Billy relays a great story... (Update: This has piqued a number of people's interest. Updates are being appended to this post.) (Update2: Great story, but it looks bunked. Pictures and details contained within...)

Optyx is in Atlanta for the week and we got some drinks with John Terrill last night. A good time was had by all talking about crypto, web apps, the homies on #vax, brushes with the law, security charlatans, and new opportunities. The night was finished with a stumbling tour of Pat and my old stomping grounds: Georgia Tech.

If you don't know Optyx, he's forgotten more hacker stories then I'll ever have. The following is, as best as the beers will let me remember, the story of the Cray-2. I've tried to tell the story as close to the way Pat did. Any errors are the fault of Guinness

So I was living in San Francisco working at a web hosting startup. A friend of mine at Lawrence Livermore National Laboratory gives me a heads up, saying they were decommissioning their Cray-2 super computer. I decided to buy it but the regulations said the lab had to hold a public auction to sell it. However, it didn’t say how far in advanced the time or place of the auction had to be published. Through some help from my friends at the lab an auction got setup where I was the only bidder.

The auctioneer wasn’t in on the scheme and he opened the bidding at $2000. I looked around, saw I was the only guy, and said “$1000.” They sold me the Cray-2 for a grand and I took back to my house on Treasure Island in the back of a U-haul. A Cray-2 weights more than a ton so this was not an easy task.

The big problem I had was how to power the thing. I hacked together a power converter and ran it off the 3 phase power outlet for the clothes dryer. But I had this girl roommate who used to complain about not being able to dry her clothes when she wanted because the computer was on. So the uptime of the super computer was dependent on the laundry habits of a roommate!

After the first month, I got the power bill. It was $2200. I decided it was time to sell the Cray.

Through a mutual friend, I found some .com yuppie who wanted to buy the Cray and use it as a couch. I sold it for around $3500 to recoup the cost of the machine and the power bill. I visited his house which was on the side of a hill in SF. You’d park in a 1 car garage underneath the house and used stairs to go up into it. It was like a big loft space on the 1st floor and that is where he decided to put the Cr... [ Read More (0.7k in body) ]

'The Most Beautifil Destruction...' | Optyx and The Cray-2

A remote user can send specially crafted data to trigger a buffer overflow in the UPnP Internet Gateway Device Standardized Device Control Protocol code and execute arbitrary code on the target system. The code will run with the privileges of the target service.

"privileges of target service" == root

Apple credits Michael Lynn of Juniper Networks with reporting this vulnerability.

Mike's fuzzing DNS again which is oh so Dan Kaminski-esque.

Remote root in Mac OS-X

The most effective way to find and destroy a land mine is to step on it.

This has bad results, of course, if you're a human. But not so much if you're a robot and have as many legs as a centipede sticking out from your body. That's why Mark Tilden, a robotics physicist at the Los Alamos National Laboratory, built something like that. At the Yuma Test Grounds in Arizona, the autonomous robot, 5 feet long and modeled on a stick-insect, strutted out for a live-fire test and worked beautifully, he says. Every time it found a mine, blew it up and lost a limb, it picked itself up and readjusted to move forward on its remaining legs, continuing to clear a path through the minefield.

Finally it was down to one leg. Still, it pulled itself forward. Tilden was ecstatic. The machine was working splendidly.

The human in command of the exercise, however -- an Army colonel -- blew a fuse.

The colonel ordered the test stopped.

Why? asked Tilden. What's wrong?

The colonel just could not stand the pathos of watching the burned, scarred and crippled machine drag itself forward on its last leg.

This test, he charged, was inhumane.

A sad, sad robot song to sing.

Bots on The Ground - washingtonpost.com

This is an audio sample from the documentary Jesus Camp, where youth pastor Becky Fischer offers prayers to her ministry's electrical system, PA system, microphones, projector, and PowerPoint presentations. At the end, it trails off into her speaking in tongues.

Be sure to use this when setting up for your next presentation...

Lord Jesus, Bless This Powerpoint Presentation (mp3)

Someone on Presidential hopeful John McCain’s staff is going to be in trouble today. They used a well known template to create his Myspace page. The template was designed by Newsvine Founder and CEO Mike Davidson (original template is here). Davidson gave the template code away to anyone who wanted to use it, but asked that he be given credit when it was used, and told users to host their own image files.

McCain’s staff used his template, but didn’t give Davidson credit. Worse, he says, they use images that are on his server, meaning he has to pay for the bandwidth used from page views on McCain’s site.

Davidson decided to play a small prank on the campaign this morning as retribution.

John McCain’s MySpace Page “Enhanced”

Absolut Hacker + Red Bull

My mailbox is being filled with IETF announcements for the upcoming meeting in Prague. I see internet draft after internet draft making proposals that are going to cause implementation errors, security holes, and ultimately service outages.

Take for example the prime candidate protocol for VOIP - SIP... SIP is far too complex.

Consider how long it has taken to deploy IPv6 - a technology that celebrated its 10th anniversary a few years ago. And IPv6 has the luxury of being an alternative to IPv4 rather than a transparently compatible upgrade. Consider how much longer it will take to deploy VOIP protocol redesigns when the old protocol is embedded in telephones around the world?

I have great concern that our approach to the internet resembles a high pillar of round stones piled on top of other round stones - we should not be surprised when it begins to wobble and then falls to the ground.

Are We Slowly Losing Control of the Internet?

This is, without doubt, the best disguised bullet/stab-proof jacket we have ever come across. You won't find it anywhere else and you will never find a protective jacket as smart as this one. The protection levels it offers are quite unheard of in such a light,3 kilo, and discreet jacket.

This jacket offers a protection level to NIJ STD 0101.04 level 11A and European Police Standard for tactical vests RPS B (1999).

The armour protects against 9mm Full Metal Jacket Round Nose (FMJRN) projectiles, with a weight of 8gm (124gr) at 430 m/s. Full Metal Jacket Round Nose (FMJRN) type DM11A1B2 (DN or MEN) projectiles with a weight of 8gm (124gr) at 415m/s. 44 Magnum jacketed Soft Point (JSP) type Norma 11103/61103 projectiles with a weight of 15.6gm (158gr) at 390 m/s. 44 Magnum Jacketed Hollow Point (JHP) projectiles with a weight of 15.6gm (240gr) at 430 m/s. Eastern European Tokarev LC 7.62 x 25mm steel core projectile with a weight of 5.5gm at 455 m/s.

This jacket also protects against stabs, cuts, slashes with sharp and blunt edged weapons like hypodermic needles, ice picks, knives and broken bottles up to 25 Joules according PSDB (2003).

Now that's my kinda fashion...

I wonder if they sell the ballistic inserts separately... My flowing black leather trench coat badly needs a new liner. It's starting to fall apart. I was thinking earlier this week that it would be the pinnacle of utilitarian hacker fashion to have the liner replaced with a ballistic insert capable of stopping handgun rounds and knives..

Bullet/Stab Proof Jacket

Holy moly that is a close up zoom of a camel (see my screenshot above) – and it works for other place on Google Maps too! Yes, it turns out that you can zoom in much more deeply onto Google Maps by doing this:

1. Select a location and switch to satellite view
2. Zoom in as far as you can, and click “link to this page” at the top right
3. Now replace the “z” parameter in the URL with a higher value, e.g. 20, 22, or 23, and wait. Some locations will now show more detailed imagery

Interesting. I have not found any area of interest yet that goes deeper than advertised. It appears this will only be useful in areas that Google already intends it to be useful.

Super-Close Google Maps Zooms hack

Acidus's Stripe Snoop was discussed by Mark Frauenfelder on the Colbert Report!

Mark Frauenfelder on the Colbert Report