Internet explorer already has signed ActiveX controls and it doesn't stop people from ending up with Comet, Gator etc which dirupt work more than many viruses. What it does do is make every developer fork $$$ for VeriSign, even for free plugins.
I am not so sure about their patch for the problem. Instead of checking after every call, they should change packet_get_int() itself to packet_get_int(int min, int max) that calls fatal() if number our of range. Otherwise, there are probably lots of other cases that can choke on strange values. If nresp is signed (not obvious from the patch), there might be fun with sending negative numbers as well. Similar, xmalloc should have a check for allocating blocks of ridiculous size. Also, look at the second patch. If they still need to check for nresp > 100, how does context_pam2.num_expected come to be over 100? Shouldn't they check it as well at the time they create it?
While I have no first-hand experience, I would imagine a lot of parents will not go to see movies if they can not get calls from a babysitter. Same for people with relatives in the hospital etc. Wouldn't be easier install cell phone detectors at the entrance. Then most people will be asked to turn off the phone and those who really need it will be allowed to bring it in.
If you go to their website, the only link to download the OS asks you to pay $99. Since most of their stuff should be based on Linux, I would expect to see sources somewhere on the Net. Ok so they only have to give source to their customers, but if they did someone should have already posted it. Where is RMS when we need him?:-)
By the way, did anyone else think about Redhat install? It mentions that the first NLS translation of the setup program was for Redneck. Wonder if that project was preserved for posterity.
I don't think X is even remotely designed to withstand hostile clients. Last time I checked, if you telnet to port 6000 and just do nothing, it will freeze the server for long time, even if you are not in xhosts. And once you are allowed to connect, you can do tons of fun things, like opening a transparent window on top of the whole screen that captures all the keystrokes. Asking X to protect itself against hostile requests is like asking memcpy to do bound checking.
Mozilla on the other hand lets you view content written by unknown people and should validate everything before rendering it. Font size is just one new thing. There is no fix even for the simple for(;;) window.open(...).
As long as they are just used for tracking and not for devices that check watermarks to check weather they should play the music. Basically, I will be able to play my music anywhere I want, share it with friends, post short "fair use" samples on my website etc. I guess very few of us download the stuff from gnutella to save $1 per song. It's more for instant access and to avoid buying CDs full of junk. Where do I sign up?:-)
Why so much hype about a portable hard drive?
on
Terapin Mine Review
·
· Score: 0, Troll
Basically, it doesn't do anything besides store data from different places. Whatever OS it's running, it sounds like you can only access it through menus on a tiny LCD which is unusable for real apps/games/etc. For just storage, people might as well get iPOD or Archos MP3 Jukebox. As for digital camera, how many 128M storage card does one really need for a trip? I really have no clue what's so exciting about these thing to be mentioned on Slashdot so many times
I never saw a good cell phone and PDA in one box. Samsung Palm cell phone comes close (decent color screen) but Sprint has terrible coverage in Bay area. Trio looks really lame and I heard bad things about it's battery life. Psion is bulky and has a very strange OS. I would rather have a really tiny cell phone that fits in the same pocket with my wallet and keys and a PDA with screen big enough to be usable.
For those, you have a couple of choices. For hacking purposes (PHA?), you might want to get a Zaurus. It runs a pretty regular version of Linux and Java, has a terminal you can use on the device, telnetd etc. But if you are really going to use it as a PDA, you need some kind of a Palm clone. The battery life is a few weeks rather than a day and also everything is in memory and is backed up on every sync with a PC, so you never loose the data. Applications are always loaded in RAM and many of start so quickly you don't even see them loading.
Also, the basic Palms are lighter and thinner than most cell phones. You might want to get Sony Clie instead of real Palm or Handspring, because they use pretty fantastic high resolution screens. I have a 760C and it looks better than any notebook screen I saw. Also the MP3 player is hardware assisted and lasts pretty much for the whole day if you turn off the display.
Well, I do the same thing because I am lazy, but you would have a better security by keeping your uniq, random passwords in a locked table drawer. At least if someone breaks it you would know. There are just too many ways to capture the password without cracking it. For example, are you sure every PC you ever logged on to those systems from is secure? Or nobody installed a logger on one of the 10 BEFORE you started working. Also, these days a brute force attack on the original 56 bit DES shouldn't be such a big deal. The problem is that by capturing just one password, someone gets access to your whole network. Using the same pw on a student machine and an admin system with grades would be a terrible idea for example.
Slashdot Mirror
You could get antharax by junk mail.
Internet explorer already has signed ActiveX controls and it doesn't stop people from ending up with Comet, Gator etc which dirupt work more than many viruses. What it does do is make every developer fork $$$ for VeriSign, even for free plugins.
I am not so sure about their patch for the problem. Instead of checking after every call, they should change packet_get_int() itself to packet_get_int(int min, int max) that calls fatal() if number our of range. Otherwise, there are probably lots of other cases that can choke on strange values. If nresp is signed (not obvious from the patch), there might be fun with sending negative numbers as well. Similar, xmalloc should have a check for allocating blocks of ridiculous size. Also, look at the second patch. If they still need to check for nresp > 100, how does context_pam2.num_expected come to be over 100? Shouldn't they check it as well at the time they create it?
While I have no first-hand experience, I would imagine a lot of parents will not go to see movies if they can not get calls from a babysitter. Same for people with relatives in the hospital etc. Wouldn't be easier install cell phone detectors at the entrance. Then most people will be asked to turn off the phone and those who really need it will be allowed to bring it in.
I know cell phones already fry your brain, but carving a cavity in your fingertip sounds a bit excessive?
If you go to their website, the only link to download the OS asks you to pay $99. Since most of their stuff should be based on Linux, I would expect to see sources somewhere on the Net. Ok so they only have to give source to their customers, but if they did someone should have already posted it. Where is RMS when we need him? :-)
By the way, did anyone else think about Redhat install? It mentions that the first NLS translation of the setup program was for Redneck. Wonder if that project was preserved for posterity.
I don't think X is even remotely designed to withstand hostile clients. Last time I checked, if you telnet to port 6000 and just do nothing, it will freeze the server for long time, even if you are not in xhosts. And once you are allowed to connect, you can do tons of fun things, like opening a transparent window on top of the whole screen that captures all the keystrokes. Asking X to protect itself against hostile requests is like asking memcpy to do bound checking. Mozilla on the other hand lets you view content written by unknown people and should validate everything before rendering it. Font size is just one new thing. There is no fix even for the simple for(;;) window.open(...).
As long as they are just used for tracking and not for devices that check watermarks to check weather they should play the music. Basically, I will be able to play my music anywhere I want, share it with friends, post short "fair use" samples on my website etc. I guess very few of us download the stuff from gnutella to save $1 per song. It's more for instant access and to avoid buying CDs full of junk. Where do I sign up? :-)
Basically, it doesn't do anything besides store data from different places. Whatever OS it's running, it sounds like you can only access it through menus on a tiny LCD which is unusable for real apps/games/etc. For just storage, people might as well get iPOD or Archos MP3 Jukebox. As for digital camera, how many 128M storage card does one really need for a trip? I really have no clue what's so exciting about these thing to be mentioned on Slashdot so many times
I never saw a good cell phone and PDA in one box. Samsung Palm cell phone comes close (decent color screen) but Sprint has terrible coverage in Bay area. Trio looks really lame and I heard bad things about it's battery life. Psion is bulky and has a very strange OS. I would rather have a really tiny cell phone that fits in the same pocket with my wallet and keys and a PDA with screen big enough to be usable. For those, you have a couple of choices. For hacking purposes (PHA?), you might want to get a Zaurus. It runs a pretty regular version of Linux and Java, has a terminal you can use on the device, telnetd etc. But if you are really going to use it as a PDA, you need some kind of a Palm clone. The battery life is a few weeks rather than a day and also everything is in memory and is backed up on every sync with a PC, so you never loose the data. Applications are always loaded in RAM and many of start so quickly you don't even see them loading. Also, the basic Palms are lighter and thinner than most cell phones. You might want to get Sony Clie instead of real Palm or Handspring, because they use pretty fantastic high resolution screens. I have a 760C and it looks better than any notebook screen I saw. Also the MP3 player is hardware assisted and lasts pretty much for the whole day if you turn off the display.
Well, I do the same thing because I am lazy, but you would have a better security by keeping your uniq, random passwords in a locked table drawer. At least if someone breaks it you would know. There are just too many ways to capture the password without cracking it. For example, are you sure every PC you ever logged on to those systems from is secure? Or nobody installed a logger on one of the 10 BEFORE you started working. Also, these days a brute force attack on the original 56 bit DES shouldn't be such a big deal. The problem is that by capturing just one password, someone gets access to your whole network. Using the same pw on a student machine and an admin system with grades would be a terrible idea for example.
From your signature, it looks like you have your after life all planned