News for hackers. Stuff that matters.

FZeroX

Re:New attack plucks secrets from HTTPS-protected pages on Friday August 02, 2013 @06:39PM (#6150114)
It's not a sure fix though, there will be occasions where you can change the page length enough to hit the padding boundary.
Re:What.cd's Gazelle on GitHub on Friday July 12, 2013 @06:36AM (#6031888)
Sorry, I didn't mean to patronize your face off - was clarifying more for the benefit of other readers who are not so au fait with the infrastructure :)
Re:What.cd's Gazelle on GitHub on Friday July 12, 2013 @06:35AM (#6031886)
I made a few simplifications for brevity and "these files" was one of them. What the .torrent actually contains is a list of the files and how those files are divided up into chunks of equal size (say half a megabyte per chunk). The bulk of the torrent is a list of hashes of each chunk, which allows your client to verify the data it has received from other peers. If you then take a hash of <<the part of the torrent that lists the files and the chunk hashes>> the resulting hash is known as the infohash. The infohash describes this particular torrent uniquely, and it's the infohash you send to the tracker when asking for peers.

Hopefully from this explanation you can see that you need it for two purposes, one so you can give the right infohash to the tracker, and two so you can verify the data you receive from peers.

Re:What.cd's Gazelle on GitHub on Wednesday July 10, 2013 @01:14PM (#6021243)
I was an architect and coder on this project back at the very beginning and for a few years after launch, if you have any questions about the code then ask away :)
Re:What.cd's Gazelle on GitHub on Wednesday July 10, 2013 @12:33PM (#6020895)
PHP wasn't really the limiting factor, it's the architecture that XBTT uses that really kills you - an SQL query for every single announce! (With millions of peers that means hundreds of SQL queries per second just to maintain your swarm)

Some other cool trackers to look at are Shadowolf (although I believe that's discontinued, sadly) and Lioness if that's floating around anywhere (What.CD likes wildcat-based codenames)

Re:What.cd's Gazelle on GitHub on Wednesday July 10, 2013 @12:31PM (#6020872)
This is my go-to example of a cool legal* website running Gazelle: http://panda.cd/

If you know of any others please let me know!

* Not that the well-known ones are illegal either, really, but the point is slightly academic as they will still throw people in jail over it...

Re:What.cd's Gazelle on GitHub on Wednesday July 10, 2013 @12:28PM (#6020858)
The tracker tells you who else has the files you want, in a nutshell.

Basic bittorrent outline:

You download a .torrent file which contains (amongst other things) a list of files, their hashes, and a list of trackers to connect to.

Your BitTorrent client connects to the tracker and says "Hi, who else has or is looking for these files"?

It returns a list of these people (aka "peers") and your BitTorrent client then connects directly to peers to download the files (and upload them to other people).

Re:What.cd's Gazelle on GitHub on Wednesday July 10, 2013 @12:25PM (#6020835)
It's not an age thing, the code we were writing was considered terrible back then too, and there were frameworks available. Wheel re-invention is fun though!
Re:What.cd's Gazelle on GitHub on Wednesday July 10, 2013 @12:24PM (#6020829)
Gazelle isn't actually a tracker though - it's a web front-end / torrent website, but doesn't actually do the tracking part itself.