Slashdot Mirror
Pwn2Own 2009 Winner Charlie Miller Interviewed
crazipper writes "Tom's Hardware interviewed Charlie Miller, winner of this year's Pwn2Own contest and formerly with the NSA. He discusses the effort it took before the contest to be able to take down a MacBook within seconds, sandboxing, and the effectiveness of the NX bit and ASLR. His outlook on end-users protecting themselves against attacks? 'Users are at the mercy of the products they buy.'"
Obama Policies Will Bankrupt USA Tsarkon Reports
Czech Prime Minister Mirek Topolanek, whose country currently holds the EU presidency, told the European Parliament that President Barack Obama's massive stimulus package and banking bailout "will undermine the stability of the global financial market." Calls Us policy a "way to hell"
Yuan Forwards Show China May Buy Fewer Treasuries, UBS Says
Anemic Treasury auction effects felt beyond bonds
The Sherminator Kicks Some Wall Street Ass
China Angry That Fed Is Deliberately Destroying The Dollar
China suggests switch from dollar as reserve currency
What are the reserve currencies?
Anatomy of a taxpayer giveaway to investors
Geithner rescue package 'robbery of the American people'
Geithner just put only the rich in Titanics lifeboats
Geithner Plan Will Rob US Taxpayers
A False Choice
Bargain-hunting house buyers wearing on sellers ajc.com
Time to Take the Steering Wheel out of Geithner's Hands
Socialising and Privatising
Fannie, Freddie to pay out bonuses
Fitch Raises Prime Jumbo Loan Loss Estimates Sharply
Chinas central bank on Monday proposed replacing the US dollar as the international reserve currency with a new global system controlled by the International Monetary Fund
- Russia too: It is necessary to work out and adopt internationally recognized standards for macroeconomic and budget policy, which are binding for the leading world economies, including the countries issuing reserve currencies - the Kremlin proposals read.
- President Barak "The Teleprompter" Obama is deeply connected to corruption, Rahm Emanuel (Radical authoritarian Statist whose father was part of the Murderous Civilian Killing Israeli Terrorist Organization known as IRGUN), Connected to Rod Blagojevich (Rahm inherited Rod's federal-congress seat), Connected to Ayers, a man who promotes the concept that civilian collateral damage is ok in a war against freedom, Preacher Jeremiah Wright, who is himself a black-elitist who wants all the people who largely "pay the freight" to suffer, 31 million on food stamps, more blacks are in prison and on food-stamps per capita than anyone else. The problem with Wright is simply this: the facts are "racist."
- Obama: Racist, AIPAC-bootlicker, Corrupted to the bone Chicago style and a Traitor to t
> Users are at the mercy of the products they buy
Terminator the movie...1984 - Kyle Reese: "Pain can be controlled - you just disconnect it."
The NX bit is awesome.
ASLR is effective, but it's generally used as a way to slow down attackers after they've already figured out how to break your broken shit.
at then you will not be at anyone's mercy ...of course you may not be able to do much then..
I'm Just saying'
'Users are at the mercy of the products they buy.' So clearly he is a big supporter of FOSS? Then you are at no ones mercy.
The first rule
next page>
about robot overlords is
next page>
we don't talk about robot overlords
next page>
!!!
--
http://vancouvercondo.info
-
Thought I'd beat you to the punch...
"If you set me down in front of an application I've never seen before and told me I have 2 minutes to hack it, as is often the case in movies, I'd have no more luck than your grandma at accomplishing it. Well, maybe a little more of a chance, but not much!"
I hope you are offended.
Why can't you sue a software company if you suffer a loss due to poor security in their product?
Negative moral value of force outweighs the positive value of good intentions.
FTFA:
Charlie: I'll leave Linux out of the equation since I know my grandma couldn't run it.
Uh, I think you're quite wrong there. I know more than a few Grandmas running Linux. The thing is, they're the ones that usually need the least amount of software. A browser, maybe e-mail if they don't do it in a browser, that's about it. Linux is perfect.
I've spent a lot of my research time on Macs because I like them and they also happen to be pretty easy to break!
That is classic
Tom's Hardware
[NEXT PAGE>
PWNs & OwnZ U
[NEXT PAGE>
If you read
[NEXT PAGE>
their articles
[To continue reading this comment, click here ]
ôó
EULA, ever read it?
"[SomeStupidSoftwareCompany] is not responsible for any damages caused by the use/misuse of this software."
From Mozilla's EULA:
4. DISCLAIMER OF WARRANTY. THE PRODUCT IS PROVIDED "AS IS" WITH ALL FAULTS. TO THE EXTENT PERMITTED BY LAW, MOZILLA AND MOZILLA'S DISTRIBUTORS, LICENSORS HEREBY DISCLAIM ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES THAT THE PRODUCT IS FREE OF DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE AND NON-INFRINGING. YOU BEAR ENTIRE RISK AS TO SELECTING THE PRODUCT FOR YOUR PURPOSES AND AS TO THE QUALITY AND PERFORMANCE OF THE PRODUCT. THIS LIMITATION WILL APPLY NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY REMEDY. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES, SO THIS DISCLAIMER MAY NOT APPLY TO YOU.
5. LIMITATION OF LIABILITY. EXCEPT AS REQUIRED BY LAW, MOZILLA AND ITS DISTRIBUTORS, DIRECTORS, LICENSORS, CONTRIBUTORS AND AGENTS (COLLECTIVELY, THE "MOZILLA GROUP") WILL NOT BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES ARISING OUT OF OR IN ANY WAY RELATING TO THIS AGREEMENT OR THE USE OF OR INABILITY TO USE THE PRODUCT, INCLUDING WITHOUT LIMITATION DAMAGES FOR LOSS OF GOODWILL, WORK STOPPAGE, LOST PROFITS, LOSS OF DATA, AND COMPUTER FAILURE OR MALFUNCTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND REGARDLESS OF THE THEORY (CONTRACT, TORT OR OTHERWISE) UPON WHICH SUCH CLAIM IS BASED. THE MOZILLA GROUP'S COLLECTIVE LIABILITY UNDER THIS AGREEMENT WILL NOT EXCEED THE GREATER OF $500 (FIVE HUNDRED DOLLARS) AND THE FEES PAID BY YOU UNDER THIS LICENSE (IF ANY). SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL, CONSEQUENTIAL OR SPECIAL DAMAGES, SO THIS EXCLUSION AND LIMITATION MAY NOT APPLY TO YOU.
So maybe you can get $500 from Mozilla of something goes wrong?
since last year.
A quote from another interview:
"Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away."
Who know what other goodies they have in store. But the browsers and the phones were hardly touched. The contestants are holding out for something better.
What?
Fed begins move that could sink dollar - Economists warn government subsidizing purchase of its debt
Posted: March 25, 2009 4:04 pm Eastern
NEW YORK The Federal Reserve began today to buy longer-term U.S. Treasury securities in a move some economists believe will end up "monetizing" the dollar, a process that could inflate the amount of money in circulation and cause serious devaluation of the currency on world markets.
The move comes the same day U.S. Treasury Secretary Tim Geithner told the Council on Foreign Relations that the U.S. is "open" to a proposal by China to replace the dollar as the world's reserve currency with a "super-currency" to be created by the International Monetary Fund, or IMF.
The Federal Reserve Bank of New York released yesterday a statement specifying that the Federal Open Market Trading Desk within the Fed will purchase up to $300 billion of longer-term U.S. Treasury securities over the next six months in what amounts to the a government-subsidized purchase of U.S. government debt.
To many Americans, the move appears equivalent to a retail consumer in debt using a Master Card to pay a Visa credit card bill.
"The Fed is monetizing U.S. Treasury debt in order to debase the dollar to create inflation in hopes of avoiding deflation," economist John Williams, author of the Internet newsletter Shadow Government Statistics, told WND in an e-mail.
"This move also sets the precedent for the Fed acting as lender of last resort to the U.S. Treasury, if foreign and other investors in U.S. treasuries balk at upcoming auctions or look to dump existing holdings," Williams said.
"The record federal deficits ahead mean record Treasury borrowings," he explained. "Fed monetization of the debt eventually means surging money supply growth and much higher inflation."
WND previously reported Williams' analysis of the U.S. Treasury's GAAP accounting of the federal budget deficit, which indicated the negative net worth of the U.S. government last year was $65.5 trillion in total obligations, a sum that exceeds the gross domestic product of the world.
"Because of the U.S. government's effective insolvency with $65 trillion in obligations, even before the Obama administration deficits, the higher inflation caused by the Fed buying Treasury debt has the early potential of evolving into an uncontrolled hyperinflation in which the U.S. dollar becomes totally worthless."
Williams' comments were especially pertinent after Britain announced earlier today that for the first time in almost seven years the country failed to find enough buyers of £1.75 billion ($2.55 billion) of bonds as debt investors rejected Prime Minister Gordon Brown's plan to stimulate England's economy with deficit-financed government spending, according to Bloomberg.
International economist Bob Chapman, author of the Internet newsletter International Forecaster, agrees.
"This is just the beginning," Chapman told WND in an e-mail. "The Obama administration expects to run annual deficits between $1-$2 trillion a year for the next decade, and we estimate that foreign buyers might only buy one-third to half that amount of debt. The Fed will have to monetize $3.75 trillion to $5.25 trillion over the next few years, just to buy the U.S. government debt."
The move by the Fed to buy Treasury debt comes as China proposes to replace the dollar as the world's reserve currency.
As the Financial Times in London reported today, China's central bank governor Zhou Xiaochuan has proposed to utilize Special Drawing Rights, or SDRs, issued by the IMF as a world reserve currency.
Red Alert explained in an article in this week's issue that the IMF, with the support of the United States and Russia, appears positioned to launch a one-world currency at the G-20 meeting scheduled for London April 2, with the move intended as a last ditch effort to prevent massive bank failures throughout the European Union.
The idea is for the IMF to issue at least $250 billion in Specia
I don't think anyone's falling for your subtle scheme of trying to make conservatives look like rabid nutsos.
Damned liberal sock-puppet-operating conspirators.
PC meaning what? Windows?
And... Mac meaning OS X?
And... Linux meaning a Linux distro?
Whenever I hear someone referring to systems like that I get in a mood to tell them off.
Last time I checked PC meant Personal Computer. Are OS X and Linux only running on Cray mainframes nowadays?
He's a security expert and I've also heard my CS professors talk like that..I mean, shouldn't they at least refer to systems properly?
Sorry for the rant, I couldn't help myself...
Between Mac and PC, I'd say that Macs are less secure for the reasons we've discussed here (lack of anti-exploitation technologies) but are more safe because there simply isn't much malware out there.
That pretty much been my take on the situation as well. Vista SP1 really is one of the most secure OSes I've used.
They glossed over Linux on this question, but I suspect Vista SP1 is probably more secure than linux too 'out of the box'... but again less safe in actual practice. Again simply due to the sheer relative volume of malware and the relative high value of windows exploits to linux ones.
(Although Linux at least does have 'SE Linux', AppArmor, Exec Shield, support for ASLR, etc, etc so its more a case that its just not on by default yet. (Ironically a complaint usually levelled at Windows).
And while improvements are added with each kernel release, too Linux admins refuse to install them because would reset their belowed uptime scores which they feel the need to post to /. on a regular basis...
I kid... I kid...
You know we dont read this shit dont you troll?
Every time you quote this, somewhere in the world a mac zealot's head explodes. I just did my part :P
Why on earth would one need a scheme to know conservatives are nutso?
Its been completely obvious for years!
just wish to say how amusing I find the above poster. The Right wingers are such good losers arent they?
In the light of the way the previous administration used the US constituion as toilet paper, any rational person sees the Obama adminstration as a quality unit.
Right wingers, they kick and scream, make up any lie they can think of and still get ignored, they find this very annoying and then spit their dummies and resort to spam and trolling.
You can post as much of this as you like but no one cares at all about your delusions.
Thanks for the laughs!
... 24/M/Australia/Jedi?
( Redundancy is ) ^ n
A former NSA person is pushing a google browser as safe?
A US company could have your long term search history, your location away from the computer via your mobile phone OS and the application you surf the web with.
Running Mac, Win or Linux is just a matter of lifestyle.
Thats a lot of tracking options for everyday people.
Domestic spying is now "Benign Information Gathering"
But if you want something with guaranteed security or uptime or the like, you aren't going to be allowed to mess with it. That means whatever software/features it comes with, you are stuck with. No installing 3rd party tools and such. The design needs to be verified, which means testing all the components against each other and making sure there are no unexpected problems.
So not only would your computer be more expensive, and use older technology (since it'd take longer to develop and test) but it'd be an appliance type device. It would do only what it was originally designed to do. You'd not be allowed to install things on it, or change the hardware.
If you want computers as they are today, where it's the "wild west" situation of being able to do whatever you want with them, well then you have to take some security problems with that. Just life. Me? I'll deal with having to have some security issues for the ability to run whatever I want, and to get systems cheaply.
He says: OSX is less secure but there's less malware because there's less users than Windows; You need Vista with SP1 to be dramatically more secure than OSX; Linux has mediocre security but is about to get a bump; His grandma can't use Linux; noscript can keep you safe but he doesn't think it's worth it. I figure the last part is just about job security...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Charlie: I'll leave Linux out of the equation since I know my grandma couldn't run it. Between Mac and PC, I'd say that Macs are less secure for the reasons we've discussed here (lack of anti-exploitation technologies) but are more safe because there simply isn't much malware out there. For now, I'd still recommend Macs for typical users as the odds of something targeting them are so low that they might go years without seeing any malware, even though if an attacker cared to target them it would be easier for them.
Pity that question wasn't earlier, I wouldn't of had to waste my time reading TFA. Nothing he said was particularly surprising and most of it had a fairly obvious bias.
# cat
Damn, my RAM is full of cats. MEOW!!
is you don't talk about it! The second rule of...
Of course these people won't discuss GNU/Linux, because it's different. It's just as secure as YOU like it do be, would drive these guys right out of business if people started using it. So they keep doing their silly mac versus pc things...
My mother is 80 and uses Ubuntu. My grandma, on the other hand, is dead and has big difficulties using MS-DOS, let alone Linux.
You're making conservatives look like rabid nutsos every time you mention "conspirators" or a left-wing media. You're making conservatives look like rabid nutsos every time you troll on Slashdot.
Also, the USA is already bankrupt and has been for decades. Look how much national debt Obaba inherited.
I know I shouldn't feed the trolls and I'll get modded -1 Offtopic, but I just don't care all that much about my Slashdot karma score.
with ubuntu 8.10, you can use the gui to add/remove wine. now true its not installed by default and the person would need to know about wine. but i digress. once it is installed you simply double click on .EXE's and they are installed and appear on the 'start' menu. its easier that under windows. i just installed a photoshop ps2. its great. so it would be a very good option for 'casual games' or other apps. and classic games, particularly old sierra and adventure games with lots of nice synth music thats was written for good but expensive.obscure sound cards, like rolands and gravis ultrasound. well installing dosbox and hear them in emulated glory, better than the original with your soundblaster. and dosbox also does graphics smoothing and interpolation. so appart from high performance games you dont need windows for windows apps.
All throughout the article, the back doors for malware are buffer overflows.
Isn't it time to write our software in something that does not allow buffer overflows? something better than C/C++, that is. The cost of securing apps written in these languages is tremendous...
OpenBSD, FreeBSD, Linux, and Windows have been using these techniques since 2004.
When I read yesterday that Mac OS X doesn't I was shocked. Shocked! I didn't even believe it, because I thought everybody had adopted this idea already. In 2009 these techniques are very old news.
I still didn't believe it today, so I wrote this program..
#include <sys/types.h>
#include <sys/mman.h>
#include <stdio.h>
int main()
{
printf("%p\n", mprotect);
return 0;
}
Sure enough, it prints the same address every time I run. Wow. Just wow, Apple. This shows that they care absolutely nothing about security.
The same program running on BSD will have the same result. you want:
int main()
{
register void *ptr __asm__("esp");
printf("%p\n", ptr);
return 0;
}
You know we dont read this shit dont you troll?
A heck of a lot more people read it when it has a child that's +1 Insightful.
MediaWiki developer, Total War Center sysadmin
Okay, here's what happened:
1. Truly anonymous and cowardly Anonymous Coward posts sincere, frothing neoconservative hate rant.
2. A non-anonymous, somewhat bold Onymous Coward poses as a grousing neoconservative, accusing the (truly hate-mongering and ridiculous) Anonymous Coward of actually being a liberal in disguise, accusing the Anonymous Coward of only pretending to be a neocon, accusing Anonymous Coward of really being a liberal trying to denigrate neocons by coming across as a crazy neocon. In fact Onymous Coward really believed the anonymous coward was what he appeared at face value to be, a frothing anti-liberal.
3. You failed to see this was what was going on (understandably -- it's convoluted), and attacked the persona that Onymous Coward put out there.
The Jiu Jitsu here is in making the hatemonger second guess his tactic by feeling that his putative brethren are uncomfortable with being lumped together with such blathering and blatant nuttery, by making him feel like he's doing more harm than help to his own cause by being so strident. The idea is to trip up the annoying AC enough to get him to shut the hell up. I apologize for throwing you off balance in the process.
On reflection, since such raving really does harm the image and viability of the fundamentally xenophobic ideology of neoconservatism... I suppose I should just let him ramble on. It would benefit the world to have his philosophy marginalized by his own distasteful flogging. Tripped myself up! Whoops!
Sorry! Anonymous Hater, if you're listening, please carry on! Shout it, brother!
Oh, my bad. The original AC comment was hidden to me.
No worries. Really my fault for such silly convolution. Sorry.