and so can alter any message in transit.

  13. Re:Can you hear me now?? on Company Makes Inconspicuous Secure Cellphone · · Score: 1

    Which is why the truly paranoid still insist on one-time pads -- an encryption key as long as the message itself. When an OTP is used properly, there is no way to distinguish between ATTACKTHEBRIDGEATNOON, DEFENDTHEFORTATSUNSET or even MYDAUGHTERHASTHEPILES. They are all equally plausible. An attacker will not even get so much as a toe-hold, unless the pad is re-used for another message as long as the first. And you aren't that stupid :)

    The main disadvantage of OTPs, and the reason why everyoe is not using them all the time, is that you have to distribute identical one-time pads to everyone with whom you wish to communicate securely. But you could use a popular chart CD or DVD as a keysource: a CD can be used to encrypt about 400MB of messages {most albums are <74 mins} before you need to choose a new one, and it's not really suspicious for two people both to have copies of the same CD.

  14. Re:What about authentication? on Company Makes Inconspicuous Secure Cellphone · · Score: 4, Informative

    This is how it's supposed to work: Alice calls Bob. Bob answers. Alice generates a key pair and sends one of the keys to Bob, keeping the inverse. Bob also generates a key pair and sends one to Alice, keeping the inverse. Alice encrypts everything she sends against the key she received from Bob. Bob decrypts it using the inverse key he generated. Bob sends everything to Alice encrypted against the key Alice sent him. She has the inverse key and can decrypt everything Bob sends.

    All clear now? Well, this is how it might work in practice, with a malicious interloper we'll call Mallory:

    Alice tries to call Bob. Mallory intercepts the call, pretending to be Bob; gets the key Alice sends, and in return sends her a key {which Alice thinks is from Bob}. A fraction of a split second later Mallory places a call to Bob, pretending to be Alice, and sends Bob a key. Bob thinks Mallory's key is really Alice's key and sends a key to "Alice". Whatever Alice says is encrypted against the key sent to her by Mallory, who -- having the opposite key -- can decrypt it, re-encrypt it against the key which Bob has, and send it on to Bob. Mallory has a nice, fast computer that can do decryption and re-encryption in real time; in reality, it only has to be twice as fast as the processor in either of their telephones. Whatever Bob says is encrypted against a key sent to him by Mallory, who can decrypt it and re-encrypt it against Alice's key. Mallory has both sides of the conversation, in the clear, and neither Alice nor Bob are any the wiser.

  15. Re:Feasibility for US Market? on Company Makes Inconspicuous Secure Cellphone · · Score: 4, Informative

    Not quite. The 900 and 1800MHz bands are used by different service providers. In the UK, 900MHz is used by Vodafone and O2, and 1800MHz is used by Orange and T-Mobile. Before the advent of the venerable Nokia 3210, most phones were single-band and were built using two PCBs: one for the main processor, audio circuitry, keypad and display, and one for the RF stuff {which would be made in 900 and 1800 versions and the phone assembled accordingly}. The 3210 used a single PCB capable of doing both RF bands. The cost saving associated with the single-board design {no expensive multiway connectors, and a better process hit rate} outweighed the cost of the extra components.

    A phone connected to a base station will always us one or the other band. But within each band there are several channels; the phone and base station automatically select the best channel continuously throughout a call {if another subscriber disconnects and the channel they were using is better, your conversation will switch to that channel}. The whole process is kept seamless because both phone and base station change at the same time, between data packets.

  16. Re:What does this mean for eavesdropping? on Company Makes Inconspicuous Secure Cellphone · · Score: 1

    Well, unless we get to examine the source code, we have no way to know how secure the thing really is. And if it's using Diffie-Hellmann key exchange, then all MI5 or GCHQ or whoever's listening have to do is mount a classic MITM attack.

  17. Re:it isn't the accepting... on Wallace's Second Anti-GPL Suit Loses · · Score: 1

    The restrictions on what you can do with GPL software do not come from the GPL itself, but from the Law of the Land. If you do not comply with the conditions upon which the GPL says you may do things that Copyright law says you need permission to do, then that permission is withdrawn and you are left in violation of copyright law.

  18. Re:Interesting take at Groklaw on Wallace's Second Anti-GPL Suit Loses · · Score: 1

    Come to Britain! Loser pays both sides' costs, and no money changes hands till a verdict is delivered.

  19. Re:Why? on Microsoft Introduces Pay-as-You-Go Computing · · Score: 1

    Meh. Someone, sooner or later, will hack the Windows drivers wide open, and write Linux equivalents. It's not really that hard, it's just a shitload of work. Why isn't it happening now? There exists no motivation to do it -- it's quicker and easier for people just to pirate Windows than to try to make their kit work with GNU/Linux. If and when it becomes hard enough to pirate Windows, people will make a serious effort with Free Software.

  20. Re:You're wrong. on Microsoft Responds To 360 Hackers · · Score: 1

    Yes, but the important phrase is "just said that the bell curve is likely skewed .....". Said is a past participle so it should have the verb "to have" somewhere ahead of it. Like "You have just said that the bell curve is likely skewed .....". Only I didn't use the opportunity to say that. I could have said it. That makes sense. And since one can use an apostrophe to indicate letters omitted [side note: is "ap'phe" grammatically correct?] one can write "could've" for "could have". But a moment's thought ought to show what it's short for.

    I'm sure if I went over this topic with a fine-toothed comb, I could find more examples of blatant misuse of the Queen's English. One shouldn't look a gift horse-in-the-mouth.

  21. Question on Japanese Lab Creates 'Da Vinci' Voices · · Score: 1

    How many real criminals got away with real crimes while the boys in the lab were abusing the facilities for something so pointless?

    Never mind, if the Japanese are anything like the rest of the world, they probably just hassled a few extra motorists.

  22. Get a grip, people on Possible Antibiotic for MRSA Superbug · · Score: 3, Insightful

    MRSA is a variant of common-or-garden Staph that is resistant to most antibiotics. It's not, however, resistant to soap and hot water.

    The problem is that antibiotics are being badly misused. After about three days on penicillin, with two days to go, you start feeling OK again. Now, at this point, you may be tempted to stop taking the stuff. That is the worst thing you can do. Your immune system has recovered a bit, and is now just about strong enough to fight off the bacteria. However, unless you can be sure that you have killed every last one of the germs, there is still a chance that they might breed. And the ones that survived the onslaught of penicillin are going to pass on the "double-hard bastard" gene to their own offspring. So you need to complete the course, using your own recovered immune system with penicillin as backup, in order to deal with the superbugs.

    People failing to finish courses of antibiotics are costing the National Health Service {and by extension the taxpayer} money. In fact, penicillin {or the artificially-manufactured equivalent, Amoxil} isn't used so much anymore because there are resistant strains of so many bacteria. My cruel side thinks it's a shame you can't ROLLBACK a medical treatment and leave people sick if they don't complete the treatment properly .....

    On the other side of the coin, if you keep taking penicillin for too long, your immune system will eventually stop trying so hard {and again you'll be breeding penicillin-resistant bugs}. Plus, the stuff isn't any respector of the essential bacteria in your body. Too many antibiotics passing through your system might even kill some of the essential bacteria in your septic tank, causing it to smell and making you unpopular with the neighbours.

  23. Re:You're wrong. on Microsoft Responds To 360 Hackers · · Score: 2, Funny

    Why do people say "could of" when they mean "could have" ?

    When I start my own country, I'll make bad grammar and spelling capital offences.

  24. hardware lockdown bad on Microsoft Responds To 360 Hackers · · Score: 1

    I don't see how Microsoft's {for that matter, any manufacturer's} hardware lockdown can be considered as anything other than anti-competitive behaviour. If a car manufacturer set out deliberately to frustrate attempts to fit extra lights, a better stereo, blind-spot mirrors, fluffy dice &c. not made by them, they would quite rightly be slapped down in the courts. In fact, there's a healthy competitive market in third-party car accessories. A firm of house builders could not legally prevent homeowners from laying new laminate flooring, installing extra power points or fitting new door handles not approved by them.

    Due to a little thing called "Exhaustion of Rights" {it goes all the way back to when some bloke signed a piece of paper at a place called Runnymeade}, when you buy an XBox360 using your own hard-earned, anything you do with it {with the possible exception of setting fire to it and throwing it through one of their windows} is none of Microsoft's business anymore.

    It was quite legal for Parker Brothers, Activision, Imagic et al to make game cartridges for the Atari 2600. What changed since then? Apart from people getting greedy .....

  25. Re:You're wrong. on Microsoft Responds To 360 Hackers · · Score: 1

    Depends which average you want: mean* {add up and divide by sample size}, median {line everyone up in order and pick the one at the halfway point; halfway along X-axis of ogive} or mode {most frequently occurring value; point on ogive where gradient is steepest}. Half of any population by definition are below the median. The mean, which is what most people think of as "average", may be skewed by a few very large or very small values, particularly if the range is blind. The median is more stable, even in a blind range, as long as the rogue values are few in number.

    * OK, there are two means. What I just described is the arithmetical mean. There is also a geometrical mean, where you multiply all the values and then ** by (1 / sample size). If you find yourself needing to do that often, you probably should consider taking the log of your data.