* Posts by Charles 9

16605 publicly visible posts • joined 10 Jun 2009

Dev gives HBO free math tips to nail Game of Thrones pirate leakers

Charles 9

Answer's probably no for two reasons. Making custom encodes for each of the screeners and translators is going to take a good deal of time, even with professional hardware. Second, custom encodes make the videos unsuitable for sending pressed BDs, which are the only way you can send ones protected by ROM-Marks (it's part of the spec). At least a short run of about 100 copies can be justified going through the process of making the press master.

Charles 9

They'll take it anyway. They take copies that emblazon "THIS IS A SCREENER," for crying out loud.

Charles 9

Re: Make it big and loud

Given the time it would take to encode each one for each screener/translator, not to mention the problem that this would also make them unsuitable for pressing (and you can only get a ROM-Mark with a pressed BD), how do you make a short-run screener unsuitable for pirating?

I suspect that ANY screener/translator copy is worth pirating. I see bootlegs with burned "THIS IS A SCREENER" subtitles here and there. If pirates are willing to take blatantly-obvious watermarked copies, few things will be taboo for them.

Charles 9

Re: Physical Copies

IIRC they're in high-def and some translators have shoddy Internet access, so it's physical or bust. Besides, even for an Internet copy, a determined foe would use an HDCP stripper combined with an HDMI recorder.

Charles 9

Re: I've always thought of:

The point is that MPEG video compression is lossy, so watermarks either have to play by MPEG's rules or risk being degraded beyond usability. That said, some screeners are willing to use destructive artifacts such as a burned "THIS IS A SCREENER" subtitle pasted periodically in the video. I suppose it depends on how far the producer is willing to go to detect or defeat screener pirates, since customizing each encode for each screener means you have to encode the movie multiple times, depending on how sophisticated your tools are (at the least, each altered section needs to be re-encoded and grafted onto the original stream).

Charles 9

"Doesn't matter. It changes the requirement from needing one compromised source to several in order to pull off this "co-operation". You are supposing many sources to be compromised and conspiring. If there are few or only one, you have again narrowed your investigation enormously."

Thing is, if nations can cooperate on matters of mutual benefit, a group of ragtag pirates with a common goal should be able to put their heads together easily, especially since each additional leaked source (and as these and other popular series prove, their very popularity makes them hot targets for theft, especially from the inside) means one more set of tracks on the same road, messing each other up. It's much like with computer entropy: barring a super-human intelligence able to deduce a complete entropy trail and negate it, any new source you throw into the mix will usually help the cause and at worst do nothing to help or hurt it.

Charles 9

There's also the issue that the screener copies can get stolen without the screener's knowledge, copied regardless of the watermarks (you should see the bootleg markets) and then sent to all and sundry.

Plus, as noted, some pirates are determined to cover their tracks and are willing to cooperate with others to cover each other's butts by collaborating on their copies to defeat watermarks. Even audio watermarking like Cinavia has been shown to be vulnerable.

This open-source personal crypto-key vault wants two things: To make the web safer ... and your donations

Charles 9

Re: More anonymity for criminals and terrorists

Cash doesn't necessarily allow the underworld to work, it's just the easiest thing for them to use over barter or a substitute currency like gold dust. If all cash were to disappear tomorrow, they'd quickly settle on something else, much as how the world of Fallout happened to settle on bottlecaps...

Grandmaster FLUSH: Chess champ booted for allegedly cheating with iPod app in the loo

Charles 9

Re: Apple Watch is next

Go is much more difficult for computers simply because the number of positions is much greater (19x19 vs. 8x8) and because it's a game of placing rather than moving, so each turn has a much higher number of possibilities which then cascade in a look-ahead system. Shogi is tougher for a computer to lick because its move set is more varied.

FREAKing hell: ALL Windows versions vulnerable to SSL snoop

Charles 9

So the correct answer is, "Turn away a customer?"

Soil and sand harden as SPEEDING MISSILES and METEORS SLAM into GROUND – boffins

Charles 9

Even tungsten or DU with its high density?

Charles 9

OK, now repeat the experiment with a pointed tip, much as how a very high diver positions his hands in a specific way to minimize surface area on impact.

ɘƨɿɘvɘЯ algo attack cracks Belkin router WPS PINs: researcher

Charles 9

Not necessarily. The serials and stuff would be done on small ROM chips, meaning all the rest of the stuff can be mass-produced. That includes the label printer that doesn't have to actually read the ROM chips to learn the serial number (key word serial) to compute the PIN. IOW, using any method other than based on the easy-to-know-at-manufacture-time serial number will seriously slow down the manufacturing process.

Charles 9

Re: Go ahead and use serial number as your seed.

But again, how else can it guarantee a genuinely-unique ID without using something like the Serial Number? ANY other source and you run the remote but still possible and highly-consequential risk of a collision. And anything sufficiently unique may as well BE a serial number for all intents and purposes.

Charles 9

Kinda poses a problem. How else can you come up with a one-size-fits-all solution for coming up with a random WPS PIN that doesn't involve programming each and every device individually?

NSA: 'Back doors are a bad idea, give us a FRONT door key'

Charles 9

But wouldn't the very act of doing so attract attention to themselves, allowing the spooks to take care of them?

Charles 9

Re: Plug that leak

Not if the pieces can be transmitted remotely over secure channels and the pieces only come together inside a black box unit. Penetrating black boxes is still an active security exercise, meaning extracting the key from a black box is still far from a given.

US govt bans Intel from selling chips to China's supercomputer boffins

Charles 9

Re: Q:

Why would it be a boon for Microsoft? Do they still develop Windows and Windows applications for POWER?

Charles 9

Re: Q:

In the US IIRC. Intel's foreign foundries are for older, less important chips.

Charles 9

Re: They're still at it

How? Bad as it looks now, the US is STILL a huge sight better than any other country on offer. Including China, or they would've ALREADY demonstrated self-sufficiency (they carry a cultural impetus) which proves they can successfully cut off the US.

Credit card factories given new secure manufacturing rules

Charles 9

Re: say again?

But once it's open, people can normally slip in or out as long as the door is open. No, what they demand is that the only way the fire door can open is by closing the way behind you first so that the ONLY direction one can go through the doorway is out. Normally this evokes images of airlocks, but you can also achieve this with the cylindrical doorways sometimes associated with darkrooms (to insure no light enters as people pass through). Imagine a weight-based mechanical latch so that once engaged, the door can only be spun to the outside and stays in that position until the door is emptied, upon which it can be spun inside again from within the building.

Charles 9

Better it go down due to a botched update rather than get pwned due to an overabundance of caution leading to the hax0rs getting through during the window of vulnerability. At least it can't be pwned while it's down.

Charles 9

Re: Oh?

Seems to me more like a CYA generalization. IOW, it's more an "Insert Sensitive Data Type Here". Name it, and apply it between the <>.

China weaponizes its Great Firewall into the GREAT FIRE CANNON, menaces entire globe

Charles 9

Re: A Browser-based solution?

I am keeping up. But what if China outright steals legitimate certificates belonging to Western companies, thus are able to perfectly mimic them and prevent them being blacklisted without collateral damage?

Charles 9

Re: A Browser-based solution?

What happens then if the Chinese start taking over non-Chinese IPs, particularly those already in use by non-Chinese businesses? Now how will you be able to know what's coming before you get attacked by the Great Cannon's zero-days?

Videogame publishers to fans: Oi, stop resurrecting our dead titles online

Charles 9

"Try Myst Masterpiece Edition. It runs on Win 7 and has higher resolution, true colour graphics. I played it through a while back."

RealMyst actually postdates Master Edition by about a year. This was supposed to be the "ultimate" edition of the game: the way they had really wanted the game to be played: not as a slideshow but an actual 3D first-person experience.

However, according to GoG, neither version is 64-bit compatible. Too old for today's hardware, it seems.

Charles 9

Re: Expand this to all technology

I've noticed that, even today, companies make use of the proprietary Bink codec. Anyone know why it's still in such wide use vs. something less encumbered like WebM?

Charles 9

Re: Expand this to all technology

Well, when it comes to products, those are covered by patents, and when the patents expire, the plans associated with that patent actually become public domain.

The trick with copyright is that works can get "second wind," so this raises a debate on just how long an author/artist/etc. should be entitled to exclusivity. Plus of course there's the argument of copyrighted works made under contract (which changes the terms).

Charles 9

Have you tried RealMyst? This redoes Myst as a 3D FPA, no QT necessary. It was made during the P3 era, so the hardware requirements in today's terms are easy, and IIRC it's available on Steam so should work even today.

Foreign firms must obey EU laws no matter where they're based, says EU. Hear that, Google?

Charles 9

Re: missing the point

"OH...... and pay taxes where you Physically Trade.... Just a WILD idea !!!!!!!"

But here's a wild idea to your wild idea. Consider e-commerce, where the buyer and seller never meet but stuff gets transferred between them. Now you have a clash because each party is within the borders of his respective country, so each country can legally claim jurisdiction: the buyer because currency changes hands in his country, the seller because the goods ship from his country. So if the laws clash between them, which takes precedence? The buyer's law or the seller's law?

Charles 9

Re: missing the point

Nope. That's due to the roads being owned or at least regulated by the respective governments. Their road, their rules. But what about privacy rights? They're of a more personal nature and don't involve government property. So who gets the call? The country of location or the country of origin?

Charles 9

Even better? What happens when a lax citizen is in a strict country (or vice versa) and a clash occurs (where the laws of the two locations differ)? Which law applies?

Charles 9

Re: missing the point

So what happens when an American is in Europe or a European is on American soil? And the specific rights in question clash? Whose law takes precedence? The soil or the citizenship?

Sorry, Qualcomm, Apple – your patents don't scare us

Charles 9

Re: First mover advantage

"If someone wrote something equivalent to your software, by the time they got it to market you would have version 2 ready."

Thing is, copycatting also makes it easier to leapfrog. Since all the effort of the v1's already done, they can think of ways to one-up you. So by the time you come up with a version 2, they may have not only anticipated but also gotten ahead of you, coming up with the equivalent of your version 3 at the same time. Suddenly you're in the uncomfortable position known as "First is Worst."

If you can be so easily leapfrogged with no recourse, why bother trying? As a result, we could end up back in the days of the Renaissance when most works were reserved for commissions from the wealthy and powerful. Note that most of the revered works of art were just that: commissions only revealed to the public long after it was originally made and therefore useless in a contemporary sense. How would you like it if the most useful software (and by that you can include the stuff needed to make other software: compilers and the like) was instead kept under the lock and key of ultra-conglomerates a la Gibson's Sprawl?

Charles 9

Re: Inventing the IP ≠ Being The Bully

But who was the first to put ALL of them together into a whole greater than the sum of its parts? Gestalt effect.

Charles 9

Re: First mover advantage

The main problem now isn't the exclusivity but the length. When the length was first used, industries were usually about durable things that last decades. But software cycles quickly. You can fix the patent problem by specifying different lengths for different industries: say a max 3 years for software and 5 for hardware.

+5 ROOTKIT OF VENGEANCE defeats forces of gaming good

Charles 9

What's to stop a miscreant from hacking the sent OGL commands to make the scene look different to the competition? A setup like this can still allow a hacker to tell "lies" to his opponents.

Charles 9

VM's are not useful for this type of cheat. The cheat would be on the host, giving it hypervisor access where it can snoop any memory at will, including pre-encryption (making a secure tunnel useless here, too).

Charles 9

Re: Confusing paper

"If the hardware/OS/games are created using the generally hated (at least here) concepts proposed by Trusted Computing Group (previously known as the TCPA and the previous Microsoft Palladium project), it would be possible to implement a hardware and software stack that would prevent client side privileged access to the system unless it was signed by a recognised key. This would at a stroke prevent almost all of this type of client side attack, but at the same time would wrest almost total control of a machine from it's owner, making it a data appliance rather than a PC."

You will note how little you hear of the Trusted Platform Module outside of tightly-controlled settings such as businesses who need the control for their own reasons. Simply put, it's a non-starter on the consumer (and gamers are a subset of consumers mostly) end. If the only practical solution is to implement a system that isn't accepted by your customers, your market is basically a dead end. Either people won't buy your games because they're full of cheats or people won't buy your games because they won't buy the "secure" hardware needed to run them.

Charles 9

Did you note the part of the article about "sponsored events" and "professional gamers"? In both, money is involved (the former due to the sponsorships and the latter because professionals, by definition, are doing it for a living).

Charles 9

I'm surprised they haven't taken a look at hardware-based cheating. At that point, the gaming companies may be forced to raise the white flag. After all, what man can make, man can subvert if determined enough.

You. FTC. Get over here. Google is INVADING our children's MINDS – anti-ad campaigners

Charles 9

Re: Major Shock!

That doesn't sound that good to me. Sure, the price may be lower, but don't you also run the risk of hitting a fly-by-night counterfeit dealer, depending on the circumstances? I know some friends that got hit like this trying to bargain-hunt online.

Popular crypto app uses single-byte XOR and nowt else, hacker says

Charles 9

Re: Bitwise XOR is a completely legit way to encrypt...

The One-Time-Pad is the only encryption system proven to be perfectly secure. Furthermore, any other perfectly-secure system must (also proven) be essentially the same as a OTP. Using XOR, the OTP also has deniability since you can change the message simply by changing the key.

Google Ads go NUCLEAR, foist exploit kit

Charles 9

Re: AdBlock

"It is not just the random nature of them , but the simple fact that no person could possibly purchase even a small %age of the ad volume on ANY website."

Trouble is, the needed %age to turn a profit is in the low fractions of a percent. IOW, just one hit in several thousand is enough, and if one follows P.T. Barnum, there will always be enough sicker to make the whole business worthwhile. Not to mention the ads are getting tougher to block, leaving you with two choices: suck up or abandon the Internet.

Microsoft drops Do Not Track default from Internet Explorer

Charles 9

Re: status quasi

They can glean information no matter what you answer. Give different answers and they'll know you're deceptive and change tactics.

Charles 9

Re: It's a common misunderstanding...

But if we're the product then we're passive and don't buy anything meaning we never respond to ads making them pointless. We MUST be customers in order to make ads worthwhile.

Why does the NSA's boss care so much about backdoors when he can just steal all our encryption keys?

Charles 9

Re: We have RIPA

Oh? They can't just demand it from EVERY suspect?

Broadband routers: SOHOpeless and vendors don't care

Charles 9

Re: Good Password(s) inadequate?

Not if they can figure out ONE of the passwords and know the technique, meaning it boils down to a one-word dictionary attack, which IIRC is within feasibility.

Also, what if you visit a bunch of sites with the same theme OR have a truly abysmal memory...oh, and the computer's shared so you can't use a password manager?

Can't patch this: Mozilla pulls Firefox encryption feature after just a week

Charles 9

Chrome is perhaps not trustworthy, but about about Chromium, which IIRC is the open-source fork of Chrome, with most of the Google-centric stuff stripped out?

Charles 9

Re: 100% False Positive rate

Aren't many hijackings the result of social engineering (AKA identity theft), which no amount of safeguarding will prevent (because the miscreant will simply glean enough credentials to pass any test)?