kbs

If you're interested in the actual details of the implementation of the syntax table, I had a great exchange on the 6502.org forum a couple of years back.

http://forum.6502.org/viewtopic.php?p=17736

There is a (relatively easier to understand) stack-based expression evaluator, with hooks to allow for operator precedence. The interesting part is the scanner, which converts each line of BASIC into the tokens used by the evaluator. This is the bit that has the "syntax table diagram".

You may also find this article by Woz on the Apple][ from the '77 BYTE magazine a pretty interesting read.

http://www.downloads.reactivemicro.com/Public/Users/Grant_St...

kbs

13 anni fadiscuss

If you are interested in the evolution of movable type and what Gutenberg might have really invented - Blaise Aguera [of PhotoSynth fame, among many other things] did some fascinating research into the glyphs that appear in the books printed from Gutenberg's printing presses.

For instance - there are a surprisingly large number of variations in any given glyph [say, the "p" glyph.] These are variations in the actual bit of metal used to print the glyph at that location, rather than some sort of printing glitch.

This is odd because Gutenberg is generally credited for inventing the movable type using a matrix[1] and type cast from a matrix would not show such variations. Blaise speculates he might have instead cast each type in sand, individually; which would destroy the mould after each type was cast. He thinks he might have used something like a small wooden stick to re-create the shape in sand for each casting. There's some substructure in many glyphs which give some credibility to this hypothesis.

On the flip side, Gutenberg may not have been given credit for Linotype[2] - where a whole line (or in Gutenberg's case, two lines) were cast all at once, rather than arranging individual glyphs.

If you find this sort of stuff interesting - do watch his presentation[3] - great stuff.

[1] https://en.wikipedia.org/wiki/Matrix_%28printing%29

[2] https://en.wikipedia.org/wiki/Linotype_machine

[3] https://research.microsoft.com/apps/video/dl.aspx?id=104803

kbs

14 anni fadiscuss

They are also using a 'sosumi' comment, guess they still want to tweak someone's nose.

    $ curl -s www.apple.com/uk/ | grep -A 1 /sosumi
    </div><!--/sosumi-->
    <p class="statement">On 25 October 2012, Apple Inc. published a statement on its UK website...

kbs

14 anni fadiscuss

I'd added a link and some notes as a comment on a related post here: http://news.ycombinator.com/item?id=4636655

Here is a link to an article with a few more details about the technique being used.

http://productsecurityblog.emc.com/2012/10/split-value-crypt...

kbs

14 anni fadiscuss

There are a few more technical details at

http://productsecurityblog.emc.com/2012/10/split-value-crypt...

The basic system decribed doesn't appear use hashes, just xor operations. Of course, it may layer this system on top of other security measures like salted hashes and so forth.

As described above, two servers are used (Red and Blue). Given a password p, the Red server stores a random number R, while Blue stores (p xor R).

To verify whether a given password s is correct, a client first generates another random number r. It sends r to Red, and (s xor r) to Blue.

Red computes (r xor R), while Blue computes (p xor R) xor (s xor r), and the results are compared. The results are identical if and only if p == s, ie. when the passwords match.

Neither the query operations nor the data stored reveal the password to either Red or Blue in isolation; data in both servers must be combined to recover a password. The assumption is that this reduces the risk by forcing an attacker to hack both servers rather than just one.

To further mitigate attacks, the entries in both Red and Blue are periodically xor'ed with another random sequence R_t.

In other words, the entry for a user in Red changes over time as

R

(R xor R_1)

(R xor R_1 xor R_2)

...

while Blue stores

(p xor R)

(p xor R xor R_1)

(p xor R xor R_1 xor R_2)

and so on

Now the attacker must obtain both databases within the same window to recover the password.

Submissions

Show HN: Succinctly manipulate dom-like trees from java

Mat Honan: How Apple and Amazon Security Flaws Led to My Epic Hacking

comments