That's not completely true. The bug exists in IE5 which gets installed with W2k. So a clean install of w2k gets this bug installed.
And because IE is completely integrated into the operating system, the bug may not only manifests itself when browsing the internet, but also when browsing, say a network share?
Now I think of it, what would happen when a person has the "Enable web content in folders" option set in windows explorer?
Just browsing over (not explicitly opening) a bmp file shows it as a thumbnail in the web content bar.
It's quite probable the arbitrary code gets executed this way. Anyone in for a test?
Bottom line: Not using IE for internet browsing is smart, but you're not completely safe yet...
a lot longer: Freenet
I wonder how many people will start using freenet just to get the sources and not get tagged as "one that downloaded the sources".
No, I think it's because the main objective is to test the ion engine. Doing a spiral around the earth they are able to test it a lot more than just a shot right to the moon.
Anyone up for the calculation if it's accually able to do a direct shot out of earths gravity?
They might be looking for an algorithm that establishes just how random the "random bits" of a file are
This might be easier than you think. In fact you probably allready have a great tool for that installed on your desktop: ZIP
I remeber a slashdot article of quite some time ago saying scientists used zip to identify non-random bits in a microscopic image of rocks. They were trying to automate the identification of fossils in rock.
The image parts showing plain rock would compress badly, rock containing fossils compress better because of nature repeating itself.
So identification of non-random bits in a random stream shouldn't be too difficult.
and if you have other apps with problems, please post about them below.
Got one.
We've got a stand-alone java app using a client-side certificate for athentication to get some XML over https from an webserver. It's very unfortunate that our client certificate has been signed by a certificate that was itself signed before august 2002 (the moment verisign started to sign with a new cert). To be precise 1.5 month before august 2002.
Our app stopped working yesterday 45 minutes into the new day. (It runs every 15 minutes, so the first 2 or three times it still succeeded).
We have had some bad experiences with the party that owns the said webserver (changing XML specs without notice breaking our XSD's and such), so my first responce was calling them (again).
After a couple of hours they responded with the "solution" that I should reconnect with the internet explorer installed on the server that runs our application and all should be fine again.
I knew it wouldn't help because our application knows nothing about IE, but tried it and every suggestion they gave after that.
In the end they send the Intermediate Root CA in a file to us witch I imported into the default java root-CA keystore (using keytool). This fixed the problem.
I really hessitated to import something into the default keystore but it seemed the last solution I could try.
Now I read slashdot and the sun alert accompanying the article, it turns out my solution was about the only right one to use.
The application was down for more than a day.
Now I think about it.... Verisign knows the email addresses of every customer they send a certificate to, signed by this expired certificate.
In fact they know which one's were signed to be used AFTER their's would expire!
Would it have been such a problem to send these persons a warning email in stead of relying on a warning on some page of their website?
I think I wouln't have disgarded a verisign email with the subject WARNING, your certificate is about to return expiration warnings! or something like that as beeing spam.
Offcourse sending people a warning email fails to address everyone, but it sure would have triggered more response than the method they used now.
Maybe it would even had made it onto/. BEFORE it expired...
I agree (mostly).
404's because of MySQL problems aren't rare but almost always are caused by bad administration.
This is a somewhat educatsites selling some cheap products.ed guess based on the fact that the site's I see the errors on are mostly amature sites running on home systems or bussiness sites selling some cheap products.
El-cheapo systems are maintained by El-cheapo administrators.
However, if the system is not supposed to be administrated El-cheapo way, there is probably also money available to buy Oracle licences.
So seeing MySQL failing a lot says nothing about the MySQL product itself...
Slashdot Mirror
That's not completely true. The bug exists in IE5 which gets installed with W2k. So a clean install of w2k gets this bug installed.
And because IE is completely integrated into the operating system, the bug may not only manifests itself when browsing the internet, but also when browsing, say a network share?
Now I think of it, what would happen when a person has the "Enable web content in folders" option set in windows explorer?
Just browsing over (not explicitly opening) a bmp file shows it as a thumbnail in the web content bar.
It's quite probable the arbitrary code gets executed this way. Anyone in for a test?
Bottom line: Not using IE for internet browsing is smart, but you're not completely safe yet...
robby2
a lot longer: Freenet
I wonder how many people will start using freenet just to get the sources and not get tagged as "one that downloaded the sources".
It's not fast enough to do that.
No, I think it's because the main objective is to test the ion engine. Doing a spiral around the earth they are able to test it a lot more than just a shot right to the moon.
Anyone up for the calculation if it's accually able to do a direct shot out of earths gravity?
Robby2
Passenger Risk Database to be Implemented in U.S.
And Verisign is going to administer it...
Scary..
They might be looking for an algorithm that establishes just how random the "random bits" of a file are
This might be easier than you think. In fact you probably allready have a great tool for that installed on your desktop: ZIP
I remeber a slashdot article of quite some time ago saying scientists used zip to identify non-random bits in a microscopic image of rocks. They were trying to automate the identification of fossils in rock.
The image parts showing plain rock would compress badly, rock containing fossils compress better because of nature repeating itself.
So identification of non-random bits in a random stream shouldn't be too difficult.
Robby2
in stead of finding the solution myself...
/. BEFORE it expired...
and if you have other apps with problems, please post about them below.
Got one.
We've got a stand-alone java app using a client-side certificate for athentication to get some XML over https from an webserver. It's very unfortunate that our client certificate has been signed by a certificate that was itself signed before august 2002 (the moment verisign started to sign with a new cert). To be precise 1.5 month before august 2002.
Our app stopped working yesterday 45 minutes into the new day. (It runs every 15 minutes, so the first 2 or three times it still succeeded).
We have had some bad experiences with the party that owns the said webserver (changing XML specs without notice breaking our XSD's and such), so my first responce was calling them (again).
After a couple of hours they responded with the "solution" that I should reconnect with the internet explorer installed on the server that runs our application and all should be fine again. I knew it wouldn't help because our application knows nothing about IE, but tried it and every suggestion they gave after that.
In the end they send the Intermediate Root CA in a file to us witch I imported into the default java root-CA keystore (using keytool). This fixed the problem.
I really hessitated to import something into the default keystore but it seemed the last solution I could try.
Now I read slashdot and the sun alert accompanying the article, it turns out my solution was about the only right one to use.
The application was down for more than a day.
Now I think about it.... Verisign knows the email addresses of every customer they send a certificate to, signed by this expired certificate.
In fact they know which one's were signed to be used AFTER their's would expire!
Would it have been such a problem to send these persons a warning email in stead of relying on a warning on some page of their website?
I think I wouln't have disgarded a verisign email with the subject WARNING, your certificate is about to return expiration warnings! or something like that as beeing spam.
Offcourse sending people a warning email fails to address everyone, but it sure would have triggered more response than the method they used now.
Maybe it would even had made it onto
Just a thought.
Robby2
I agree (mostly).
404's because of MySQL problems aren't rare but almost always are caused by bad administration. This is a somewhat educatsites selling some cheap products.ed guess based on the fact that the site's I see the errors on are mostly amature sites running on home systems or bussiness sites selling some cheap products.
El-cheapo systems are maintained by El-cheapo administrators.
However, if the system is not supposed to be administrated El-cheapo way, there is probably also money available to buy Oracle licences.
So seeing MySQL failing a lot says nothing about the MySQL product itself...
Robin
So he discovered a law *AND* he's got a great looking cousin who is queen of some planet far far away...
You are thinking completely the wrong way...
:-)
Think sevens of nines.....
Robby2