Maybe I should write about things other than myself for a while.

Oct 11, 2008

If you're involved in the retrocomputing or PC history scenes, chances are you've heard of double-sided floppy disks that are formatted for one system on side A and another system on side B. For example, I've got a copy of the game Ninja which had the C-64 version of the game on one side and the Atari port on the other. At the time this was a pretty straightforward thing to do because drives only read one side of a disk at a time. A couple of weeks back, PC historian Trixter came across a highly unusual 5 1/4" floppy disk containing ports of the game Mental Blocks for the Commodore and the IBM PC... mixed on the same side of the disk. This is highly unusual because, under normal circumstances, when you format a disk, you format a disk with a particular file system, and that's that - every block on the disk is in use. Upon analysis, Trixter discovered that the FAT-12 file system on the disk was rife with bad disk blocks, which are actually perfectly valid Commodore disk file system blocks due to the differing methods by which the IBM PC and the Commodores accessed their disk drives. Whomever came up with that hack was truly inspired, and I'd love to take them out for a beer sometime.

In other news, a group of human rights activists and computer security researchers at the University of Toronto discovered that the Chinese government, long known for its policies of monitoring and filtering Internet traffic, has found a way of monitoring Skype instant messenger traffic. Skype, a mostly free to use peer-to-peer application (IM and calls between Skype users are free; calls to the rest of the telephone network require a paid subscription), makes it possible to communicate with other Skype users via ext-based instant messenging or verbally using VoIP (voice-over-IP). Skype the company claims that the traffic is encrypted in such a way that a hostile entity (like a government) can't decrypt it (specifically, using AES for session encryption and RSA to exchange session keys) and that they've performed security audits of their source code, the results of which you can download and read for yourself. In China, the IM service is provided by TOM-Skype, which is a joint venture of Skype and a Chinese wireless provider, and probably the proxy the Chinese government trusts to send traffic through the Great Firewall. Therein lies the problem: TOM had to write software which acted as a gateway between Chinese users and the Skype service, which is outside of Chinese control.

Briefly, Skype IM and VoIP traffic is encrypted. To set up an encrypted connection, the Skype client has to contact the other Skype client to negotiate communication parameters and exchange session keys. Due to the fact that the TOM-Skype servers had to be gone through to set up the encrypted sessions, they were in the perfect location to stage a man in the middle attack; chances are, the TOM-Skype servers on the Chinese grids pretended to be the other end of every connection and transparently relayed traffic, recording the messages before re-encrypting them to the other end of of the connection and sending them on their way. Encryption's great, but if you have to use a malicious node to get anywhere you're pretty much screwed. Also in that vein, it's been known for a couple of years that laptops and electronic storage media entering the United States may be confiscated at the border for forensic imaging and analysis, and may not be returned to the rightful owners depending on how the Department of Homeland Security is feeling that day. Last week, US Senators Russ Feingold, Maria Cantwell, and Adam Smith have proposed a bill called Travelers Privacy Protection Act, which if passed would limit the power the DHS has to seize and analyze the equipment of people who are otherwise under no suspicion. Specifically, the bill would require reasonable suspicion of wrongdoing (same as state and local law enforcement), probable cause, and a warrant or court order to hold onto gear for longer than 24 wallclock hours. The bill would also require limits on the types of information that may be searched for and used as well as Congressional oversight of the activities of the DHS in this regard. It's about time, guys.. maybe next American citizens will be able to travel abroad without having to claim that they're Canadian.

Last and certainly not least, the National Research Council has been studying the science of data mining as used by the United States government, and it's concluded what anyone who's ever sat down and thought seriously about it has said: it doesn't work for finding people up to no good in general or terrorists in particular. The research team looked at every data mining technology and practice in depth to determine how well it does what the government wanted it to, where the practical shortcomings are, and methods of reducing the number of false positives in the results. The people who carried out this study are no slouches - among them are Bill Perry, who was the US Secretary of Defense in the 1990's as well as a professor at Stanford University, former MIT President Charles Vest, and Google research scientise Daryl Pregibon, so these aren't slouches in this domain by any stretch.

Maybe things will be changing for the better soon.