Yes, I'm absolutely sure about that. That particular page, which goes along with Steve Ballmer's comments, seems to believe that.NET is nothing more than web services: In other words an Apache server with PHP could entirely be a ".NET Server" : Take SOAP requests and respond with an XML response. You've got yourself a.NET server!
Of course there's an entirely different camp within Microsoft, which to me has much more credibility and much more of an actual product, who define.NET as a protected, byte-code interpreter of sorts for running safe, secure code in the Windows environment. Others still define.NET as the encapsulation of a wide swatch of functionality and interfacing to the Win32 subsystem via the.NET Framework (eliminating all of the long held complaints about the Win32 inconsistencies).
.NET, as a technology, is not just a language, or a particular tool, but a platform, and the platform has the vulnerability. (i.e. No one has ever defined what exactly encapsulates ".NET": Is it just the languages, but not the implementations of them? If so then.NET will forever be perfect, as it's merely the silly implementations that have vulnerabilities)
Well I wouldn't make such conclusions quite yet. Firstly, shortly after Visual Studio.NET (which in essence is.NET) was released, there was a buffer overflow found in, ironically (truly ironically), a security feature intended to thwart buffer overflows. Secondly, there have been 2 service packs already for the.NET Foundation, and on top of that it has been very lightly exercised (extremely few websites use it, and I've yet to see a single commercial or even big shareware or freeware.NET app): Give it time. I will bet you, putting money on the table, that there will be numerous exploits for.NET as time goes by. No malice intended towards Microsoft, but rather it's just the nature of large scale software.
P.S. I love asp.net, Visual Studio.NET, etc, but I also know that Microsoft does not have a stellar security history behind it.
Beleive it - in Utah, where its painfully normal for early 20 somethings to have babies, they always bring them to theaters.
It might surprize you, but nature actually says that women are most capable of having babies in their 20s (i.e. the probabiliy of unpleasantry starts going up dramatically later than that). Of course there are those jealous and/or self-righteous people who feel the need to belittle anyone who does something that they themselves don't do.
To paraphrase Chris Rock: you can either get your kid on, or your movie on, but not both. If you decide to spit out a kid at the age of 22, you pretty much give up your ability to do anything but sit and look at the walls for the next 6 years.
Yeah, because anyone who has a child of course is sitting looking at a wall for 6 years, missing out on all the great movies (well...at least for 4 months or so until it's on DVD, which is the route which many people without babies follow...and presuming that their area is backwards and doesn't have special movie showings for parents). It's not like they're having an experience that almost all of them will forever describe as the best time of their life. Oh wait, yes it is.
In my area (the Greater Toronto Area), several organizations have been setting up special movie showings specifically for parents with babies, where of course everyone will be much more tolerant, etc. This seems like a fantastic idea to me.
Having said that, there is a limit that parents with babies should be segregated. A couple of friends I know are extremely considerate and always settle their daughter down in public places (i.e. they don't do the "I can't hear a thing" routine that many ignorant people do), however recently while at a loud roadhouse restaurant (the kind where everyone is basically yelling) an ignorant oaf offered the "suggestion" that they don't bring their baby in public, etc.
The bus and memory architecture is also why x86 does so incredibly bad in multi-CPU boxes. It's just not designed for it, the contention issues are hideous, and while you may only get 1.9x the performance going to a 2 CPU Sun box, you'll only get 1.7x on x86. It gets worse as you scale (note - those numbers are for reference only, I don't recall the exact relationships for dual CPU x86 boxes anymore, but the RISC systems handle it better due to bus design).
However couple that with the fact that Intel machines are generally so space and price effective that instead of the classic SMP "Put lots of CPUs together", one can instead "put lots of systems together in a cluster", each machine which has full I/O bandwidth without the need to do arbitration on its own bus.
I don't know about your area, but where I live there are several thousand dollars of property taxes per year. Secondly, houses don't maintain themselves, so unless you got a comprehensive new home warranty, add in the invariable several thousand in unexpected furance fans, shingles, eavesdroughs, etc. Thirdly, you compare a $200K house with a $1500 apartment: In areas where apartments are $1500, houses are dramatically more than $200K (at least where I live). I'm not anti-home ownership, but a lot of people really create an illusion around home ownership.
I recently had a deadbeat bidder, and rather than being screwed with the auction fees because some moron bid one something that they didn't want or couldn't afford, I filed a deadbeat bidder report. Ebay refunded the auction fees and put a mark against the deadbeats name.
An online auction system would be much more legitimate if every seller and bidder were verified in some way: i.e. if even buyers had to authenticate against a credit card with the proper address, etc (maybe they do now, but they didn't the last time I looked). As it was the last time I looked, one could create an account and bid on 10 similar items, and then bail on all but the one you like most. Rinse and repeat.
Bah...the link was to the hilarious Satire Wire that talks about the millions of Americans that are pretending that they own their homes. Ah....here it is. Sorry about the confusion.
He really does have a point that most homeowners grossly underestimate what they put into their home (repairs, upgrades, taxes, legal and administrative fees, etc), and fail to understand that a massive portion of their monthly payment goes to interest for the first several years. In Canada, interest (which is "money that went to nowhere land". You don't accrue an asset by paying interest) is not tax deductable, so the situation is a little worse, but I've had this "my home is an investment" discussion with quite a few people: When you do the final analysis, a home is an expense that's a place to stay.
In high school my abuse game of choice was the game called "Empire" on the Atari ST, a turn based strategic board games of sorts. While the games started off brisk and progressive, as each side expanded, individual turns started taking upwards of 45 minutes (each person took turns doing their moves): The game did not scale. We easily spent 24 hour periods at time playing that game. The end of the game came one day when he casually mentioned that it sure seemed that he was having a lot of bad luck...perhaps I gave him a handicap (the game let you when you start a game). After checking through the menus and finding that there was no way to check the levels of the two sides, I flicked the power switch: The value of victory to me instantly was dissolved.
BTW: It wasn't my hands, but rather my teeth would literally start to feel loose after extended periods of awakeness. Very disconcerting.
Going down in flames? Uh huh. Actually it was a classic Slashdot situation where every, err, "educated", fellow felt the need to condescendingly offer their expert opinion on why everyone else is an idiot, ignoring the fact that given the context (for example: The fact that we're talking about a OTP that has been altered to be a MTP, which is in plain and obvious text in the article) their impressions are absolutely wrong. I presume, as the AC suggested, that you're one of those idiots that realizes that their condescension might have been doled out a little heavy and without regard for facts.
Because OTP have little practical use: If you have to transmit the OTP key, and it's larger than the data that you're "encrypting", then why not just transmit the data?
This story is not about a one-time pad. It is likely yet another variation on the XOR scheme using a key smaller than the sum of the encrypted content.
This article is about a variation on a OTP, "improving it" to being a multi-use pad. Such "improvements" are the type of thing such as what the prior poster mentioned : Something like "shift the bits in the otherwise one time key by the sum of the encrypted document...and then store the shift count in the final word...".
For someone to see all this instantly--and then call it obvious--means that he is on a level of genius that our puny mathematical brains cannot possibly understand--nor should we try to.
Perhaps your brain really is puny, however in this case the article is talking about a variation of a OTP, converting it into a MTP, without being given any details on how the system works. Note that we're talking about a MTP, not a OTP. Can you see where there might be a problem there?
Indeed, and my guesstimate is that it's yet another saviour encryption solution (there have been countless such solutions proposed, and when you get to the root of them they're plain XORs) that XORs against the same key multiple times (perhaps with some variation, such as shifting forward or backwards in the random string).
Thank you for pointing out that I mistyped "weak". It is crucial that you did this, especially that you took the time to place it in quotation marks (especially given that it's not a quotation, but a "correction"). You tremendously improved your position by this maneuver.
Having said that, I am not an encryption expert, though I have at times been involved with encryption products (indeed, I submitted bug fixes to the AES reference code). One of the first things I learned in the field of encryption is that first assumptions about encryption are often horribly wrong, and are often treading over ground that's been well worn and dismissed by hundreds of others (encryption is the sort of field where there are thousands of extremely bright people working on it day and night). That's why it's so important that it's a peer review field where nothing is given credibility until it has undergone the analysis of dozens of peers: There are a million flawed assumptions that would have made it into security products if it weren't for this peer review process. I won't bother detailing the "obvious" issues with a plain XOR, especially for a multi-use pad (which is what we're talking about): I'll leave that to Google.
Indeed. It sounds like an "XOR" encryption scheme : i.e. make a large, random digit file, and XOR it against things that you want to encrypt. It is incredibly week for obvious reasons, but it's been proposed as a method of encryption countless times.
I highly doubt he started adding auto links to capitalize on his well known "Nissan Foreign Car Mobile Repair Service".
Firstly, he doesn't even bother to make the link to Nissan an actual hyperlink, instead simply giving the text. Secondly, the unlinked link wasn't added until after he was sued: Take a look at the wayback machine: http://web.archive.org/web/*/nissan.com for, say, late 1999. At this point he has burrowed his computer hardware deep in the site, and instead turned it into a banner page: 100% the purpose was to capitalize upon millions of people looking for Nissan automobiles (clearly the page and domain had zero value to his business, and any expert would attest to this).
Look at Alexa's "sites people also followed" the big links for nissan.com are Nissan USA, Toyota, Mazda, American Honda, Subaru : Yeah, that's people looking for a Raleigh NC computer store.
I have mixed feelings about this case, honestly. On the one hand the guy's name is Nissan, so he certainly has a claim, but on the other hand the overwhelming (i.e. 99.99%+ probably, and the other 0.01% are checking for info on the lawsuit) majority of people going to nissan.com are looking for the car company, not his computer store. I almost see it as a "public good" thing that perhaps he should be forced to sell it to Nissan, but at "fair market value" : Not $15,000,000, which is what he requested, but perhaps say $250,000.
Watch out! There goes a point flying over your head!
If you have an answering machine, it is for people to leave messages. Let them leave the message. I find it humorous that you're presuming that I'm saying that you have to answer the phone, when instead I'm saying "Don't misuse technology in a way that irritates and annoys people": An answering machine is an answering machine to take messages, and millions of hours of time are wasted when people cast it into a screening machine.
Almost everyone with whom this has come up in conversation despises when people do this. Indeed, most people (such as myself) simply hang up when we get the answering machine of someone who plays the screen game with their machine.
If they call and get an answering machine, they should *just leave a message*!
Perhaps you missed that point, however people do try to leave a message (which is a perfectly fine technology: If you're not answering then the person leaves a message) and then some moron picks up. There are systems nowadays that are meant for screening, and they don't force the person through the motions of leaving a message (note: People start going "Hello? You there?" after they feel like an ass a few too many times trying to leave a message for the person to pick up). Get one of those or use caller display. Don't be surprized when people don't think it's worth the effort to beg for you to pick up.
Every time I see the cameras mentioned in relation to a crime, it says, the recording was too grainy to be useful (like not even the license plate number is recognizable)...The recording is done on the same tapes over and over, so, of course, it will be of very low quality, unless, with luck, a fresh tape was added just recently.
I completely agree with that, however that's a technological problem that is being solved as we speak: already digital video recording and archival systems, backed by TBs of hard drives and optical drives, are being implemented in high security complexes. Over time such technology will be common place and will be the norm, at which cameras will become even more valuable.
As it is, most cameras do have images that are at best blurred abstract representations, however even that is often enough: Crimestoppers shows it and someone sees the culprit moving just like someone they know, etc.
Turn the answering machine on, but set it so that you can hear the messages people are leaving. Then, screen every call. Period. If people start to leave a message, and it's a message you want, pick up the phone.
Just so you know, most people ABSOLUTELY HATE THIS: If you made me listen through your bloody inane message, then give me the courtesy of leaving the message that I've already thought through and am in the process of leaving as you stumble on the phone, blessing me with the sacred pick-up. If you want to screen calls use call display, but it's considered incredibly rude to overtly screen calls by making people do the lame ass "Hello? Hello? You there...it's me". On the flip side, now I have to deal with people leaving messages on my real answering machine (not used to screen, but rather when I'm not answering the phone) always starting it off with 30 seconds of pleads for me to pick up. Grrr.
However, I otherwise agree with your philosophy: Many people have been brought up to consider the phone some god like communication device for which everything else must be dropped.
Slashdot Mirror
Yes, I'm absolutely sure about that. That particular page, which goes along with Steve Ballmer's comments, seems to believe that .NET is nothing more than web services: In other words an Apache server with PHP could entirely be a ".NET Server" : Take SOAP requests and respond with an XML response. You've got yourself a .NET server!
.NET as a protected, byte-code interpreter of sorts for running safe, secure code in the Windows environment. Others still define .NET as the encapsulation of a wide swatch of functionality and interfacing to the Win32 subsystem via the .NET Framework (eliminating all of the long held complaints about the Win32 inconsistencies).
Of course there's an entirely different camp within Microsoft, which to me has much more credibility and much more of an actual product, who define
.NET, as a technology, is not just a language, or a particular tool, but a platform, and the platform has the vulnerability. (i.e. No one has ever defined what exactly encapsulates ".NET": Is it just the languages, but not the implementations of them? If so then .NET will forever be perfect, as it's merely the silly implementations that have vulnerabilities)
Well I wouldn't make such conclusions quite yet. Firstly, shortly after Visual Studio.NET (which in essence is .NET) was released, there was a buffer overflow found in, ironically (truly ironically), a security feature intended to thwart buffer overflows. Secondly, there have been 2 service packs already for the .NET Foundation, and on top of that it has been very lightly exercised (extremely few websites use it, and I've yet to see a single commercial or even big shareware or freeware .NET app): Give it time. I will bet you, putting money on the table, that there will be numerous exploits for .NET as time goes by. No malice intended towards Microsoft, but rather it's just the nature of large scale software.
P.S. I love asp.net, Visual Studio.NET, etc, but I also know that Microsoft does not have a stellar security history behind it.
BTW: When I say "roadhouse" I mean restaurant that serves the standard wings/ribs type "roadhouse" fare, and they usually have poor soundproofing.
Beleive it - in Utah, where its painfully normal for early 20 somethings to have babies, they always bring them to theaters.
It might surprize you, but nature actually says that women are most capable of having babies in their 20s (i.e. the probabiliy of unpleasantry starts going up dramatically later than that). Of course there are those jealous and/or self-righteous people who feel the need to belittle anyone who does something that they themselves don't do.
To paraphrase Chris Rock: you can either get your kid on, or your movie on, but not both. If you decide to spit out a kid at the age of 22, you pretty much give up your ability to do anything but sit and look at the walls for the next 6 years.
Yeah, because anyone who has a child of course is sitting looking at a wall for 6 years, missing out on all the great movies (well...at least for 4 months or so until it's on DVD, which is the route which many people without babies follow...and presuming that their area is backwards and doesn't have special movie showings for parents). It's not like they're having an experience that almost all of them will forever describe as the best time of their life. Oh wait, yes it is.
In my area (the Greater Toronto Area), several organizations have been setting up special movie showings specifically for parents with babies, where of course everyone will be much more tolerant, etc. This seems like a fantastic idea to me.
Having said that, there is a limit that parents with babies should be segregated. A couple of friends I know are extremely considerate and always settle their daughter down in public places (i.e. they don't do the "I can't hear a thing" routine that many ignorant people do), however recently while at a loud roadhouse restaurant (the kind where everyone is basically yelling) an ignorant oaf offered the "suggestion" that they don't bring their baby in public, etc.
The bus and memory architecture is also why x86 does so incredibly bad in multi-CPU boxes. It's just not designed for it, the contention issues are hideous, and while you may only get 1.9x the performance going to a 2 CPU Sun box, you'll only get 1.7x on x86. It gets worse as you scale (note - those numbers are for reference only, I don't recall the exact relationships for dual CPU x86 boxes anymore, but the RISC systems handle it better due to bus design).
However couple that with the fact that Intel machines are generally so space and price effective that instead of the classic SMP "Put lots of CPUs together", one can instead "put lots of systems together in a cluster", each machine which has full I/O bandwidth without the need to do arbitration on its own bus.
I don't know about your area, but where I live there are several thousand dollars of property taxes per year. Secondly, houses don't maintain themselves, so unless you got a comprehensive new home warranty, add in the invariable several thousand in unexpected furance fans, shingles, eavesdroughs, etc. Thirdly, you compare a $200K house with a $1500 apartment: In areas where apartments are $1500, houses are dramatically more than $200K (at least where I live). I'm not anti-home ownership, but a lot of people really create an illusion around home ownership.
I recently had a deadbeat bidder, and rather than being screwed with the auction fees because some moron bid one something that they didn't want or couldn't afford, I filed a deadbeat bidder report. Ebay refunded the auction fees and put a mark against the deadbeats name.
An online auction system would be much more legitimate if every seller and bidder were verified in some way: i.e. if even buyers had to authenticate against a credit card with the proper address, etc (maybe they do now, but they didn't the last time I looked). As it was the last time I looked, one could create an account and bid on 10 similar items, and then bail on all but the one you like most. Rinse and repeat.
Bah...the link was to the hilarious Satire Wire that talks about the millions of Americans that are pretending that they own their homes. Ah....here it is. Sorry about the confusion.
He really does have a point that most homeowners grossly underestimate what they put into their home (repairs, upgrades, taxes, legal and administrative fees, etc), and fail to understand that a massive portion of their monthly payment goes to interest for the first several years. In Canada, interest (which is "money that went to nowhere land". You don't accrue an asset by paying interest) is not tax deductable, so the situation is a little worse, but I've had this "my home is an investment" discussion with quite a few people: When you do the final analysis, a home is an expense that's a place to stay.
In high school my abuse game of choice was the game called "Empire" on the Atari ST, a turn based strategic board games of sorts. While the games started off brisk and progressive, as each side expanded, individual turns started taking upwards of 45 minutes (each person took turns doing their moves): The game did not scale. We easily spent 24 hour periods at time playing that game. The end of the game came one day when he casually mentioned that it sure seemed that he was having a lot of bad luck...perhaps I gave him a handicap (the game let you when you start a game). After checking through the menus and finding that there was no way to check the levels of the two sides, I flicked the power switch: The value of victory to me instantly was dissolved.
BTW: It wasn't my hands, but rather my teeth would literally start to feel loose after extended periods of awakeness. Very disconcerting.
Going down in flames? Uh huh. Actually it was a classic Slashdot situation where every, err, "educated", fellow felt the need to condescendingly offer their expert opinion on why everyone else is an idiot, ignoring the fact that given the context (for example: The fact that we're talking about a OTP that has been altered to be a MTP, which is in plain and obvious text in the article) their impressions are absolutely wrong. I presume, as the AC suggested, that you're one of those idiots that realizes that their condescension might have been doled out a little heavy and without regard for facts.
Because OTP have little practical use: If you have to transmit the OTP key, and it's larger than the data that you're "encrypting", then why not just transmit the data?
This story is not about a one-time pad. It is likely yet another variation on the XOR scheme using a key smaller than the sum of the encrypted content.
This article is about a variation on a OTP, "improving it" to being a multi-use pad. Such "improvements" are the type of thing such as what the prior poster mentioned : Something like "shift the bits in the otherwise one time key by the sum of the encrypted document...and then store the shift count in the final word...".
For someone to see all this instantly--and then call it obvious--means that he is on a level of genius that our puny mathematical brains cannot possibly understand--nor should we try to.
Perhaps your brain really is puny, however in this case the article is talking about a variation of a OTP, converting it into a MTP, without being given any details on how the system works. Note that we're talking about a MTP, not a OTP. Can you see where there might be a problem there?
Indeed, and my guesstimate is that it's yet another saviour encryption solution (there have been countless such solutions proposed, and when you get to the root of them they're plain XORs) that XORs against the same key multiple times (perhaps with some variation, such as shifting forward or backwards in the random string).
Thank you for pointing out that I mistyped "weak". It is crucial that you did this, especially that you took the time to place it in quotation marks (especially given that it's not a quotation, but a "correction"). You tremendously improved your position by this maneuver.
Having said that, I am not an encryption expert, though I have at times been involved with encryption products (indeed, I submitted bug fixes to the AES reference code). One of the first things I learned in the field of encryption is that first assumptions about encryption are often horribly wrong, and are often treading over ground that's been well worn and dismissed by hundreds of others (encryption is the sort of field where there are thousands of extremely bright people working on it day and night). That's why it's so important that it's a peer review field where nothing is given credibility until it has undergone the analysis of dozens of peers: There are a million flawed assumptions that would have made it into security products if it weren't for this peer review process. I won't bother detailing the "obvious" issues with a plain XOR, especially for a multi-use pad (which is what we're talking about): I'll leave that to Google.
Indeed. It sounds like an "XOR" encryption scheme : i.e. make a large, random digit file, and XOR it against things that you want to encrypt. It is incredibly week for obvious reasons, but it's been proposed as a method of encryption countless times.
I highly doubt he started adding auto links to capitalize on his well known "Nissan Foreign Car Mobile Repair Service".
Firstly, he doesn't even bother to make the link to Nissan an actual hyperlink, instead simply giving the text. Secondly, the unlinked link wasn't added until after he was sued: Take a look at the wayback machine: http://web.archive.org/web/*/nissan.com for, say, late 1999. At this point he has burrowed his computer hardware deep in the site, and instead turned it into a banner page: 100% the purpose was to capitalize upon millions of people looking for Nissan automobiles (clearly the page and domain had zero value to his business, and any expert would attest to this).
Look at Alexa's "sites people also followed" the big links for nissan.com are Nissan USA, Toyota, Mazda, American Honda, Subaru : Yeah, that's people looking for a Raleigh NC computer store.
I have mixed feelings about this case, honestly. On the one hand the guy's name is Nissan, so he certainly has a claim, but on the other hand the overwhelming (i.e. 99.99%+ probably, and the other 0.01% are checking for info on the lawsuit) majority of people going to nissan.com are looking for the car company, not his computer store. I almost see it as a "public good" thing that perhaps he should be forced to sell it to Nissan, but at "fair market value" : Not $15,000,000, which is what he requested, but perhaps say $250,000.
Watch out! There goes a point flying over your head!
If you have an answering machine, it is for people to leave messages. Let them leave the message. I find it humorous that you're presuming that I'm saying that you have to answer the phone, when instead I'm saying "Don't misuse technology in a way that irritates and annoys people": An answering machine is an answering machine to take messages, and millions of hours of time are wasted when people cast it into a screening machine.
Who considers it rude(besides yourself)?
Almost everyone with whom this has come up in conversation despises when people do this. Indeed, most people (such as myself) simply hang up when we get the answering machine of someone who plays the screen game with their machine.
If they call and get an answering machine, they should *just leave a message*!
Perhaps you missed that point, however people do try to leave a message (which is a perfectly fine technology: If you're not answering then the person leaves a message) and then some moron picks up. There are systems nowadays that are meant for screening, and they don't force the person through the motions of leaving a message (note: People start going "Hello? You there?" after they feel like an ass a few too many times trying to leave a message for the person to pick up). Get one of those or use caller display. Don't be surprized when people don't think it's worth the effort to beg for you to pick up.
Every time I see the cameras mentioned in relation to a crime, it says, the recording was too grainy to be useful (like not even the license plate number is recognizable)...The recording is done on the same tapes over and over, so, of course, it will be of very low quality, unless, with luck, a fresh tape was added just recently.
I completely agree with that, however that's a technological problem that is being solved as we speak: already digital video recording and archival systems, backed by TBs of hard drives and optical drives, are being implemented in high security complexes. Over time such technology will be common place and will be the norm, at which cameras will become even more valuable.
As it is, most cameras do have images that are at best blurred abstract representations, however even that is often enough: Crimestoppers shows it and someone sees the culprit moving just like someone they know, etc.
Turn the answering machine on, but set it so that you can hear the messages people are leaving. Then, screen every call. Period. If people start to leave a message, and it's a message you want, pick up the phone.
Just so you know, most people ABSOLUTELY HATE THIS: If you made me listen through your bloody inane message, then give me the courtesy of leaving the message that I've already thought through and am in the process of leaving as you stumble on the phone, blessing me with the sacred pick-up. If you want to screen calls use call display, but it's considered incredibly rude to overtly screen calls by making people do the lame ass "Hello? Hello? You there...it's me". On the flip side, now I have to deal with people leaving messages on my real answering machine (not used to screen, but rather when I'm not answering the phone) always starting it off with 30 seconds of pleads for me to pick up. Grrr.
However, I otherwise agree with your philosophy: Many people have been brought up to consider the phone some god like communication device for which everything else must be dropped.