9 ms·
Why the Sun 2 has a message “Love your country, but never trust its government”
- lultimouomo 11y agoI wonder if this trap street message, which was inserted in some code initializing a DES chip, was chosen because it was rumored that NSA had backdoored DES. The article doesn't mention it, but it would be quite a coincidental choice!
- Arnt 11y agoOr maybe it was just put there because a clone maker might change functionality but would be sure not to cast a glance at crypto-related code. Noone audits crypto code, right?
- tptacek 11y agoThe entire article explains what the string is doing there. You don't have to speculate.
- lultimouomo 11y agoThe article explains that the message is a trap street; it says that Gilmore had read it and noted it years before and at he "plucked it" as the secret message. I can't seem to find in the article the reason he plucked just that message, and why he stuffed it in the DEC routine. Am I missing something?
- new299 11y agoJohn Gilmore's political views are well known. And the statement was likely chosen because he felt it was inline with his own beliefs: https://en.wikipedia.org/wiki/John_Gilmore_%28activist%29 https://en.wikipedia.org/wiki/John_Gilmore_%28activist%29
- nailer 11y agoWhoa. Fifth employee at Sun, wrote the first version of what became DHCP, started the EFF. What an awesome life.
- coldpie 11y agoHe stopped by our offices last year on his way across the country and we took him out to lunch. He seemed genuinely thankful when I told him I'm an EFF supporter. Fun guy to talk to, and he's really into what the EFF is doing.
- eternalban 11y agoHis website: http://www.toad.com/gnu/ http://www.toad.com/gnu/
- DonHopkins 11y agoYes, the message is totally in keeping with John's character. "Contributed to lively corporate culture" is one way of putting it! ;) http://www.toad.com http://www.toad.com http://www.toad.com/gnu/ http://www.toad.com/gnu/ Things I've Put A Lot of Energy Into Sun Microsystems Sun is a computer manufacturer, long a leader in the technical workstation and database markets. Many Web pages are served from a Sun server. Sun is now a multi-billion-dollar company; working there made me financially independent. It was acquired by Oracle in 2010. I was its fifth employee, and later a consultant. I handled architecture, design, implementation, and debugging of Sun Workstations. Wrote and maintained bootstrap and diagnostic ROMs for the Sun-1, Sun-2, and Sun-3. Debugged first prototypes of Sun-1 and Sun-2, working with the hardware designer. Worked on first bringup ever of Unix on Motorola 68010 and 68020. Designed and diagnosed the chip designs for the SPARCstation-1 and SPARCstation-2. Straddled the hardware and software camps to locate, explain, and solve design, implementation, and manufacturing problems. Pulled many chestnuts out of fires. Debugged Unix utilities, kernel, device drivers, and CAD software. Diagnostics. Documentation. Electronic mail maintenance, support, and enhancement. Performance and code generation improvement. General technical support. Network relations. Contributed to lively corporate culture.
- ethbro 11y agoIt's DES. And yes. "Vinod Khosla, first President of Sun, came to me at one point and said to put something hidden, triggered in an unexpected way, into the ROM Monitor, so that if somebody cloned the Sun Workstation (violating our software’s copyright), we could do that unexpected thing to the competitor’s demo workstation at a trade show and thereby prove that they had cloned it." "I had found that saying years before on a hand-painted sign tacked up on a pole or tree in central Pennsylvania, wrote it into one of my notebooks at the time, and plucked it out as the hidden thing after Vinod asked."
- lultimouomo 11y agoThanks for the spelling correction, very helpful. By the way, I read your quote twice but I can't find any mention of NSA and DES backdoors.
- DonHopkins 11y agoIf you hit L1-A to get into the boot monitor and typed the phrase "Love your country but never trust its government.", it would simply echo it back to you instead of printing an error. There was definitely no DES software in the Sun boot ROMs, and the DES chips were optional and rarely used. If there was any DES software in the boot ROMs, it would have been illegal to ship Sun Workstations overseas, since DES software was officially considered an export controlled munition. To address that problem, John funded and helped build Deep Crack [1], a hardware DES cracker, whose purpose was to prove that it was well within the capabilities of the NSA to crack DES (which they lied to deny), since EFF could do it for a few hundred thousands of dollars. They published a book with the VHDL source code so you could build you own, which didn't include a floppy disk because that would have been considered a munition, so they printed the checksummed source code in the book along with software to reliably bootstrap scanning it in and validating it. (Like a software error correcting paper floppy disk, to get around the stupid export control laws.) >In 1998, the EFF built Deep Crack for less than $250,000. In response to DES Challenge II-2, on July 15, 1998, Deep Crack decrypted a DES-encrypted message after only 56 hours of work, winning $10,000. This was the final blow to DES, against which there were already some published cryptanalytic attacks. The brute force attack showed that cracking DES was actually a very practical proposition. Most governments and large corporations could reasonably build a machine like Deep Crack. >Six months later, in response to RSA Security's DES Challenge III, and in collaboration with distributed.net, the EFF used Deep Crack to decrypt another DES-encrypted message, winning another $10,000. This time, the operation took less than a day – 22 hours and 15 minutes. The decryption was completed on January 19, 1999. In October of that year, DES was reaffirmed as a federal standard, but this time the standard recommended Triple DES. >The small key-space of DES, and relatively high computational costs of Triple DES resulted in its replacement by AES as a Federal standard, effective May 26, 2002. [1] https://en.wikipedia.org/wiki/EFF_DES_cracker https://en.wikipedia.org/wiki/EFF_DES_cracker John Gilmore {sun,pacbell,uunet,pyramid,amdahl}!hoptoad!gnu gnu@toad.com Love your country but never trust its government. -- from a hand-painted road sign in central Pennsylvania
- geofft 11y agoAs far as I can tell, it was not inserted in code initializing a DES chip. It was shipped with the ROM monitor, and the DES chip, which would have been initialized by software (not boot ROM), was not even shipped. The article is a little confusing but it looks like an email reply to multiple questions, the first one "Why this message" and the second one "Why the empty chip slot". (And the third one about a Sun-2 emulator, which also comes out of nowhere.)
- tokenizerrr 11y agoI may be missing something, but what is the link between the DES chip and the message being triggered? Because the message shouldn't be triggered without doing the convoluted key combination, right?
- ams6110 11y agoGilmore's reply seems to be in the context of a thread that had discussed the DES chip.
- DonHopkins 11y agoIt had nothing to do with the DES chip, which was optional. The phrase was in the Sun-2 boot ROMs, which John wrote.
- alienjr 11y agoAsk NSA...
- lewiscollard 11y agoHN hug of death, so cached version (text-only): http://webcache.googleusercontent.com/search?q=cache:https://nohats.ca/wordpress/blog/2016/01/24/why-the-sun-sparc2-has-the-message-love-your-country-but-never-trust-its-government/&num=1&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:https:/...
- bostonpete 11y agoHN has a hug of death now? Man, this place is turning into reddit... ducks
- jamescun 11y agoWith regards to the copy protection aspect, it was a pretty common practice back in the day (perhaps even still is). In the Macintosh Classic's ROM, there were debug sequences that not only would display pictures of the development team, but write the text "STOLEN FROM APPLE COMPUTER" to the screen. http://appletothecore.me/files/mac_se_easter_egg.php http://appletothecore.me/files/mac_se_easter_egg.php
- Tloewald 11y agoThat's in part because Apple was the canonical case of a company whose ROMS were stolen by cloners.
- _0ffh 11y agoWhen digging inside my Acorn Risc-PC I once found a message along the lines of "Help! We are being kept in a cellar and forced to write software!"... :-)
- _0ffh 11y agoOkay, I checked on the details. The verbatim message was "Help! We're being held prisoner in a software factory!". Close enough! :)
- rwmj 11y agoA reference to this story? https://store.bbc.com/jackanory/help-i-am-a-prisoner-in-a-toothpaste-factory https://store.bbc.com/jackanory/help-i-am-a-prisoner-in-a-to...
- edwintorok 11y agoIs it similar to this easter egg? http://www.mackido.com/EasterEggs/BlueMeanies.html http://www.mackido.com/EasterEggs/BlueMeanies.html
- mikeash 11y agoThat's good, it's more obviously a joke. Your original could almost be confused with a legitimate cry for help!
- draw_down 11y agoNor its marketing industry.
- Hello71 11y ago> NFS ran in plaintext and used the sender’s IP address for authentication and it still does
- markild 11y agoThere are solutions though[1] [1]: https://wiki.debian.org/NFS/Kerberos https://wiki.debian.org/NFS/Kerberos
- pjc50 11y agoActually getting Kerberos+NFS to work is a huge pain, though. Then there's the consideration of userid mapping.
- toast0 11y agoUserid mapping is easy: Centrally manage the password file, so you don't need to map. Anything else is madness; hopefully you figure this out early, it is painful to fix later.
- gm3dmo 11y agoToo right. The madness arrives when you have to retrofit the mapping and people have used different uid numbers for the same user and different users have the same uid across machines.
- DonHopkins 11y agoIt was much worse than that. Back when I was a summer intern at Sun in 1987, it was common knowledge among the engineers at Sun that NFS stood for "No File Security", and the rpc mount protocol would trust the client to tell the server its host name, which the server would look up in /etc/exports to decide how much to trust it. So if you know that Scott McNealy's workstation's name was "doober" (which it was), and it gave permission to a server named "mama", then on any workstation you could type: % hostname mama; mount doober:/usr /mnt; hostname `hostname` And you'd have Scott McNealy's /usr file system mounted. This also worked over the internet!
- eternalban 11y agoSun Microsystems Founders Panel - CHM [1]. [1]: https://youtu.be/dkmzb904tG0?t=1h38m29s https://youtu.be/dkmzb904tG0?t=1h38m29s
- dsugarman 11y agoIf anyone was curious, this quote is credited to Robert A. Heinlein, a science fiction writer.
- digi_owl 11y agoMore and more it seems like trusting any large org structure is a fools errand.
- robotresearcher 11y ago> More and more Same as always, rather.
- mixmastamyk 11y agoGreat quote. I usually use wikiquote to verify attribution, but this one is not mentioned there. Is there any proof, or is this simply the most popular attribution? Sadly, most are simply popular, which has led me to be suspicious.
- liquidise 11y agoi strongly recommend The Moon is a Harsh Mistress (one of Heinlein's more celebrated novels) to tech-savvy political thinkers. It is a fascinating take on sovereignty in a futuristic world.
- Kristine1975 11y agoOracle did something similar with the network protocol of its database driver. Not to prevent copying, but to prevent others from writing their own drivers: http://dacut.blogspot.de/2008/03/oracle-poetry.html http://dacut.blogspot.de/2008/03/oracle-poetry.html
- tempVariable 11y agoOK, is this for real ? Does everyone have to use the Oracle OCI library under the hood ?
- Natsu 11y agoDefinitely real. I WTF'd the first time I read that poem out of a packet capture.
- GlitchMr 11y agoI doubt that it would work in practice. Sega tried similar thing (requiring games on Sega Genesis to print "PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES LTD.") to block interoperability, and they lost a case against Accolade.
- JoshTriplett 11y agoLEGO tried to do the same thing with their Mindstorms SDK.
- johngalt 11y agoI had a fluke network tester that would put "elvis lives" in the padding of it's ping tests.
- kjs3 11y agoI have one of those!
- United857 11y agoApple does something like this as well: https://news.ycombinator.com/item?id=8579272 https://news.ycombinator.com/item?id=8579272
- webXL 11y agoIsn't there a name for this? Poison pill? Logic bomb? Honey token? http://www.sans.edu/research/security-laboratory/article/log-bmb-trp-door http://www.sans.edu/research/security-laboratory/article/log...
- nisse72 11y agoCopyright trap https://en.wikipedia.org/wiki/Fictitious_entry#Copyright_traps https://en.wikipedia.org/wiki/Fictitious_entry#Copyright_tra...