I think I know why they claim a need to rewrite their downloader, it's because of the way the loader does implicit loading of DLLs at process initialization. This implicit loading is vulnerable to DLL hijacking , and mitigations like SetDLLDirectory() and such don't help because it happens before any code in their updater gets to run -- even if they use a custom entry point. You can see this yourself by using WinDbg with Loader Snaps enabled , you will see DLL loads occurring before any of your own code gets to run. So, one good way to defend against DLL hijacking, given this, is to make sure your downloader has no dependencies on Microsoft APIs except for those in kernel32.dll (and I suppose user32.dll). These DLLs are 'special case' DLLs that can't be hijacked due to their presence in the KnownDLLs list. But, taking an updater with heavy dependence on Microsoft APIs and reducing this dependency across the board might easily require a big rewrite.
I agree...The original article is definitely BS...I've spent months at high altitude (13000ft+) in the himalayas, and food tastes great there. Cabins are indeed pressurized to 8000ft, I've verified this with the altimiter on my watch (which works off barometric pressure) while flying.
I feel compelled to relate my good experience with a Manhattan broker.
In 1998, I rented a 3K/month 1600 square foot loft in the financial district of Lower Manhattan. I paid the standard 15% of a years rent commission to the broker, a nice woman in her 30s.
The landlord required a 9K dollar security deposit, which I paid.
When I moved out 2 years later, after having the place professionally cleaned , I met the broker, who was practically in tears, to get my deposit back. It turned out that the landlord had left her an envelope with 6K dollars in it, saying that was the amount of my deposit he was returning, offerning no other explanstion. Then he got on a plane to Israel.
She absolutely went nuts and swore that she would get me my money back. She called him (and secretly let me listen on the call) and asked him what the problem was, and he told her it was none of her business and to stay out of it. She told him that she couldn't do business with him if he was going to cheat people, and gave up his listing.
She then got an ex-boyfriend of hers, a very prominent Jewish lawyer involved, at no expense to me. He resolved the matter by calling my landlord and threatening to make him persona non grata in the community for 'giving Jewish people in Manhattan a bad name'. I do not know whether or not he also threatened legal action.
My landlord returned the rest of my deposit that week.
So, in my case the broker earned her fee.
Ken
I also have a Vaio G1, which I backpacked around the world with last year. It's so light you can throw it in a daypack and forget it. It's tough, too.
I took it through 17 countries, without a single problem. The case is all scratched up now, but it still works like a charm. In fact, I am writing this post on it, in Buenos Aires, Argentina.
I also went around the world in 2001 with a Panasonic R1... I think it was part of the toughbook line. In any case, it survived the trip, but didn't survive the 4 foot fall onto my hardwood floor in San Francisco when I accidentally knocked it off the table one day after my return
By the way, I don't see the point of taking a laptop all the way to Everest Base Camp. Just leave it in your hotel safe in Kathmandu. That's what I did.
I don't know what VAIO you looked at , but my Sony VAIO G1 has a carbon fiber case, a 12" screen (I think), an internal writable DVD drive, and wifi, and it weighs just over a kilogram, and gets way better battery life than this Apple laptop - I often get 6hrs.
I would love a good source to prove that Weatherbug is spyware. My parents use it (the full, paid for version). I had heard that it was spyware and told them so, but my brother in law, who is an executive in the IT department of a major corporation, told them it wasn't. Guess who they believed?
-Ken
Well, I know what I think about the FARC. They kidnapped my Uncle and held him for ransom, in 1994.
Our first ransom offer to get him released was for $40,000. For that, they said, they wouldn't even tell us where they left his body.
It's true -- the FARC sells back the corpses of its kidnap victims to families who fail to come up with enough ransom money to get them back alive.
You can read about my Uncle by doing a web search on his name, 'Thomas Hargrove'. The best article about him was titled 'Adventures in the Ransom Trade', written by William Prochnau in Vanity Fair. His kidnapping was the (loose) inspiration for the movie 'Proof of Life'. Meg Ryan played my Aunt!
Ken McKinney
I've likely smoked pot more than 15 times, and I've never bought it from anyone, nor had it in my possession for longer than necessary to pass the joint;-)
I agree that it's a silly requirement. I have a CS degree, 10 years of development experience, I'm not at all overweight, I'm a decent shot, and I've travelled to 20 countries, including China and Pakistan, yet the FBI won't have me. Perhaps I should apply to the CIA! They obviously have a different take on the "War on Drugs".
Ken
Slashdot Mirror
I think I know why they claim a need to rewrite their downloader, it's because of the way the loader does implicit loading of DLLs at process initialization.
This implicit loading is vulnerable to DLL hijacking , and mitigations like SetDLLDirectory() and such don't help because it happens before any code in their updater gets to run -- even if they use a custom entry point. You can see this yourself by using WinDbg with Loader Snaps enabled , you will see DLL loads occurring before any of your own code gets to run.
So, one good way to defend against DLL hijacking, given this, is to make sure your downloader has no dependencies on Microsoft APIs except for those in kernel32.dll (and I suppose user32.dll). These DLLs are 'special case' DLLs that can't be hijacked due to their presence in the KnownDLLs list.
But, taking an updater with heavy dependence on Microsoft APIs and reducing this dependency across the board might easily require a big rewrite.
I agree...The original article is definitely BS...I've spent months at high altitude (13000ft+) in the himalayas, and food tastes great there. Cabins are indeed pressurized to 8000ft, I've verified this with the altimiter on my watch (which works off barometric pressure) while flying.
I feel compelled to relate my good experience with a Manhattan broker. In 1998, I rented a 3K/month 1600 square foot loft in the financial district of Lower Manhattan. I paid the standard 15% of a years rent commission to the broker, a nice woman in her 30s. The landlord required a 9K dollar security deposit, which I paid. When I moved out 2 years later, after having the place professionally cleaned , I met the broker, who was practically in tears, to get my deposit back. It turned out that the landlord had left her an envelope with 6K dollars in it, saying that was the amount of my deposit he was returning, offerning no other explanstion. Then he got on a plane to Israel. She absolutely went nuts and swore that she would get me my money back. She called him (and secretly let me listen on the call) and asked him what the problem was, and he told her it was none of her business and to stay out of it. She told him that she couldn't do business with him if he was going to cheat people, and gave up his listing. She then got an ex-boyfriend of hers, a very prominent Jewish lawyer involved, at no expense to me. He resolved the matter by calling my landlord and threatening to make him persona non grata in the community for 'giving Jewish people in Manhattan a bad name'. I do not know whether or not he also threatened legal action. My landlord returned the rest of my deposit that week. So, in my case the broker earned her fee. Ken
I also have a Vaio G1, which I backpacked around the world with last year. It's so light you can throw it in a daypack and forget it. It's tough, too. I took it through 17 countries, without a single problem. The case is all scratched up now, but it still works like a charm. In fact, I am writing this post on it, in Buenos Aires, Argentina. I also went around the world in 2001 with a Panasonic R1... I think it was part of the toughbook line. In any case, it survived the trip, but didn't survive the 4 foot fall onto my hardwood floor in San Francisco when I accidentally knocked it off the table one day after my return By the way, I don't see the point of taking a laptop all the way to Everest Base Camp. Just leave it in your hotel safe in Kathmandu. That's what I did.
I don't know what VAIO you looked at , but my Sony VAIO G1 has a carbon fiber case, a 12" screen (I think), an internal writable DVD drive, and wifi, and it weighs just over a kilogram, and gets way better battery life than this Apple laptop - I often get 6hrs.
Ken
I would love a good source to prove that Weatherbug is spyware. My parents use it (the full, paid for version). I had heard that it was spyware and told them so, but my brother in law, who is an executive in the IT department of a major corporation, told them it wasn't. Guess who they believed? -Ken
Well, I know what I think about the FARC. They kidnapped my Uncle and held him for ransom, in 1994. Our first ransom offer to get him released was for $40,000. For that, they said, they wouldn't even tell us where they left his body. It's true -- the FARC sells back the corpses of its kidnap victims to families who fail to come up with enough ransom money to get them back alive. You can read about my Uncle by doing a web search on his name, 'Thomas Hargrove'. The best article about him was titled 'Adventures in the Ransom Trade', written by William Prochnau in Vanity Fair. His kidnapping was the (loose) inspiration for the movie 'Proof of Life'. Meg Ryan played my Aunt! Ken McKinney
I've likely smoked pot more than 15 times, and I've never bought it from anyone, nor had it in my possession for longer than necessary to pass the joint ;-)
I agree that it's a silly requirement. I have a CS degree, 10 years of development experience, I'm not at all overweight, I'm a decent shot, and I've travelled to 20 countries, including China and Pakistan, yet the FBI won't have me. Perhaps I should apply to the CIA! They obviously have a different take on the "War on Drugs".
Ken