My DNS service (currently with Network Solutions) managed to get reset today, presumably because I was foolish enough to renew my services this morning. Sorry about the inconvenience; the real domain should be back up shortly, with my current blog intact.

The blog has been relocated to kernelmustard.com . Come visit me there!

After quite a bit of work, I've decided to move the blog to my own server and transition to WordPress. It worked for Scoble , and I have really just wanted a more modern blogging platform for a while. .Text is not exactly a spring chicken. So, please come visit me at http://kernelmustard.com . You will have to re-subscribe your RSS feed - the new feed url is http://www.kernelmustard.com/feed - which is RSS2, as far as I know. :-) In case anyone out there is using Vienna, I had to manually change

MD5 has been seriously broken for a while, but when I saw the news that Patrick Stach has posted super-efficient collision-generating code , I was surprised that it was that broken. I tried the code on a few boxes, and generally had trouble getting it to finish in the time my patience allotted me, but Matt Miller did get it to produce results: $ time ./md5coll block #1 done block #2 done unsigned int m0[32] = { 0x298640cf, 0x60bd40e2, 0xf2d40369, 0x2883fcb5, 0x5c85f76d, 0x35336462, 0xca28a356, 0xd355d92c

I'm sorry for the amazingly high unavailability of my blog today; the blog host has been having issues. I am actively working to resolve them. Also, I've been updating the MD5 article throughout the day; if you haven't looked at it since my first post, lots has changed. Bottom line: it turns out that both MD5 and SHA-1 have been broken, and that that fact is rather old news.

Patrick Stach has announced a new implementation of an MD4/5 collision generation algorithm that can generate MD4 collisions instantaneously and MD5 collisions in under an hour on commodity hardware. MD4 hasn't been considered to be secure in a while, but MD5 is a mainstay of digital signatures, IPSEC, and tons of other security applications. The practical implications of this are easy enough: switch to SHA-1, now . Quit using MD5 for secure anything. Even if this attack turns out to be impractical

A lot of people were wondering why Microsoft couldn't have (or didn't) detect the Sony DRM rootkit without writing new code. I covered that topic yesterday . Today, an NTDEV reader named Daniel Terhell posted a tool that has the potential to detect some kinds of hooks by analyzing the system service dispatch table and seeing where the functions pointers point. Anything that points outside of the kernel is flagged as possibly hooked. The tool is known as Hook Analyzer and can be downloaded from his

useful: www.dnstools.com [12:00: corrected stupidly malformed link]

Microsoft is adding support for server-based Excel in version 12. This may not seem like it's relevant content here, and that's because it's not. But boy howdy, this has been the #1 gripe of Positive Networks users for years . 5MB Excel worksheet + 1Mbps Internet access == toothache-like pain. Reminds me of a story that used to be passed around in networking circles a few years ago. My friend Deep Medhi is fond of reminding people to never underestimate the bandwidth of a station wagon loaded with

Microsoft has decided to add support for removing the Sony DRM rootkit to its various malicious software removal tools. My article at ArsTechnica on the subject has more info. One of the commenters on the Ars post said something to the effect of "Why didn't Microsoft just remove this automatically (rather than needing to write custom code for removing it after it happened)?" This is an interesting question, and I'd like to discuss it a bit. As Mark's original blog post points out, the thing manages