4 ms·

> Actually, the purpose of the software is to recognize whether a special key has been pressed or released. Instead, however, the developer has introduced a num

> Actually, the purpose of the software is to recognize whether a special key has been pressed or released. Instead, however, the developer has introduced a number of diagnostic and debugging features to ensure that all keystrokes are either broadcasted through a debugging interface or written to a log file in a public directory on the hard-drive. Looks like it's not intentional. Although really poor code-quality process I would say.

jlg23 9y ago
> Looks like it's not intentional. Although really poor code-quality process I would say. OTOH, pretending incompetence has always been a pretty successful defence. This is a class of error that I won't easily attribute to incompetence.
wolfgke 9y ago
> Looks like it's not intentional. Although really poor code-quality process I would say. To quote from > https://en.wikipedia.org/w/index.php?title=Underhanded_C_Contest&oldid=773989999 https://en.wikipedia.org/w/index.php?title=Underhanded_C_Con... (emphasis by mine): "The Underhanded C Contest is a programming contest to turn out code that is malicious, but passes a rigorous inspection, and looks like an honest mistake." Do you really believe that Malory does not use practices that make the security hole look like a mistake of a not-so-experienced programmer or an internal debugging tool that was accidentally left in?
- drinchev 9y ago
  That's why I wrote "Looks like" in first place. A little paranoia here would actually be helpful. Anyway my thought process is : If it's really intentional, they would not dump the keystrokes to a text file ( maybe some `.dat` shit ) and will not truncate it on every log in. On the other hand. It seems quite stupid for anyone to not foresee what happens when the code is being executed on a scale. If I'm a big corp, I would actually demand ( via court ) from HP/Conexant to open source the driver itself, since any investigation will need access to it anyway.
- mijoharas 9y ago
  Sorry, what do you mean by "Malory" here? trying to google I only get references to Malory Archer from Archer. EDIT: Think I found it. The new M's name is Gareth Mallory[0] [0] http://jamesbond.wikia.com/wiki/M_(Ralph_Fiennes) http://jamesbond.wikia.com/wiki/M_(Ralph_Fiennes)
  - wolfgke 9y ago
    > Sorry, what do you mean by "Malory" here? trying to google I only get references to Malory Archer from Archer. > https://en.wikipedia.org/wiki/Alice_and_Bob https://en.wikipedia.org/wiki/Alice_and_Bob "Mallory or (less commonly) Mallet: A malicious attacker." Sorry I forgot one "l" in "Mal[l]ory".
    - mijoharas 9y ago
      Thanks! I was only aware of Alice, Bob and Eve, good to know there's a whole cast of characters.

jlg23 9y ago

> Looks like it's not intentional. Although really poor code-quality process I would say. OTOH, pretending incompetence has always been a pretty successful defence. This is a class of error that I won't easily attribute to incompetence.

wolfgke 9y ago

> Looks like it's not intentional. Although really poor code-quality process I would say. To quote from > https://en.wikipedia.org/w/index.php?title=Underhanded_C_Contest&oldid=773989999 https://en.wikipedia.org/w/index.php?title=Underhanded_C_Con... (emphasis by mine): "The Underhanded C Contest is a programming contest to turn out code that is malicious, but passes a rigorous inspection, and looks like an honest mistake." Do you really believe that Malory does not use practices that make the security hole look like a mistake of a not-so-experienced programmer or an internal debugging tool that was accidentally left in?

drinchev 9y ago
That's why I wrote "Looks like" in first place. A little paranoia here would actually be helpful. Anyway my thought process is : If it's really intentional, they would not dump the keystrokes to a text file ( maybe some `.dat` shit ) and will not truncate it on every log in. On the other hand. It seems quite stupid for anyone to not foresee what happens when the code is being executed on a scale. If I'm a big corp, I would actually demand ( via court ) from HP/Conexant to open source the driver itself, since any investigation will need access to it anyway.
mijoharas 9y ago
Sorry, what do you mean by "Malory" here? trying to google I only get references to Malory Archer from Archer. EDIT: Think I found it. The new M's name is Gareth Mallory[0] [0] http://jamesbond.wikia.com/wiki/M_(Ralph_Fiennes) http://jamesbond.wikia.com/wiki/M_(Ralph_Fiennes)
- wolfgke 9y ago
  > Sorry, what do you mean by "Malory" here? trying to google I only get references to Malory Archer from Archer. > https://en.wikipedia.org/wiki/Alice_and_Bob https://en.wikipedia.org/wiki/Alice_and_Bob "Mallory or (less commonly) Mallet: A malicious attacker." Sorry I forgot one "l" in "Mal[l]ory".
  - mijoharas 9y ago
    Thanks! I was only aware of Alice, Bob and Eve, good to know there's a whole cast of characters.