darren_

20 ms·

151.
by darren_ 14y ago
This case is not 'the wrong thing'. The wrong thing is selling this data to criminals, or not publishing it at all because odds are someone else is going to find it eventually. What you're calling "the right thing" isn't zero cost. It takes
152.
by darren_ 14y ago
They don't have a vulnerability reward program, so why on earth would you?
153.
by darren_ 14y ago
http://code.google.com/p/chromium/source/search?q=ABPerson&#...
154.
by darren_ 14y ago
As someone who's been watching these statistics obsessively for a while now, the most impressive part is how fast Romania's risen - they've gone from zero to 6% in literally a couple of months.
155.
by darren_ 15y ago
Yes? But it presents a much smaller attack surface (as compared to the attack surface presented by the set of applications you might otherwise run under a sandbox). And it's maintained/secured by one vendor instead of the set of vendors tha
156.
by darren_ 15y ago
It's not even 'poorly written', it's nearly every non-trivial C/C++ app, over a long enough time, turns out to have _something_ exploitable in it.
157.
by darren_ 15y ago
It's not. For whatever reason, OS X installer pkg files are deemed 'safe files' by safari, which has an option to open such "safe" files automatically. So the thing that actually launches is a standard Installer.app from apple, but running
158.
by darren_ 15y ago
You've basically described 10.6's anti-malware 'solution', although obviously its little plist file hasn't been updated to include Mac Defender yet.
159.
by darren_ 15y ago
A positive step for Lion is that they've started actively engaging members of the exploit research community, although details are scarce on what that means or how seriously they'll take their advice. Proper ASLR and sandboxing Safari by de
160.
by darren_ 15y ago
> But iPlayer for non-UK viewers, it just isn't feasible. It seems like they're working on it (iPad only, by the looks of it): http://www.guardian.co.uk/media/2011/mar/02/bbc-global-iplay... You're right, though, ad-supported iPlayer
161.
by darren_ 15y ago
Other comments are assuming this is flash wearing out, but is this actually the flash wearing out or is it something else (buggy firmware, cheap memory cells, what have you)? The time-to-failure seems way too low for it to be excessive writ
162.
by darren_ 16y ago
This does seem most likely, but the other thing is that this previous image data is from times when no-one was using the camera. So the question is where did the previous image data come from?
163.
by darren_ 16y ago
The last post in the thread makes it sound as though an app wasn't even on the display when it happened ("I hit the button to see if anyone called me (no one did) and drove off" - and then later the picture is of him when he hit the button)
164.
DoS for NetBSD-derived ip stacks processing nested IPComp payloads(lists.grok.org.uk)
4 points by darren_ 16y ago|0 comments
165.
by darren_ 16y ago
AV software is written to pass the tests of AV software reviewers. This is subtly but importantly different from "written to accurately detect and block malware"; in particular, it's extremely difficult for a reviewer to test an AV's abilit
166.
by darren_ 16y ago
You'd think so, but actually there exist keyloggers that take screenshots on mouseclicks, precisely to bypass this.
167.
by darren_ 16y ago
It looks fiddly for constant use, but if it were toggleable, provided it's quick to invoke (and difficult to accidentally invoke) it'd be great for the situations where small links are a pain. Note that in this case it has to be less effort
168.
by darren_ 16y ago
Pretty sure TippingPoint ZDI gets the details of your vulnerability as part of the contest, and they notify vendors and either a) release publicy if there's no real response from the vendor or b) give them a 'reasonable timeframe' to workin
169.
by darren_ 16y ago
ASLR was in 10.5 and 10.6 but it's not a good implementation at all (in particular the dynamic linker isn't randomized, and has plenty of useful code in it to play with, rendering the randomization basically pointless). Most ASLR bypasses a
170.
by darren_ 16y ago
Interestingly, according to http://www.computerworld.com/s/article/9214002/Safari_IE_hac... , the researchers who signed up to hit Chrome have either not shown up or decided to concentrate on Blackberry instead. Seems their sandbox holds
171.
by darren_ 16y ago
It's not surprising because he [Charlie Miller] was fourth or fifth in line. Everyone who signs up for this has exploits already in the bag that they've been working on for weeks, it's not like it's hackers showing up and racing each other
172.
by darren_ 16y ago
On non-jailbroken iOS you can't mark a section of memory as executable once it has been writable (and vice-versa, apparently). Executable pages are also checked against a signature by the kernel before they're used.
173.
by darren_ 16y ago
If you don't mind me asking, how many applications is that spread over?
174.
by darren_ 16y ago
Does vmware fusion's support for installing OS X Server guests allow Lion Server?
175.
by darren_ 16y ago
Carrier-locked phones with appstores were the standard long before iPhones came out. See: crappy verizon flip-phones with the BREW store. Fair enough that people might not remember them so well though, because there was literally nothing wo
176.
by darren_ 16y ago
The last two DS Zeldas were basically begging to be cloned by someone with even an iota of common sense - they had fun dungeon/town sections spoiled by incredibly tedious overworlds that basically ruin the games (especially in the train one
177.
by darren_ 16y ago
Well I make no promises about the 'good' part (in fact it seems like its modern incarnation is a complete mess) but Graal Online used to be MMORPG based on a link to the past-like engine, I think at one point back in the day it even had rip
178.
by darren_ 16y ago
I did > 8 interviews with Google and never encountered anything resembling manhole/ping-pong ball problems; this was more than two years ago and my friends who've interviewed since haven't mentioned them either. Still, limiting the numb
179.
by darren_ 16y ago
Actually that's a cross compiler, and products made with it are almost certainly allowed on the appstore (I actually worked on a J2ME->iPhone cross compiler in 2008 when the appstore rules were even stricter, and products using our comp
180.
by darren_ 16y ago
Someone forgot to configure an update to the Remote app to have a minimum iOS version of 4.x, apparently. Though the fact that apparently apple were going to send engineers to his house (... really? I pretty much don't believe that at all

More ›