Does anyone know how Palladium is exactly supposed to stop buffer overflow attacks?
I mean what is to prevent a buffer overflow vulnerability in the TCP/IP stack implementation from being used? Say it receives the wrong data, the stack overflows and your code is now executing with kernel privileges. From the OS's perspective, no new application has been run, therefore, no check for signatures will ever be attempted.
Granted, the nub may prevent you from reading encrypted data, but you will have access to everything that is not encrypted. And you are in a very good position to use the kernel privileges to attempt attacks on the nub.
Also, presumambly, the TCP/IP stack will be part of the kernel which itself is signed and authenticated by the nub at boot time...
I had to sign the IEEE copyright form about a week ago for a paper that will appear in the proceedings of the Conference on Intelligent Robotic Systems (which is in Switzerland by the way, not in the USA). The form still had the DMCA clause in it. Too bad I don't have it with me now to post it.
Actually, it was a DCMA clause. They referred to the law as the "Digital Copyright Millenium Act." It looked like a joke. I thought lawyers who write copyright forms were supposed to know what they are writing about.
I was pissed off when I saw the DMCA mentioned, since I remember reading somewhere that they were going to remove it. I was planning to investigate but damn thesis --- takes all of my time.
So, it looks like their timing was wrong. They should have done this before the deadline for the conference, not after that. More than 400 authors (from all over the world) now had to put up with this insanity.
Hughes agrees that theoretical safety against an attack of the clones means little...
Safety against the attack of the clones? No way. Even the Jedi Knights are not safe against such an attack. We all know what's gonna happen in a theater near you in 3 weeks...
Here is the email I got from them. Note the
finesse with which they tell you that they
own you now (last paragraph).
Your privacy is very important to us here at Yahoo!. We are sending you this email to let you know that we have updated our Privacy Policy. You can read our updated Privacy Policy by visiting Yahoo!'s comprehensive Privacy Center.
Our commitment to privacy hasn't changed. We believe that you should understand what we do with your information and what choices you have. So why are we revising our Privacy Policy? To streamline it and make changes to address several important topics.
In recent years, we have added a Children's Privacy Policy and Privacy Information for users of Yahoo!'s financial products and services, in accordance with requirements of federal legislation. We at Yahoo! have become increasingly aware of questions about how data is treated when a user's safety may be at risk, when fraud or illegal activities may be occurring, or when companies are combined. We feel that the time is right to streamline our privacy policies into a single, comprehensive policy and to address these and other issues in the process. Please take a moment to visit our Privacy Center and read our updated Privacy Policy. (Note: The Yahooligans! Privacy Policy, for our children's web site, has not changed. Although the format and some parts of the Yahoo! Privacy Policy have been updated, our collection, use, and treatment of information from kids under age 13 remains unchanged.)
Yahoo! recognizes that while we've grown and changed, things in your life have probably also changed. You may have a new job, a different email address, a new house, or different interests. We invite you to take this opportunity to update your personal information so you can continue to receive content and advertising that is most relevant and interesting to you. Please do not reply to this message. If you have any questions about these changes, please visit our Frequently Asked Questions page.
I've been using Enlightenment 0.16 for more than a year now and must admit that I found it the most comfortable window manager I've seen so far. Every now and then, when a new version of KDE or Gnome comes out, I download it and check it out to only discover that it is not as functional.
And, to reply to a previous post, I think E16 includes innovative features. Here are some, which I really love but haven't seen on any other WMs:
Moving windows across desktops: Most WM's approach is to go to the title bar, right-click, choose Move to Desktop i (very slow). A faster approach is to use a pager, but it is typically too slow and then you need to go to the desired desktop and adjust the window.
In E16, what you do is "grab the window" (click and hold the title bar) as if you are going to move it (which you are really doing) and then press Alt-Fi to switch to desktop i and release the mouse button. That's it. If it needs adjustment, it comes naturally, since you are moving the window anyway.
Have you heard of eesh?. This thing is really cool. It is a shell to the WM itself. You can use it to send commands to the windows and do such things as shade/unshade, iconify, move, resize..., everything you want. From a script! I wrote a small Perl script that uses the titles of the windows to arrange them in various predefined configurations. This is much more powerful than session-management!
I know it was not E that introduced the concept of small applets (I think Gnome had those before E) but have you even looked at the source of an epplet? It is rarely more than a page or two. Why? Because, they are so easy to write... Just #include "epplet.h" and you've got a very powerful API in your hands...
I am also impressed with the code that the E folks are producing as part of E17. I happened to use Evas for visualization in one of my projects. I needed sometinng that was easy to learn and will help me do the job quickly. Evas was (and still is) in beta and probably incomplete but functional enough. When I downloaded it and saw the sample code, I just loved it. It is so incredibly easy to develop with it. I finished that visualization tool in a matter of hours.
To summarize: I've been extremely happy with the stable version of E and am very excited about what the future E17 has to offer.
I don't understand. Wasn't he supposed to wait
until the court gives him a green light to openly
discuss or publish his work? That was what this
last suit was all about, wasn't it?
In other words he seems to have decided to take a
chance and be able to be sued by the RIAA if the
court says "No" for some reason...
I am from Bulgaria and I know that a lot of people in my country are at least starting to seriously consider Linux (possibly other Free OSs). Of course, there is a strong geek culture there too (I am currently in the US) but the main reason why people would want to run Linux is that "free as in beer" part.
As almost everywhere in the world, all the ordinary user sees is Microsoft's OSs. Computers were sold with pre-installed Windows. However, most of these copies of Windows were illegal and people would only pay for the hardware. This was
mainly due to the economic situation (average monthly salary is ~$100USD) -- no one was able to buy the software legally. As a result, people got used to the idea of "free" software.
Things used to be like that for a while. Although the computer shops were breaking the law, no one would go after them since this required a lot of time and money and there were many more urgent priorities on a national level.
The situation changed since Microsoft took to what they do best: started going after the companies.
Yes, the government may not have enough money but Microsoft surely do. I have friends who own a computer shop and they stopped installing Windows on the computers they sold.
It is still very easy to find a "free" copy of Windows but in the mean time small companies that need to use software for their work have turned to look for another alternatives. And that is how they are learning about Linux. Granted, it is for purely economic reasons but I guess at some point people will start to see the other positive aspects of Open Source/Free Software. I guess Microsoft did us a great favor after all.
Slashdot Mirror
(02/06/06 1.537.2.10)
[PATCH] Re: mislabelled label patch
No pun intended...
I mean what is to prevent a buffer overflow vulnerability in the TCP/IP stack implementation from being used? Say it receives the wrong data, the stack overflows and your code is now executing with kernel privileges. From the OS's perspective, no new application has been run, therefore, no check for signatures will ever be attempted.
Granted, the nub may prevent you from reading encrypted data, but you will have access to everything that is not encrypted. And you are in a very good position to use the kernel privileges to attempt attacks on the nub.
Also, presumambly, the TCP/IP stack will be part of the kernel which itself is signed and authenticated by the nub at boot time...
I had to sign the IEEE copyright form about a week ago for a paper that will appear in the proceedings of the Conference on Intelligent Robotic Systems (which is in Switzerland by the way, not in the USA). The form still had the DMCA clause in it. Too bad I don't have it with me now to post it.
Actually, it was a DCMA clause. They referred to the law as the "Digital Copyright Millenium Act." It looked like a joke. I thought lawyers who write copyright forms were supposed to know what they are writing about.
I was pissed off when I saw the DMCA mentioned, since I remember reading somewhere that they were going to remove it. I was planning to investigate but damn thesis --- takes all of my time.
So, it looks like their timing was wrong. They should have done this before the deadline for the conference, not after that. More than 400 authors (from all over the world) now had to put up with this insanity.
Glad to see this go, though.
Safety against the attack of the clones? No way. Even the Jedi Knights are not safe against such an attack. We all know what's gonna happen in a theater near you in 3 weeks...
And, to reply to a previous post, I think E16 includes innovative features. Here are some, which I really love but haven't seen on any other WMs:
In E16, what you do is "grab the window" (click and hold the title bar) as if you are going to move it (which you are really doing) and then press Alt-Fi to switch to desktop i and release the mouse button. That's it. If it needs adjustment, it comes naturally, since you are moving the window anyway.
I am also impressed with the code that the E folks are producing as part of E17. I happened to use Evas for visualization in one of my projects. I needed sometinng that was easy to learn and will help me do the job quickly. Evas was (and still is) in beta and probably incomplete but functional enough. When I downloaded it and saw the sample code, I just loved it. It is so incredibly easy to develop with it. I finished that visualization tool in a matter of hours.
To summarize: I've been extremely happy with the stable version of E and am very excited about what the future E17 has to offer.
Keep up the good work, E team!
In other words he seems to have decided to take a chance and be able to be sued by the RIAA if the court says "No" for some reason...
I am from Bulgaria and I know that a lot of people in my country are at least starting to seriously consider Linux (possibly other Free OSs). Of course, there is a strong geek culture there too (I am currently in the US) but the main reason why people would want to run Linux is that "free as in beer" part. As almost everywhere in the world, all the ordinary user sees is Microsoft's OSs. Computers were sold with pre-installed Windows. However, most of these copies of Windows were illegal and people would only pay for the hardware. This was mainly due to the economic situation (average monthly salary is ~$100USD) -- no one was able to buy the software legally. As a result, people got used to the idea of "free" software. Things used to be like that for a while. Although the computer shops were breaking the law, no one would go after them since this required a lot of time and money and there were many more urgent priorities on a national level. The situation changed since Microsoft took to what they do best: started going after the companies. Yes, the government may not have enough money but Microsoft surely do. I have friends who own a computer shop and they stopped installing Windows on the computers they sold. It is still very easy to find a "free" copy of Windows but in the mean time small companies that need to use software for their work have turned to look for another alternatives. And that is how they are learning about Linux. Granted, it is for purely economic reasons but I guess at some point people will start to see the other positive aspects of Open Source/Free Software. I guess Microsoft did us a great favor after all.
So are you saying that we will switch to playing games at work soon?