6 ms·

Even though this happened a long time ago, whenever I hear or think about it, I am a mazed that it didn't put Xerox out of business, or at least hurt a little m

by lynx23 3y ago

Even though this happened a long time ago, whenever I hear or think about it, I am a mazed that it didn't put Xerox out of business, or at least hurt a little more. After all, some big players were already doing digital archiving at the time. :-/ BTW, the CCC had a pretty neat presentation at that time as well: https://www.youtube.com/watch?v=c0O6UXrOZJo https://www.youtube.com/watch?v=c0O6UXrOZJo

masswerk 3y ago
Maybe, these – the demise of Xerox not happening and the size of the players involved – are related? As in: none wants their archives and data bases put in question? (Meaning, in order to claim damages, you'd have to admit that there is damage, indeed.)
- r4indeer 3y ago
  But Xerox has admitted that the character substitution was enabled on all compression levels even though they claimed it was only active on one specific level. So theoretically, everyone who archived during that time using Xerox WorkCentres has to question their documents.
  - masswerk 3y ago
    Which might be exactly, why nobody wants to talk about this. (This may be especially nasty where archives had been digitized and then the analog originals were disposed of. What can you even do about this?) PS: In order to have learned anything from this, there should be a rule for the digitization of archives containing core documents to use (at least) two unrelated scanning technologies, with unrelated processors and unrelated software from different sources (much like Airbus does it with flight computers). A sole, single scan should attribute to nothing.
    - sofixa 3y ago
      > In order to have learned anything from this, there should be a rule for the digitization of archives containing core documents to use (at least) two unrelated scanning technologies, with unrelated processors and unrelated software from different sources But what do you do in case of conflict? There's no way of resolving it, so for this type of thing to be more effective, you'd need 3 different scans, and a quorum of 2 to decide the real version.
      - masswerk 3y ago
        Knowing that the data is unreliable is something already. Then, you can apply heuristics. And, if there is a systematic error, you should be able to detect this, eventually. (E.g., what is the unreliable series, what is the bug and when is it triggered?) But, yeah, this is why I wrote "at least".
    - r4indeer 3y ago
      I'm pretty sure that Kriesel said in his C3 talk that at least one company called and told him that they scan and dispose of the originals. You can't do anything at this point. You're probably right – they rather just want to forget about it because the only correct solution would be to scrap everything. My original comment was more aimed at the point that damage would need to be admitted. But they did admit it, which makes it evermore confusing why nothing really happened after that, at least publicly. I don't think that TMR or similar overhead would be practical. Just ban compression algorithms that do pattern matching and substitution for archival purposes (like the German BSI did).
      - masswerk 3y ago
        There's a scene in the Cryptonomicon, where Goto Dengo's (a lieutenant in the Japanese Imperial Army in WWII) convoy is sunk by a US air attack. This involves a new weapon, which also requires a crucial change in tactics – and he knows that the Imperial Army has lost the war: this is not how the Americans are supposed to attack, how could this happen? Notably, this requires that several high ranking figures observe, comprehend and admit that their tactics are ineffective, that they are wrong – and invent and implement something new and adjust their tactics, instead, involving the entire chain of command. This shouldn't happen. They must have all killed themselves. No warrior of principles would admit to such a fault, commit to the shame, and change tactics in the midst of the war…
        HPsquared 3y ago
        Given that science progresses one funeral at a time, the practice of seppuku would seem to allow the Imperial Japanese officer corps to evolve their tactics more rapidly than most.
        masswerk 3y ago
        The problem being that many of our big corporations and institutions are much like an Imperial Army, but without the culture of seppuku. They have overrun considerable territory and established the Greater Welfare Zone, including its glacis and satellites, by adhering to concise, even gruel tactics. This works. This is how it works. If we just stick to the tactics and principles, this will continue to work. This is how we do things… Admitting fault and accepting shame, just to veer off proven and established procedures, isn't only a serious danger to your career, it also endangers the greater good, we've all committed to… There's too much at stake. (Compare how we are all just forced to throw out even the basics of AI safety out of the window. There's no alternative. Let's suppose that Banzai attacks do work…)
    - toast0 3y ago
      > A sole, single scan should attribute to nothing. That's not much less than a sole, single repository of paper documents that may not be climate controlled or fire protected (or the fire protection may be sprinklers which will ruin most of the documents anyway). Document digitalization is a cost saving program, but it doesn't save money if you need to have two vendors, validate the vendors are actually separate and remain actually separate, have a comparison process and an exception process. If the requirements are too high, paper remains and nobody uses the documents because the retrieval costs in labor and time are too high.
garfieldandthe 3y ago
The youtube link is David presenting his work that he describes in the originally linked article. One of the legendary presentations in CCC's history.
KennyBlanken 3y ago
What's even more amazing is that it wasn't retracted from the PDF standard. Everyone knew how dangerous it was, changing digits, but it was left in the standard and in many implementations. Years and years later, someone implements a turing machine using it, hacks journalist's iPhones, and the question is: why did modern systems implement it?
- acqq 3y ago
  > implements a turing machine Just searched for some details, it's amazing, all this inside of a JBIG2 image: "Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations." https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
- josefx 3y ago
  > changing digits, but it was left in the standard and in many implementations. The format has a lossless mode that would have saved Xerox a lot of trouble, of course it was just that mode that was used to hack the iPhones. Also for many texts you don't need every digit to be correct, hell any single typo, smudge or bad font can fuck you over if that is the case, no need for a Xerox. Ideally your numbers either include a checksum or have some other redundancy, like requiring that they are written out as words.
BiteCode_dev 3y ago
PRISM didn't kill companies, Apple home button scandal didn't touch it, sony infecting its users with a rootkit didn't make it sell less playstations, HP lying cartridges had no impact on its long term business... Fines and green washing are budgeted and only a small fractions of the profit they make by misbehaving. On this very site you can read regularly people telling you we should forget about the MS of the past because now they are good guys. So they can get away with corruption, sabotage, monopoly abuse, insulting the competition, stealing, lying, patent trolling, etc. No problem. Bill Gates is a wonderful person and a great philanthropist nowadays. The corporations and billionaires have found the recipe to get away with everything. The humans were always hackable.
- lynx23 3y ago
  Well said, I couldn't agree more, unfortunately... I also noticed the "MS is cool now"-cult, felt surreal and almost like deliberate misinformation. Classic counterpart to FUD, Honeypotting. However, more people seem to fall for that because it is less known, and games the "assume good intentions"-virus.
- usrusr 3y ago
  Not so sure about HP. I mean yeah, their inkjet ploy still pays for itself I suppose, but at this point I consider home photo printing as basically dead, killed by greed, and those printer divisions as little more than autonomous external marketing divisions for those ubiquitous b/w Brother boxes.
- azalemeth 3y ago
  I guess part of the problem with boycotts is that it's very hard to know who will not buy your product because of e.g DRM, and who won't buy it because they're not interested in it. I haven't bought a single Sony product since the rootkit fiasco, but I've never been able to tell them this directly. I don't buy products with DRM in them. I just don't. I'm not going to be appearing in the balance sheet, however, and won't appear in the calculus of lost growth for an MBA. The only time I think boycotts do work is when they cause a direct negative action to a company's bottom line that is sufficiently obvious that an accountant can see it. Long, slow protests -- such as exist against Nestlé for example -- are worthy but likely for the birds.
ensocode 3y ago
too big to fail
m3affan 3y ago
This was an amazing talk. He did a great job keeping it entertaining.

by lynx23 3y ago

masswerk 3y ago

Maybe, these – the demise of Xerox not happening and the size of the players involved – are related? As in: none wants their archives and data bases put in question? (Meaning, in order to claim damages, you'd have to admit that there is damage, indeed.)

r4indeer 3y ago
But Xerox has admitted that the character substitution was enabled on all compression levels even though they claimed it was only active on one specific level. So theoretically, everyone who archived during that time using Xerox WorkCentres has to question their documents.
- masswerk 3y ago
  Which might be exactly, why nobody wants to talk about this. (This may be especially nasty where archives had been digitized and then the analog originals were disposed of. What can you even do about this?) PS: In order to have learned anything from this, there should be a rule for the digitization of archives containing core documents to use (at least) two unrelated scanning technologies, with unrelated processors and unrelated software from different sources (much like Airbus does it with flight computers). A sole, single scan should attribute to nothing.
  - sofixa 3y ago
    > In order to have learned anything from this, there should be a rule for the digitization of archives containing core documents to use (at least) two unrelated scanning technologies, with unrelated processors and unrelated software from different sources But what do you do in case of conflict? There's no way of resolving it, so for this type of thing to be more effective, you'd need 3 different scans, and a quorum of 2 to decide the real version.
    - masswerk 3y ago
      Knowing that the data is unreliable is something already. Then, you can apply heuristics. And, if there is a systematic error, you should be able to detect this, eventually. (E.g., what is the unreliable series, what is the bug and when is it triggered?) But, yeah, this is why I wrote "at least".
  - r4indeer 3y ago
    I'm pretty sure that Kriesel said in his C3 talk that at least one company called and told him that they scan and dispose of the originals. You can't do anything at this point. You're probably right – they rather just want to forget about it because the only correct solution would be to scrap everything. My original comment was more aimed at the point that damage would need to be admitted. But they did admit it, which makes it evermore confusing why nothing really happened after that, at least publicly. I don't think that TMR or similar overhead would be practical. Just ban compression algorithms that do pattern matching and substitution for archival purposes (like the German BSI did).
    - masswerk 3y ago
      There's a scene in the Cryptonomicon, where Goto Dengo's (a lieutenant in the Japanese Imperial Army in WWII) convoy is sunk by a US air attack. This involves a new weapon, which also requires a crucial change in tactics – and he knows that the Imperial Army has lost the war: this is not how the Americans are supposed to attack, how could this happen? Notably, this requires that several high ranking figures observe, comprehend and admit that their tactics are ineffective, that they are wrong – and invent and implement something new and adjust their tactics, instead, involving the entire chain of command. This shouldn't happen. They must have all killed themselves. No warrior of principles would admit to such a fault, commit to the shame, and change tactics in the midst of the war…
      - HPsquared 3y ago
        Given that science progresses one funeral at a time, the practice of seppuku would seem to allow the Imperial Japanese officer corps to evolve their tactics more rapidly than most.
        masswerk 3y ago
        The problem being that many of our big corporations and institutions are much like an Imperial Army, but without the culture of seppuku. They have overrun considerable territory and established the Greater Welfare Zone, including its glacis and satellites, by adhering to concise, even gruel tactics. This works. This is how it works. If we just stick to the tactics and principles, this will continue to work. This is how we do things… Admitting fault and accepting shame, just to veer off proven and established procedures, isn't only a serious danger to your career, it also endangers the greater good, we've all committed to… There's too much at stake. (Compare how we are all just forced to throw out even the basics of AI safety out of the window. There's no alternative. Let's suppose that Banzai attacks do work…)
  - toast0 3y ago
    > A sole, single scan should attribute to nothing. That's not much less than a sole, single repository of paper documents that may not be climate controlled or fire protected (or the fire protection may be sprinklers which will ruin most of the documents anyway). Document digitalization is a cost saving program, but it doesn't save money if you need to have two vendors, validate the vendors are actually separate and remain actually separate, have a comparison process and an exception process. If the requirements are too high, paper remains and nobody uses the documents because the retrieval costs in labor and time are too high.

garfieldandthe 3y ago

The youtube link is David presenting his work that he describes in the originally linked article. One of the legendary presentations in CCC's history.

KennyBlanken 3y ago

What's even more amazing is that it wasn't retracted from the PDF standard. Everyone knew how dangerous it was, changing digits, but it was left in the standard and in many implementations. Years and years later, someone implements a turing machine using it, hacks journalist's iPhones, and the question is: why did modern systems implement it?

acqq 3y ago
> implements a turing machine Just searched for some details, it's amazing, all this inside of a JBIG2 image: "Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations." https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
josefx 3y ago
> changing digits, but it was left in the standard and in many implementations. The format has a lossless mode that would have saved Xerox a lot of trouble, of course it was just that mode that was used to hack the iPhones. Also for many texts you don't need every digit to be correct, hell any single typo, smudge or bad font can fuck you over if that is the case, no need for a Xerox. Ideally your numbers either include a checksum or have some other redundancy, like requiring that they are written out as words.

BiteCode_dev 3y ago

PRISM didn't kill companies, Apple home button scandal didn't touch it, sony infecting its users with a rootkit didn't make it sell less playstations, HP lying cartridges had no impact on its long term business... Fines and green washing are budgeted and only a small fractions of the profit they make by misbehaving. On this very site you can read regularly people telling you we should forget about the MS of the past because now they are good guys. So they can get away with corruption, sabotage, monopoly abuse, insulting the competition, stealing, lying, patent trolling, etc. No problem. Bill Gates is a wonderful person and a great philanthropist nowadays. The corporations and billionaires have found the recipe to get away with everything. The humans were always hackable.

lynx23 3y ago
Well said, I couldn't agree more, unfortunately... I also noticed the "MS is cool now"-cult, felt surreal and almost like deliberate misinformation. Classic counterpart to FUD, Honeypotting. However, more people seem to fall for that because it is less known, and games the "assume good intentions"-virus.
usrusr 3y ago
Not so sure about HP. I mean yeah, their inkjet ploy still pays for itself I suppose, but at this point I consider home photo printing as basically dead, killed by greed, and those printer divisions as little more than autonomous external marketing divisions for those ubiquitous b/w Brother boxes.
azalemeth 3y ago
I guess part of the problem with boycotts is that it's very hard to know who will not buy your product because of e.g DRM, and who won't buy it because they're not interested in it. I haven't bought a single Sony product since the rootkit fiasco, but I've never been able to tell them this directly. I don't buy products with DRM in them. I just don't. I'm not going to be appearing in the balance sheet, however, and won't appear in the calculus of lost growth for an MBA. The only time I think boycotts do work is when they cause a direct negative action to a company's bottom line that is sufficiently obvious that an accountant can see it. Long, slow protests -- such as exist against Nestlé for example -- are worthy but likely for the birds.

ensocode 3y ago

too big to fail

m3affan 3y ago

This was an amazing talk. He did a great job keeping it entertaining.