paulfr

5 ms·

1.
by paulfr 10y ago
The SHA256 of that file is exactly that of Firefox Setup Stub 35.0.1 (Win32), so of course Authenticode checks out. I'm not 100% sure why some people thought it was a malicious file, but the comments on Virustotal mention [1] which, fo
2.
by paulfr 10y ago
Their conclusion is simply that "the major part has been fixed" in MS12-024, and that you should be careful if you write a self-extracting installer. No big deal.
3.
by paulfr 10y ago
Interesting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.
4.
by paulfr 10y ago
I'm not talking about a "trusting trust" attack, which is difficult to pull off and requires special compiler knowledge because it needs to survive bootstrapping. Here the attacker just needs to patch a binary once and he alr
5.
by paulfr 10y ago
Yes, the number of reported vulnerabilities isn't a good metric to judge the security of a project. It often means that few people bothered to look, and that when developers fixed a bug they didn't try to find out whether it was e
6.
by paulfr 10y ago
Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.
7.
by paulfr 10y ago
Thank you. To be clear, I don't mean that as a criticism of the developers, who as the parent points out do very useful work and do it for free. But I feel that it's important to have an objective look at the current shortcomings
8.
by paulfr 10y ago
Can you give me pointers about authenticode flaws? After a quick search the two issues I found were with MD5 collisions (solution: the signer should never emit MD5 certificates) and certificate padding (solution: the user should set a regis
9.
by paulfr 10y ago
I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a malicious ".zip" file on Windows could trigger
10.
by paulfr 10y ago
I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The install
11.
by paulfr 11y ago
There is some very shady SEO going on here. The French translation link goes to a Wordpress blog with a very bad translation of the introduction. The root of the translation website is a completely unrelated Dutch used car website. Other pa
12.
by paulfr 11y ago
I'll pile on the bandwagon. I just downloaded the dataset, and color is such a powerful feature that training a random forest on images downsampled to a single pixel results in 95% and 98% accuracies! (for the 4-category and 6-catego
13.
by paulfr 11y ago
The grant is for the DAL project [1], which presumably fits the "ground-breaking, high-risk" label. In such a project, some tasks will be high-risk, some tasks will be low-risk. Quantifying the branch predictor of current processo
14.
by paulfr 11y ago
> the one other researchers (which I respect much more) discovered in 2006 You seem to be blissfully unaware that they're in fact the same researchers: André Seznec is a co-author of the paper. This paper is valuable in pointing o
15.
by paulfr 11y ago
There are no absolute values in the summands, so in your example pairs of consecutive terms sum to 0 when you choose b = 2. The theorem seems entirely correct to me. You can prove it with these sub-steps: (1) the set of all j + a_j is the s
16.
by paulfr 11y ago
What the article doesn't state clearly is that this assumes the strong exponential time hypothesis: it assumes that SAT cannot be solved in time 1.9999^n -- in other words that it's impossible to do better than the brute-force a
17.
by paulfr 12y ago
I see the article climbing back up the front page, and I want to make it abundantly clear that I don't believe that there is necessarily a causal relation from breastfeeding vs formula to IQ. I could control for demographic factors, bu
18.
by paulfr 12y ago
The contest was hosted on TopCoder. The name of the organization who provided the data and funded it is not public, but I'm told it will be made public at some point. http://community.topcoder.com/longcontest/?modu
19.
by paulfr 12y ago
I found a big improvement to my model just after the contest was over, so I made a proposal to develop the improved model and do some more in-depth analysis. I'm currently waiting for their reply! If they accept I'll have an oppor
20.
by paulfr 12y ago
I can't edit any more, so I'm posting as a reply. I compared my dataset and their data, and it turns out that even in Brazil there is significant correlation between mother education and breastfeeding, barely less so than on the d
21.
by paulfr 12y ago
Just 2 weeks ago, I won a machine learning contest with a $20,000 prize pool where the goal was to predict the IQ of a child at age 7, based on various biological measurements and demographic indicators. The data includes whether a child wa