log of Logfish.net

Today I installed Dropbox and got an idea. It turns out that if the service has your file already, it will not upload it again. Syncing an 600 MB ubuntu iso took me less time then it took me to download the file, and my upload is not faster then my download. There must be some kind of hashing going on there (they would be stupid not to do it).

However, the speed of the sync got me thinking about a security bug that was discovered in SSH a while back. The problem was that it was possible to notice if a user existed or not because the time it took to respond to an existing user was different then to a non-existing user.

The same holds true for Dropbox: if I create a random file, I'm able to check whether a user on Dropbox already had it by timing the sync speed in correlation with my network output (or even just looking at the network traffic amount will do the trick). Now the question is: what kind of security related file, or personal information format, will be best to randomly generate and try to find?

Theoretically it should be possible to download all Dropbox data this way, hopefully somebody will one day find a good way to exploit this optimization.

At youtube there is a movie about cymatics and it shows a guy (Collin?) using a non-Newtonian liquid (corn starch) to produce forms. The movement makes the liquid go solid, building a base. At the top, the liquid doesn't move that much anymore and forms a solid again. This combines into a sort of fountains running around in a huddled mass.

I've always wanted to create my own language, and it is probably a good idea to start with something simple. And that may just be a movie computer scripting language.

If you ever see a computer in movies, you know what I'm talking about: large dialog boxes stating "downloading" or "encrypting" and a larger then life progress bar filling most of the screen. Or weird documents popping up on screen.