J
Jon Skeet [C# MVP]
G.Doten said:I don't. He clearly says "It is mostly true that the MAC address is
unique among default, manufacturer-assigned MAC addresses." Insisting on
"mostly true" when he knows darn well it is true. He's splitting hairs
here just to argue with me.
I really don't think so. I think the "mostly" is to cover vendor
mistakes.
But there is that denial, and of the standard itself. Venture what you'd
like; it's a free Internet!
Again, I see no such denial. I think we'll have to agree to disagree
about this.
No, it wouldn't. That's like saying it would be foolish to follow the
standard when dealing with these addresses. There must be many standards
that are misapplied, yet what they say can still be used. If a problem
with a particular implementation is encountered it can be worked-around,
especially in this specific case of built-in MAC addresses.
There's a difference between working round a problem and believing that
such a problem doesn't (or can't) exist.
Sure you can! You're losing me.
The *reported* address can be set by the user, therefore it shouldn't
be trusted. I thought *that* bit was agreed on...
Yes, I do. I may easily be wrong.
Do you really think that resetting a customer's networking settings is
realistic as a viable way to do things? People kick up a fair amount of
fuss about installers requiring a reboot - but resetting network
settings is a whole different league, IMO.
"That is _not_ the standard for MAC address as they are used in
networks." Wrong.
He's making the distinction between MAC addresses which are used in
real life and the MAC addresses which are built into the hardware. I
think that's a very valid distinction to make, given that users can
change the MAC addresses that are used. What's controversial about
that?
We disagree on the meaning of non-negligible, I think.
Possibly.
No, I think that would work fine. Supposedly it does, anyway.
If any installer tries to screw around with my network settings, it
certainly doesn't count as "working fine" in my view.
Yes, it works; it is used by products.
Just because it's used doesn't mean it works though. ROT-13 can be
*used* as an "encryption" mechanism, but it doesn't *work* as an
encryption mechanism. It's not a viable, feasible, workable encryption
scheme. If a product shipped using it, that wouldn't make it any more
secure as a scheme.
That's your definition of licensing scheme (and isn't a bad one).
Because a product ships with a "MAC address licensing scheme" that may
(or may not) let MAC addresses be spoofed does not mean it isn't a
legitimate licensing scheme. I would say that there is no licensing
scheme that is 100% accurate nor 100% secure. A product company may
decide that this hole may be perfectly acceptable for their needs.
This is what makes such a licensing scheme workable.
I think it depends on the amount of difficulty involved in cracking it.
If it takes 5 minutes without having to install any extra drivers etc,
that's pretty unworkable in my view - and that's what I suspect the
case is for most if not all such licensing schemes, unless they commit
the cardinal sin of tampering with my network settings. At that point
they may be more secure, but I suspect not 100%. The cost is too high
though, IMO.
Now, as with most holes, I suspect that it's not the case that
companies deem such a hole as acceptable so much as that they don't
understand the hole to start with.
Well, we agree on that. I don't like any of those schemes either,
including the one-time validation ones. All of them are relatively easy
to crack.
There are pros and cons. At least there isn't usually too much pain for
legitimate owners, however - no network settings tampering, for example

I don't see how it can be denied that it is a workable technique, but
whatever. I never claimed, nor would I ever claim, it is a perfect
solution. But I would say it is perfectly acceptable for the needs of
some companies.
I would be interested to see what those companies would say if a
5-minute zero-expertise (beyond reading a web page) crack were to be
presented to them. Of course, without trying out one of these products
(and knowing a valid licence key for a given MAC address) it's hard to
show that - but I have strong suspicions that their products aren't as
safe as they expect them to be. When a risk is accepted unknowingly it
shouldn't count as making the scheme involved "workable" IMO.
Which is why they can define how bullet-proof or not bullet-proof their
licensing scheme is.
Only if they understand the weaknesses of such a scheme.
You make an excellent proxy for Peter, BTW.
I just got fed up with the situation where I couldn't see that much
disagreement on what you actually believed, just on the words being
used.