Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Submission + - SHA-3 Hash Function Announced: Keccak

LargeMythicalReptile writes: In 2007, after a number of attacks on existing cryptographic hash functions such as MD5 and SHA-1, the US National Institute of Standards and Technology (NIST) announced a competition to create a new algorithm. After receiving 64 submissions and narrowing the field to five finalists, today NIST announced the winner: the sponge hash function Keccak. Keccak will take its place as SHA-3, a new US government standard.

Comment Re:Sorry, what? (Score 5, Informative) 324

There's some needed context.

Aaronson himself works on quantum complexity theory. Much of his work deals with quantum computers (at a conceptual level--what is and isn't possible). Yet there are some people who reject the idea the quantum computers can scale to "useful" sizes--including some very smart people like Leonid Levin (of Cook-Levin Theorem fame)--and some of them send him email, questions, comments on his blog, etc. saying so. These people are essentially asserting that Aaronson's career is rooted in things that can't exist. Thus, Aaronson essentially said "prove it."

It's true that proving such a statement would be very difficult, and you raise some good points as to why. But the context is that Aaronson gets mail and questions all the time from people who simply assert that scalable QC is impossible, and he's challenging them to be more formal about it.

He also mentions, in fairness, that if he does have to pay out, he'd consider it an honor, because it would be a great scientific advance.

Comment Re:This is informative how? (Score 2) 186

Assuming no relationship between decisions is ludicrous. On many items that aren't terribly controversial, Ginsburg and Scalia, for example, would rule similarly just because they are trained judges with a background in US law.

[...]

I'd be really surprised if you didn't have a correlation between how one particular justice votes and how the rest of the justices vote.

Exactly. (PDF)

TL,DR:
Last Supreme Court term,
-Almost half of all Supreme Court decisions were unanimous
-The two Justices who disagreed most frequently in judgment were Ginsburg and Alito--and they still agreed with each other noticeably more than half the time (62.5%). Ginsburg and Scalia, in your example, agreed in judgment 65% of the time.
-That said, there is at least some truth to there being a "liberal wing" and a "conservative wing" (with Kennedy being the "swing vote"): of the 16 cases that were decided 5-4, 14 of them were Roberts-Scalia-Thomas-Alito vs. Ginsburg-Breyer-Sotomayor-Kagan with Kennedy casting the deciding vote. But a number of the lineups are more interesting.

The Justices are highly educated professionals, and as such agree with each other a lot of the time about what the law actually says. None of them is blindly ideological--but just the same, they do have their individual opinions about how the law should be interpreted, so some level of ideology is certainly present.

Comment Re:Article is Troll **AND** Flamebait all in one! (Score 1) 642

It's not just "the ones who fail the metal detector" who get pat-downs, and that's not what the article is about. The TSA is increasingly using backscatter x-ray machines; if they decide to put you through one of those, you can opt to get a manual pat-down instead. This is the category of people we're talking about; they are trying to get more people to choose the backscatter x-ray by making the manual search more uncomfortable.

As for there not being enough scanners, TFA says "Agents were funneling every passenger at this particular checkpoint through a newly installed back-scatter body imaging device." I can confirm this; the last few times I've been to Logan Airport in Boston, they were putting every adult through the scanner. (They allowed a few small children to go through the metal detector instead.) Perhaps this is true only at some airports or only at non-peak times, but there are certainly situations where everyone gets funneled to the backscatter machine, and opt-outs get patted down.

The second time this happened to me, the TSA agent announced that we would go through the scanner, and didn't mention that anyone had the option to get a manual pat-down instead. When I politely requested to opt out of the scanner, the TSA agent kept trying to talk me out of it, repeatedly asking why I wanted a pat-down, informing me that it would be degrading, etc., before finally allowing it. (Honestly, one of the reasons I wanted to request a pat-down was so that other people knew it was an option!)

Comment Re:So funny.. (Score 1) 684

it would be more work to re-engineer somebody else's code to avoid detection than to just write it from scratch.

Very true. I've been a TA in CS at a well-known university, and it's surprising how many students don't realize how easy it is to catch cheaters.

Much of our work is cooperative--either explicitly group work, or of the "you can talk with friends about the ideas or help them debug, but write it up yourself" variety. In addition, the TAs are available for any questions (and don't mind helping you--really!). So, it's really not that hard to do the work honestly and do ok. Maybe you won't do great, but you'll do ok.

But I never saw the people who ended up cheating during office hours, or saw other signs that they were putting forth any effort to actually learn. So I don't think cheating is a matter of ability so much as laziness. The issue, as parent rightly points out, is that while it's certainly possible to cheat in an undetectable manner, doing so requires at least as much work as doing the assignment. And if someone is cheating due to laziness in the first place, they often don't put much effort into cheating, and it's very, very easy to catch them.

If you are too stupid to realize that when you hand in plagiarized code, you aren't taking a *risk* that you will be caught, you are engaging in the certainty that you will be caught, then you don't deserve to be at a university of this caliber.

I'd agree, but sadly the full consequences don't always filter through, because departments and institutions make it hard. One of my students once blatantly cheated on a large final project. As a TA, I would have supported very harsh penalties. I was a bit let down when the professor gave a lesser penalty...and mentioned the reason for it to me: ultimately, if the professor tried to institute a penalty with long-lasting academic effects, it would mean a ton of paperwork and annoyance on the professor's part. I don't blame the professor for this (since I know how much he really had going on at the time), but I think the department should have made it a bit easier for people to deal with cheaters.

Comment Re:Oldbar (Score 2, Interesting) 447

Install the "oldbar" add-on.

In any discussion of the awesome bar, someone always mentions oldbar, and someone else always mods it informative.

The description of oldbar is "oldbar makes the location (URL) bar look like Firefox 2" (emphasis added). It does not change functionality, only appearance. rantingkitten--and I--have complaints about the functionality first and foremost. oldbar doesn't help.

I could go through a litany of complaints about the actual functionality (ridiculous prioritization decisions, various forms of nondeterminism that don't make consistent sense even if you accept the prioritization decisions, etc.), but ultimately my complaint is the same as grandparent's: There's no way to turn it off. And by "turn it off" I don't mean "make it look different while retaining AwesomeBar functionality" or "disable location bar dropdown altogether" (as replies to this complaint typically suggest). I mean "revert to the previous, predictable, sane functionality."

Currently, I'm approximating the previous functionality with a number of obscure, poorly-documented about:config tweaks, but 1) why should you need to go through that to provide a vague approximation of the user experience you had in the previous version, and 2) it's not perfect; there's still strange behavior.

Sure, have the awesome bar. Sure, make it the default--a lot of people like it. All I want is a checkbox to revert to the previous behavior, that's all.

Comment Re:Voting needs to be transparent (Score 1) 207

If you can confirm your vote, you can prove how you voter to others. This makes room for buying and extorting votes! I can imagine some employers requiring you to prove you voted correctly to keep your job.

Or union bosses. Or the local political-organizing group slipping you some money in exchange for voting a certain way. Or even an unorganized gang of thugs trying to intimidate you (think a group of rednecks who suspect you might have voted Democratic, or a group of Berkeley hippies who suspect you might have voted for Prop 8).

But I disagree with your first sentence. It's certainly true about the scheme proposed by GP, but contrary to intuition, there are ways to confirm your vote without being able to prove how you voted to others.

Such voting systems typically use a "cut-and-choose" method in which your vote is split into two or more pieces, any one of which is useless for determining how someone voted, yet together create the full vote. The voter takes a copy of one of the pieces as a receipt and can verify that the piece was counted correctly. So if there are two pieces overall, someone trying to tamper with the votes would have a 50% chance of being caught for each vote tampered with, which quickly becomes negligible for any significant number of votes. Yet the voter can show the piece to others, and it doesn't give any information about how they voted.

Here (PDF) is one method for doing this, by David Chaum.
Here (PDF) is another (without cryptography!), by Ron Rivest.

The issues with these new systems seem to be usability, inertia, and public trust. Usability: Voting should be extremely simple for the voter. If Great-Grandma can't do it, it's not going to be our voting system.
Inertia: Current election systems seem to be "good enough" for most people; despite some agitated geeks and the occasional news story about voting machines being laughably insecure, there isn't a huge popular movement to change. (Cost of switching systems can also be included here.)
Public trust: Even if cryptographers agree that a system is secure, if the system involves a user experience any different from the familiar "check off from a list of names" protocol, they'll have to work to convince the lay public that it's ok.

Comment Re:So how does a country club work, legally? (Score 3, Informative) 198

Legally, the difference between a bar and a country club is that the bar is what is frequently referred to as a semi-public space. That is, it is private property, but is open to the general public. Restaurants, shops, etc. typically fall into this category.

Owners of semi-public spaces do have some rights to control their property (e.g. enforcing a rule that they'll kick you out of the store if you don't buy anything, or a movie theater not allowing kids into a theater hall that is currently showing an R-rated film). However, they have fewer rights over the property than owners of private spaces do (e.g. they can't prevent someone from entering solely based on their race).

A country club is typically a fully private space--while there are procedures for gaining access, the general public is excluded. A bar is a semi-public space--there is a general expectation that it is "open to the public" (subject to legal age restrictions). Your proposal of "membership" might be seen as an attempt to make a bar a letter-of-the-law private space. IANAL, but I'd expect it to fail in one of two ways:
1) Someone could legitimately argue that the temporary "membership" is basically a farce and the bar is still a semi-public space, since the general public can--and, indeed, is desired to--still access it by gaining trivial membership.
2) There may be zoning restrictions involved. Bars are frequently located in commercial zones; cities may require any businesses operating in the area to be semi-public.

Comment Re:And yet (Score 1) 493

What's more, you shouldn't have to dig around in about:config to change a setting that doesn't actually do what you want.

The max rich results setting just means it won't display any search results. That's not even remotely the same as going back to an old-school auto-complete functionality.

Exactly. (Mod parent up.) There is no way to disable the Awesome Bar in the sense that d3ac0n means, i.e. returning to a sensible autocomplete dropdown rather than the search-based algorithm it uses now. And there apparently won't be, given that this bug is "RESOLVED WONTFIX".

To be fair, I hated it at first (and at times I still do) but while it sometimes has completely random matches, there are a number of sites that I can now get to much more easily, even without having bookmarked and tagged them. About the only thing that I do always do is use the oldbar extension as a basis for my CSS to get a slightly more sensible appearance (i.e. something that doesn't go half way down your screen with half a dozen results).

I don't hate it as much as I used to, and I recognize that 95% of users love it, but I'd still switch back if I had the option. I have miscellaneous usage problems I could rant in detail about (and yes, I have "trained" it--I've been using FF3 since Download Day), but my biggest problem is philosophical: it breaks expectations. The location bar is for typing locations. If I start typing a location, if it employs any kind of "smart" searching technology, then I can't predict what will be in the dropdown--whereas a bar that simply autocompletes rather than searches is predictable and useful.

In the WONTFIXed bug, the developers encourage feedback about how to make the awesome bar customizable, how to change the weightings applied to the search function, etc. They completely miss the point that no amount of tweaking and preference-weighting will make an algorithm that can exactly predict what I want 100% of the time. The entire premise of "search" in the location bar is flawed.

Admittedly, that's my opinion. And as I mentioned above, I recognize that the vast majority of people like it. I don't ask for it to be removed, or for it to not be the default. All I ask is for the option to revert to the old behavior.

Comment Re:Spam? (Score 1) 430

I could understand citing the political blogosphere as a whole, but to specifically mention the Huffington Post is just creepy. It's neither revolutionary nor reputable.

It is, however, the source of the best news correction I've ever seen:
"UPDATE: The Huffington Post has learned that the below video has been doctored. We regret the error and apologize to Mr. Gibson. John Gibson never compared Eric Holder to a monkey with a bright blue scrotum." Source

Comment Re:Ummmm (Score 4, Interesting) 79

You don't, and as scientific proof of the Earth's rotation, this is obviously completely useless. But if you trust the motor, this is a fun way to see what a Foucault pendulum does, without the expense and inconvenience of needing a full-sized model.

True enough, but if you ever want to show it to others, there will be skeptics.

I once saw a full-size Foucault pendulum at a science museum. If you stood and watched it for a few minutes you could see the precession (there were markings on a ring around the pendulum, so it was easy to see where it swung before). I overheard some other patrons asking if it was powered, why it didn't come to a stop, etc. The museum guide explained that it was not powered and how it worked, and mentioned that because of air resistance they used an electromagnetic ring to give it a tiny "push" with each swing to keep it going. He also explained that because the magnet was circular, it would always push the pendulum directly back the way it came rather than from side to side.

Several onlookers remained convinced that it was a trick and the electromagnet was causing the precession. And remember, these are people standing in a science museum, looking at an exhibit so massive it required the entire building to be designed around it, whose entire point was to show this effect.

Now imagine if there had been a motor attached to it, designed to "compensate for ellipsoidal motion"....

Comment Re:Already got one (Score 1) 125

Indeed. Google's PageRank algorithm started off as citation analysis for academic papers--one could find out which papers were notable in a given field by the quantity and notability of the papers citing it. Then they realized that the same approach could work for the Web, treating links as citations.

As a sibling post points out, this says nothing about the correctness of the paper, only its notability--but ideally if a paper is shown to be faulty, then the paper exposing the faults will get many citations too.

The proposed system might give a more detailed granularity than a purely citation-based system, so in that sense might have a reasonable benefit. However, as a "social network" of sorts, it will tend to have a life of its own, and consequently could very easily be subject to failings at the social/political layer (as other commenters have noted).

Encryption

Submission + - Rogue CA Certificate Created from MD5 Collision

LargeMythicalReptile writes: A team of researchers has successfully used weaknesses in the MD5 hash function to create a rogue CA certificate that appears to be signed by one of the common root CAs. According to them, "We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This certificate allows us to impersonate any website on the Internet, including banking and e-commerce sites secured using the HTTPS protocol."

Slashdot Top Deals

Today is a good day for information-gathering. Read someone else's mail file.

Working...