The Accidental Weblog

So there was a report out earlier this week about a rather cool proof of concept attack on the SSL PKI stuff setting up the chain of trust the browser you’re probably using to read this uses…

Cool/scary things about the attack: i) it used that MD5 collision stuff that turned up a few years ago (more on this in a bit), ii) they used a PS3 cluster (200 machines or so) to find useful collisions (PS3s are easily the cheapest and easiest way to get your hands on a Cell processor, which is apparently pretty good at doing this kind of thing), iii) it was pretty cheap: apart from the computing costs (probably in one to a very few thousands of bucks to do on commercially available cluster services like Google uses), the proof of concept cost the team just some $657 in certificate requests from the root CA they wanted to impersonate, and, umm… iv) yeah, and this is the real trouble, here: they were able to use the collision to generate an apparently valid cert from the root CA which allowed them to set up their own ‘rogue’ CA as an intermediate CA…

v) which, in English and in terms of potential ramfications, means, yes, this matters to you, whether you’re running an ecommerce site or using them. Because anyone else could now, quite practically, do just the same, set up an apparently valid intermediate CA, and sign certs for phishing and scamming sites to their heart’s content. And users suckered onto those would have no practical way of telling them from the real thing: the cert would look good, browser wouldn’t bitch, it’d all look legit and secure.

The full circle part: the MD5 collision and what it would eventually mean was one of the very first posts I ever wrote, way back in 2004, when I first took it into my head to start blogging…

Guess eventually is now.

Anyway speaking of now, they’re fixing it now (this is the good news part), and they pretty much have to: the few CAs left using MD5 for their hashes are moving quick to SHA-1. And this does effectively close the window of opportunity for the black hats: the technique demonstrated needs the root CA up and running and signing certs using MD5 for the fingerprint to work; as long as the root CAs stop doing that pronto, the attack stays theoretical…

Wait a few days, and maybe not. That PS3 cluster cranked through the work quick enough that the team got their collision in about four weekends of work (they used weekends because the root CAs are usually less busy then—makes it easier).

In related news, I now find myself looking upon my PS3 with a little more respect, still. Sure, there’s only so many games on the thing I’m ever going to want to play. But hey, it’s still a good, cheap, Blu-Ray player…

And if I ever need a supercomputing cluster, apparently I’m already 1/200th of the way there.

So there’s this retread of a story getting some play again: this notion that it’s actually a fairly small group of rather obsessed people who do most of the writing/editing of Wikipedia… the capsule view you may get is that really, Wikipedia isn’t so much an emergent hive mind phenomenon so much as a pretty standard volunteer project, staffed, as usual, by a cadre of diehards who do most of the work.

Except that, really, that capsule view misses an important detail: yes, it’s a relatively small group of people who do most of the edits on the site, but most of those edits are about formatting and classification—the library science stuff. (The source covering this is here.)

Now, don’t get me wrong, that library science stuff does matter. Good classification and consistent formatting are valuable, no question, and without ‘em, any such source would get a lot more annoying to use. But the interesting thing here is: yes, in terms of the information actually present and contributed, the site is very much as previously advertised: 21st century hivemind weirdness. The content mostly comes from a vastly larger group of ‘outsiders’ who don’t seem so much to be regulars on the site.

So we need a slight update to the 80/20 rule, I guess. Twenty percent of the world does eighty percent of the copy editing…

(But can one of the regulars make that edit for me? I’m more a content person, myself.)

So User Friendly’s been doing this sequence on those @##$ ‘mandatory’ copyright notices at the beginning of certain disk-based media…

It amused me.

Yeah, yeah, I know. World’s a mess. Industrial economies from the dateline counter-clockwise all ‘round the world back to that same dateline going belly-up like so many guppies in an overheated fishtank, wars and climate chaos, folk getting free passes to Syria for knowing slightly too many people named Ahab, and still, I’m gonna take a moment and bitch about watching a copyright notice I could, I suppose, theoretically, ignore while I went to the bathroom or somethin’.

(Or, I guess, alternative to the bathroom break, I could just take a valium. Those come in handy when economies are tanking, after all. But I digress…)

But, of course, I’ve bitched about this before. Best moment was plunking down all that green for HD gear only to discover it’s infested with that BS, too… Great… Here’s a few grand… On which you will insist I first watch copyright messages…

And it did also briefly strike me there is some grist for thought, here. So here’s Sid, the guy who actually pays for his DVDs (power, brother—I still do that, too—and yes, I know, this probably makes me weird) getting hassled, and I got to thinking: that’s just the way, isn’t it? It’s those of us with vestiges of a conscience left who always get it first. And all those ugly little laws trying to make piling up slightly too many prerecorded programs on your PVR illegal, duping a DVD or CD that got scratched indictable, sticking the DVD on your iPod or your PSP without the appropriate corporate-approved software handling it a good enough reason to seize your hard drive and waterboard it—all that shit is just a matter of certain money grubbers in an industry in a tight spot reaching for the low-hanging fruit. An organized syndicate doing mass dupes and sellin’ ‘em, those guys are smart, know how and where to operate—which makes tracking ‘em down and making ‘em pay for their ill-gotten gains inconvenient. Dicking around with enforcement and rules and making more difficult the lives of ordinary and mostly honest folks who’d just like to watch their damned perfectly validly paid-for disk when and where they want, on the other hand, that’s so much easier…

But they’d better watch ‘emselves tho’, I say. I mean, I’m getting it. They’re on message, all right. Let’s mess with the guys with a conscience, huh?

Hey, listen, MPAA, you’re the guys who make all those movies with the standard ‘nice guy pushed too far’ cliche in full bloom. So you should know how this works:

So let’s be clear, here: as per yer cliche, I think the understanding here is my conscience might just be somewhat detachable, given appropriate extremes of annoyance…

And I know how to run BitTorrent, more than well enough, dearies. Know how DRM works pretty well, too, now that you mention it. Even know some of the really, really stupid implementation tricks you wankers have written into far, far too many of your schemes… So I could very, very easily go all piratey on yer asses if you get me pissed off enough…

You don’t want that, trust me. Think of it as Michael Douglas in that POed white male movie of his (or is that all his movies… my memory fails… they do sorta blur, after a while… jes’ sayin’)…

Or nice girl Willow goin’ all veiny and homicidal after that hot blonde goddess fried her lover—whichever…

‘Cept with a DVD burner, instead of guns and bloodlust.

Anyway. My point is: don’t mess with the nice guys. There’s gotta be some nice, real criminals actually offending against existing, sensible laws you can mess with, somewhere, fer cryin’ out loud. Leave Sid alone, if you know what’s good for you.

…if you can’t make fun of the pope, you’re just not trying.

It’s good for whatever may ail you.

The Mars Reconnaissance Orbiter spotted ‘em, apparently at a mid-latitude region called the Nili Fossae. In a bit of misfortune, that spot had been on the list of possible landing spots for the next NASA rover, but was passed over.

Carbonates are interesting because they suggest not just the presence of water, but water not especially acidic. It had been previously suggested carbonates weren’t turning up on Mars because the pH had maybe been too low when water had been around (the fact that lots had been around once isn’t especially in dispute, now).

(And yes, I’m still around—just a bit busy. Work and the run-up to midwinter festivities, especially the traditional hoarding of commercial merchandise suitable for giving to sons, daughters, nieces, and nephews, has been keeping me pretty swamped.)

There’s not a lot of info yet, but CP reported yestereve someone found a 13 Kg piece of the rock that just made that cool lightshow out west.

13 kilos, damn. That’s more than suitable for a doorstop. A real pricey doorstop.

I’m generally fascinated by the psychology of deception. It’s an old truism in the area, too, that frequently, you lie to yourself best and first. The guy who starts out by convincing people he’s heard a message from his god for purely pragmatic (political, military, or financial) reasons can and rather frequently does start believing it himself.

This may or may not actually be useful to the con. Believing it true probably makes you a more convincing liar (or are you still a liar… here the terminology does get complicated, but ya know). But there can be hazards to this. It’s all well and good convincing people you can deflect bullets with your bare hands if you’re just in it for the sponsorship deals, and never forget the vital sleight of hand in which your assistant’s live rounds get switched for blanks… No worries, there. Right up until you lose track of reality, and try to catch a real bullet…

In some fields, in which the truth is more a matter of interpretation, it’s even more complicated, I guess. Politics and economics are full of those. And if you’re trying to move popular opinion toward your position, as you argue for the position, your own committment to the position is likely to harden or even become more extreme. Start out by saying as an academic that a tight money supply is probably a good thing, then wind up running a political party that holds to that ideology, and it’s entirely possible you’ll start sounding less and less like an academic with a coupla theories he kinda likes and more and more like a fanatical zealot who will tighten the money supply over the dead bodies of your central banker and all of his staff, if they won’t go along with it…

And then there’s convincing yourself you’ve got a ‘mandate’ and the Canadian people are all on board with your program when your share of the popular vote rose by a whole 1.4 percent to all of 37.65, and well, the trouble you can get into is clear enough, I guess…

It’s funny. I’ve been listening to the Harper shills taking this to the airwaves for the last coupla days, as they desperately try to paint the opposition’s coalition plans as a horrifically antidemocratic coup or something, and I’ve heard an awful lot about that ‘mandate’ of theirs. And it struck me: they really believe it now, don’t they? No one’s been in their meetings politely reminding them they’re a minority government and will have to act like it; they’ve been trying to move public opinion toward this notion they can act like a majority if they damned well feel like it—trying, I suspect, to get into everyone’s heads, including the opposition’s, with that message—and apparently, prior to bringing in that economic statement, they’d started to believe it a little too well.

Better than just about everyone else, apparently. Which is always bad for a con.

I get that it’s probably ugly for them. I mean, they haven’t held the strings of power in a real way since Mulroney flamed out (or Campbell, technically, if you still wish to blame her)—or ever, if you see the Harperites more as a pretty thin rebranding of Reform than as a real coalition with the old Tories—as some of us do. Then they saw the Liberals go arrogantly corrupt in the sponsorship scandal, they figured it was their turn to reap the rewards of not being the ones caught in the act. But they’re still neocons in a country that really isn’t much behind that philosophy, apparently, and it hasn’t been going their way nearly so far as they’d like. Sure, they’d successfully painted Dion as a loser in the last election—and then watched as most of the support his party lost went to parties other than their own. Ripe stituation for convincing yourself things are better than they are, you’re doing better than you are…

So they told themselves they deserved to be a majority, dammit, and started acting like it, anyway… And, well, that went about as well for them as it usually does for minority governments.

What can ya say. I’m sitting here bemused, honestly. It’s a bit of a dog’s breakfast of a choice, if you ask me: I’m okay with the notion of a Liberal-NDP coalition, but really, the Bloc, that’s another matter. Which is worse: neocon zealots or nationalist zealots? How heavily will the Bloc’s stamp lie on things in the coalition versus their influence now? Looks kinda like we’re about to see, I guess.

But anyway, like I said: here’s another point of data for your consideration: you’re always the easiest person to fool. But that’s not always in your interest.

… governments, that is. The news today is a certain band of minority neoliberal thugs, in a move that should surprise no-one who knows said mob’s capacity for this kind of ideologically-motivated BS, are playing the standard crap such parties always do: trying to use a crisis to hack big pieces out of their political enemies, instead of actually, y’know, trying to do anything substantitive about the oncoming economic mess.

More precisely: they’re trying to take away the federal public service’s right to strike (right… people are gonna strike now, chuckleheads), and, icing on the cake, kill some $27 million that normally goes to registered political parties on a per-vote basis…

As you may be able to work out, or may already know, that’s about $1.90 a vote, and I’d rather expect most folk between these shining seas aren’t too upset to think some $1.90 of their money might go to the party they themselves voted for… It’s not uncommon in democracies, and a nice side effect is that smaller parties not really up to large-scale fundraising get a better shot than they might otherwise, if they can just convince people to vote for them… But this hasn’t stopped the usual neanderthal shock jock types from calling it ‘political welfare’…

I’d call it more larceny to take it away, really. Seeing as most politically educated voters know perfectly well their vote gives that small chunk of their money to their party of choice—and these are voters and parties that already got screwed out of appropriate representation by vote splitting giving the advantage to the thugs currently (nominally, and for now) in power.

More fun ‘n games. The $27 million it is, of course, somewhere a little over 1/100th of one percent of the $200 billion federal budget, and they’re trying to call this sensible and necessary austerity. There’s a fiscal crisis, y’know… So hey, when you’ve got an uneducated, rabid base who can be turned on a dime to carp about anything you can plausibly call ‘welfare’, why would you put real work into addressing that incoming crisis when you can just dick around with that chump change—the very chump change that will hamstring your now very divided and disorganized opposition, who are, yes, currently very much relying on that subsidy to pay back their costs from the last election they just went through (oh… yeah… also one they wound up fighting at Harper’s initiative). Essentially, the Harper ideologues are saying: yes, you had to fight this on our timetable, and people voted for you—more for you than for us, actually—but we’re gonna try to burn you and them for that subsidy, anyway, see if we can’t bankrupt our opposition…

Anyway: the fun part. That previously very divided opposition is now looking a bit less divided, all of a sudden, and talking coalition.

This would amuse me, it would, if the buggers who only got in on vote splitting on the left suddenly lost it when they tried a stunt like this and managed, with such petty politicking in the face of a crisis, to get those votes put back together.

Let’s hope.

So that fireball that lit up the skies of Western Canada a little while back does seem to have made it to the ground. The CBC’s reporting this am pieces have been found.

I expect Dr. Plait’ll have many breathless details, as usual, as they trickle in.

In the event you haven’t already heard and seen, this was an unusually Hollywood meteor. It came in relatively slowly, and was apparently insanely bright, so there’s video all over the place of it—essentially anyone standing around with a video camera who was even half awake had more than enough time to shift their aim—and then there’s security camera footage, so on. Big, bright fireball, almost ambling across the sky toward the horizon. Well worth Googling for, if you haven’t already.

(ETA: Stuff’s up at BA now… but as of this posting, not much in new info yet. Sounds like there’s a press conference happening later today, tho’.)