Slashdot Mirror


User: dbacher

dbacher's activity in the archive.

Stories
0
Comments
166
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 166

  1. Re:Glad to see DRM is protecting digital rights on Crackers Tune In to Windows Media Player · · Score: 1

    Well, under International Copyright law, which you seem to like to ignore, and US Copyright Law, the original author of a creative work (the artist) has a right to control how the creative work is distributed and exibited.

    The artists, as part of publishing through RIAA record companies, assign the rights to their work to the record label (Emi, Sony, etc.) who then, under US and international law, and as consitutionally garaunteed in the United States, have the right to protect the distribution and exibition of that work.

    The RIAA and MPAA, in turn, represent the intrests of member companies, who are typically infringed on as a whole. It's very rare to find someone who is illegally obtaining music from only one record company, it's much more common they are illegally obtaining music from many companies.

    Yes, the RIAA has the constitutionally protected right to pursue both Civil and Criminal charges. Congress is granted the right to pass laws related to copyright, and to use those laws to ensure that people authoring creative or technical works are free to control how their works are used.

    If you don't like the RIAA, there are plenty of unaffiliated labels and independent records out there, most at a fraction of the cost of RIAA artists, and many just as good.

    If yuo want the Sony label songs, etc. don't kid yourself by saying P2P is fair use, etc. P2P is a printing press for mass reproduction of files. When those files are legal, P2P is a great thing. When those files trampel over any copyright holders rights, P2P is a bad thing.

    Dilution of any copyright -- whether it's a RIAA or MPAA, or the GPL, impacts all of us... =/

  2. Re:I know this is a very pro linux forum but on Crackers Tune In to Windows Media Player · · Score: 1

    Yeah, I know what you mean... A buffer overflow in Microsoft's SMB code that allows Administrator access obviously is far more severe than a buffer and artithmetic overflow in SAMBA allowing execution of code as root... Seriously, there are a few dozen open source vulnerabilities reported a week, and typically between six and eight patches are downloaded on my Linux box, each of which e-mails me with information about what it did, etc. In what way is that better than Windows? Because there are more patches? Because the patches are less well explained? Because nobody /.'s them because they aren't written by Microsoft? I'm not saying Microsoft is better here, but define "more frequently" and "more severe" -- root execution privledge is root execution privledge, regardless of what OS it's on, and last I heard, that was about as severe as exploits got. More frequently is subjective -- most of what I see on bugtraq and other forums tracking it is actually open source, so I'd tend to say more frequently is also a stretch. Of course, this being /., it's expected for everything to be scewed and reported with no actual relation to reality. After all, this is the forum where people think that posting source code to disable virus scanners on the public internet before informing package maintainers of the vulnerability is a good way of doing things.

  3. Re:Unsuspecting??? on Crackers Tune In to Windows Media Player · · Score: 1

    Weatherbug does not pretend -- at all -- not to be advertiser supported. When you run it, it tells you it's advertising supported, when you view the reports, you see the advertisements, etc.

    Most anti-spyware companies either classify it as a non-threat and ignore it, or as is the case with Giant and Microsoft's new derivitive (and Sunbelt's) classify it as a low threat with a default of "ignore."

    Similarly Wild Tangent (the other typically named AIM "spyware") reports back playing of Wild Tangent content files to Wild Tangent. As it turns out, the creator id in the wild tangent file is important to them, because they charge per-view for the use of Wild tangent. This charge goes to the content provider, not to the content viewer, who gets to see the content for free.

    Again, it's a matter of definition. Weatherbug tells you up front it's going to deliver ads, delivers ads only when you're using it, and has well documented (on their website) information on what data it sends, when and how.

    If you don't want it, there are plenty of alternatives, and AOL doesn't force you to install it.

  4. Re:Uneducated Users on Crackers Tune In to Windows Media Player · · Score: 1

    Windows 2000 and XP, by default, only provide the option "User" or "Power User" when you use the "add user" option in control panel.

    The bigger issue is "not running as administrator" doesn't fix the problem. With either Mozilla or Internet Explorer, when you view a site that requires a plug in, you're prompted to install the plug in. This plug in will be installed into your profile, and doesn't require administrative works.

    The web browser has access to everything the currently logged in user has access to, can access all his/her software and settings, can alter all his/her settings, and can communicate with any random internet sites that it chooses. It can log keystrokes for the current desktop session, it can log mouse clicks, it can search data files, and it can infect other applications that support add ins, plug ins or scripting languages.

    Running as a non-Administrative account lowers the attack surface, but not by nearly as much as what people think it does. Microsoft Installer, for example, will escalate to Administrator as required to install software from signed MSI files, and XPI can still install plug ins into FireFox for all users unless you manually go and lock down the firefox folder, for which instructions are not provided.

  5. Re:No logic on Crackers Tune In to Windows Media Player · · Score: 1

    It's not even MP3's -- the file has to be encoded with the DRM scheme itself. It's not checking file signatures, etc. The music file itself has encoded in it "I'm not licensed." The "crackers" are going into services like Kazaa, and putting up songs that "look" legitimate, and installing spyware instead. This has been going on for several weeks now, and is well covered elsewhere...

  6. Re:Can't grill anymore on Lean Mean Grilling PC Mod · · Score: 1

    It's a shame, too -- the grill would make a wonderful heat sink, and you could fry all of your hamburgers for free, since your PC is running all the time anyway.

  7. Re:Now *that's* cool. Thanks, IBM! on IBM Opens Their Patent Portfolio to Open Source · · Score: 1

    More precisely what it says is:

    If you are using open source software containing an IBM patent and you sue an open source project, you lose your right to use the open source software.

    If I have closed source software, or have otehrwise already obtained a right to use the IBM patents, then in that case the original agreement is still binding and I can do whatever I want to the open source projects.

    But if I'm using open source projects in the first place, then it seems I would be unlikely to file a patent lawsuit anyway, since it would tend to be counterproductive.

  8. Did you read what he did? on Security Researcher Faces Jail For Finding Bugs · · Score: 1

    OK guys, put down your stupid "this is a college kid, etc. etc. etc." stuff for a second...

    If you find a vulnerability in a virus scanner, there are a few ways you can deal with it.

    1. You can contact the package's maintainers and ask for them to correct the bug. You can inform them of the vulnerability, and give them time to fix it.

    2. You can report it to a service that will report it to the package's maintainers and provide a brief synapsis.

    3. You can ignore it and pretend it doesn't exist.

    If yuo do any of these things, or even write a magazine article or trade publication where you talk about the weakness, you're OK (although any reputable publication will inform the package's maintainers).

    What this "kid" did wasn't any of these. He wrote code to exploit the vulnerability -- also known as a proof of concept -- then posted it to the public internet, so that all these nice people who bring us viruses such as Code Red, Netsky, Beagle, etc. can write lovely programs that disable end-user's virus scanners.

    This is a totally irresponsible and unacceptable way of reporting a vulnerability. It's the wrong way of doing it, in that you've not given the package's maintainers any time to do anything about the problem, and you've not informed any of the package's users about the problem.

    The only people you've informed, in fact, are the bad guys who will use it to attack people's computers.

    There is no way this benefits the users.

    There is no way this benefits the package maintainers.

    There is no way this benefits the public internet.

    I'm sick of "this is going to improve the product quality." Telling the people who maintain a package -- be it OSS or Commercial -- improves the product. Posting code to exploit a vulnerability hurts users, hurts system administrators and helps all these people trying to install spyware, trojans, worms and viruses on end user's systems.

    Get a clue -- posting code to an exploit helps nobody, send it to the company writing the scanner quietly, discreetly. Report it to a security website that reports such things if your paranoid, but don't post the exploit on the public internet where the bad guys can get at it.

    The assumption is if you are demonstratably doing things that help only the bad guys (as this kid was), that you therefore must be a bad guy.

    And it's a valid assumption -- take a look at whose being arrested, you see 40-50 year old white men being taken to jail for writing viruses, or do you see snot-nosed college students without a clue in their head.

    Not a researcher -- a researcher doesn't post source code to an exploit to the public internet.

  9. Re:If I break in your car... on Security Researcher Faces Jail For Finding Bugs · · Score: 1

    The person oferring you the EULA and the person offering you the software is quite often a different person (normally is a different person).

    The EULA usually -- Microsort, IBM, EA, Sony and every other EULA I have seen -- actually says you do have the right not to accept it, and that if you choose not to, you should return the software to the point of purchase.

    Now if the point of purchase refuses to take the software back, that is (of course) the responsibility of the point of purchase, and not of the publisher of the software.

    If you're not bothering to read the EULA, that's you're own fault.

  10. Re:Ugly on ExpressCards, the new PCMCIA? · · Score: 1

    PCMCIA and Cardbus have always had a "large" card for devices such as hard drives, and a "small" card for devices such as networks and SCSI adapters, etc.

    Some manufactuers gave large slots, some gave small slots, and some gave a combination. It was common to have two cardbus slots one above the other, with the cover designed so that you could put a full size card in and block both slots, or put in the smaller card.

    Keep in mind, this is for laptops and is for devices that need performance -- for example, when you need gigabit ethernet and it wasn't created when the laptop was built -- and so it's harder to make it "look nice." Every laptop has different colors and different layout, etc. and it's much harder to make something that looks right in all of them.

  11. Re:Sounds like on Hubble Snaps Photo of Extrasolar Planet · · Score: 1

    Terrestial Planet Finder is supposed to be this kind of a mission. NASA is talking about an array of space telescopes placed well outside of earth's orbit that would be collectively able to take a picture of a planet the earth's size or smaller directly.

  12. Re:Take the second flight... on Hubble Snaps Photo of Extrasolar Planet · · Score: 1

    That of course depends on the particular flavor of FTL used.

    If it's the Warp Drive, Electron Stutter, hyper, etc. where the assumption is that the speed of light is no different from the speed of sound, then you might be able to pick up the people in the slow boat (if there was enough space, etc.), and at least probably could send someone back for them.

    If it's a Jump drive, gate drive, wormhole, etc. that you use, then there's not really a way to pick them up. It all depends on how faster than light travel eventually works itself out.

  13. Re:Don't be surprised... on The Centralization of BitTorrent Networks · · Score: 1

    The problem is doing something that warrants a C&D in the first place.

    Have a policy on your site that you'll remove infringing content if its reported, and make the facility to do so readily available on your index page, and you're golden.

    If website A infringes website B's contents, you can go to google, you can file a complaint, and google will contact the operators of the infringing website. If they find that A is in fact infringing B's copyrights, they will remove it from the index and add it to a blacklist.

    That's all it takes to avoid a lawsuit or C&D letter. If your site is, of course, dedicated to the systematic and intentional violation of copyrights, this facility will (of course) result in there being very few files available, and will (of course) destroy your ability to distribute illegal software, music or movies.

    Of course, if your site is dedicated to sysetmatic and intentional copyright violation (as SuperNova was), then you deserve the C&D letter and/or lawsuit in the first place, and it's your own fault.

  14. Re:I hear this all the time on Intel and AMD's 2005 Plans Revealed · · Score: 1

    This all depends.

    I don't see a good explanation of this, so I'm going to try it.

    Multithreading isn't benefited by a dual processor design. Typically a multithreaded program has a lot of common variables/globals between threads, and so most operating systems will try to use a "processor affinity" on the task, to make all of its threads run on a single processor to make the best use of the cache.

    Multiprocessing is benefited. Each task is given a processor affinity, and runs on that processor. The affinity can be changed, but each task will spend most of its time on one particular processor (ideally).

    On Windows, in order for a thread to be processed by a second processor, you have to make a call telling Windows that this behavior is OK. The last time I played with it directly on Linux, this same thing was true there, but it may have changed.

    Modern processors (anything newer than a 386DX2) run a slower external bus to memory and i/o than they run internally. Because of this, any time you have to leave the cache, you take a performance hit.

    On the multicore machines, you have half the memory bandwidth (because it's split up between two cores) and half the i/o bandwidth (because it's split between the two cores), so you have to realy manage things to run adequately.

  15. Re:Conspiracy! on Breakthrough Efficient, Paintable Solar Cells · · Score: 1

    Ah yes, a nice clean process of burning water which produces hydrogen peroxide, which is also known as -- are you ready for it? -- rocket fuel.

    That's indeed a much safer byproduct than the water produced from a natural gas or hydrogen powered car, indeed. This water as an exhaust thing the car companies have been demonstrating all over the US is just going to make it rain more.

  16. Re:Okay since heat is IR... on Breakthrough Efficient, Paintable Solar Cells · · Score: 1

    However, if you're using an intel part, you can just use the heat to boil water and turn a generator, in the process getting enough power to run a clock for a few days.

  17. IP in China is talking Copyright on US To Push Criminalization of IP Violations · · Score: 1

    OK folks, take off your tin hats...

    People with a copyright on software are trying to enforce it, and would like the existing, criminal punishment for infringement enforced. Pop a DVD into your drive, or pop a VHS in and watch the FBI warning. See where it says "Felony" and "Violation of International Law?"

    In China, and most other asian countries, you have 3-4 pirated copies of copyrighted software for each legal one, and these are sold on the street for a fraction of the cost of the real programs. The people buying them aren't told they are pirated (although most should know), and often call the software company looking for help, etc.

    It already is a criminal offense to violate Copyright, something the Free Software Foundation has used and threatened to use in the past, but now that our government is asking China and other Asian countries, as well as our own, to enforce existing laws that benefit big corporations, small businesses and non-profit groups alike, and that protect your right to license and distribute your work in the manner you choose, it's suddenly a bad thing?

  18. Re:multicore GPU's on Gigabyte's 3D1 brings SLI to a single card · · Score: 1

    Matrox had multicore GPU's. The G200 was two G100's on a chip, and each core could be directed separately to perform tasks.

  19. Re:SSN as National ID card (was:Re:Not Illegal) on Security Holes Draw Linux Developers' Ire · · Score: 1

    Typical bank configuration (this is for a mission critical application, but not one that touches money):

    Production Master, Production Backup
    On-site DR Master, On-site DR Backup
    Off-site DR Master, Off-site DR backup
    Quality Assurance Master, Quality Assurance Backup
    Development Master, Development Backup

    Sometimes they would have 2 or 3 more. We licensed specifically for this.

    Even with this, it still was 99.7 or so uptime -- there are unforseen events that redundancy alone cannot compensate for.

  20. Re:Time for (even) better security? on Security Holes Draw Linux Developers' Ire · · Score: 1

    It all depends on how tight your security has to be.

    There are two forms of attack. There is an internal attack, and there is an external attack.

    An internal attack can originate from any employee, contractor or service personel with access to the building. Many of these people are allowed to work with little or no supervision.

    An external attack originates from hackers on the internet.

    You have to weigh how likely these are, but in general, in a truely secure environment, where you really are trying to protect valuable data, you consider internal threats equally to external threats, and indeed would install this patch.

    But again, it depends on your environment. If access to the server room is an armed guard and at least two people knowing what is being done, then protection against a console based attack would be less than if the web server is just sitting in an unused cubicle where anyone can physically access the machine at any time.

  21. Re:Talk About Bleedin' Obvious on Microsoft Drops Windows XP for Itanium · · Score: 1

    More accurately...

    MS 1: How many orders for XP Itanium do we have?
    MS 2: None
    MS 1: Not one?
    MS 2: None
    MS 1: What about 2003?
    MS 2: We sell alot of Itanium 2003.
    MS 1: OK, so that stays and XP goes, sounds good write up a press release.

  22. Re:Disclaimer: Linux not compatible with Linux on Archos PMA400 Linux Based Media Portable · · Score: 1

    It has 802.11b support.

    Do you really care what they say it supports? Get it close, copy the file, and you're done. They're shipping virtual dub and whatever with it, with windows configurations, but if you've got Linux running, you most likely don't need a poorly written front end to set up virtual dub for you.

  23. Re:Wowee! Windows Media files! on Archos PMA400 Linux Based Media Portable · · Score: 1

    Napster, MS Music Store, Real, Rhapsody and virtually every music store other than Apple's sells WMA format.

    Apple doesn't license their DRM scheme to anyone.

  24. Re:How far can the Sims Virus go? on Sims 2 Hacks Spread Like Viruses · · Score: 1

    Here's how it works (for those speculating)... This is based off of MUD -- Sims works the same way, it's just easier to talk with MUD terms. Each object consists of a "master" and multiple clones. The clones contain only the ID of the master. The master is locked away where nobody is supposed to be able to get at it. The "hack" is a scripted object with the same ID as the master. The game loads the base files, then loads the save. The save contains an object with the same ID, so it overwrites the master, at which point all the objects start using the new behavior. When you download a pack, it goes into your save and becomes part of your game's state. When you upload a lot, everything needed by the lot is copied into the save and transfered along with it, including the modified master. So what happens is once you've downloaded a file with the bad master, every espresso machine becomes the super espresso. If you then have an espresso machine in your lot, then when you upload the lot it carries with it the modified code, replacing every espresso in anyone who downloads it. The relationship thing is similar -- you download a sim or a lot that contains a sim that has a modified master, and you get the master. Then if you upload any of your sims, the modified master is carried along with it. As a result, stuff changes based on the script. It is a common practice to use a scripting language, because it makes it easier to add items at a later time, and makes it possible to add more items. The issue with this particular thing is that it replaces a built-in game master, and then can propogate it to other instances of the game (if you choose to share). It can't do anything outside what the scripting language allows, such as modifying sims stats or potentially possibly causing a lock up (dependent on how much protection sims has).

  25. Re:WJR 760 on Wired Interviews Bram Cohen, Creator of BitTorrent · · Score: 1

    BitTorrent is a great program -- I use ABC, typically for it, but there are numerous other implementations.

    I downloaded Windows XP SP 2 (just the service pack) from a widely publicized Torrent that was on SuperNova. I've obtained Linux distros that way, too.

    However when you went to SuperNova.org, it was pretty clear most of the traffic they were generating would be for illegal files, and I think yes, it's fair to say illegal content via Torrent dwarfs legal content.

    For each legitimate torrent SuperNova had listed, there were at least 100 illegal torrents. And that same is true at most of the other index sites, you had to really work hard to find what you were looking for if you were looking for one of the handful of legitimate/legal torrent files.

    Netcraft has statistics on total bandwidth, but vs. looking at the popular seed sites and just looking at the files that they have seeded, there's not really a way to identify percentages of the traffic.

    But I think it's fairly safe to say that under 20% of bit torrent traffic is currently used for non-infringing uses.