4 ms·

Has Gibson ever explained how SpinRite works? Many people won't believe in magic even if it works.

by wmf 2y ago

paulryanrogers 2y ago
Listen to the "Security Now" podcast. He explains how SpinRite works every 3rd or 4th episode, with testimonials on every show. He seems open minded and mostly harmless, both in his tool (which I find works better than free alternatives), and in his armchair security analysis. Sometimes though he oddly contradicts his own best practices, like nearly blind faith in LastPass for years based on (IIRC) a white paper and the early execs being very chummy and accessible. Thankfully the audience calls out the questionable stuff.
- naikrovek 2y ago
  The podcast is called “Security Now” but what it should be called is “privacy now” because Mr. Gibson fails to understand a lot of contemporary security problems yet is quite sure that Windows collecting telemetry is the most severe problem on the planet today. unless you use his software to fix it, that is. Every episode having a 15-minute commercial for spinrite (via testimonials which all sound like they were written by the exact same person) should be more than enough for anyone to start to question the guy.
  - TeeMassive 2y ago
    I didn't listen to that show for a while now; but it seemed that it was the only show out there that explained in details computer security news. I remember him explaining the speculative execution exploits when they first appeared really well when they first appeared. Does the people I know who works on blue and red teams listen to him? No, they already know that stuff, and yeah he could be more up to date, but he does his researc, does his homework and is a great pedagogue.
    - naikrovek 2y ago
      > he does his research, does his homework Is that why he ran Windows XP unpatched as his primary computer because “it’s fine, this is all I need; I have a firewall, nothing can get in.” That is not the behavior of a security expert. If you don’t know why that is bad, you do not understand entire classes of attack, today.
      - userbinator 2y ago
        That is the behaviour of a security expert who isn't afraid to challenge the dogma perpetuated by Big Tech.
        LeoNatan25 2y ago
        To all the downvoters, this is sarcasm.
      - Gormo 2y ago
        If he has implemented mitigations for all of the applicable risks of the software he's using, how is that "not the behavior of a security expert". To my mind, a security expert is someone who understands the functional details of specific vulnerabilities, and explains how to mitigate them, not someone who makes vague, cargo-culty judgments about entire applications or OSes.
        paulryanrogers 2y ago
        He was browsing the web, that's pretty high risk. And sticking to reputable sites isn't enough when their ads could contain malware. While it sounds like he doesn't use XP anymore, (IIRC) he was using it for the Internet well beyond its EOL. He also admitted to having trouble getting his dev environment working on newer OS's. My guess is he was rationalizing the choice to stick with XP to avoid the friction of upgrading development tools. Which is odd since he's not afraid to delay things for years and ultimately has upgraded his environments anyway.
        2y ago
- 8372049 2y ago
  If you think of Steve Gibson as more of a technical minded journalist and less of a "security expert", then the show is very enjoyable. There's a lot less grave errors now than there used to be, his voice is pleasant and he usually covers relevant and interesting news.
deleted 2y ago
[deleted]
bigB 2y ago
There is in depth information on its workings, on the website itself, in the newsgroups and in the podcast. If the author of the article were to look it would remove any "magic" of its workings. The author apparently has an axe to grind, for whatever reason , having said that , it may be for a very good reason but for transparency sake this should be included in the article. Instead its just a weird ramble about what he thinks of other tools and that he thinks Spinrite is a "scam" without technically explaining why, boiling it down to essentially a technically worded opinion piece.
- johnkizer 2y ago
  The in-depth information on the website appears to be this link: https://www.grc.com/files/technote.pdf https://www.grc.com/files/technote.pdf Which, while not directly dated in the content of the document, references a "screaming Pentium II 333 MHz", which would theoretically put it ~1998. Is the claim that operating at a "low level" on hard drives in 1998 is the same as in 2024?
  - jjeaff 2y ago
    the simplest explanation for what spinrite does that I have heard is that on spinning rust drives, it simply tries to access the same bad data over and over until it finally (sometimes) gets a result. which makes sense that it would work (sometimes) because hard drives that are going bad tend to do so intermittently.
    - Hakkin 2y ago
      This is more or less also what (GNU) ddrescue does[0]. It first tries to do a linear copy of the full disk, skipping any errors, then goes back and tries to re-read the error sectors until you either cancel or it succeeds. It also keeps track of everything it's doing so you can stop and start the process without it redoing work. [0]https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html#Algorithm https://www.gnu.org/software/ddrescue/manual/ddrescue_manual...
cqqxo4zV46cp 2y ago
As someone that’s listened to Security Now on and off for 16 years, with some light memory jogging I’d probably find that I know far more about SpinRite than would ever be useful to me.

Has Gibson ever explained how SpinRite works? Many people won't believe in magic even if it works.

by wmf 2y ago

Has Gibson ever explained how SpinRite works? Many people won't believe in magic even if it works.

Listen to the "Security Now" podcast. He explains how SpinRite works every 3rd or 4th episode, with testimonials on every show. He seems open minded and mostly harmless, both in his tool (which I find works better than free alternatives), and in his armchair security analysis. Sometimes though he oddly contradicts his own best practices, like nearly blind faith in LastPass for years based on (IIRC) a white paper and the early execs being very chummy and accessible. Thankfully the audience calls out the questionable stuff.

naikrovek 2y ago
The podcast is called “Security Now” but what it should be called is “privacy now” because Mr. Gibson fails to understand a lot of contemporary security problems yet is quite sure that Windows collecting telemetry is the most severe problem on the planet today. unless you use his software to fix it, that is. Every episode having a 15-minute commercial for spinrite (via testimonials which all sound like they were written by the exact same person) should be more than enough for anyone to start to question the guy.
- TeeMassive 2y ago
  I didn't listen to that show for a while now; but it seemed that it was the only show out there that explained in details computer security news. I remember him explaining the speculative execution exploits when they first appeared really well when they first appeared. Does the people I know who works on blue and red teams listen to him? No, they already know that stuff, and yeah he could be more up to date, but he does his researc, does his homework and is a great pedagogue.
  - naikrovek 2y ago
    > he does his research, does his homework Is that why he ran Windows XP unpatched as his primary computer because “it’s fine, this is all I need; I have a firewall, nothing can get in.” That is not the behavior of a security expert. If you don’t know why that is bad, you do not understand entire classes of attack, today.
    - userbinator 2y ago
      That is the behaviour of a security expert who isn't afraid to challenge the dogma perpetuated by Big Tech.
      - LeoNatan25 2y ago
        To all the downvoters, this is sarcasm.
    - Gormo 2y ago
      If he has implemented mitigations for all of the applicable risks of the software he's using, how is that "not the behavior of a security expert". To my mind, a security expert is someone who understands the functional details of specific vulnerabilities, and explains how to mitigate them, not someone who makes vague, cargo-culty judgments about entire applications or OSes.
      - paulryanrogers 2y ago
        He was browsing the web, that's pretty high risk. And sticking to reputable sites isn't enough when their ads could contain malware. While it sounds like he doesn't use XP anymore, (IIRC) he was using it for the Internet well beyond its EOL. He also admitted to having trouble getting his dev environment working on newer OS's. My guess is he was rationalizing the choice to stick with XP to avoid the friction of upgrading development tools. Which is odd since he's not afraid to delay things for years and ultimately has upgraded his environments anyway.
        2y ago
8372049 2y ago
If you think of Steve Gibson as more of a technical minded journalist and less of a "security expert", then the show is very enjoyable. There's a lot less grave errors now than there used to be, his voice is pleasant and he usually covers relevant and interesting news.

deleted 2y ago

[deleted]

bigB 2y ago

There is in depth information on its workings, on the website itself, in the newsgroups and in the podcast. If the author of the article were to look it would remove any "magic" of its workings. The author apparently has an axe to grind, for whatever reason , having said that , it may be for a very good reason but for transparency sake this should be included in the article. Instead its just a weird ramble about what he thinks of other tools and that he thinks Spinrite is a "scam" without technically explaining why, boiling it down to essentially a technically worded opinion piece.

johnkizer 2y ago
The in-depth information on the website appears to be this link: https://www.grc.com/files/technote.pdf https://www.grc.com/files/technote.pdf Which, while not directly dated in the content of the document, references a "screaming Pentium II 333 MHz", which would theoretically put it ~1998. Is the claim that operating at a "low level" on hard drives in 1998 is the same as in 2024?
- jjeaff 2y ago
  the simplest explanation for what spinrite does that I have heard is that on spinning rust drives, it simply tries to access the same bad data over and over until it finally (sometimes) gets a result. which makes sense that it would work (sometimes) because hard drives that are going bad tend to do so intermittently.
  - Hakkin 2y ago
    This is more or less also what (GNU) ddrescue does[0]. It first tries to do a linear copy of the full disk, skipping any errors, then goes back and tries to re-read the error sectors until you either cancel or it succeeds. It also keeps track of everything it's doing so you can stop and start the process without it redoing work. [0]https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html#Algorithm https://www.gnu.org/software/ddrescue/manual/ddrescue_manual...

cqqxo4zV46cp 2y ago

As someone that’s listened to Security Now on and off for 16 years, with some light memory jogging I’d probably find that I know far more about SpinRite than would ever be useful to me.