Skip to content

Seen, Heard, Said

Things I’ve seen, heard, or was told by someone. Item in this category usually originate from the Internet.

MD5 Argument

There’s been a hilarious argument on the WP-Hackers mailing list over what MD5 is:

Its a one-way hash, and thinking it can’t be looked up in a rainbow
table or brute forced fairly easily is more often than not wrong
(because more often than not people are using things like md5() once
without any sort of salt to hash the password).

But please, do not call it encryption. It is not, and it will never
be. Encrypting passwords in a database is just silly.

Response:

MD5 *is* technically an encryption scheme. And yes, with the help of rainbow tables, it can be decrypted – but it is never stored in plain text anywhere in a vanilla copy.

Instead, the user password when logging in is encrypted and the two MD5 hashes are compared.

Response:

No it is not. MD5 is technically a compression scheme. It is a one way
hash i.e. you cannot reverse the conversion function f(password) = hash.

For it to be an encryption scheme there must be an equivalent function
g(hash) = password.

Rainbow tables do not allow you to decrypt the MD5 hash as it has not
been encrypted all they allow you to do is identify one of the set of
plaintexts which compress to the hash string.

Response:

No, its not an encryption scheme. Its a digest algorithm. A one way
hash. And no, it can’t be decrypted, ever. You can do a reverse lookup
(rainbow tables) or generate a collision.

Encryption by definition allows one to reverse the process knowing a
certain secret (the function to reverse the process). MD5 has no such
capability. In fact, run MD5 over a terabyte of data and it’ll end up
with the same length checksum as if you checksum the letter “a”.

MD5 is a cryptographic hash function. It takes an input, performs a reducing function on it, and spits out a 32 character “fingerprint.” There is no way to mathematically take a output of a MD5 function and get the original input back. I’ve have a MD5 utility up that you play around with: http://fergcorp.com/project/tools/md5.html

New Antivirus Recommendation

I’m getting rid of Microsoft Windows Defender and Command Antivirus today. Why? Performance. CodingHorror has the scoop:

From www.codinghorror.com:

And nothing cripples your PC’s performance quite like anti-virus software. This isn’t terribly surprising if you consider what anti-virus software has to do: examine every single byte of data that passes through your computer for evidence of malicious activity. But who needs theory when we have Oli at The PC Spy. Oli conducted a remarkably thorough investigation of the real world performance impact of security software on the PC. The results are truly eye-opening:

Percent slower
Boot CPU Disk
Norton Internet Security 2006 46% 20% 2369%
McAfee VirusScan Enterprise 8 7% 20% 2246%
Norton Internet Security 2007 45% 8% 1515%
Trend Micro PC-cillin AV 2006 2% 0% 1288%
ZoneAlarm ISS 16% 0% 992%
Norton Antivirus 2002 11% 8% 658%
Windows Live OneCare 11% 8% 512%
Webroot Spy Sweeper 6% 8% 369%
Nod32 v2.5 7% 8% 177%
avast! 4.7 Home 4% 8% 115%
Windows Defender 5% 8% 54%
Panda Antivirus 2007 20% 4% 15%
AVG 7.1 Free 15% 0% 19%

Holy crap. Norton and McAfee both increase disk access times by 20x! That’s over 0.16 seconds instead of 8 milliseconds! Fortunately, I have run either of those programs for at least two years. I have been using Command Antivirus since our schools offers it for free, but the update process sucks beyond belief. I’ve also been running Windows Defender, but found that it’s probably doing more harm then good with it’s 50% increase in access times. I’m now installing with AVG Free Edition on my Tablet and I will be running that exclusively, I recommend the same now.

Saved by What?

From www.boingboing.net:

A woman in Nanjing, China fell off a sixth floor balcony and survived thanks to a pile of poop on the ground below.

I’m not quite sure what to say about this. I guess if it’s a difference between life with crap and death without, I’d rather have have life. But still…crap! Common!

Fake TV Cameras

This is a great short story. Watching it reminded me of some of the things that I did with real video cameras back when I was little. I could also see this being expanded into a movie. Not a whole movie about playground kids running around with fake video cameras, but that would certainly be one part of it.

In any event, I think it’s about high time I transfered those videos to the computer and put them up.

From www.kottke.org:

Fascinating clip from the This American Life TV show about some grade school kids who became obsessed with using fake video cameras. Animated by Chris Ware.

The RIAA Pendulum

I remember Dad telling me about pendulums in the ski industry a long time ago. I think it had something to do with skiing versus snowboarding and how after many years of increasing snowboarders, skiing was making a comeback: the pendulum effect.

I think many industries can be modeled the same way, including the lawsuits being brought by the RIAA. Which reminds me, guess who won the “Worst Company in America 2007” award? Yup, the RIAA, which really equates to Warner Music, Universal Music, EMI & Sony-BMG, was voted at the worst company in 2007. Bravo guys!

I digress back to my pendulum.

In recent months, I’ve come across a number of stories that constitute a severe hampering to RIAA’s recent attempts to extort recoup money from pirated music. We’ve all head the stories of that one mom fighting off the RIAA and winning.

I use “that one mom” in a generic sense. There have been several instances of this, with the accused typically stereotyped as a “soccer mom” who can’t even check her own email; or better yet, doesn’t even own a computer. In fact, as far as I know, the RIAA has never won a case when it actually went to trial. NEVER!

A few weeks ago, there was a FoxTrot strip parodying that fact:
foxtrot.JPG

The pendulum isn’t swinging back the other way yet, but I think it’s certainly slowing down.

Living in Colorado, I think there’s some unwritten rule that says I must hate the Nebraska Corn Huskers. In this case, I’m making an exception:
From www.boingboing.net:

The University of Nebraska is so pissed off with the RIAA’s outrageous requests to help rat out students who file-share that it has sent the RIAA a bill for the time the University has wasted dealing with the RIAA’s demands. Go Corn Huskers!

I tip my hat to you, Huskers.

There’s also this sickening story about WB suing a disabled Florida man:
From recordingindustryvspeople.blogspot.com:

Although the defendant John Paladuk, an employee of C&N Railroad for 36 years, was living in Florida at the time of the alleged copyright suit, and had notified the RIAA that he had not engaged in any copyright infringement, and despite that the fact that Mr. Paladuk suffered a stroke last year which resulted in complete paralysis of his entire left side and severely impaired speech, rendering him disabled, and despite the fact that his disability check is his sole source of income, the RIAA commenced suit against him on February 27, 2007.

via BoingBoing

Can’t imagine there’s great public relations on that story.

Then there’s this tale:
From www.boingboing.net:

A California man got out of his music-sharing lawsuit by having his lawyer send a sharply worded letter to Sony Music, the plaintiff.
…
The letter threatened to sue Sony for malicious prosecution, citing the crummy evidence used by record companies in other suits, and on receipt the letter it, Sony chickened out and withdrew the suit.

Remember those Microsoft Word Templates you could get to write up your last will and testament? How long until someone creates something similar for being sued by one of the RIAA members companies? (Side note/interesting fact: People aren’t sued by the RIAA, they’re sued by an individual music company that is a member of the RIAA. The RIAA more or less exists to deflect the bad PR from actual record companies).

The pendulum continues to slow down and it’s now only a matter of time before it starts swinging the other way.

576 Megapixel Camera

I’ve always wondered about this, so I’m glad I was finally able to get an answer. Long story short:
From www.kottke.org:

The human eye is equivalent to a 576 megapixel camera and has a nighttime ISO of 800 (~1 during the daytime).

It’s actually pretty cool how this guy figured it out. I read through most of the material and while I didn’t go through and check all his calculations, it seems pretty solid to me. Here’s the good stuff:

From www.clarkvision.com:

Based on the above data for the resolution of the human eye, let’s try a “small” example first. Consider a view in front of you that is 90 degrees by 90 degrees, like looking through an open window at a scene. The number of pixels would be
90 degrees * 60 arc-minutes/degree * 1/0.3 * 90 * 60 * 1/0.3 = 324,000,000 pixels (324 megapixels).
At any one moment, you actually do not perceive that many pixels, but your eye moves around the scene to see all the detail you want. But the human eye really sees a larger field of view, close to 180 degrees. Let’s be conservative and use 120 degrees for the field of view. Then we would see
120 * 120 * 60 * 60 / (0.3 * 0.3) = 576 megapixels.
The full angle of human vision would require even more megapixels. This kind of image detail requires A large format camera to record.

When Physicists Have Kids

I thought this was rather humorous:
From www.kottke.org:

A man outfitted his family minivan with high-precision cesium clocks to demonstrate to his kids that they gained 22 nanoseconds of vacation time on their mountain camping trip than they would have at a lower altitude.

I can imagine the conversation going like this:
Kid A: “My vacation was longer than your vacation!”
Kid B: “Nu uh!”
Kid A: “YA hu!” Whips out some fancy chart detailing vacation time
Kid B: “No fair!”

Overheard in Starbucks

I’m studying for my Mechanics of Materials exam at Starbucks. There’s a mom and her two kids (at least, that’s the relationship I’m assuming) doing schoolwork. The daughter asks,

“Mom, what’s ethnic cleansing?”