Posts by Daniel B.

Re: Good luck, with some devices embedded management servers...

Being honest, AES was standardized in 2001. It has been FIPS 140-2 validated for at least 10 years, maybe even since 2001 as well. Any device built in this century could and should support AES, or at the very least 3DES (though I'd disable that shit cipher as well server-side).

RC4-only devices would be those from the 20th century.

Re: What?!?

I'm betting it wasn't even the "Impact Team" the one blackmailing people. Anyone who grabbed the AM dump could have done it. Of course, anyone paying would be simply stupid as the info is already out there and thus, available to everyone. The "epic dump" was released on August 16; anyone paying after that date (or asking for blackmail money) is just wasting their time ... or their money.

Re: Hmmm...

The hackers seemed to pretty much have root/superuser/admin access to the entire AM IT infrastructure, and "the database" mentioned there is a live/running one. So, it's pretty safe to say encrypting the data at rest wouldn't have stopped them gaining access to it, since they could access it via the running application.

If the encryption had been made at the application level (that is, it is decrypted by the application itself, but stored encrypted in the DB), it wouldn't have been in cleartext in those dumps. Because they were made with mysqldump.

This is expected behavior when trying to write to page 0 ... from userspace. The way I understood this vuln, the NULL pointer makes it way down to kernelspace calls, and there is where the writing occurs.

Re: No wonder we are running out of IPv4 addresses

Every single device connected to the net should have its own publicly routeable IP address. NAT was a hackjob implemented to alleviate the IPv4 address shortage ... but instead, network engineers saw that as "extra security" and took that at face value.

Of course, NAT "security" is bollocks, and this hack proves it if the devices are connected to a NATted network. The faster we migrate to NATless IPv6, the faster we get all the security theater mentality away from IP addresses.

Re: Where is the real Outlook substitute?

Zimbra don't seem quite there for my needs yet, though looks interesting for those that have an open-minded IT crowd.

Zimbra has ... served us well. The payware version even d0es calendar syncing IIRC.

Um...

Actually, they were far better on "doing a secure smartphone OS" business, even though Symbian was the one that actually did their flagship OS. It was the iToys becoming popular that sent most smartphone OSes off the rails.

Nokia smartphones were able to last more than 24 hours on a single charge. That's an impossible feat with "modern" smartphones...

SLAAC and fixed IP

Solaris 10 allows you to add a "token" to your IPv6 config, which will be used during SLAAC. So you set up:

ifconfig e1000p0 inet6 token ::b00b:babe:cafe/64

and you'll get that addy even if you are using SLAAC. :)

Re: Anytime there's an awesome video of people doing crazy stuff

In America, kids play Call of Duty to fight fictional wars. In Putin Russia, kids go out to street to fight street brawl wars!

In America, kids play GTA to do dangerous driving stunts. In Putin Russia, everyone drives like that in real life!

In America, kids play Assassin's Creed. In Putin Russia, they do parkour themselves while using selfie sticks to record themselves!

Maybe Russians just need more videogames.

Re: Nokia was dead anyway

no-one will like me for saying this but Nokia (phone division) was already dead before MS got involved. It was already a business case of a giant missing the boat and failing badly (aka Kodak).

Nope. They were actually rebounding upwards, and Symbian Belle was getting rave reviews ... up until the Elopocalypse. MS's strategy for borging Nokia instead killed the only strong non-Apple, non-Android smartphone competitor. Sure, by the time MS bought the phone division it was pretty much dead weight, but that was because of MS's mingling in the first place.

The smell of RIAA

... is all over this proposal. They were unable to get SOPA/PIPA/ACTA passed, so of course they're trying to sneak this crap into ICANN.

Any real criminal activity would result in the proxy domain registrar being subpoenaed. This is an obvious attempt to circumvent the law, with the MAFIAA forcing registrars to engage in mass-doxxing. A boon for copyright trolls like the long-gone ACS:Law, but even more for those big-ass internet trolling groups.

The worst thing that might happen if this gets approved would be activists getting "doxxed", and probably killed. This is really, really BAD.

Re: It's a damn pity...

...that no one sells/supports a proper desktop Linux distro that is designed for PC users instead of geeks.

Pretty much most of the mainstream distros are actually geared towards PC users, and even pass the grandma test. They have been like this for quite some time, 6 years, maybe longer. Of course, thanks to Gnome 3 there's a Windows 8-ish moment in some graphical interfaces, but the thing is: they're pretty much useable out of the box. Ubuntu even works with WiFi out of the box, as does Fedora.

The only real stopper is the lack of MS Office, and even that is mostly because of MS's stranglehold on the word processing and spreadsheet areas.

Apollo 12

Switch SCE to AUX!

Also, that hardware survived lightning striking twice. I wish I had hardware survive one lightning bolt!

Re: Whooooops!

Apple currently still has, on its app store, an app expressly stating that it is intended to be used to "bypass your school filter", etc. It's as simple as installing it, and you get full, free, VPN access to the outside world that's almost undetectable.

If your school system can't stop VPNs, you're doing it wrong. Pretty much any corporate network I've had to plug into has blocked pretty much all VPN connection methods. Some proxies are even smart enough to detect "SSL" connections that have been transferring far more data than what a regular HTTPS request would require and cut off those connections.

Re: Rogue? Nethack?

Also, Zork.

It is pitch black. You are likely to be eaten by a grue.

Re: Microsoft is the malware cesspit (@ AC)

Stealing. You keep using that word. I don't think it means what you think it means.

Hint: There's a reason why theft and copyright infringement are treated as separate offenses in most jurisdictions.