Jun 172012
 

If you hang out at the more high falutin’ photographic forums on the Internet, you will sooner or later (and usually sooner) encounter a variation on the theme that somehow film endows a piece of work some extra artistic value, and (the quite possibly true) sentiment that in the art-market that high value photographic art is usually analogue in nature (such as the work of Sally Mann) because somehow the process of working the analogue process adds some sort of artistic value to the final work.

Which is just so much horseshit of course – with the greatest respect to those who prefer to work in analogue methods.

There is a very fuzzy boundary between what is art and what is artisanship; whether or not an object has any artistic value, it can still have added value because of the work the craftsperson has put into a work – a hand knitted cardigan is worth more than a machine knitted one. Although I suppose I should note that if the person doing the knitting is your own granny, it’s a whole different ball-game (and it gets even weirder when your granny was also a professional hand knitter!).

There is no great harm in adding the value of the artisanship to the value of a piece of art; what is harmful is assuming that the artisanship contributes to the quality of the art. It isn’t so.

To use the photograph as an example, an image is sensational by provoking thought and emotion not because it is an 8×10 contact print, but because of the image. You could be looking at the original 8×10 contact print by the photographer, or looking at one of a thousand inkjet prints of a scan of the original film; the artistic value is the same (but not the financial value).

Similarly with any art work that can be reproduced – a painting that can be scanned and printed, a sculpture that can be scanned and manufactured using a CNC machine. Although the original may have the addition of an emotional attachment to the artist, any competent reproduction should still encapsulate the artistic vision that was crafted into the original.

Although far smaller than the original, doesn’t this reproduction of “The Scream” (borrowed from the Wikipedia article) still tell the same story as the original ?

As an another example, good literature is just as much art as the finest painting. Yet we do not question the value of reading from a reproduction – who insists on reading the original of The Ballad Of Reading Gaol and insists that reproductions (i.e. any book) has no value ?

If a reproduction can reproduce the artistic vision of the original, it implies that the true original art work is actually the artist’s vision and what we call the original, is just the first reproduction of the artist’s vision. The artist needs to be a competent craftsperson to reproduce that vision in the medium of their choice and may influence the original vision, but it is still a reproduction.

There is a belief that analogue techniques for reproducing artistic visions have a greater value than digital techniques. Why should this be?

In either case, the original vision is still the same; the artist has merely chosen to choose different crafts to reproduce that vision. And despite the critics beliefs, digital techniques still need a good craftsperson to execute those techniques. It may be that digital techniques are easier (although I believe it is more that they are more available) than analogue techniques.

 

Jun 152012
 

Today somebody finally woke up and realised that the amount of time that pedestrians get to cross the road at a crossing is ludicrously short. They concentrate on the problem that the elderly have in crossing a road in the short time that the little man shows green.

But they are not the only ones who can have trouble. And it is not just about the trouble in crossing in time.

Why should pedestrians huddle at the edge of the road waiting until they get the chance to rush across the road tugging at their forelocks ? Car drivers may protest that giving pedestrians more priority will slow them down, but come on – it isn’t as if you don’t get there quicker than pedestrians anyway. What is a few extra minutes ?

Car drivers might argue that because they pay so much in motoring taxes that they deserve extra priority on the roads. Well, it’s an interesting argument, but is really totally irrelevant. Taxes of any kind are raised in all sorts of different ways and put into a common pool from which government spending is taken – both central government and local government. And the government decides how much will be spent on roads in competition with all the other demands on government funds.

And roads are not the only costs that motoring causes – there is also dealing with the health issues related to motoring such as accidents and respiratory issues.

Besides which, the way that local roads are funded – and all pedestrian crossings are on local roads – means that a relatively small proportion of the costs is made up of motoring taxes. No council funds come directly from motoring taxes, but from council taxes instead. Which means that pedestrian waiting to cross the road may actually be paying more towards the roads than you think.

Besides which it is not simply about the money, but about simple fairness and safety. In terms of safety, the lights need to be green not just long enough to allow slower pedestrians to cross the road, but also to allow pedestrians who are reasonably close to the crossing to cross the road. And even long enough at cross-roads to allow pedestrians to cross both roads – to do the equivalent of a left or right turn.

 

 

Jun 062012
 

If you have not already heard about it, and you have a LinkedIn account, you should be aware that a large number of password hashes has been found in the wild. This means it is possible that hackers have the ability to crack your password and break into your account.

Change any LinkedIn account passwords now.

But there are still just a few unanswered questions :-

Why were the password hashes unsalted ?

Storing passwords in the clear is just about the most irresponsible thing a website operator can do, but storing passwords in hashed form without a so-called salt is also a clear indication that someone needs a slap and told to go the extra 10m. It has long been known (i.e. for decades) that using a simple password hash allows for someone to find out what the original password was.

This is why the Unix system from the 1970s used a salt to make revealing passwords harder.

Technically a salt is a few extra bits of randomness added to the hash (and included in the output) to make pre-computing the password hashes more expensive. It also obfuscates identical passwords.

So why weren’t LinkedIn salting their passwords? Couldn’t be bothered? Assumed that their systems were so secure that nobody could break in? Whatever the reason, it was not a good enough reason – allowing their site to be hacked is bad enough, but caring so little about the security of our data shows pure incompetence and arrogance.

Are We Sure These Password Hashes Belong To LinkedIn?

In a word: No. We assume it is, and there’s some evidence to support that assumption. Several bloggers (one), have posted indicating that they have checked and found that their own LinkedIn password hash can be found in the file.

So we can assume that these password hashes are from LinkedIn, and to change our password if we have an account. Perhaps this is wrong and this huge list of password hashes is just some prankster’s idea of a fun day, but this is one of those cases where you assume it is real to be safe.

But There Are No Usernames. Aren’t We Safe?

I’ve come across at least one comment indicating that because the usernames aren’t associated, there isn’t anything to worry about.

It is true that the information as released is not especially helpful – if you cracked all the password hashes you still wouldn’t know if my password was #32768, #65536, or any of the others. But you could still use that information with the help of a botnet army and enough time to let the tools like Hydra do their work.

And we do not know that the person or group who obtained this information in the first place does not have access to further information. Even if all they had access to was a database table containing just the password hashes, they will almost certainly know the frequencies of every password.

So no, we’re not safe.

Only 6.5million? I Thought LinkedIn Had 150million Accounts?

Indeed! It does seem strange that there are only 6.5million password hashes in the released file.

But those who have had a chance to poke around in the released file (including myself) have found that there are no duplicate hashes. Which would be normal in a salted password hash file, but given how woeful most people are at picking good passwords you would expect a very large number of duplicates in 150 million password hashes. Whether you would get as few as 6.5 million unique password hashes seems a touch unlikely, but possible.

Of course it may be that the person or group who grabbed this password dump in the first place only managed a partial dump for some reason.

But If The Original Leak Isn’t Fixed, Isn’t Changing Our Password A Waste Of Time?

It is certainly true that if LinkedIn hasn’t fixed their original problem, or has not implemented some form of remedial action, then it is possible that an attacker could break in with exactly the same method as they did before, and steal the passwords again. Which means we will probably have to change our passwords again – once LinkedIn finally gets around to announcing this has all been fixed.

But not changing your password now is foolish in the extreme – you should assume that the attacker(s) have your account details now.

Jun 042012
 

You know those annoying ads you can see surrounding this posting ? The ones that don’t go anywhere near paying for the costs of running this site ?

I get to see them myself, and was somewhat surprised to find one today that had just a teensy little problem with it :-

Nine Mistakes You Should Avoid in 2011

Which was advertising a financial services company. Got to admit that whilst anyone can make a mistake, I would be very unlikely to let someone near my money who is likely to make this sort of mistake!