They're using SHA1 to sign / identify programs. Finding and exploiting a hash collision would be fairly straightforward and could have really bad consequences, since I presume I could publish my "rogue" modified program to peers fairly easily.
Hello (Distributed) World: Designing Software that Spreads P2P
11–20 of 32 posts
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#12They're using SHA1 to sign / identify programs. Finding and exploiting a hash collision would be fairly straightforward and could have really bad consequences, since I presume I could publish my "rogue" modified program to peers fairly easily.
Just out of curiosity, is there any new progress in the collision discovery of SHA1? Can you provide some references so that I can dig into?
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#13Is there any protection against software piracy?
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#14I've been waiting for this release for a looooong time. Bravo!
What release? It's another blog post.
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#15They're using SHA1 to sign / identify programs. Finding and exploiting a hash collision would be fairly straightforward and could have really bad consequences, since I presume I could publish my "rogue" modified program to peers fairly easily.
Just out of curiosity, is there any new progress in the collision discovery of SHA1? Can you provide some references so that I can dig into?
[deleted]
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#16They're using SHA1 to sign / identify programs. Finding and exploiting a hash collision would be fairly straightforward and could have really bad consequences, since I presume I could publish my "rogue" modified program to peers fairly easily.
Just out of curiosity, is there any new progress in the collision discovery of SHA1? Can you provide some references so that I can dig into?
Here is the questions posed to the Stack Overflow audience, however its from 2009[1]. The linked article says that they can now get collisions in about 2^52 operations- as opposed to the previous 2^69.
The National Institute of Standards and Technology has urged Federal agencies to stop using SHA1 digital signatures by the end of 2010, and instead start transitioning to the SHA2 family[3].
[1] http://stackoverflow.com/questions/1147830/understanding-sha...
[2] http://www.schneier.com/blog/archives/2005/02/sha1_broken.ht...
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#17Is there any protection against software piracy?
We don't build any in, but the same strategies (ie, requiring a license key, etc) that work for regular applications like Microsoft Word also work for fluid applications. The bits can be copied easily, but the same is true for traditional software.
Crazy strategies, like CDs that physically can't be copied and must be in the drive or kernel extensions obviously won't work, but that's probably a good thing. =)
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#18So now we can't patch a security hole in a library without "recompiling" every application it's linked to? That seems like a huge step backwards to me.
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#19Earlier quoted context omitted.
How about a chatroom?
Ignoring user interface and the mechanics of peer discovery... user-interface, discovery-system | # This process is spawned with two pids as arguments # If either pid halts, I halt too. user-interface.link discovery-system.link user-interface.subscribe(when( text-entered: { message | # I entered a message in the UI, announce it to everyone subscribed to me my-actor.announce('exclaimed, message) } )) discovery-system.…
Are the names discovery-system, user-interface, my-actor important?
Re: Hello (Distributed) World: Designing Software that Spreads P2P
#20Earlier quoted context omitted.
Ignoring user interface and the mechanics of peer discovery... user-interface, discovery-system | # This process is spawned with two pids as arguments # If either pid halts, I halt too. user-interface.link discovery-system.link user-interface.subscribe(when( text-entered: { message | # I entered a message in the UI, announce it to everyone subscribed to me my-actor.announce('exclaimed, message) } )) discovery-system.…
Are the names discovery-system, user-interface, my-actor important?
Every process has "my-actor" defined in its global environment. It provides methods related to basic actor functionality. In this case I'm calling the "announce" method to say something to all of the process' subscribers.
user-interface and discovery-system are two hypothetical processes whose pids (process identifiers) are passed in to this process as arguments. user-interface would be responsible for creating a window with a text display area and a text entry box. discovery-system would use our remote service discovery model to find others chatting in the same "room."