Even if SELinux/AA are able to confine the actions of a pwned firefox or it is running as a different user, firefox can get access to keyboard and mouse actions and possible more via X (try xev).
Full virtulization is useless, if the attack is advanced enough that it can is keylogging a separate user (has root), modifying your Firefox binaries (has root and then some) or modifying what you see (one hell of an exploit somewhere in your xorg stack), then the chances are the attacker can modify your virtualized os when its mounted,
If the virtualization is good, the attacker still cannot break out of the VM. In practice there will be exploits allowing to break out, but at least now there are many barriers: the attacker has to exploit firefox, then possibly break out of SELinux/Apparmor and get root, after that it has to modify the kernel and break out of the VM. And depending on the VM and the exploit the attacker may then still only have access to a userspace part of the virtualization environment, running as a normal user on the host. So this is much better than just a single defense.
And while most users don't have to be this paranoid, the good thing about virtualization is that it's easy: you can get all this security with very little effort - the "cost" is much lower than e.g. configuring Apparmor, and the protection is much better.
Or is there an easy, lightweight (lightweight as in "I don't necessarily want to virtualize a full OS just to run a browser", way to sandbox a browser?
Have a look at the Linux extensions like SELinux or AppArmor. At least the latter one can be set up comparatively easy, and is useful to protect a few selected processes such as FF from doing harm. Certainly not perfect, but it should be able to stop an exploit from taking over the whole account.
However, the weak link will then probably be X and your window environment (KDE/gnome), so full virtualization is still much better. Of course, even that doesn't offer perfect protection.
It's not only an argument from authority. I wouldn't care if Obama switched from KDE to Gnome, but Linus is a very technical minded person (aka a geek), and he's switching for a reason. And many other people with a similar mindest share this view.
Yes. The Russian mafia. They have much more than sufficient resource - not merely access to supercomputers, but also access to large botnets of other people's PCs. Cracking encryption is a task well suited to distributed computing.
Yes, these people can and routinely do crack military grade encryption, if the data is valuable enough. This data is valuable enough.
"military grade" is a pretty useless term here - the military uses all kind of encryption, from weak to very secure. But when talking about encryption suitable for "secret" stuff (i.e. classified secret), then you can be pretty sure the NSA is not going to allow any form of encryption which is known (to the NSA) to be breakable. Not breakable by any other (foreign) government agency with a multi-billion-dollar budget, and certainly not by the Russian mafia. And as a reminder, AES is a valid algorithm be used to protect secret communications and available to pretty much everyone.
To get your data, they would try to get the encryption keys by hacking the computer or by physically breaking into your house and office. They might even sneak backdoors in the software you are using and weaken the encryption artificially. But they will not bother with the encryption itself, unless you've been using weak encryption from the start.
This is an extreme example, of course, but any sufficiently complicated expression that affects what code path is taken and/or termination of the program will pretty much have the same problem when it comes to static analysis.
But for programs where it really matters (the usual example: aviation), you should have a very tight specification. And that specification hopefully doesn't contain "sufficiently complicated" expressions. So analysis tools may work pretty well on software written with such specifications, simply because the specification doesn't allow any behavior for which the halting problem would matter.
Not just lynx - 10 years ago you could run netscape on linux systems which had 4 MB total (+ some MB swap).
I have tried this with X running on a different machine connected via the serial port (115 kBit/s). This may explain the 4 minutes starting time needed by netscape - but it worked. Even java applets worked, though not for very long...
But these days I am willing to spent a lot of memory to have some decent layout - the blink-tag may be very memory-efficient, but CSS is slightly more powerful;-)
http://en.wikipedia.org/wiki/List_of_web_browsers lists 141 web browsers (if you count the different version of IE and Netscape)
I guess the question is how many of them do you have to have used in order to keep your nerd card?
IMHO the number isn't that important. More important is:
have you ever used text-based browsers like lynx/links etc.? Bonus for obscure ones like e.g. charlotte (for IBM VM/CMS mainframes)
have you ever read a webpage just using netcat or telnet?
did you have to install your first webbrowser from floppy, because the OS didn't come with one preinstalled? Same for the TCP/IP stack... But this is unfair because it favors the old geeks.
If it involves installing 3rd party software locally then I'll stick with the plain web interface. Why can't they do this with DHTML?
RTFA. It does work with DHTML.
This (if it is working as advertised) is a great thing. Getting commercial results when information I was looking for information (or the other way around) is the biggest problem I have with google's result, to the point where the results become useless.
I couldn't even find a "Schroeter Institute for Research in Cycles of Solar Activity" in the telephone book, at least not in Waldmünchen. However a Miss Landscheidt is listed for the address given as the Insitute's address.
c.f. this (german), search for "schröter"
And Inktomi doesn't even get the URLs right. Their spider regularly tries to access URLs on my domain where the path contains elements from other sites - or sometimes the whole path is from another site. It's seriously broken...
If you happen to be in Germany take the ICE from Cologne to Frankfurt. The track mostly goes right along the A3-Highway and the new ICE 3 achieve speeds here at 300km per hour (that's about 187 mph).
Some people prefer to take the IC - it may be slower, but it's a bit cheaper and most importantly it's going along the Rhine river, so you have a very nice view (make sure you sit at the window on the right side).
Slashdot Mirror
YouTube stupidity
Obligatory XKCD: http://xkcd.com/202/
Keep the disk spinning at 15K but add heads with their own actuator and everything.
Has been done some time ago (so no 15k/min), see: http://www.tomshardware.com/news/seagate-hdd-harddrive,8279.html
Google to the rescue: http://www.fromtheinside.us/thinking/Groundspeed_Check.htm Don't know if it's authentic, but fun to read.
how is X the weak link?
Even if SELinux/AA are able to confine the actions of a pwned firefox or it is running as a different user, firefox can get access to keyboard and mouse actions and possible more via X (try xev).
Full virtulization is useless, if the attack is advanced enough that it can is keylogging a separate user (has root), modifying your Firefox binaries (has root and then some) or modifying what you see (one hell of an exploit somewhere in your xorg stack), then the chances are the attacker can modify your virtualized os when its mounted,
If the virtualization is good, the attacker still cannot break out of the VM. In practice there will be exploits allowing to break out, but at least now there are many barriers: the attacker has to exploit firefox, then possibly break out of SELinux/Apparmor and get root, after that it has to modify the kernel and break out of the VM. And depending on the VM and the exploit the attacker may then still only have access to a userspace part of the virtualization environment, running as a normal user on the host. So this is much better than just a single defense.
And while most users don't have to be this paranoid, the good thing about virtualization is that it's easy: you can get all this security with very little effort - the "cost" is much lower than e.g. configuring Apparmor, and the protection is much better.
Or is there an easy, lightweight (lightweight as in "I don't necessarily want to virtualize a full OS just to run a browser", way to sandbox a browser?
Have a look at the Linux extensions like SELinux or AppArmor. At least the latter one can be set up comparatively easy, and is useful to protect a few selected processes such as FF from doing harm. Certainly not perfect, but it should be able to stop an exploit from taking over the whole account.
However, the weak link will then probably be X and your window environment (KDE/gnome), so full virtualization is still much better. Of course, even that doesn't offer perfect protection.
Routers will only exchange BGP messages if both are configured to do this. Each "neighbor" must be added using its IP and AS-number.
... it was (obviously) all over the damn front page of kde.org...
Hm, I just can't find it:
http://web.archive.org/web/20080113080143/http://www.kde.org/
And the release announcement only mentions "major improvements", "major new capabilities", "improvements" etc..
http://www.kde.org/announcements/4.0/
Am I missing something?
The announcement for 4.1 on the other hand has been quite clear about this.
It's not only an argument from authority. I wouldn't care if Obama switched from KDE to Gnome, but Linus is a very technical minded person (aka a geek), and he's switching for a reason. And many other people with a similar mindest share this view.
I just ran across this nice example for a damaged packet - packet drops outside of the IP world can end pretty bad:
http://userweb.kernel.org/~warthog9/damaged_server/
According to the frontpage, this is git.kernel.org
Yes. The Russian mafia. They have much more than sufficient resource - not merely access to supercomputers, but also access to large botnets of other people's PCs. Cracking encryption is a task well suited to distributed computing.
Yes, these people can and routinely do crack military grade encryption, if the data is valuable enough. This data is valuable enough.
"military grade" is a pretty useless term here - the military uses all kind of encryption, from weak to very secure. But when talking about encryption suitable for "secret" stuff (i.e. classified secret), then you can be pretty sure the NSA is not going to allow any form of encryption which is known (to the NSA) to be breakable. Not breakable by any other (foreign) government agency with a multi-billion-dollar budget, and certainly not by the Russian mafia. And as a reminder, AES is a valid algorithm be used to protect secret communications and available to pretty much everyone.
To get your data, they would try to get the encryption keys by hacking the computer or by physically breaking into your house and office. They might even sneak backdoors in the software you are using and weaken the encryption artificially. But they will not bother with the encryption itself, unless you've been using weak encryption from the start.
This is an extreme example, of course, but any sufficiently complicated expression that affects what code path is taken and/or termination of the program will pretty much have the same problem when it comes to static analysis.
But for programs where it really matters (the usual example: aviation), you should have a very tight specification. And that specification hopefully doesn't contain "sufficiently complicated" expressions. So analysis tools may work pretty well on software written with such specifications, simply because the specification doesn't allow any behavior for which the halting problem would matter.
Not just lynx - 10 years ago you could run netscape on linux systems which had 4 MB total (+ some MB swap). ;-)
I have tried this with X running on a different machine connected via the serial port (115 kBit/s). This may explain the 4 minutes starting time needed by netscape - but it worked. Even java applets worked, though not for very long...
But these days I am willing to spent a lot of memory to have some decent layout - the blink-tag may be very memory-efficient, but CSS is slightly more powerful
IMHO the number isn't that important. More important is:
If it involves installing 3rd party software locally then I'll stick with the plain web interface. Why can't they do this with DHTML?
RTFA. It does work with DHTML.
This (if it is working as advertised) is a great thing. Getting commercial results when information I was looking for information (or the other way around) is the biggest problem I have with google's result, to the point where the results become useless.
I couldn't even find a "Schroeter Institute for Research in Cycles of Solar Activity" in the telephone book, at least not in Waldmünchen. However a Miss Landscheidt is listed for the address given as the Insitute's address. c.f. this (german), search for "schröter"
And Inktomi doesn't even get the URLs right. Their spider regularly tries to access URLs on my domain where the path contains elements from other sites - or sometimes the whole path is from another site. It's seriously broken...
If you happen to be in Germany take the ICE from Cologne to Frankfurt. The track mostly goes right along the A3-Highway and the new ICE 3 achieve speeds here at 300km per hour (that's about 187 mph).
Some people prefer to take the IC - it may be slower, but it's a bit cheaper and most importantly it's going along the Rhine river, so you have a very nice view (make sure you sit at the window on the right side).
The point is that climate change has always been a feature of the Earth, especially in the last few thousand years.
But not global climate change. Big difference.