Discussion Locked
Dark Side Programming
0 helpful
190 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
blog root
190 replies
by ediaz
Tool Of Objective Truth
Three years ago, when google api come to the public, I wrote a little program named TOOTD6, based on Tool Of Objective Truth (sadly, is no longer availabe, AFAIK), a simple game that used the google api to determinate the "objective truth" about any topic, based on how many references has a word, or term, in google.
The world wasn't ready for TOOTD6, but perhaps now its the time to give TOOTD6 a chance. Now is available in Windows only, but I hope to write a more portable version soon. Sources are available on request (is a delphi 7 program)
You can download the current release of TOOTD6, called LNDSTOOTD7 here.
If you like it, write me a note, is freeware.
An example
The picture show how we determinate which one of 3 programming languages are more popular, candidates are Java, Ruby y Python:
by ediaz
Linus Torvalds announced the release of the 2.6.13 Linux kernel. "The most painful part of 2.6.13 is likely to be the fact that we made x86 use the generic PCI bus setup code for assigning unassigned resources"
Visit http://www.kernel.org/.
There is a RSS Feed to keep track of kernel development at: http://kernel.org/kdist/rss.xml
This release has better support for PCI Devices, specially on laptops, according to Linus Torvalds:
The most painful part of 2.6.13 is likely to be the fact that we made x86
use the generic PCI bus setup code for assigning unassigned resources.
That uncovered rather a lot of nasty small details, but should also mean
that a lot of laptops in particular should be able to discover PCI devices
behind bridges that the BIOS hasn't set up.
by ediaz
I live on a country where every children born with his/her national id number.
Well, our National Identity Number is an old institution, as far I know, it is more than 50 years old, perhaps 100 years (I will check this number).
Id Card oposition is a cultural thing, for us, to carry an id card is natural, perhaps our history make us accept id cards just a natural way to identify people.
The problem of id card, is the excessive bureaucracy, every transaction needs a confirmation of identity.
The reason of this, is the barely mentioned by Bruce Schneier on this this post, Id cards can be lost or stollen, is relative easy to alter a card, and make a fraud. That obligates to the stablishment of more bureaucracy, we have birth certificates, a national registry of identification, certificates of residence, a big fingerprint database, etc, etc.
A nightmare of bureaucracy :)
It's good, or bad?
Is a fact of live for me, my country is not the only one with id card.
For all those countries that choose id cards, the only way is to improve this tecnology to avoid identity theft. Is an obligation to give better id cards, to give better and reliable verification technology. We, the citizens of this countries, didn't choose to be identified by a number, so our governments must ensure our identity is safe, now, more than ever, because we live in an interconnected world.
Perhaps the solution is not to use id card, but, I believe this is not longer possible (no without a revolution ;).
I don't care much if USA will have an id card, I care of my country id card, if I can't avoid it, I need it to be more secure. This is an issue, or opportunity, to all people interested on privacy and security. Given, the fact of id cards, how we can improve it, and make it safer, if this is possible.
by ediaz
According to RealMeme owner, Broward Horne, after he published his "Saving Google" memegraph, his google ranking disappeared.
Is a paradox, because, real meme gives google, more business, I support Horne demands, read more on: news.com
by ediaz
Remember, .Net is not only for Windows.
I read on Sean's blogs, about monoppix.
Monoppix, is a port of Knoppix, with full Mono Support:
That means you can compile an application on Windows under Visual Studio, copy the EXE onto a Linux box with Mono installed, and run it under Mono. There are of course other requirements, like you can't be making Windows native PInvoke calls, Mono needs to have implemented all features you're using, etc., but there's no need to compile under Mono to run on Mono
(Quoted from JonGalloway.ToString())
Well, you must remeber to compile an MSIL compatible application, and you are portable.
Think about this, how many servers are linux based?
Think, how many programmers are proficients on Visual Basic .Net, over Java, PHP, or python....
by ediaz
I Like Koders, you can search on millions of line of code, try it:
by ediaz
Good biometrics practices must ensures that:
1.- Sample can only captured one time, this is called cancelable biometrics. An advance is covered in this CNN story.
2.- The database must store the biometrics features in a secure mode, preventing tampering. This can be done using cryptography, and many known techniques to prevent tampering.
3.- Ensure capture of live biometric sample, we now have sensors that can sense live finger prints, reading pulse, pulse, temperature, etc.
Remember, biometrics is part of the security equation, you must combine it with passwords, tokens, and other security elements.
Even, is better to have multi modal biometrics...
by ediaz
Find beautiful images of southern stars and galaxies, taken on the First Ligt of the Southern African Large Telescope (SALT).
Heres a sample: 
(2Mb, from Salt site)
See more detailed images on SALT Site.
by ediaz
RainbowCrack is a general propose implementation of Philippe Oechslin's faster time-memory trade-off technique.
In short, the RainbowCrack tool is a hash cracker.
The method described is useful for many hash functions, not only MD5, also for NTLM, MD2, MD4, SHA-1, lm (LanManager), and RIPEMD160.
This method stores pre calculed intermediate results needed for the cracking, "several years of computation effort can be saved in tens of GB of data".
So given enough time, and disk space, you can make your crack, for example, the passcracking site use this tables.
So, are you still considering MD5 useful???
by ediaz
Just write how to make money in the internet, put a site with the topic, write a ebook on pdf format, and sell it in $100, and bingo, you are making money (ah, you have to do some spam, via email and blog posting, using callbacks, and blog comments).
I will experiment with this post, perhaps my visits begin to increase :)
:) :) :)
We must add spam filtering to our blogs, I bet, this post is a candidate for spam.
by ediaz
I have to agree on Bruce Schneier arguments about code signing, according to an slashdot discussion, Bruce wrote 'Code signing, as it is currently done, sucks'.
I don't have read the book yet. But the article of slashdot quotes some of the arguments:
- Bruce's Argument #1) Users have no idea how to decide if a particular signer is trusted or not.
- Bruce's Argument #2) Just because a component is signed doesn't mean that it is safe.
- Bruce's Argument #3) Just because two component are individually signed does not mean that using them together is safe; lots of accidental harmful interactions can be exploited.
- Bruce's Argument #4) "safe" is not all-or-nothing thing; there are degrees of safety.
- Bruce's Argument #5) The fact that the evidence of attack (the signature on the code) is stored on the computer under attack is mostly useless: The attack could delete or modify the signature during the attack, or simple reformat the drive where the signature is stored.
I think, the most critical argument is the first one.
You know that certificates can be stollen, or worst, in some time in the future will be altered without notice. So, even you decide to trust every component downloaded from Microsoft, perhaps you could be fooled.
by ediaz
If you want to hear a little bit of the Big Bang, you're going to have to turn down your stereo.
That's what neighbors of MIT's Haystack Observatory found out. They were asked to make a little accommodation for science, and now the results are in: Scientists at Haystack have made the first radio detection of deuterium, an atom that is key to understanding the beginning of the universe. The findings are being reported in an article in the Sept. 1 issue of Astrophysical Journal Letters.
Researchers find clue to start of universe
by ediaz
In the august issue of Communications of the ACM, Microsoft published an full page ad, with the following content:
** Can you spot the security Hole **
This is the Source Code in DCOM that led the Blaster Worm
HRESULT GetMachineName(WCHAR *pwszPath)
{
WCHAR wszMachineName[N+1];
LPWSTR pwszServerName = wszMachineName;
while (*pwszPath != L'\\')
*pwszServerName++ = *pwszPath++;
....
}
The ad, offer resources for academics in the area of teaching security.
Ironically the original blaster worm contains this message
billy gates why do you make this possible ? Stop making money
and fix your software!!
Perhaps all these ads are a response from billy gate???
Well, about the code show, this is the public enemy number one, the buffer overflow, I suggest always to read this book:
You can learn how to avoid this kinds of bugs.
by ediaz
An open source class library to provide connectivity with the MSN Messenger service: DotMSN.
A cool tool that use it is this .Net Reference Bot
by ediaz
The following graph, on realmeme, shows the buzz of Delphi Programming language in misc.jobs.*
<a href="http://www.realmeme.com/Main/miner/historical.jsp?startup=http://www.
At least, we have a succesor in Chrome.
by ediaz
According to this article on wired, it tooks to Director Robert Rodriguez less than a day to shoot the firsts 3 minutes of Sin City. In fact this "demo" was made to convince Frank Miller to join as co-director.
The sequence was shot on Rodriguez's own studio on Texas, using his own HD Sony Cameras, Discreet, Avid digital editing machines, and XSI modeling software.
A great movie, with good prety smart use of technology.
by ediaz
The disasters, like 9/11, or Tsunami, and now the New Orleans floods and Katrina Hurricane stress our comunications systems.
Jef Jarvis propose Recovery 2.0:
The goal is to be ready ? God help us ? for the next disaster so people can better use the internet ? via any device ? to better:
1. share information,
2. report and act on calls for help,
3. coordinate relief,
4. connect the missing,
5. provide connections for such necessities as housing and jobs,
6. match charitable assets to needs,
7. get people connected to this and the world sooner.
This looks like a reformulation of the myth about DARPA, to make an indestructible network, even under cathastrophic conditions.
ARPANET wasn't devised as a communications link that could survive nuclear war. However the idea to build a indestructible message, was crucial on the development of IP protocols.
We need to make internet a more resilient communication medium.
by ediaz
"...there are 100 billion neurons in the average human brain and 100 billion stars make up the Milky Way Galaxy,we have now sent more than 100 billion text messages in the UK"
In UK an average of 87 million message are sent in a day!!
Thats a lot of traffic, perhaps the people on UK use more SMS as email...
Teenagers, use a lot of SMS because of the privacy, your father can hear a text message ;).
by ediaz
Dr Emily Emily Finch UEA interviews career criminals about their activities claims.
The study shows how the thieves adapt to new technologies, and broke them using the weakest link: human nature.
"What fraudsters know about is human nature. They know about people, they know how we operate, and they know how relationships of trust in which information is disclosed develop,"
"Instead of using stolen cards, criminals are now taking over people's identities and applying for cards in their name "
Dr Emily Finch, UEA
More on this article: Criminals to 'adapt to ID cards'
When you design security you must remember that humans are the weak link on the security chain.
Dr. Finch points out that
"The more people rely on the production of a particular piece of identification to verify identity, the less vigilance people will exercise themselves - that's the problem. If there are ID cards we will trust them to be unassailable."
by ediaz
An old, but still useful article about injecting code to other process on windows, you know what this means in terms of security....
Three Ways to Inject Your Code into Another Process
by ediaz
The following image is taken from the paper Practical Attacks on Digital Signatures Using MD5 Message Digest
As shown in the picture the current collisions findings can be used to alter files, like digital signed documents, distribution files, like RedHat Linux RPMs, or Debian Packages .DEB.
The paper shows a proof of concept, is question of time to this technique be extended for virus injection into valid distributions files, for example.
by ediaz
Eclipse + Perl, seems a good answer for all people interested on Perl IDEs, I dislike Komodo, and I think I will Eclipse + Perl a try, anyway I'm using Eclipse for java and tersus development, adding perl is cool.
by ediaz
by ediaz
Ed Bott writes about how an alarming story on eWeek, claiming that 80% of enterprise software are infected, was only a company promotion of an antyspyware product.
OK, all time companies send ready made stories to magazines, this is marketing. Fortunatelly we now have a lot of smart bloggers with the power to speak out and point out the truth.
Now, tech journalist must double check their sources, and perhaps some day this type of "news marketing" will banish.
If press is the 4th power, then blogging will become the 5th ;)
by ediaz
Wesner Moise's write about design.
He is using XML for design, later the xml is translated to C#.
I haven't write on WISDOM for a while, but I believe that my proposal is more practical for extreme programming with user participation.
The XML approach is interesting enough, to make it a core component of WISDOM.
WISDOM is my idea of Wiki Oriented Software Development, a spare time project I hope to finish some day.
by ediaz
Here's some thing I didn't know, the list of shortcuts associated to the windows key: A celebration of the Windows key.
I wonder if still will be valid on Vista?
by ediaz
A lot of buzz about AJAX, Scot Hanselman has a new list of AJAX related links.
AJAX seems to me as a good DHTML enhancement, the results are great, like gmail, google maps, etc. I don't like to write Javascript, so I like component thats hides the complexity of AJAX to me, two products you could check are:
I'm using Telerik's product, they have a good suite, and CallBack is a good set of components.
I hope, we see more and more AJAX based components on time, they are giving the web a new live.
by ediaz
Reading Schneier blog I was lead to a very good article: The Six Dumbest Ideas in Computer Security, written by Marcus Ranum.
After read this article, I checked my email and received a Secunia Alert on Firefox vulnerability.
The count of advisories for Firefox is 65 now.
Here we are in presence of two of the dumbest ideas on action:
#2) Enumerating Badness: because now we now how to make a buffer overflow on Firefox, just read this.
and
#3) Penetrate and Patch: is the Firefox Team following an spiral of Penetrate and Patch? I hope no, we must start to follow their bug rate to confirmate this.
Penetrate and Patch, seems to me a common mistake on software development, for example, we have all those never ending Beta versions of products, like google does.
by ediaz
My 16 years old son, installed Ubuntu two weeks ago, all good, a nice linux distro. But that distro didn't support his video card, a "monster video card" tuned for gaming.
We started a search for the drivers, until we found the necessary patch. We just needed to dowload the driver in .tgz format, compile a module and link with the kernel!! Easy if you are a hacker, but what for the unexperiencied user, frustrated because can't use his software?
We did it, but in the process we downloaded python, perl, make, gnu cc, and some others developers tools, not included by default on ubuntu.
This experience make wonder: What if a bad hacker, takes control of my son's computer? He will a lot of guns ther. Many worms were conceived to use the shells tools and compilers available on Unix, or Linux. Many worms can be conceived to use them.
Distros like Ubuntu doesn't install development tools, because the security breach they open.
But, in open source the patches are distributed on source code, with a typicall readme file, with simple instructions, if you are a linux hacker you can do the usual ./configure, make, make install cycle.
But when things go wrong, we must to download and install gnu cc, or perl, or python, before the installation. And, in many cases we must have root access to run all the install procedure.
When you do that, you are installing developer tools, that can be used by bad guys. If you are not a programmer, you don't need them.
I think, user must be warned, and these tools must be removed after install. Or a new procedure must be conceived to distribute this patches.
Fortunatelly, new linux distros are working hard to make linux more friendly with the non expert. The case I told happens because not all the hardware providers are giving support to linux, but the people that writes the alternative drivers and patches, must be more aware of the possible security breach they can open.
If you are writing modules, patches or new drivers for linux, try to send them to the distros owners, like redhat, ubuntu, etc. Use theirs distributions format, .deb, .rpm. Give the source and the binary distribution. Digital sign them, give people ways to verify origin.
Try not to expose to user requesting to download or install developer tools, if they will not use it.
by ediaz
The fix was published.
The problem is in IDN (International Domains Names), bad things, because we, people on latinamerica are eager to use this feature: Por fin dominios con e?e.
I think this happens , because programmers don't give security priority.
by ediaz
Katrina and the waves, the name of this 80's rock band sounds now like a strange premonition.
Katrina still raise waves. On political side, and also raise questions about security investments, in the most wealth country of the world.
There is not such this like a natural disaster, just bad political decisions, the so called natural disasters involve the concurrence of a population and a natural event, like an hurricane, but this can be mitigated with good decisions, and and money spent correctly.
by ediaz
I have found icerocket, a blog search engine, with a nice tool of trend terms on blogs.
This graph shows the posts of Java versus posts on C#:
There is a tendency here...
The tool is at http://www.icerocket.com/c?p=trend
by ediaz
If you want a visa for visiting the United States, your fingerprint will be collected. So, don't be surprised if this happens to you, like it or not.
From the consulate of USA on Guangzhou, China
Q: Why are you collecting fingerprints for visa applicants?
A: U.S. law requires that as of October 26, 2004, we collect biometric identifiers from all visa applicants. As of October 26, any immigrant visa applicant (including K and V applicants) aged 14 and above and any non-immigrant visa applicant between the ages of 14 and 80 at any U.S. consulate or embassy will have fingerprints taken as part of the visa application process. We chose fingerprints as the most effective and least intrusive biometric identifier.
....
Q: What happens if a visa applicant refuses to be fingerprinted?A: We would refuse to issue a visa, since the application is incomplete. However, if the applicant later decides to be fingerprinted, their visa application would be reconsidered. The applicant would not be required to pay a new fee.
More information at: Consulate Guangzhou
One more important question about this:
Q: Will the machinery be disinfected regularly to prevent the spread of diseases like SARS?
A: The fingerprint machine will be cleaned and disinfected on a regular basis.
:)
by ediaz
The speed of blogsearch surprised me, in few minutes your posts are collected into the site.
I think, that this will become the facto blog tool search.
The bad, is the click tracking, I don't like it, I want to click directly to the blog site I was loking for.
But, perhaps is part of the bussiness model for blogsearch, just imagine all the directed marketing they can make with this....
by ediaz
I have built a proof of concept based on the this papers:
* http://www.cits.rub.de/MD5Collisions/
* http://www.doxpara.com/md5_someday.pdf
This image shows the proof of concept:
The program generate 2 files, with the same MD5 value, but one extract a good file, and the other a harmful file.
You can read, and download the project for visual studio on Codeproject.
by ediaz
http://www.eso.org/outreach/press-rel/pr-2005/pr-23-05.html
Beautiful pictures of a massive black hole without host galaxy, found by observatory at paranal:
by ediaz
According to eWeek.Com:
Microsoft is banning certain cryptographic functions from new computer code, citing increasingly sophisticated attacks that make them less secure, according to a company executive.
The Redmond, Wash., software company instituted a new policy for all developers that bans functions using the DES, MD4, MD5 and, in some cases, the SHA1 encryption algorithm, which is becoming "creaky at the edges," said Michael Howard, senior security program manager at the company, Howard said.
by ediaz
I don't like the argument of Ed Felten, but not the thesis.
Is impossible to make a perfect DRM.
DRM is doomed, because the only effective way to make a perfect DRM is to develop an invasive technology to put directly in the brain the content, to make them unbreakable.
If the content is broadcasted, then is always possible to make copies of it. Every time a song is aired, a movie played, these contents are exposed to copy.
The best DRM is lower prices ;)
My congratulations to the people that convinced the movie industry to spend $ 30 millons, on this. That's a lot more than the offer for free energy machines: http://www.phact.org/e/freetest.html
by ediaz
According to Symantec Mozilla browsers more vulnerable than IE.
From the news.com article
There is one caveat: Symantec counts only those security flaws that have been confirmed by the vendor. According to security monitoring company Secunia, there are 19 security issues that Microsoft still has to deal with for Internet Explorer, while there are only three for Firefox.
Anyway, programmers need to pay more attention to security, you can not be exposed this way.
by ediaz
Luca Mori, the first cyber archeologist, the man who found the remains of an ancient villa near Parma, Italy, has put this new site: cyberarchaeologist.net.
Great for all the archeology aficionados ;)
by ediaz
I received a nice comentary about my article on codeproject: http://www.codeproject.com/useritems/HackingMd5.asp, I reproduce bellow:
I believe the intent is to demonstrate a very specific type of attack that exploits the inherent trust of an MD5 hash. It's sort of a semi-social engineering attack.
The attack shown in the article illustrates how the distributor/author/etc can issue a hash for a "good" application and then begin distributing an "evil" application by exploiting the trust of the "good" application's published MD5 hash. Needless to say, this is a very specific scenario and uses predefined vectors; however, it does work to reinforce a fundamental truth about security.
Bruce Schneier[^] asserts that security is a process, not a product1. This article demonstrates a specific attack that exploits the product-based view of security..."This file is safe because the MD5 hash I just calculated matches the published (well known) MD5 hash". The article highlights the importance of establishing a process that assumes products are flawed and manages exposure to attack and effectively deals with breaches.
thanks to Erik Westermann
[1] Crypto-Gram Newsletter, May 15, 2000[^]
Well, security is a process, not a product.
That's the point about this proof of concept, the weak link is the human link. So, is not surprising that this attack become a reality in a near future.
by ediaz
Steven J. Vaughan-Nichols interesting article Windows Beat Unix, But It Won't Beat Linux make me thing about the success of Linux.
Acording to the author, Linux cames to the field with two advantages:
"The first was that it was open-source"
"The second advantage was it had Linus Torvalds."
Because Torvalds is the single leader of Linux, it has avoided the old Unix trap of in-fighting, which continues to bedevil the BSDs.
If all Linux had was Torvalds, I'd worry about the operating system's future. Linus is a wonderful person and a great programmer, but if that's all there was to Linux's success, we'd be one bad car accident away from its end.
Linus is the heart of Linux, and he pushed and kept it under control all this years, some time Linux will not need Linus anymore, but that time all the job will be done.
by ediaz
NASA's Johnson Space Center Closed
NASA's Johnson Space Center in Houston is closed due to the threat posed to the Houston-Galveston area by Hurricane Rita. A small, emergency rideout crew will remain on site.
The center will not reopen until the storm threat has passed.
Does this hurricanes belongs to an evil plot of terrorism?, experts say no: "How Terrorists Might Exploit a Hurricane".
May be is an evil plan of ambientalist, to justify his theories of global warming: Global Warming and Hurricanes.
I don't know, I don't know
by ediaz
I have received a lot of visits from Turkey, a beautiful country I want to visit some day. The reason is a post on http://ferruh.mavituna.com/, a site I think is for developers.
I just curious about what this post says about this site, can anybody help me?
Here the text, I can't find a translator from turkish:
?irin isimli g?zel bir blog sitesi bu [w] Dark Side Programming (Security, hacking and coding fun), sitenin ?zellikle [w] Cryptography k?sm? ?ok ho?uma gitti. MD5 ?zerine pratik ataklar ve makalelere de ba?lant?lar var? (Olamaz link yerin ba?lant? dedim !, san?r?m t?rk?e yazma olay?nda ciddi bir ad?m daha att?m)
by ediaz
I have a lot of readers form Turkey, thanks, the text of previous post translate to this:
"This is a good blog site with a nice name [w] Dark Side programming (Security, hacking and coding fun), i especially like the [w] Cryptography part of this site. There are articles about MD5. "
(Thanks to gCg.
From today I like Turkey a lot more :) Welcome
Does anybody knows a site like Babelfish for turkish?
by ediaz
I'm playing with google print, and a search of my favourite theme of last time: md5, give some very interesting results.
For example, on the 1994 edition of PGP from O'Reilly, page 219 contains the following text:
"Mathematically, it's easy to see that billions of messages have the same MD5 result because MD5 function produces only 128 bits of output, - just sixteen 8-bit digits......
So why does MD5 seems so secure? Because 128 bits allows you to have 2^128 = 340,282,366,920,938,463,463,374,607,431,768,211,456 different possibles MD5 codes [...] human beings aren't likely to find many of them on their lifetimes." (link, probably google ask to you to register)
OK, the statement is still true, but doesn't matter, because of
MD5=MD5 => MD5=MD5
we can build classes of MD5 values now, and this is enough to do a lot of good and bad things....
Besides, I like google print, sadly they still not incorporate an OCR, to make it more useful...
by ediaz
===
_____ _ _____ _ _
| __ \ | | / ____(_) | |
| | | | __ _ _ __| | __ | (___ _ __| | ___
| | | |/ _` | '__| |/ / \___ \| |/ _` |/ _ \
| |__| | (_| | | | < ____) | | (_| | __/
|_____/ \__,_|_| |_|\_\ |_____/|_|\__,_|\___|
_____ _
| __ \ (_)
| |__) | __ ___ __ _ _ __ __ _ _ __ ___ _ __ ___ _ _ __ __ _
| ___/ '__/ _ \ / _` | '__/ _` | '_ ` _ \| '_ ` _ \| | '_ \ / _` |
| | | | | (_) | (_| | | | (_| | | | | | | | | | | | | | | | (_| |
|_| |_| \___/ \__, |_| \__,_|_| |_| |_|_| |_| |_|_|_| |_|\__, |
__/ | __/ |
|___/ |___/
p.by ediaz
The Lazy Genius is so lazy that it didn't mention my authorship of the article, I trackback him and I'm waiting for an excuse.
by ediaz
Bruce Schneier publish about the Fingerprint-Lock Failure in a Prison.
Prison officers have been forced to abandon a new security system and return to the use of keys after the cutting-edge technology repeatedly failed.
The system, which is thought to have cost over ?3 million, used fingerprint recognition to activate the locking system at the high-security Glenochil Prison near Tullibody, Clackmannanshire.After typing in a PIN code, prison officers had to place their finger on a piece of glass. Once the print was recognised, they could then lock and unlock prison doors.
However, problems arose after a prisoner demonstrated to wardens that he could get through the system at will. Other prisoners had been doing the same for some time.
I work for a Biometric focused company, I decided to try to understand where is the bug in this case.
To try to understand the causes of this failure I will write some of the fundaments of biometrics in this post, and discuss some of the causes of this failure. However, I must warn you that I don't have more information on this, other than the posts.
Biometrics ==
The now classic work on fingerprints is the Handbook of Fingerprint Recognition
If T represents the biometric stored template of a person, and I is the acquired input for recognition, then we define 2 hypothesis:
H0: I <> T, input does not come from the same person as the template
H1: I = T, input comes from the same person as the template
Then we have the decisions:
D0: person is not who she claims to be;
D1: person is who she clains to be.
Because biometrics is not exact, we define a similarity function s(T,I). If s(T,I) < t then we decide D0, else decide D1, where t is the system threshold.
With this definitions we can define the followings parameters of operation:
FMR = P(D1|H0 = true)
FNMR = P(D0|H1 = true)
FMR: is the False Matching Rate, and FNMR is the False Non Matching Rate
FMR is the probability of acepting an impostor, and FNMR is the probability of reject the true person.
FMR and FNMR are in fact function of the threshold t, so we write FMR(t) and FNMR(t).
Remember we defined the similarity function, s(T,I), and we said that we decide D1 if s(T,I) >= t. So if t decreases, FMR increases.
The election of t is critical.
== Biometrics samples on a Prison
The guards probably have damaged fingerprints, because of their hand work. And optical sensors are sensitive to this. Many people has dry fingerprints, and this happens with people with hands used on hard works, like guards, and prisoners.
So the people that worked on this project relaxed the threshold to allow maximun recognition of the guards.
But if you relax the threshold, then you increase your FAR. So this make possible to prisoners to find matching fingers.
The system could do better if they incorporated into the enrollment process to the prisoners, and later adjusted the parameters to get an acceptatble FAR.
Anyway, you can't trust only on fingerprint for identification.
by ediaz
Super High Definition SHD 4K digital video, correspond to images of 4000 horizontal pixels, this is almos four times the resolution of the current HD television formats used widely, and 24 times normal television broadcast.
The UCSD and the Keio University of Tokio linked together to transmit the first broadcast of SHD 4K, through 15,000 kilometers of optical fiber networks using IP at ciscuits of 1Gbps. They implemented JPEG2000 to compress and decompress at 200-400 Mbps on real time.
The demonstration was part of the iGrid 2005 conference.
by ediaz
Slodoban Celenkovic published a good article in his blog, about the impact of the cantity ob objects over garbage collection.
The post is centered on Java, but is applicable to C# too, and for any language that uses garbage collection.
The conclusion is that the if you allocate many objects, the cantity of object impact on the performance of any garbage collector.
by ediaz
by ediaz
= Gold Fever on Chile =
(Google translation of press note of Mercurio of Valparaiso
Fever of gold in Juan Fernandez
Although the mayor assures that "to see to believe," the islanders have hopes.
The islanders of the archipelago Juan Fernandez are excited. He is not for less. It is that the news of the supposed finding of the treasure of the archipelago Robinson Crusoe has borders of feat and feat. And, of course, of an undeniable factor of luck. More above the one would have been a robot that obtained the miracle, putting aim to a mystery of more than two centuries.
THE DESTINY ==
As it says the saying: nobody knows for whom it works. This history makes remember those soccers match where an equipment attacks all the party, it delivers all the attack during 90 minutes, is created the best plays... but it does not write down. And when they are in the discounts, a sudden counterstroke comes and the opposite equipment makes the goal. The stage explodes, the referee touches pitazo final; the won ones go away for their house with the tail between the legs, whereas the unexpected triunfadores are embraced in the center of the field.
Something thus happened in the island of Juan Fernandez. Because if somebody were near finding the treasure - therefore they believed all to it was the North American millionaire Bernard Keiser, who stepped on the island in 1994 for the first time, and from he was obsessed there to find it. Wine time and time again, assuring that it was on the verge of obtaining it.
But this week a group of explorers of the Wagner company gave a true slap him to the destiny, since, of being certain the finding, they could be before one of the discovered treasures greater of the world.
to verify the authenticity of this news, the glory destiny that seemed writing for Keiser will be usurped, as century ago the privateers did who sailed by these coasts.
== ROBOT ARTURITO
The mission was headed by the Wagner company, that it affirmed to have given with the treasure in the sector of the island known like Three Ends.
In order to obtain his assignment, it had a great ally: a called robot "TX spider", the same one with which was the body of the industralist Francisco Yuraszeck and arsenals in Villa Baviera.
By his characteristic, it was baptized by the press like "Arturito", in reference to the dear robot of the film of George Lucas, the War of the Galaxies.
According to Rodrigo Irarr?zabal commented, lawyer of the Wagner company, in the sector of the discovery two or three would be kept from the ships that went in the expedition of Atahualpa. "Atahualpa was one of the Incas who donated gold pieces to save the life and ships of that expedition disappeared and at the moment are kept or buried in the island Juan Fernandez", it said.
The news generated yesterday great movement in the islanders, who dream about having some participation in the discovery. Nevertheless, the company/signature did not reveal the exact point of the discovery.
The information already began to cross the orb, and is great sense of expectancy on the confirmation of the same one. Thus it was possible to be appreciated in Internet vestibules, such as the Universal one of Mexico, Terra of Argentina or agencies like Ansa Latin America.
The company already advanced that they are not interested in obtaining with the part that corresponds to them in this discovery, and that they will make donations to organizations like the Home of Christ, the Telethon, among others.
In the Wagner company already they occur satisfied by the work of its robot, the one that could consolidate world-wide like a great finder under earth.
THE TREASURE
The sailor of the Spanish crown, Juan Esteban Ubilla and Echeverria, General of the fleet that remained in Veracruz (Mexico), was the one who brought the treasure until Juan Fernandez in 1714. History indicates that Ubilla in 1715 chose to return Spain, nevertheless, died in a shipwreck.
According to the archives, Ubilla would have hidden the treasure in the Island Robinson Crusoe, because in those times, between 1700-15, the war got rid of Spanish succession; and one would have been involved in a conspiracy against the Borbones.
In order to make more expeditious east exercise, Ubilla took secret contacts with the British, who, later, came to the island to rescue the treasure.
Captain Cornelius Webb, 1761, and on board of the ship "Unicorn", arrived at this archipelago to rescue the treasure. In this Webb expedition he only managed to unearth it, because when tried to return to England, surprised a storm, having to return to the island where he hid the fabulous shipment again. After this, Webb sailed until Valparaiso with the intention to repair its ship. There it discovers rebellion plans and it chose to burn the ship with his crew on board and to return to the coasts of Valparaiso in a boat to oar. Web it sent a codified letter to Anson, but never it received it.
History reaches tech republic
The history reached techrepublic:
Excerpt: Chilean robot ?Arturito,? who made his bones, literally, by finding a dead man?s bones, has now taken on thedecidedly less-altruistic task of treasure hunting. Seemingly little more than a modified metal detector, Arturito wasunleashed on Chile?s Robinson Crusoe island (pictured above) where he stumbled across about 600 barrels of buried goldcoins and jewels, presumably looted from the Incans during the Spanish occupation. The hunters? lawyer estimates thetreasure to be valued at around $10 billion (our lawyer tells us that Engadget has a similar valuation),and promises that it will be donated to non-profit organizations (although the Chilean government says you can?t ... -
I don't believe on this claims, according to chilean press the robot is capable of analyze the deeps of the ground using gamma rays.
I wrote about my doubts in my spanish blog.
A google translation to english is here.
by ediaz
http://www.flashearth.com/
Great Interface to google earth, and Microsoft Virtual Earth, written in flash. This Guy is a genius.
by ediaz
eDonkey creator, Sam Yagan gives his testimony yesterday before the United States Senate Committee on the Judiciary, about "Protecting Copyright and Innovation in a Post-Grokster World"
The transcript of Sam Yagan Speech is this:
Sam Yagan's testimony:
Chairman Specter, Ranking Member Leahy, Senators, and staff: thank you for inviting me to testify this morning on this issue that will undoubtedly have broad and lasting ramifications for both the content and technology industries.
For the last three years, I have served as president of MetaMachine, the developer and distributor of the peer-to-peer file-sharing application eDonkey. From my vantage point I have witnessed and participated on the front lines of the confrontation between technology and content. I hope my experience on this cutting edge will be valuable to the Committee.
You might be curious about what kind of person would run a peer-to-peer company, so I'd like to tell you a little about my background. Prior to joining MetaMachine I co-founded and served as CEO of an educational publishing company called SparkNotes. In that role, I was a rights owner and my job was to sell physical content ? not so different from the goals of the record labels and movie studios. I share this background with you to give you comfort that I am not an anarchist and I have no ax to grind with owners of intellectual property. I hold a bachelor's degree in Applied Mathematics from Harvard and an MBA from Stanford.
Before I get to the core of my opening statement, I'd like to make it clear to the Committee that we have replied to the RIAA's cease-and-desist letter and I have personally committed to Mr. Sherman ? which I reiterate today ? that we are in the process of complying with their request.
Therefore I am not here as an active participant in the future of P2P, but rather as one who has thrown in his towel and with no interest in replaying past issues. I hope that as a result of my pending retirement from the P2P industry, I can speak with more candor and that you will accept my testimony not as pushing any self-serving agenda but merely as sharing with you my views on this Post-Grokster world.
I'd like to comment on three elements of the Grokster case that I find most important.
First: Because the Grokster standard requires divining a company's "intent," the decision was essentially a call to litigate. This is critical because most startup companies just don't have very much money. Whereas I could have managed to pay for a summary judgment hearing under Betamax, I simply couldn't afford the protracted litigation needed to prove my case in court under Grokster. Without that financial ability, exiting the business was our only option despite my confidence that we never induced infringement and that we would have prevailed under the Grokster standard.
Second: The court specifically cites that Grokster's marketing to "former Napster users indicates a principal, if not exclusive intent to bring about infringement." Is this really proof of intent to induce infringement? Does this mean that every advertiser that has advertised in the eDonkey software also has a similar intent? I should hope not, because last summer the campaigns of both President Bush and Senator Kerry ran advertisements on eDonkey. Were they really both courting the "swing infringement vote" or could they have had some other "intent?"
My final point on Grokster is that its inducement standard cannot serve as a long-term equilibrium. Imagine if since eDonkey's inception not only had we not made any statements inducing infringement ? but also that we made no statements at all ? and instead simply put up a website that read "eDonkey is a peer-to-peer file-sharing application." It seems to me that would not qualify as "affirmatively and actively inducing infringement." If we had never made any other statements would we be in the clear now? If so, new P2P applications will inevitably spring up and easily satisfy Grokster in this way. If we would not be in the clear than the effect of Grokster will go far beyond merely chilling innovation ? it will almost certainly freeze it in its tracks.
I'd like to wrap-up by humbly stepping beyond my area of expertise and making four observations that may be beneficial as you continue your oversight:
First, encourage a market solution. I don't think anyone knows which specific outcome would be best to mandate, but I have limitless trust in our free market system to generate numerous new business models to take advantage of the tens of millions of Americans who use P2P to quench their thirst for content and other data. Imagine if for the last ten years we had been able to convert just 1% of the estimated tens of billions of shared files into paid downloads. There is a market solution to be found ? it may well be one that fits in to the business model of the incumbent entertainment industry, but it also may not. It's not for anyone in this room to decide; only the market can.
Second, on this issue be especially aware of unintended consequences. With many P2P applications offshore or simply open sourced, the entities that will end up being most devastated by Grokster will be those ? like us ? that set up shop in the US, abided by American laws, paid taxes, and, at least in eDonkey's case, tried to license content from the entertainment industry. I fear that the winners in Grokster will not be the labels and the studios, but rather the offshore, underground, rogue P2P developers who will have just lost half a dozen of their biggest competitors.
Third, clarify the Court's decision in Grokster. As it is, many companies and would-be entrepreneurs simply cannot be sure of where they will stand with respect to the law. As you know, eBay recently acquired the P2P company Skype for more than two billion dollars. Note that Skype was founded offshore; it would be a real tragedy and a blow to our economy should all technology entrepreneurs take their innovations offshore.
And finally, I've started a few companies in my career and if I have one overriding passion it is for entrepreneurship ? the driving force of our economy. I urge you to try to empathize with entrepreneurs trying to innovate in nascent industries. I hope you will do all that you can to nurture and encourage entrepreneurs and provide them with a legal environment in which they can face the myriad challenges that startups do without the additional burden of having to wonder how a judge many years in the future will construe their every email, every phone call, and indeed every thought.
by ediaz
The Atacama Pathfinder Experiment (APEX), is a powerful Radio Telescope, with the capacity to research how the Universe was formed.
This is the first prototipe radio telescope to be installed on the Llano de Chajnantor, 0 Km east San Pedro de Atacama, North of Chile, and is the kickoff of the ALMA Project. (See map below).
Placed at an altitude of 5,105 meters (16,748 feets aprox.), the site was selected for his tiny atmosphere, and clear skies.
The APEX inauguration was on september 27th.
This is a modified ALMA prototype antenna as a single dish on the high altitude site of Llano Chajnantor.
The APEX will APEX will allow the study warm and cold dust in starforming regions both in our own Milky Way and in distant galaxies in the young universe. High frequency spectral lines enable the exploration of the structure and chemistry of planetary atmospheres, dying stars, molecular clouds as well as inner regions of starburst galaxies, the structure of the Universe down to the physics and chemistry of comets (more on APEX site).
The ALMA Project
ALMA (in spanish alma means soul), is the The Atacama Large Millimeter Array (ALMA), an international collaboration between Europe, Japan and the North America to build a synthesis radio telescope that will operate at millimeter and submillimeter wavelengths, situated on the North of Chile, at an altitude of 5.105 meters.
When completed (in 2011), ALMA will be the largest and most capable imaging array of telescopes in the world.
See technical specifications at ALMA web site.
Here is a picture of the APEX Radio Telescope:
![merlandsen_250181_1[363827].jpg](http://www.darksideprogramming.org/archives/images/merlandsen_250181_1%5B363827%5D.jpg)
by ediaz
I'm doing some image analysis, and need to do fast calculus of sums, media and variance, in sub matrices.
While reading Handbook of Face Recognition
Also, other interesting paper is "Rapid Object Detection using a Boosted Cascade of Simple Features", by Paul Viola, and Michael Jones (search.
in google scholar).
The Algorithm
The first picture [1] shows how we build the sum matrix, for the original matrix I(x,y) we make S(x,y) = Sum Over (x' < x, y' < y) Of I(x',y').
In the image we have the matrix inverted, as usual on graphic and game programming.
To calculate the Summed Area Table the recurrences:
s(x, y) = s(x, y-1) + i(x,y)
ii(x, y) = ii(x-1, y) + s(x,y)(where s(x,y) is the cumulative row sum, s(x, -1) = 0, and ii(-1,y) = 0.
Now, if we have the following matrix:
The value at cell 2 of ii, is A+B, the value at cell 4 is A+B+C+D. The sum at D can be computed as (4+1)-(2+3).
Here a console program, in C#, to test the algorithm, the program generates a random matrix, and calculate the sum in a given sub matrix:
using System;
using System.IO;
public class FastMatrixSum
{
public static void Main(string[] args)
{
if (args.Length != 6) {
Console.WriteLine("usage: matrixsum N M left top right bottom");
Console.WriteLine("This program build a random matrix of N rows with M columns,");
Console.WriteLine("and calculate the sum of the sub matrix (left,top)-(right,bottom)");
Console.WriteLine("This are the conditions for the parameters");
Console.WriteLine("N > 0 and M > 0");
Console.WriteLine("(0 <= left < M) and (0 <= right < M)");
Console.WriteLine("(0 <= top < N) and (0 <= bottom < M)");
Console.WriteLine("left <= right and top <= bottom");
}
int n = Convert.ToInt32(args[0]);
int m = Convert.ToInt32(args[1]);
int left = Convert.ToInt32(args[2]);
int top = Convert.ToInt32(args[3]);
int right = Convert.ToInt32(args[4]);
int bottom = Convert.ToInt32(args[5]);
double[,] matrix = FillMatrix(n,m);
double[,] sum = SumMatrix(matrix);
Console.WriteLine("Matrix");
PrintMatrix(matrix);
Console.WriteLine("Sum(Matrix)");
PrintMatrix(sum);
Console.WriteLine();
Console.WriteLine("The sum fo the sub matrix ({0},{1})-({2},{3}) is = {4}",
left,top,right,bottom,SumSubMatrix(sum, left,top,right,bottom));
}
static double SumSubMatrix(double[,] sum, int left, int top, int right, int bottom)
{
double v1, v2, v3, v4;
v1 = (left 0 || top 0) ? 0 : sum[left-1, top-1];
v2 = (top 0) ? 0 : sum[right,top-1];
v3 = (left 0) ? 0 : sum[left-1,bottom];
v4 = sum[right,bottom];
return (v4+v1)-(v2+v3);
}
static double[,] FillMatrix(int n, int m)
{
Random rnd = new Random();
double[,] result = new double[n,m];
for (int i = 0; i < n; i++)
for (int j = 0; j < m; j++)
result[i,j] = rnd.NextDouble() * 100.0;
return result;
}
static double[,] SumMatrix(double[,] matrix)
{
int n = matrix.GetLength(0);
int m = matrix.GetLength(1);
double[,] s = new double[n,m];
double[,] ii = new double[n,m];
s[0,0] = matrix[0,0];
ii[0,0] = s[0,0];
for (int x = 1; x < n; x++)
{
s[x,0] = matrix[x,0];
ii[x,0] = ii[x-1,0] + s[x,0];
}
for (int y = 1; y < m; y++) {
ii[0,y] = s[0,y] = s[0,y-1] + matrix[0, y];
for (int x = 1; x < n; x++) {
s[x,y] = s[x,y-1] + matrix[x,y];
ii[x,y] = ii[x-1,y] + s[x,y];
}
}
return ii;
}
static void PrintMatrix(double[,] matrix)
{
int n = matrix.GetLength(0);
int m = matrix.GetLength(1);
for (int y = 0; y < m; y++)
{
for (int x = 0; x < n; x++)
Console.Write(" {0,8:00.00} ", matrix[x,y]);
Console.WriteLine();
}
}
}by ediaz
I'm reading this very interesting book:
If you are in biometrics, and interested on face recognition, this is the right book. It contains papers from the leading edge investigators on the field. And a lot of information on algorithms for image processing in general. Like my previus post on fast sums over sub matrices.
by ediaz
The Airbus 380 The Airbus 380 is the world's largest airliner. Last year Joseph Mangan made public that he believed that there were problems with a computer chip on the aircraft.
"Mangan said he found serious flaws early last year in TTTech's computer chips and the software for the A380's cabin-pressurization system, according to legal documents. The system was executing "unpredictable" commands when it received certain data, possibly causing the pressure valves to open accidentally."
In October of 2004 Mangan was fired Mangan and his employee filed civil and criminal charges against him for revealing company documents. He published it on his blog, and the Austrian court fined him $185,000 for violating the injunction.
He faces bankruptcy and arrest in Austria.
Read the full story in Los Angeles Times.
This is the text, found online but not verified at www.eaawatch.net which appears to be Mangan's now famous blog (via IAG Blog)
------------
From: joseph mangan
To: botho.zichner@airbus.com
Cc: jmangan02@earthlink.netSubject: Criminal Activity of Obstruction EASA - Airbus discovery of TTTech A380 CPCS Certification Data Package non compliance to CRI F09
Date: Oct 6, 2004 11:44 PM
Attachments: 2004_09_29_telephone_meeting.docFrom: joseph mangan
Sent: Oct 6, 2004 1:23 PM
To: botho.zichner@airbus.dassa.de
Subject: Criminal Activity of Obstruction Airbus - EASA discovery of TTTech A380 CPCS Certification Data Package detailsMr. Botho Zichner.
I have reported this information to the EASA director's office, however, I am concerned that you and Mr. Claude Espinat of the DGA|CEAT may not yet be aware of this information.
You may remember that I brought up the fact that TTTech's and Nord Micro's documents
do not comply with CRI F09 in your audit at our facility.My firm was not happy with my having disclosed this, and has since conspired with
Nord Micro, to prevent your further efforts to discover the issues with the Certification Data Package for the Device - Microcode - and Nord Micro claimed use of the device as a 'SIMPLE' testable device under the CRI and DO-254, when in fact it is a complex device.The evidence of this conspiracy is contained in the enclosed attachment.
TTTech have, since becoming aware of my notification of EASA, terminated my employment.
I am concerned that the EASA are not moving fast enough to prevent the possibility
of destruction of evidence. As TTTech have poor archiving and file access controls
in place to prevent tampering with additional evidence.As you will see, I attempted on Friday to contact Mr. Claude Espinat of the DGA|CEAT referred to in the email. I left a voice message, but have not been contacted back.
Please get in contact with him to determine if he is aware of this activity.
Thanks for your efforts.
Joe Mangan
Vienna
Austria
Phone Number 069910446552
Country code is 43::EASA Director Notification Email
Is this true?
Or another conspiracy theory?
What do you think?
by ediaz
I didn't know about this, but the U.S. National Cancer Institute (NCI), has a grant to promote Centers of Cancer Nanotechnology Excellence.
In fact the Burnham Institute for Medical Research announced its contribution to the newly funded Center of Cancer Nanotechnology Excellence (CCNE) established at the University of California.
Dr. Erkki Ruoslahti, professo the Institute, will join a team of world class nanoengineers to integrate "homing" functionality into nanodevices, or so called "mother ships," capable of delivering diagnostic or therapeutic cargo to cancer blood vessels.
Wow, nanobots to fight cancer, this is a huge advance.
by ediaz
In July they where breached using a Drupal exploit.
This time the problem was with the twiki software
The security breach allows the attackers to retrieve the passwords, stored with MD5 HASH!!!
We will notify you again when the site is back up with
instructions on how to change your password. (Note: We do use MD5
hashing on the passwords, but MD5 cannot protect all passwords against
off-line dictionary style attacks.)
More details on slashdot.
by ediaz
The recent breach on SpreadFirefox, a lot of security breaches on PHP, and in many CMS open source products, like drupal, or mediawiki, make me worry, and wonder, how much people cares about security?
People even don't know what a encription algortihm is!!
Many people sell security, but do they know what they sell?
And many developers don't worry about security.
Security is a process, remember that.
by ediaz
We know about the Multiple Browsers Dialog Origin Vulnerability Test from Juny of 2005.
The exploit is illustrated below:
(source secunia.com)
(See secunia proof of concept)
This vulnerability affected many browsers, and allows spoofing, or phishing.
Firefox fixed it at July, in version 1.0.5.
But Microsoft, just suggest: "do not browse on untrusted sites!".
Quote:
Customers who already follow our general guidance about avoiding spoofing and phishing attacks are at reduced risk of being affected by this issue. If a particular window or dialog box does not have an address bar and does not have a lock icon that can be used to verify the site?s certificate, the user is not provided with enough information on which to base a valid trust decision about the window or dialog box. To view Microsoft?s general guidance about how to avoid spoofing attacks visit the Security at Home Web site.
from http://www.microsoft.com/technet/security/advisory/902333.mspx
This remember me an old joke:
Patient: Doctor when I rise my arms I feel a pain in the back.
Doctor: well, don't rise your arms.
I translated from spanish, I hope the translation is good.
by ediaz
This a social public health experiment using the blogsphere and wiki to help on the prevention of flu.
The purpose of Pandemic Flu Awareness Week, and the Flu Wiki, is to allow the dissemination of information down to the local level so that everyone can use each others? experience, planning and ideas so as not to be left unawares should an actual pandemic occur. Like hurricanes, when a pandemic occurs can not be accurately predicted. Nonetheless, that which can be done in advance should be done, because eventually something will happen. Planning can only help, even if at the local level it can?t prevent.
Source: http://www.fluwikie.com/
by ediaz
We know that exceptions cost is high (see this article).
One of the features I miss of the Stream Object on .Net is the EOF property (in Java we have the same problem). However there is an EOF property for XmlTextNodeReader, and XmlReader.
Why not in BinaryReader?!!?
Even, trying to addressing this issue I found the following error on Microsoft Documentation (in both .Net 1.1 and .Net 2.0):
(you can read the full entry here)
Design classes so that an exception is never thrown in normal use. For example, a FileStream class exposes another way of determining whether the end of the file has been reached. This avoids the exception that is thrown if you read past the end of the file. The following example shows how to read to the end of the file.
class FileRead {
void Open() {
FileStream stream = File.Open("myfile.txt", FileMode.Open);
byte b;
// ReadByte returns -1 at EOF.
while ((b == stream.ReadByte()) != true) {
// Do something.
}
}
}This code can't compile. And this is not the way to solve the problem.
The original problem
I wanted to read a binary file using BinaryReader, because I wanted to read primitive types.
For Example, I wanted to write something like this:
FileStream fs = File.OpenRead("table_file");
ArrayList table = new ArrayList();
using (BinaryReader rdr = new BinaryReader(fs))
{
while (!rdr.EOF)
{
table.Add(rdr.ReadDouble());
}
}Well, you can't write that code. The usual way is
FileStream fs = File.OpenRead("table_file");
try {
ArrayList table = new ArrayList();
using (BinaryReader rdr = new BinaryReader(fs))
{
table.Add(rdr.ReadDouble());
}
}
catch (EndOfStreamException ex)
{
// eof reached, ignore
}
finally
{
fs.Close();
}What happen to the rdr object? is Disposed?
I don't like this kind of code, why raise an exception for an EOF condition?!.
Perhaps using this:
using(FileStream fs = File.OpenRead("table_file"))
{
ArrayList table = new ArrayList();
using (BinaryReader rdr = new BinaryReader(fs))
{
if (fs.PeekChar() >= 0)
table.Add(rdr.ReadDouble());
}
fs.close();
}
catch (EndOfStreamException ex)
{
// eof reached, ignore
}
finally
{
fs.Close();
}The problem is that PeekChar requires the stream to support seeking.
Well, what we really need is a function that tell us how many bytes are left on the stream.
You can solve this using this code:
public bool ReadDouble(out double datum)
{
datum = 0;
if (length - fs.Position < sizeof(double))
return false;
datum = rdr.ReadDouble();
return true;
}But still is ugly, the solution is to have an EOF method. But, we have to cope with this design decision.
by ediaz
The Californa Governor Arnold "Terminator" Schwarzenegger signed an anti phishing Law.
Bruce Schneier point out that:
If there's one general precept of security policy that is universally true, it is that security works best when the entity that is in the best position to mitigate the risk is responsible for that risk. Making financial institutions responsible for losses due to phishing and identity theft is the only way to deal with the problem.
You can read his comments on wired, and a previous post about identity theft.
I agree with Schneier posture.
The problem is responsability of the financial institution, not the merchant, unfortunately the merchant account not always is favorable to the merchant, and the chains of responsability tends to go to the card holder. With stress, bad financial records, etc.
Identity has many meanings, I think that Bruce Schneier confunds the terms when he writes that Identity Theft is an oxymoron.
In this context, Identity is given by a "set of individual characteristics by which a thing or person is recognized or known".
So, given that definition identity theft is a crime. Schneir says that identity theft is a new tactic for fraud. And later he says that we must ensure the transactions.
I don't agree, because you interact with many institutions, and is economically more efficient to design a digital identity that every body can check, than ensure transactions in a case by case basis.
The main problem with identity on digital world is that it relays on codes, identity numbers, digital signatures, credit card numbers, etc. All of this are esentially numbers that can be guessed, robbed, tampered, etc.
We need to invent a new way to identify people on the digital world.
In real world we count on other mechanism, like see if the signature match, if the photograph is similar, some times we check fingerprints, etc.
I'm not saying that biometrics is the answer, but it must be an important part for the digital identity.
by ediaz
La Web 2005 is the 3rd Latina American Web Conference to be held on Buenos Aires Argentina.
LA-WEB 2005 seeks original papers describing research in all areas of the Web. Topics include but are not limited to:
* Applications (Area 1),
* Browsers and User Interfaces (Area 2),
* Electronic Commerce (Area 3),
* Hypermedia (Area 4),
* Mobility and Wireless Access (Area 5),
* Multimedia (Area 6),
* Performance and Reliability (Area 7),
* Search and Data Mining (Area 8),
* Security and Privacy (Area 9),
* Semantic Web (Area 10), and
* Web Engineering (Area 11).
LA-WEB 2005 proceedings will be published by IEEE CS Press
Buenos Aires is a beautiful city, so is the oportunity to visit it, and learn to dance Tango :)
by ediaz
On these days the Web 2.0 Conference is being held on San Francisco.
Web2Con is an important web conference because of the quality of the speakers, the influence it will generate, and the trends that will follow the web in the future after this event.
An the beautiful Kim Polese is there too.!! :)
by ediaz
This thread on slashdot, tells about a paper of Penn State University:
"Some Penn State professors and students have published a way to jam cellular voice service with simple text messages. From the article: 'Because text messages are transmitted on the same signal that is used to set up voice calls, just 165 messages a second is enough to disrupt all cellphones in Manhattan.' Cellular providers, of course, fired back, one stating that it 'constantly and aggressively monitors potential threats to the integrity and security of its network.'"
Read the paper here, and they have a site devoted to the subject in http://www.smsanalysis.org/.
Beautiful paper, but in the practice this doesn't happen.
TV SHows in latin america and spain, that I personally know, receives near 150.000 sms per hour (~40 sms/sec).
With a modem gprs/gsm we can send 30 sms/second. In fact, i my former job we sent periodically over 50 sms/sec without DOS effect over GSM networks.
Are you telling that with 4 modems we can disrupt the all the cell phones in Manhattan?
No, is not possible. Even without modems, using SMPP directly, the protocol is so slow that we can't reach a throghput big enough to make this possible.
In practice, Cell Phones Companies doesn't allow more than 40-50 sms/sec.
Personally, I wrote a ESME application server server with a throughput of 600 sms/sec, using SMPP, but no company ever acepted more than 50 sms/sec, because of contention.
There is a lot of contention in SMSC and all ESMEs must be aware of this, and manage their own queues because of this.
In the paper the investigator forgot some important bussines step before the SMSC query the HLR. The SMSC must consult de Subscribers Database and check billing systems, for example. This is the main reason of contention of sms messages. I don't know how cell phones billing is in USA, but in many countries there is a limit based on the plan subscripted.
This table shows the SMS messages per month in mayor countries of Europe
| Germany | 200 million |
| Italy | 150 million |
| Finland | 75 million |
| UK | 70 million |
| Norway | 70 million |
| Sweden | 70 million |
| Portugal | 60 million |
| France | 60 million |
| Spain | 60 million |
| Denmark | 50 million |
| Belgium | 25 million |
| Greece | 15 million |
| TOTAL | 1 Billion |
1 Billion Month!!
In Germany the mean is 30 sms/sec.
So, do you still think this DOS is possible?
by ediaz
Via Eureka Alerts:
How much data can we cram onto a hard disk?
Professor Harald Brune and his colleagues of the Laboratory of Nanostructures
at Surfaces Switzerland, believe they have found the ultimate density limit of magnetic recording: 26 Terabits per square inch,
as published in a paper appearing online in
Physical Review Letters, the LNS group created a self-assembled lattice of non-interacting two-atoms-high islands of cobalt on a single-crystal
gold substrate. The islands' density -- 26 trillion islands per square inch -- is
the highest yet recorded and 200 times the bit density of current computer hard disks.
The magnetic properties of the islands are the most uniform ever recorded, and because the islands don't
interact with each other, they can each hold one bit of data.
The bad news? these records were posted at the very cold temperature of 50 Kelvin degrees (-369 Farenheit, -223 Celsius)!
Above this temperature, thermal excitation starts to reverse the magnetization and the memory gets volatile.
Well, a little problem, but don't worry, they are trying to solve the problem using bi-metallic islands of 500-800 atoms that can maintain the desired magnetic properties at room temperature.
by ediaz
Concerning the the DOS attack to GSM Networks, I just read a very good post on Brough Turner's Blog about this issue.
I quote from the post:
"Their full paper also cites six news articles which they assert represent occasions when SMS traffic impacted voice traffic. The articles they cite are about cellular traffic overloads -- either SMS or voice -- and efforts to prevent traffic overloads, however none of the stories actually shows a case where SMS traffic impacted voice traffic.
If they weren't prepared to actually try their proposed attack, they might at least of discussed their ideas with signaling experts within a real mobile operator."
Is easy to write a good paper from the academy, all in the paper is true, but their conclusions are alarmists, so before publishing check with the real people working on the real industry first, don't you think?
The bad thing is the publicity this paper received because was slashdotted, and was mentioned on Schneier's Blog. I repeat, their conclusions are alarmist, and harm the adoption of SMS in USA. The attack is theorically possible? perhaps yes, perhaps no, I think they pushed the alarm button to early.
Let me finish with a comment on Schneier' blog:
"Anyone who lives in a country with heavy SMS usage wouldn't be as gullible as the US media has been in believing the claims of this paper. While it is understandable that the media wants to amplify sensationalist claims, someone like Bruce whose words carry immense weight should check carefully before publicising work like this.
Security researchers in the US seem to need sensationalist papers. The latest fad seems to be to reserve a new domain name every time there is new sensationalist paper to publicise, and then call NYT. Perhaps this is needed for getting NSF and homeland security funding. But the tendency does not serve science well. We have seen similar sensationlist papers about Bluetooth security, RFID security etc. The fact that these papers are peer reviewed does not imply that they are sound. Most security researchers who populate program committees do not know the application areas (e.g., GSM, Bluetooth) very well and cannot judge the real impact of the claims.
Next time someone has a sensationalist paper about security in some vertical domain (and reserve a domain name to advertise the paper!), I hope Bruce and other respected experts will double check before giving the papers a forum."
Posted by: Disappointed at October 8, 2005 08:37 AM
If you are affraid of terrorist uses of SMS, then examine the M11 attack on Madrid Spain, sadly in this case the gsm network worked far too well.
by ediaz
The usability guru says that office 12 come with a new paradigm on GUI. On his alertbox newsletter, Jacob Nielsen writes about the limitations of the Mac Style GUI, and how the new version of Microsoft Office introduces the Results Oriented UI, a better paradigm on usability.
From the article:
"Much as I have criticized Microsoft for its thousands of buried features, the company actually has a good usability team and was well aware of the problems. Basically, it tried to retrofit usability onto an overly complicated foundation and failed. Microsoft has now finally realized that enough is enough: The company is parting ways with the old UI and going for something completely new."
The main limitations that Nielsen see in WYSIWYG are:
- Lot of commands, and people can't find them
- No guidance relative to the goal to be achieved by the user
In the new paradigm, we have a reverse in the paradigm of interaction, now it?s What You Get Is What You See, or WYGIWYS.
"The focus is now on letting users specify the results they want, rather than focusing on the primitive operations required to reach their goals. "
Worth reading.
by ediaz
The Thinking Fluidly blog has some interesting post about the Office 12 UI and a comentary on Nielsen's article:
by ediaz
There is a serious flaw on windows registry reported some time ago in secunia: http://secunia.com/advisories/16560/.
According to this blog the vulnerability allows to hide a key with length > 254 into the registry.
I decided to test, first in C#, but the Registry Class on .Net has some verification code that throws exceptions when the keys are of length > 254.
The code I tried is this:
StringBuilder sb = new StringBuilder();
for (int i = 1; i < 255; i++)
{
sb.Append ('A');
}
string key = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BAD\" + sb.ToString ();
RegistryKey rk = Registry.LocalMachine.CreateSubKey (key);
rk.Close ();;This code generates an exception: "Registry subkeys should not be greater than or equal to 255 characters."
So I decided to try other way, for simplicity I wrote a simple Delphi program to test the flaw, a C program could be written too.
The source code is in the continuation of this article.
The result is that I was able to write a hidden registry key, as shown on the screenshot:
Below Optional there is a key, whose name is a string of 256 'X's, but is hidden to regedit.
If you look closely I have put this hiddenn key below the Run key, so if I were a malware developer, I could put bad software to be executed when windows start up.
Why worked on Delphi, and not in C#? For the same reason why this would work on a C program, because if we have access to the Win32 API, we can override the security checks of the .Net library and write this hidden registry keys.
I tested with regedt32 and regedit on Windows 2003.
Very dangerous, and Microsoft still doesn't fix it.
by ediaz
I am a big fan of Gosling, perhaps one of the best programmers of the world. However, I didn't know he is actually writing a blog!
On The Java Road is the blog of James Gosling. I don't like the design because of the background image make reading dificult, is not an accesible blog, I hope he reconsider a more clean design for his blog.
His last post is in about to a slashdot thread about java performance legends.
He writes an interesting history that I transcript here:
There was a funny incident at a recent developer event where some folks had a booth where they where demo-ing a high end industrial strength C compiler and had a benchmark that they had transliterated into Java. They were comparing their compiler to GCC and Java. GCC was running at about 2/3 the performance of this high end compiler; the Java version was running at about 2/3 the performance of the GCC version. Folks were gathered around the booth and someone noticed that the script they were using to run the Java version didn't have optimisation turned on. A few seconds with vi to add the "-server" switch and Java's performance jumped up to match the fancy C compiler. This got the pro-GCC crowd all excited, so a bunch of them started fiddling with its command line switches. They got a bit of improvement, but not much (the original selection had been pretty good).
source: http://blogs.sun.com/roller/page/jag?entry=java_urban_performance_legends.
Nice history, actually I think it's depends on the application.
by henry eh...
Agree on the comment regarding "depends on the application". Reminds me of a similar story on performance given at a training session. I think it was something AIX and Oracle. The first run of the application took about 20 minutes. THey wanted to run it again and since they just ran it they figured it would take 20 minutes - so they decided to get a coffee. Just as they were about to leave the room, the application finished - about a minute to run this time.
The explanation was that data was in memory from the first run so it ran much faster. Ever since I heard that story, I've been sceptical about performance claims. But I like to hear them just the same.
Thanks
Henry
by ediaz
Well, the RegistryKey class on Microsoft.Net hides a bug of the RegCreateKeyEx, if you examine the implementation of CreateSubKey (using Reflector, for example), you will notice that there is an if statement like this:
if (subkey.Lenght > 255)
throw new ArgumentException(...)Good, for .Net programmer the bug is hidden, but if you use interoperability then is posible to reproduce the bug I mentioned previously.
Update:
I have just read the post of Alexey A. Popov on CodeProject, he wrote the same sample on CSharp, you can find it on codeproject,
I decided to copy the code in the continuation of this article, because the C# code is more accesible for many of my readers.
The point missed by Alexey, is that as I have shown, the bug is hidden in the .Net Library, many tools don't display the registry, and can be exploited for evil purposes.
Steve T. found some interesting results, he posted in the discussion thread on codeproject.
I Quote Steve T:
[..] The point is that one malicious program with
"inside knowledge" can create a 256 byte registry key name and another
program, designed to seek out malicious registry entries may not be
able to read its name because it is only looking for keynames up to
the 255 character limit as documented by Microsoft.
[...]
This is not a bug in third party applications; it is a mismatch
between documentation and API - either way it is an error on
the part of Microsoft that could open the door to security problems.
[...] As a side note I decided to test these conditions myself and found
that RegEdit is even more bug-ridden than the 255/256 byte conflict
would suggest. If you try to create a new key in RegEdit by hand
it will not allow names of more than 240 characters (where does that
number come from?). If I try to create a subkey in a test application
with a long name it will allow anything up to 256 characters before
failing ... BUT if it is anywhere between 247 and 256 inclusive then
not only is the long keyname invisible but ALL ITS SIBLING SUBKEYS
which are alphabetically greater than the long subkey also become
invisible in RegEdit! WTF! ... Using XP Pro SP 2
So the bug is more serious that I have suspected.
by ediaz
There is an article at EPIC with wrongs assertions concerning the technology used on Disney.
Disney appears to be using Hand Geometry readers, no fingerprint readers.
Hand Geometry can't be used to identify you in a court case, for example, because is a technology to be used on small universe of users, and only in a 1 to 1 identification matching, thats the reason for the use of a codebar in the identity card. Is just a mean to check that the owner of the card is who claims to be.
The handkey code consists of a vector o 9 bytes, with hand geometry features. The False Matching Rate is worst than fingerprint readers.
In fact, we have the twins effect, with identical (for the device) hands, even there is people with "simmetric" hands, so they can put the right hand, or the left hand on reversed position and will pass.
The Handkey reader has the property of adjust the identification vector along time, because of changes on morphology of the hand, like becoming more fat, or wearing rings, even nails growth. But, for this to work, you have to update the handkey vector with every read. This means that is you are storing this data in the card you must rewrite it after every hand scan.
I believe that is not the case on Disney's parks.
Think on childrens growing, you need to update the cards because in the next season will become obsoletes.
Handkey in this scenarios are like a token, or a id card. Don't see the problem on privacy here.
Consider other countries, where all people has his fingerprints stored on a central database, and we leave with no problem with this.
Privacy is just a cultural convention.
I use it every day to mark my time attendance on my job.
by ediaz
I suspect this is a undocumented feature of the API, I tried a modified version of a demo found in MSDN:
#include "stdafx.h"
// QueryKey - Enumerates the subkeys of key and its associated values.
// hKey - Key whose subkeys and values are to be enumerated.
#include
#include
#include
#define MAX_KEY_LENGTH 256
#define MAX_VALUE_NAME 16383
void QueryKey(HKEY hKey)
{
TCHAR achKey[MAX_KEY_LENGTH]; // buffer for subkey name
DWORD cbName; // size of name string
TCHAR achClass[MAX_PATH] = TEXT(""); // buffer for class name
DWORD cchClassName = MAX_PATH; // size of class string
DWORD cSubKeys=0; // number of subkeys
DWORD cbMaxSubKey; // longest subkey size
DWORD cchMaxClass; // longest class string
DWORD cValues; // number of values for key
DWORD cchMaxValue; // longest value name
DWORD cbMaxValueData; // longest value data
DWORD cbSecurityDescriptor; // size of security descriptor
FILETIME ftLastWriteTime; // last write time
DWORD i, retCode;
TCHAR achValue[MAX_VALUE_NAME];
DWORD cchValue = MAX_VALUE_NAME;
// Get the class name and the value count.
retCode = RegQueryInfoKey(
hKey, // key handle
achClass, // buffer for class name
&cchClassName, // size of class string
NULL, // reserved
&cSubKeys, // number of subkeys
&cbMaxSubKey, // longest subkey size
&cchMaxClass, // longest class string
&cValues, // number of values for this key
&cchMaxValue, // longest value name
&cbMaxValueData, // longest value data
&cbSecurityDescriptor, // security descriptor
&ftLastWriteTime); // last write time
// Enumerate the subkeys, until RegEnumKeyEx fails.
if (cSubKeys)
{
printf( "\nNumber of subkeys: %d\n", cSubKeys);
for (i=0; iIf you remember, I put a hidden key into HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Optional\\.
The only way to see the hidden key it was ignoring the result code.
by ediaz
The MIDL_user_allocate function in the Microsoft Distributed Transaction Coordinator (MSDTC) proxy (MSDTCPRX.DLL) allocates a 4K page of memory regardless of the required size, which allows attackers to overwrite arbitrary memory locations using an incorrect size value that is provided to the NdrAllocate function, which writes management data to memory outside of the allocated buffer.
Source: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2119
Beautiful, for remote exploting.
Read the MS Security Bulletin MS05-051 and patch your windows boxes ASAP.
by ediaz
What SOA means to you?
I like Fowler's Bliki, and he updated his article on SOA: Service Oriented Ambiguity
by ediaz
The recent post of Schneier about ID Cards give me the oportunity to write an odd history I was involved.
Five years ago I was in charge of development of a financial database, in my country Chile.
In Chile, all citizens have an ID Card, with a ID Number, called RUN.
Every baby when born in Chile receives a RUN ID.
The case is that one day the lawyer of the institution I was working gives us an order to delete all the records of certain RUN. I was informed that this RUN must be deleted because it belongs to a baby dead 35 years ago!!
So, someone obtained a valid RUN from a dead baby and used to build a new Identity!
The dead registration wasn't recorded, or perhaps deleted, and the fathers requires to the justice that all financial records of the baby, were deleted.
Then this RUN kept in an extrange situation.
The RUN is clean now, no records, approve the transaction.
The ID Card is useless if you can't check if the Identity is real.
Today, all finantial information system in Chile incorporates a flag to tell you if the person is dead, or alive. In fact exists a certificate emitted by government to demonstrate that you are alive.
So, if you wan't ID Card, you need a lot of bureaucracy, we in Chile accept the situation, for historical and cultural reasons, and we are few people. But, anyway, Identity is no more protected that other countries.
by ediaz
The recent post of Schneier about ID Cards give me the oportunity to write about an identity theft case I was involved.
Five years ago I was in charge of development of a financial database, in my country Chile.
In Chile, all citizens have an ID Card, with a ID Number, called RUN.
Every children born in Chile receives a RUN ID.
The case is that one day the lawyer of the institution I was working gives us an order to delete all the records of certain RUN. I was informed that this belongs to a baby dead 35 years before!!
So, someone obtained the valid RUN from a dead baby and used to build a new Identity, and make frauds.
The dead records were lost, or perhaps deleted, and the fathers requires to the justice that all financial records of the fradster using their baby identity, were deleted.
Then this RUN kept in an extrange situation.
The RUN is clean now, no records in financial databases. So, the bad guy can make frauds again!
My reflection is this, the ID Card is useless if you can't check if the Identity is real. Today, all finantial information system in Chile incorporates a flag to tell you if the person is dead, or alive. In fact exists a certificate emitted by government to demonstrate that you are alive!
So, if you wan't ID Card, you need a lot of bureaucracy, we in Chile accept the situation, for historical and cultural reasons. But, anyway, Identity is no more or less protected that other countries.
If you want to learn the good and bad sides of ID Cards, check the experiences in countries like Chile.
by ediaz
Jakob Nielsen writes about weblog usability.
You can read the last post on Weblog Usability: The Top Ten Design Mistakes.
I make my comments below:
1. No Author Biographies
I Agree, you must trust the writer, so why are you reading this blog? I have no biography (yet). Well, I have to put one.
2. No Author Photo
Agree with this one too. Well, a photo of me can be reached in my personal blog, I am the guy with the red necktie :)
3. Nondescript Posting Titles
Good tip, we all made this mistake some time.
4. Links Don't Say Where They Go
This is a good practice. All this links like, you can read more about here, or here really don't make you clik them. We are lazy in this subject, again, a good tip.
5. Classic Hits are Buried
Oh, I hope many of you still remember my posts on MD5, I always tried to mantain the context on the posts, makes live easy for me too.
7. Irregular Publishing Frequency
Well, many of the bloggers are not professional writers. I write this blog for fun, and to share knowledge, and for vanity too.
Keepen regularity is difficult, and according to technorati, the 45% of bloggers abandon after 3 months.
8. Mixing Topics
I try to keep focused on security, criptography and coding fun. My problem is that the coding fun part is too broad. I will ignore this hint :)
9. Forgetting That You Write for Your Future Boss
I never thought about this. Mmmmm....
10. Having a Domain Name Owned by a Weblog Service
Yes, this is the best tip, real bloggers own a proper domain name.
by ediaz
A case of phishing using cell phones.
In Beijing, China a Mr. Wang never thought a text message on his mobile phone would cost him more than 150,000 yuan (US$18,500).
He received a message that claimed he had bought items with his credit card that totalled more than 18,000 yuan (US$2,200). He call to the number in the message, and the fraudster, on the other side of the line ask him to gives his credit card number and security pin to check what was happening.
In China there are near 400 millions of cell phone users.
by ediaz
This simple code:
<html><body><strong>Mozilla<sourcetext></body></html>is the new bug of Firefox.
You can test it at: http://www.milw0rm.com/exploit.php?id=1253 (Danger, firefox will not respond and CPU usage raise to 100%).
Original post on WhiteDust Security.
Again, why developers are not concerns on security + quality.
by ediaz
Just after writing about the tag bug on Firefox, I received this note about a flaw on IE+Media Player from News.Com.
by ediaz
A very good article on the singleton pattern on C# is: Implementing the Singleton Pattern in C#.
If you don't want to read the article, the singleton pattern is implemented this way:
public sealed class Singleton
{
Singleton()
{
}
public static Singleton Instance
{
get
{
return Nested.instance;
}
}
class Nested
{
// Explicit static constructor to tell C# compiler
// not to mark type as beforefieldinit
static Nested()
{
}
internal static readonly Singleton instance = new Singleton();
}
}by ediaz
Wilma is the last name assigned to a hurricanes for this year.
If a new hurricane is advertised it will named Alpha, because names of hurricanes are predefined by the World Meteorogical Organization. Next year, the first hurricane will be named Alberto, according to the Tropical Cyclone Programme Manual [PDF], you can read the names below.
In this season there were 21 hurricanes, what would be the causes of this increment, Global Warming or strange weapons from submarine civilizations?
by ediaz
Rice University scientists have constructed the world's smallest car -- a single molecule "nanocar" that contains a chassis, axles and four buckyball wheels.
The nanocar consists of a chassis and axles made of well-defined organic groups with pivoting suspension and freely rotating axles. The wheels are buckyballs, spheres of pure carbon containing 60 atoms apiece. The entire car measures just 3-4 nanometers across, making it slightly wider than a strand of DNA. A human hair, by comparison, is about 80,000 nanometers in diameter.
A full paper wil be published on October Edition of Nano Letters
Via Eureka Alerts Journal.
by ediaz
A company intends to "monetize" on his claimed "intellectual property":
From News.Com:
"Charlotte, N.C.-based Scientigo owns two patents (No. 5,842,213 and No. 6,393,426) covering the transfer of "data in neutral forms." These patents, one of which was applied for in 1997, are infringed upon by the data-formatting standard XML, Scientigo executives assert."
(read more)
That's why I don't like patents!
Anyway, XML is succesor of SGML an old technology, probably this patent claim will not prosper, the patents are from 1997 and the first draft are from 1996.
The problem is that in many cases the patents describes generics processes. For example, there are patents that describes every type of middleware!
Are lawyers converting programmers to the dark side ?
:)
by ediaz
Microsoft.Net 2.0 Released. Today Microsoft released the official 2.0 version of Microsoft.Net. Is available for MSDN subscriber, and the framework (runtime) and sdk are available on Microsoft Site. Originally this was announced to be ready on November 9. Visual Studio...
by ediaz
NSA has developed and distributed configuration guidance for operating systems. These guides are currently being used throughout the government and by numerous entities as a security baseline. Very detailed instructions how to do it on your system on this link....
by ediaz
A complete list of open source software packages is being built on the Wikipedia. Nice and useful, located at http://en.wikipedia.org/wiki/List_of_open-source_software_packages...
by ediaz
The 65,536-processor machine can sustain 280.6 trillion calculations per second, called 280.6 teraflops, IBM said Thursday. That's the top end of the range IBM forecast and more than twice the previous Blue Gene/L record of 136.8 teraflops, set when only...
by ediaz
RedGuy tell us: "What happens if you navigate for 2 days with Firefox without closing it ? Take a look at the screenshot. I'm pretty dissapointed, 1 tab open and Firefox isn't freeing the RAM.view image | digg story I have serious...
by ediaz
Codus is a great OpenSource Object/Relational Mapping Code Generator for the Microsoft.Net Framework. Built by Sean McCormack What's New? v1.2.0.0 Added support for MySql (provided by Ben Reichelt) Added NHibernate templates Added support for local and distributed transactions Added table...
by ediaz
A New York Times article on Google Ads claims that because his advanced technology, users click ads 50 percent to 100 percent more often on Google than they do on Yahoo.read more | digg story...
by ediaz
Now, when a $100 laptop is being developed, is good to remember the old ZX81. Yes, there was a computer sold for under 100 u.s. dollars. I had one! digg story...
by ediaz
A lot of "accepted wisdom" is just flat-out wrong. If you've been told that patches always fix a security hole, or that SSL is all you need to be safe, read on.read more | digg story...
Trending After Hours posts
Sort by Trending
0 helpful
10 replies
0 helpful
2 replies
0 helpful
3 replies
Discussion
Hello everyone
0 helpful
3 replies
Discussion Locked
Designing Websites for Clear Mobile Viewing
0 helpful
1 reply