Slashdot Mirror


User: aphor

aphor's activity in the archive.

Stories
0
Comments
454
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 454

  1. Biting the hand that feeds: on Public Money, Private Code · · Score: 4, Interesting

    If you think the move to privatize CS research is natural and good, you are mistaken because you do not understand the economics of the scientific process and peer-review. If the universities and labs make valuable software, then why shouldn't they make money off of it? Oh, they should "make money off of it" for sure, I'm not arguing that. What you have to understand about my argument is that you can make money without restricting software distribution. You don't have to say "you can't copy it or use it or see it unless you pay me first."

    Economically, it is crucial to learn the difference between economic value and market value. If you say the distinction is unimportant, let me remind you there is no such thing as a free-market economy where economic and market value are fully balanced. There are cases where a thing has more economic value than market value and vice versa.

    A piece of research software, in the form of a source tarball, can be compiled into a useful productive component of a machine. It can also be modified, improved, extended, etc. to create a new source tarball which can be compiled into a superior component of a productive machine. The source of the value in any of these elements is the ingenuity of those who created the original source code (or those who created the theory behind it). Most of the combined science of prior history is always a necessary ingredient for this ingenuity and vision.

    Newton: "If I have seen far, it is because I have stood on the shoulders of giants." Ask yourself if you could do without Newtonian Physics on the chance that prior work was unavailable because some greedy short-sighted boob decided not to let anyone read Aristotle (for example) on the off-chance something of great value would come of it and boob would be left out? If you think about it, I.P. licensors are usually assholes trying to set up a retirement plan based on the value of someone else's continuing work.

    You can't believe in God if you believe in intellectual property. You can't take it with you!

    Now the economy is "adjusting" to the wild ambitions of people who discovered the Internet late... People who were around for the whole thing know that the value of the Internet is actually pent-up demand coming from prior licensing bungling with the Public Switched Telephone Network (PSTN). Circut-Switched networks are not as efficient as Packet-Switching.

    I'm sorry for the livid tone, but I'm tired of all the whining Ayn-Rand type wannabes running around thinking "I'm a good person, I suffer righteously, and I got the other guy down so I'm gonna stick it to him!"

    I know (because I'm educated) that the litmus test for what side you're on is whether you believe you're partly responsible to future generations or not. Just think about what kind of world you would like to be born into and live that choice. Damn. I'm too worked up to even finish an argument. I retract everything. Forget I said any of this...

  2. Off-Topic: good .sig on Satellite Command Security? · · Score: 1

    I just wanted to say that your sig qualifies as poetry. When I read it and thought "WTF?" I started coming up with all these completely hilarious explanations --granted though, all in geekish dialect. Congratulations for having high-density humor!

  3. Do a Bruce Schneier "Attack Tree" analysis on Satellite Command Security? · · Score: 1

    Attack Trees are a documentation system to identify security priorities, by Bruce Schneier of Counterpane Security and general computer security lore.

    Theoretical attack on your satellites' controls:

    1. Get a Mac Titanium book, and learn how to program the altivec DSP so you can use it to analyse the RF communications.
    2. Find the command center by using the institutional addresses and scouting for the fabled high-power antennae, or just look for the characteristic antennae.
    3. Use some RF equipment to "snoop" the band near the antennae and compare that to the RF band signal levels on the other side of a nearby hill in order to determine the antennae's transmitter band(s).
    4. Snoop the most interesting channels on the suspected antennae's band. Correlate the suspected command packet transmissions with likely distant signals that return just after the minimum delay to geosynchronous orbit (about 600ms).
    5. More snooping to find all the possible forward/reverse communication frequencies/channels of the command center. Save some RF snoops on your big 40GB hard drive.
    6. Figure out the signalling used on the interesting channels. The forward and reverse channels are likely to have the same signalling.
    7. Once you have the signalling down, figure out the transmission (packet) format.
    8. Write yourself a packet decoder, and make sure you can tweak it when you find out new stuff.
    9. Start analysing the packets' payloads for protocol. Since security is light here, you are roundig third base at this point.
    10. Construct yourself a bigger antenna array and some transmitter/reciever equipment.
    11. Take your equipment out into the field and test it out :)

    BAM! In no time, you will have your own secret satellite command center!

    Now, with that in mind, think about how you can make each step of this theoretical attack easier/harder. Go read that Attack Tree paper and make a draft-doc for your boss.

  4. Pre Shared Keys are step 1. Next: Public Keys on IPsec Tunneling Between FreeBSD Hosts · · Score: 5, Informative

    Pre-Shared Keys are the first step in getting IPSec running, but it really doesn't fulfil the role that IPSec was intended for: securing rlogin/rsh/rcp, ftp, etc. on an ad-hoc basis using the Transport Mode AH/ESP.

    For that you want to set up "Transport Mode" (as opposed to Tunnel mode) IPSec policies, and you don't want to use pre-shared-keys (ie. that must be kept in sync on both ends of any IPSec connection).

    What you want to do is use OpenSSL or the SSL certificate utilities that come with Apache-SSL (or is it mod-ssl?) to make a Certificate Authority (CA) key pair for yourself. You want to keep those on removable media; don't leave them laying around on some hard-drive. Then, (this is a repeated-per-host step) use the same utilities and your new CA to make keys and x509 certificates for each of the computers' IP addresses that you intend to secure with IPSec. Trust me on this one: make sure you make keys for both IPv4 and IPv6 for each IP address that appears in netstat -rn output.

    Setting hosts up for the public-keys you just made: You need to distribue a copy of the CA public key to each machine wherever your OpenSSL(1) configuration likes CA public keys. Put the host keys somewhere like /usr/local/etc/racoon/hostkeys and make sure only root (the racoon daemon) has access to the private keys. Your standard racoon.conf file will need a "path certificate" line that specifies your hostkeys directory as well as your systems' OpenSSL certificate areas. You should start doing these steps as part of any standard installation procedure if you have one.

    Once you have keys set up on two hosts, set them up with IPSec policies to allow rlogin over authenticated ESP encrypted connections only. If you didn't set up keys (correctly), rlogin will be firewalled out by the IPSec policy. If you got it all right, you should be able to rlogin between the hosts.

    man pages of interest:

    • openssl(1)
      This is a couple of days' worth of homework if you're not already familliar. Also look at /etc/ssl/openssl.cnf (which should be fully customised as a prerequisite to this project).
    • racoon(8)
    • racoon.conf(5)
    • setkey(8)
  5. FUD FUD FUD on Ximian Adds Subscription · · Score: 1

    Why should I sympathise with you? Really? I haven't read one good reason to feel like

    if there's anything on my linux box that I can't do in console mode ... I don't do it.
    You seem to want to imply that Linux just isn't a Desktop OS for you. That means you aren't really relevant in this discussion now are you?

    Why don't you tell us in detail we can all verify for ourselves exactly what the full splendor (horror) of what was Gnome 1.4 actually means? Maybe you can't because you spend too much time getting bent-over and loved-gently by Microsoft?

  6. Re:*IMMERSIVE* not *EMERSIVE*?? on University of Illinois uses a Cluster for Immersive VR · · Score: 1

    The real problem here is that technology is hard to understand, and the people who can understand it are too few to pay for it. This creates the need to *sell* it to idiots and dummies (like in the books) or business suits who don't even care about the technology.

    Cutting to the chase: the sales-weasels of high technology (Which the UofI and NCSA have become in the wake of NCSA Mosaic's effect on the WWW) like to coin meaningless words to name their projects so that people who aren't capable of understanding the technology can still recognise it. What I care about is when people lampoon this practice by creating a silly name with some kind of inside joke for the people who *DO* understand the technology. I was just fishing.

  7. *IMMERSIVE* not *EMERSIVE*?? on University of Illinois uses a Cluster for Immersive VR · · Score: 1

    I'm not sure that emersive is even a word. However, immersive, adj. (immerse, verb: to place an object within something else), in this case, means to place the computer user within the computer interface.

    If emigrate/egress (to leave) is the opposite of immigrate/ingress (to arrive), then maybe emersive means to place the user outside of the interface.

    Is there an inside joke or other good reason for using emersive? I'm not really complaining about spelling as much as "WTF does this confusing term really mean?" Really, does anyone have a story for this or is it just a speling mistake?

  8. Re:It's all so arbitrary... on Fair Domain-Dispute Arbitration Firm Quits the Business · · Score: 1

    Ajax cleaning supplies (AJAX.NET) and Microsoft (Word) are whining because they want to weasel their product into any use of the word Word or Ajax. It is weaselly of them to take this crap to the courts where less-than-enlightened , where's-my-kickback-underpaid judges issue rulings in favor of their future post-retirement-kickback-perks. I agree it is ethically indefensible.

    However, nobody says you have to use the system that they are dictating. Workable alternatives exist. Be like Internet Protocol (was designed in the beginning) and say "OK, barrier, find another way" and learn to ignore the crap as much as you can.

    Network protocols are VOLUNTARY. You can put whatever numbers into your computer in whatever order you want. If you refuse this, don't whine because you don't like the numbers/order you're told to use.

    PS:
    Slashdot doesn't do HTML Entities, so you'll have to use your imagination for the & stuff...

  9. It's all so arbitrary... on Fair Domain-Dispute Arbitration Firm Quits the Business · · Score: 1

    I don't know why people are so pissy about all this. ICANN has always been so arbitrary anyways. The Tim Berners-Lee model of the web doesn't need mnemmonic domain names because hostnames are embedded in contextual hyperlinks. Anyone with a persistent (broadband) connection these days can run a root nameserver for their own arbitrary TLDs, and contrary to popular belief: you don't have to sell *everyone* on them, just the ISPs who run DNS caching forwarders for the Hoi Polloi. That's ANOTHER discussion...

    ---Begin Humor---

    Oh, why can't *I* be a household name? Why is an existing multimillion dollar corporation more important than *me*? Why are the brokers of fame always controlling who gets famous or not. Waaaah.
    ---End Humor---
  10. Q: SDMI Watermark Enforcement VS. 3rd Amendment on Ask Ed Felten About Watermarking Analysis And More · · Score: 1

    I've been thinking about what is fundamentally wrong with SDMI and digital watermarking, and I wonder if a technical expert would object to my characterization of exactly how the stuff works.

    Technically, how well does software that verifies SDMI-watermarks fit into the metaphor of "quartering of soldiers" in terms of privacy? Can we make the argument that SDMI is an invasion of privacy because the cryptographic software extends the influence of publishers into the private domain of users' legally purchased hardware?

  11. We should ask for a followup re: Slashdot Loadtest on Building a Better Webserver · · Score: 1

    At first glance, I would say a 500MHz Sun BL100 might be a tad on the underpowered side for a web server with broad user appeal, but I'm really interested in a deep and meaningful way to hear the followup on their design article with all of the Slashdot Effect taken into account.

    Why 64bit? Is there a lot of big integer math going on here? Does the web server/jvm do a lot of memory-copy operations on data that is 64 or more bits large? What kind of stuff does ldd(1) tell you about the 64bit implications of the web server?

    How *is* the disk IO on the blade? That's the traditional bottleneck for any system design to tackle first. How about their Internet provider's network? That's the first culprit in low-cost systems' ability to handle more concurrent users. What is the CPU spending most of its time doing?

  12. Async vs. Softupdates? Buffer-cache granularity? on Byte: FreeBSD vs Linux Revisited · · Score: 1

    I think the numbers could show the cost of synchronous filesystem mounts (even with softupdates) simply cannot keep up with the raw performance boost of allowing the kernel to lie to processes about the completion of disk writes. EXCEPT THAT THERE WAS NO DISK WRITING IN THIS BENCHMARK EXCEPT *MAYBE* WEB SERVER LOGGING.

    I'm also not sure about the granularity of buffer cache objects and physical disk IO operations on each box. How were the kernels set up differently by default?

  13. RIAA represents THE MANAGEMENT on Recording Artists File Brief Against RIAA · · Score: 2, Interesting

    The RIAA represents the interests that control PROMOTION AND DISTRIBUTION of music, and NOT the PRODUCTION OR AUTHORING of music. They don't care about music or artists that have not been proven as "mass marketable" because the payoff does not attract lawyers and middlemen.

    The RIAA exists to reserve the SCARCITY of good music (keeping music OUT of the hands of consumers) until pent-up demand can generate windfall revenues. Musicians who slowly build up a following simply do not sign bad contracts that give all the windfall to the industry people. The RIAA exists to control the money of one-hit-wonders and fad music that rises quickly out of obscurity into the obsessions of conformity-minded 12-13 year olds.

    If you think about Napster vs. RIAA in those terms, you see that the timeless music most heavily traded on Napster threatens the middlemen more than the artists. What would happen to Britney Spears and Puff-Daddy if junior-high aged kids started to think that their parents' old record collection was cooler than the crap being hyped on MTV and department store PA systems?

  14. Microsoft's Scott Culp screams "leave me alone!" on Microsoft Blames the Messengers · · Score: 1

    With his controversial and incisive essay, Microsoft Security representative Scott Culp thrust himself into the parthenon of computer security public figures.

    "Microsoft doesn't want to waste money protecting the interests of users," Culp says. "And no matter how many script kiddies make exploits out of security bulletins and no matter how much is at stake with each vulnerability they will never reach the developers and project mamagers who are responsible."

    When asked to get to the bottom line Culp replies "Microsoft actually *wants* to violate the security of its user-base, not catastrophically, but slowly and methodically to gain more and more control over users' work and lives as this translates directly into more control over users' money...hackers who figure out back-doors are troublemakers and usurpers who can't even collect the financial benefits of exploiting users. They are vandalizing an entire emerging economy."

    Please note this is a "ha-ha, only serious" parody, and the quotations attributed to Mr. Culp cannot be verified. Caveat Lector.

  15. Why does the W3C need its own revenue stream? on Ask the W3C's RAND Point Man · · Score: 2, Interesting

    A Consortium is a group of entities/people/companies/whatever consorting/sharing/talking/discussing things. If the W3C started charging, it would be its own entity with interests to protect, and members would no longer have the same motivation for participation. Things would be different, but how?

    Have the original reasons for involvement in the W3C been reviewed and rejected? What is the justifying logic in the W3C charter and how does that play into the fees issue?

  16. Buy only indie and bootleg music. Boycott the crap on Music Industry Forcing WMA standard? · · Score: 2, Insightful

    If you buy music to listen to on your computer, and that requires ripping to mp3 or Ogg/Vorbis, then these new fangled MS crippled CD's are worthless to you. Don't trade your $15.00 for a worthless CD. Buy bootlegs instead. Buy old (used) CDs where you can.

    If you think about it, how much archive quality music does the RIAA membership put out in a year? Most of it is one-hit-wonders and teeny-bopper crap. Hip-hop, electronic, and rock music all have big underground and indie (non-corporate) scenes. Musicians should all be producing their own discs for sale via pay-pal anyway.

  17. Re:You never buy software on Software Transferability? (or the lack of it) · · Score: 1

    YOU can just take it how you like it.

    The thing is, you have to follow the money. Lawyers get PAID prosecuting big offenders. You need to have a good case (ie. a jury could tell that the packaging is lies) and you need to have enough total damages at stake to get the lawyers' interest, and you need to be going after someone who has enough cash that awards will be paid for at the judgement.

    If you don't have all those three things, you are screwed, but you screw yourself when you have all the necessaries and still take it lying down. In that case, I have some nice swampland in Florida....

  18. Re:You never buy software on Software Transferability? (or the lack of it) · · Score: 1

    Well, there are other laws to protect consumers in your situation:

    So you buy that game that's supposed to run fine on a Pentium 75MHz with 16MB of memory and when you install it in your Pentium 133MHz with 64MB of RAM the thing doesn't run. Too bad...
    This is called false advertising, and the publisher can be held criminally liable. If the publisher printed the packaging in another state, the crime is a federal violation.

    Go get yourself a bunch of co-plaintiffs (ie. anyone else who got bitten like you) on a list and take the list shopping for lawyers. Lawyers love cases with lots of co-defendants racking up damages against a corporate entity that can be fleeced with prejudice for such easy-to-prove missteps.

  19. Who is astroturfing the "dying BSD" legend? on IP Theft in the Linux Kernel · · Score: 2, Insightful

    BSD is not dying. The KAME IPv6 stack, as integrated into BSD OS's, for prima facie example, is the reference for how all other OS will implement IPv6. BSD is already (and always has been) as dead as it is going to get: note the sarcasm.

  20. From Crossbows to Cryptography on Ethics in Scientific Research · · Score: 3, Interesting

    This issue was already explored by the Internet community, and the cypherpunk manifesto From Crossbows to Cryptography explains the issue, though some of us find our collective selves on the other side of the coin from the cypherpunks this time.

    The issue is power, which privacy confers because anonymity is impunity. Authorship being one of the critical facts concealed by any encrypted parcel. Technology originates in the powerful, in order to confer more power to them. However the technology itself is information which escapes by multiplying itself in unacquainted minds, eventually in those minds outside the power elite which devised the technology. The balance of power falls back to somewhere between the power elite and the subject people.

    Now all of this exists independant of ethics. No doubt the power elite would like the subjects to restrain their use of the technology on a principle that does not bind the power elite. Ethics are weak (subjective and voluntary), but they are at least sometimes effective.

    Where this leads us is to the question: should we develop new encryption technology? Should we implement Key Escrow? I urge you to think long and hard about the cold facts of how any of those possibilities can be abused. Experts agree that without strong cryptography (even for terrorists) democracy will fail. This is a new world and requires acute wisdom to set the direction we move next. Freedom of speech is not an option or a priviledge, it is a right whithout which people cannot guarantee governance by consent.

  21. Re:To every one worried about encryption........ on Purdue Builds Quantum-Computing Semiconductor · · Score: 1

    So far they haven't proved that it is feasible to build a machine out of qubits, let alone an arbitrarily complex one, or one that is complex enough to perform real quantum calculations. Even then, we don't know if we can get qubit machines to calculate entanglement cryptography.

    It is all hypothetical upon hypothetical upon one pair of qubits that have not been replicated in other research yet.

  22. Re:KEY ESCROW IS AGAINST BILL OF RIGHTS on Legislating Insecure Encryption · · Score: 1

    This would require congress to declare war, and the period of war would be prescribed by the act of Congress, enduring until the stated objectives are met in a manner to be prescribed by law.

    Since cryptographic privacy and cryptographic accountability (non-repudiation) are tied by the need for truly secret keys, escrowed keys are a legal loophole that the courts will not uphold. Thus, by refusing to accept an escrowed key as a token of identity beyond a reasonable doubt or by a preponderance of evidence or whatever burden applies, (as they limit escrowed keys' legal value) they will indirectly underwrite the value of private keys.

    The only way to enforce key escrow encryption is to legally prohibit the use of private keys. This is reducible to lay terms: you are legally forbidden to communicate anything illegal in a manner that cannot be legally prosecuted.

    I believe the courts, as I do, interperet the first amendment to place this criterion above the law, in the spirit of guaranteeing civil disobedience, and indirectly the court's own superiority as the gatekeepers of the law. The court will protect this (right to speech in the gray area of legality) to ensure that public or private proceedings in the courts are beyond the jurisdiction of the executive. It's not just patriotism, but professional self-interest clad in nationalistic patriotism that will guide the judiciary.

  23. Re:*BSD is dying on Ripping MP3s in BSD · · Score: 1

    Anonymous Coward forgot to mention Mac OS-X.

    What is the motivation for expressing this opinion? What is dying in this context? What is sales to a Free operating system?

    If you are inclined to agree with this guy's post, then you will be interested to look at Microsoft's sales numbers and their prospects of growth without booming PC sales. As for the facts, I won't pretend to nail down hard numbers based on Usenet posts.

    Even though this is flamebait, and the author is a troll, once you think through the underlying question(s) and the possible answers and corrolaries, you will learn something.

    The people who think in terms of sales and users as the driving force behind free software are very interested in killing off the BSD family.

  24. KEY ESCROW IS AGAINST BILL OF RIGHTS on Legislating Insecure Encryption · · Score: 1

    The Bill of Rights in the US Constitution protects your right to say anthing, whether or not the government can grok it. It guarantees freedom from "the quartering of soldiers" which is loosely interpereted by the Supreme Court as an individual domain of privacy. I doubt they would miss the connection between quartering soldiers and/or quartering escrowed keys (agents of the Government).

  25. Copyright Violation or GPL violation on FSF Statement on Violation of GPL by RTLinux · · Score: 1

    If you release binaries compiled from modified GPL code, then you are bound by the GPL and the software is encumbered. If you fail to comply with the GPL restrictions, then you may be liable for copyright violation against the owner of the code you modified.

    In this case, Linus Torvalds is owed damages for copyright violation on each copy of RTLinux distributed. If source code modifications were released, then the GPL "free redistribution" waiver would kick in, and Linus would nto be entitled to anything.

    If Linus Torvalds accepts *anything* for damages, it should not be without injunctive relief applying to the patent.