brians

56 ms·

601.
by brians 12y ago
This is self-imposed, owner-initiated DRM: it's software specifically to make your computer run fewer programs and be less useful, because it might hurt the owner to come to rely upon powerful non-free programs.
602.
by brians 12y ago
Rsync stats a bunch of files on both sides. There are plenty of cases where reading is much more expensive than writing at the destination---imagine Glacier, maybe.
603.
by brians 12y ago
I don't believe Flickr keeps and returns to you the same videos you sent it; OneDrive may, but I don't know. If yahoo shuts down Flickr tomorrow, it's users are screwed. If Dropbox shuts down tomorrow, all my pictures are on
604.
by brians 12y ago
Carousel is backed by a huge storage array, and automatically backs up every picture. The author seems to have missed the critical elements of how it works!
605.
by brians 13y ago
There I agree with you. Thanks.
606.
by brians 13y ago
Not here: you can't do much with AGPL+OpenSSL. AGPL requires release under AGPL. OpenSSL requires advertising clause. There is no legal way to distribute software including parts you have only under APGL and parts you have only unde
607.
by brians 13y ago
We're not doing anything we wouldn't have done in response to mail to security@akamai.com encrypted to pub 4096R/5B9283CE 2007-04-04 [expires: 2017-04-01] Key fingerprint = 4A76 FD9B 3603 C9F5 33F8 1490 49E0 5C45 5B9
608.
by brians 13y ago
I hope Akamai has learned our lesson: upstream earlier, among others. Watch and see.
609.
by brians 13y ago
We're talking about it. The patch is dependent on details of our unreleasable (GPL+OpenSSL+all sorts of other things) server.
610.
by brians 13y ago
It was released as both: we thought that our old protection against swap protected us against Heartbleed. What a stroke of luck. We did check for key values visible in the heap, and on our implementation, in our lab, didn't find them
611.
by brians 13y ago
Yes. Our actual implementation was vulnerable. We disabled TLS heartbeat before 5 April 2014, so are not still vulnerable.
612.
by brians 13y ago
We're still evaluating some of his arguments. I still believe some of them are true in the general case, but do not apply to our specific embedding of this code. I say that aware that I was mistaken 12 hours ago, and so very well cou
613.
by brians 13y ago
Yup. Hard to read! Better that than not to read it. As Rich Salz said in the post to openssl-dev, this is a prototype that nobody should take and use straight. We did think we were pretty lucky that our old patch to keep keys from being
614.
by brians 13y ago
An attack that reads everything is different from an attack that writes everything; 4.1 doesn't seem to understand that. The latter will just crash the computer like some kind of Core Wars champ. The former can copy out the whole heap
615.
by brians 13y ago
That paper only seems to mention heap overflows for purposes of writing to a target object that will later be used for indirection or execution. I don't see how it makes Heartbleed any better to extract a shuffled heap instead of a so
616.
by brians 13y ago
Thanks! As someone who grew up in the Akamai ops environment... How else could you get anything done? I've taken this tool for granted since it was built in 2000. I expect every planetary scale computing company to do this. Isn'
617.
by brians 13y ago
We definitely leaked session cookies and passwords, until we patched. This only protected SSL private keys.
618.
by brians 13y ago
As Rich said: a prototype that works in our world, for our use cases. It needs lots of work to generalize. For example, we have about ten thousand SSL private keys per machine. This, without guard pages, protects all but the first few hund
619.
by brians 13y ago
Can't distribute, actually. We have internal combinations of GPL'd software and OpenSSL, which has Eric Young's advertising requirement. The GPL forbids us from distribution that combination with the extra requirement, and O
620.
by brians 13y ago
Please don't install it! Unless you're using openssl in a small set of server processes on x86 or x86_64, on real machines, and without interactive shell users. Nobody has seriously thought about what it does in a VM, off x86, o
621.
by brians 13y ago
In some sense, yes, the special free list caused it. In another sense, the missed bounds check caused it. In a third sense, the lack of proofs of safety, or informal code review process, "caused" it---that one's harder for
622.
by brians 13y ago
Akamai posted its special heap implementation</a> to openssl-dev yesterday: < http://marc.info/?l=openssl-users&m=139723972124003&w=2> . We'll follow that up with help to adapt it to openssl&#x27
623.
by brians 13y ago
We did, internally. We got key extraction in an hour, about the same as Cloudflare---so we save $10k and rotate exposed keys. Since we renew most certs on an annual basis, all our easy-to-rotate certs were flipped months ago. The outliers
624.
by brians 13y ago
Well, that could be true. But it's not. Check MIT's own definition, at the first Google hit for "MIT Community" and the shockingly predictable URL HTTP://web.mit.edu/community : MIT's diverse communi
625.
by brians 13y ago
That's my report card. The grades are up to Cs now and should be As within a day. I'm glad Ivan and Qualys are helping show us where we really are.
626.
by brians 13y ago
Indeed, it looks like that's a bug in the SSL labs rating scheme: given two trust paths, it takes the longer one. The Baltimore root is trusted, but also signed by the old GTE 1024-bit root. It's not clear to me what harm it does
627.
by brians 13y ago
The public suffix list has two purposes: browsers won't accept wildcard cookies (desirable) but also won't accept a wildcard certificate against that name (undesirable). It's true that nobody should have a certificate for *