topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Friday April 26, 2024, 6:34 am
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - wraith808 [ switch to compact view ]

Pages: prev1 ... 360 361 362 363 364 [365] 366 367 368 369 370 ... 403next
9101
P.S. I think Google is only biding it's time and letting the dust settle before they hand Tavis Ormandy his walking papers. To paraphrase The Godfather: Keep your friends close, and keep employees that did something which might get you hauled into court even closer.

You think they'll hand him his walking papers on something like this?  I for one, never associated his actions with Google other than peripherally, and didn't realize that so many people bought into the conspiracy theory surrounding that association.

9102
...He contacted MS who reacted slowly...

Five Three Days.  Now that we're to the "it's MS's bug and he made an error in judgement" phase, how is 3 days slowly?

9103
I'm glad this topic came up, or I wouldn't have even known about this app!  Thanks!

9104
Boy, you guys sure have a lot of certainty at arm's length (or more). I'm afraid I can't compete with that kind of clarity of vision. But the release of demo exploit code is far from unprecedented...

No, not unprecedented.  Not clarity of vision nor certainty on the actual discussions or conversations either.

But the 5 days to release an exploit is the part I'm having a hard time with.  Can you give *any* circumstances where it's OK to release actual working exploit code after 5 days notice?

Let's err on his side.
1. I find an exploit.
2. I contact MS.
3. They're complete and utter douches and won't work with me at all nor give me the time of day.
4. I release exploit code after 5 days.

Even in *that* case, where is the justification for releasing *working* exploit code into the wild?

9105
He communicated with them *for 5 days*, and they weren't playing ball, which if you look around is a fairly common story with MS and security researchers, especially smaller/independent ones that don't represent someone like Secunia, Sophos, etc. I'm not saying he's right or MS is wrong, just that it's not so clear cut as you and some others seem to feel. But then I'm completely on the opposite side of the "government secrets" debate too, hehe.

He communicated with them for 5 days... on and off I'm sure, i.e. 5 days elapsed.  So actually 3 days, since they said they last communicated with him on the 7th and he released on the 9th.  On the 7th, they said that they'd know about their release schedule at the end of the week, i.e. the 11th.  Just because they wouldn't give him what he wanted on his terms, i.e. tell me that it's going to be released on my timetable now without even looking at the problem, he released it.  And why release the exploit code in such detail?  Why not release news of the exploit, then if they didn't come to the table if they were indeed not playing ball, he could release the exploit after giving them time?  That's the part that *is* clear cut.  He released the exploit *code* into the wild and someone apparently used *his* code to craft a drive-by.  How is that *ever* right?

9106
Evidently Ormandy was negotiating with MS for a patch release schedule and published only after he felt that negotiations were not being productive. His tweet about this is here: http://twitter.com/t...o/status/16005411316
And an article with a quote confirming this from Microsoft here: http://www.computerw...y_Microsoft_confirms
Microsoft confirmed that its security team had discussed a patch schedule with Ormandy.

"We were in the early phases of the investigation and communicated [to him] on 6/7 that we would not know what our release schedule would be until the end of the week," said Bryant. "We were surprised by the public release of details on the 9th."

My sense that Ormandy was not so clearly "wrong, wrong wrong!" continues...

Why?  He communicated to them, and they didn't give him an immediate answer that they wanted, so he released it.  How does this change anything?  He couldn't wait until the end of the week?

Technology is Science, not art.

Just to go randomly off the rails here... ;)

Actually, I find that a lot of tech is art. I find that a lot of what I do is art. It might all be tech, but there's structure and elegance in there. I suppose the best sort of analogy is that tech is often like a fugue or canon as they have structure and a mathematical elegance.

I also find that what I do is an art form.  Science is reproducible in the same way by anyone given the same conditions and the same desired result.  As you get into more advanced programming- not so much.  Each programmer leaves his own signature on his code- I don't know that you do the same when dealing with pure science.

9107
Living Room / Re: Apple Attacks Adobe
« on: June 15, 2010, 03:12 PM »
Apple's market cap passes Microsoft's... and now their legal woes do too.

Mo' money, Mo' problems.

9108
Living Room / Re: Apple Attacks Adobe
« on: June 15, 2010, 09:55 AM »
http://arstechnica.c...tive-code-change.ars

But the changes still don't address the part that I want... MonoTouch!  What's the problem with MonoTouch?

9109
If the drive is write protected, would I have to worry about any of these infections?

No... but I'm not sure that Firefox portable will run on a write-protected drive.  It saves your profile information and cache there if I'm correct...

9110
I would think that Firefox would work in a read-only format though.  It would all take place in the computer memory like everything else (generally speaking - I know there are a lot more variables than that though).  Another option might be to use a read only USB and copy down the portable version to the PC being used, then wipe out the software, but that leaves more traces, not less.

I don't know if firefox would work in read-only mode.  It needs significant cache space for web pages and such, doesn't it?

9111
Public Computers are like Public Toilets, once you sit down you're fully exposed to the last guy's mess.

Talk about uncomfortable analogies...

9112
And that goes for the spandex wearing musclebound as well as...umm...their spandex wearing opposites.

That reminds me of one thing I did when I was younger (and so less aware of the fact that some people wearing spandex were not aware that they shouldn't)...

A friend of mine and I went to a gaming convention.  You know the type... where people wear costumes and dress up and play games, etc.

My friend and I dressed up as referees.  Complete with flags and such.  We went around the con finding people that were wearing things that should not have been worn with their ... proportions.  It's amazing how people can think they can dress up as superman or wonder woman and pull it off when they obviously can't.

When we found them, we'd throw flags on the ground like we were calling a football play, and yell out, "Flag on the play!  Illegal use of spandex!"

(I know... pretty bad.  But admit it... you laughed... :))

9113
It really depends on how you set things up.  If you're using truly portable applications, the only things that are used on the host machine should be the processor and the memory.  Of course, this also depends on the computer not being compromised before you start using it- keyloggers are still an issue, and I'm not sure how you defend against such a thing.

9114
I think more on the men's side than the women.  I was just talking with my wife about this, and she was telling me about a study where men have little imagination other than where their thoughts intersect with women, and women have a lot of imagination, other than where their thoughts intersect with men.

Leotards are like bikinis--it's basically underwear that's been socially accepted to be worn in public.  You are basically able to see everything.  So that makes it sexy.  It also tends to enhance most body shapes by having the stretchy fabric everywhere.  It makes everything look all tight and smooth.

it's the same thing with those tight muscle shirts the guys wear.  it makes things look better by being all tight, shiny, and smooth.

That's when things are in proportion.  Some people don't have the physique to wear such things.  I know I don't and wouldn't.

9115
+1 Eóin.  In the end, the end-users are not techies, and don't know how to even start to do steps for a workaround.  No matter what vulnerabilities are found, the end users are the consumers and the risk takers in the end for most of this.  And disclosure like this makes the end user more vulnerable, no matter how you spin disclosure.  It's sort of like the whole whistleblower thread- disclosure vs responsibility.  And in this case, I definitely think responsibility should have won out.

9116
To Josh and wraith808:
So what you say is that, for example, W. Mark Felt was wrong to leak information about the illegalities committed by the Nixon administration?

<snip />

Indeed, I do not work with classified data, so I do not know all the details regarding this subject. I only read some stories about some whistleblowers, people that have put their careers and even lifes in jeopardy in order to stop bad things and bad people (or at least to inform us about their existence). And I am glad that they did it.

Let's go a bit into why oversight isn't as good as it perhaps should be, and why those being scrutinized might have a problem with it.

The classified information in a lot of cases isn't just discrete bits of data.  In the end, there are assets on the ground- people- that put their lives in the way for different reasons.  No matter what these reasons are, “We sleep safe in our beds because rough men stand ready in the night to visit violence on those who would do us harm.”  People in oversight in some cases use information for political purposes of all sorts.  Because of people getting burned, the assets are skittish about people knowing about them, and the people that utilize the information are skittish because these leaks make it harder for them to get the assets in the first place.  This makes our defense weaker- we might not get information to effectively handle something because someone is concerned for their safety.

This lack of trust for the oversight, and for the operations that might be put into place makes the oversight process a lot less than it should be, which then weakens the ability for true problems to be brought to light.

Was W. Mark Felt wrong?  Yes.  Do the ends justify the means?  No.  Something good came of it, but that still doesn't make it right, or him any less wrong.  The problem with classified information and oversight needs to be solved, but having people reveal classified information doesn't make that problem go away, nor does it make going against the vow that you make right.  These kinds of revelations have the potential to make real people that are just doing their job and happen to be incidental to the information in question be put at unnecessary risk... and that's not right no matter what IMO.  The problem needs to be fixed from the top down, and not the bottom up, and the only way to do that is to (1) make enforcing the CIA Secrecy Agreement a priority no matter what, so that those protected by the classified information are just that... protected, and (2) make oversight a priority and those that violate oversight for any reason liable for that, and (3) make sure that the oversight committee is staffed by those that understand that they either *have* to be available when a Presidential Finding is issued in order to be notified, or give some sort of leeway in the reporting to take into account their unavailability.  

Exceptions to prima facie ethical principles must be shown to fulfill more important principles, not simply be assumed to be acceptable due to their being professionally "expedient." An affirmation of the legitimacy of the CIA as an institution does not entail moral approval of every end it might pursue nor every method it might employ.  And oversight helps to keep the CIA in line with the rule of law, while keeping their methods and information out of public scrutiny.

9117
A person that works with sensitive, classified information is not just some guy from the street. If an institution gives him this responsibility, it means it trusts him and his judgment and that he is prepared to analyze classified data from all points of view. It is not an ordinary job and it bears a lot of responsibility (or it should).

I'd have to respectfully disagree.  Just because you have access to some of the information, doesn't mean that you have access to all of the information.  And without a high level view of the information, you don't know enough to even know what you're looking at in a lot of cases.  Especially with sigint.  In the case of a lot of information that's not gathered by having assets on the ground, there's a really high noise-to-signal ratio.  So a lot of people paid to handle that information are just people paid to basically sift through a lot of detritus.  If they come across something, they shoot it to someone with a higher pay grade.  They are *not* equipped to do *anything* with the information.  If you leave that open to personal interpretation, your whole intelligence system is going to go to pot really quickly.  And these are not just random pieces out there... but people in harm's way.

Classified means just that.  And people who can't get that don't need to be in the business.  One good deed does nothing but make the situation murkier for all of the people in the field, IMO.

9118
^ Well put.  It's sort of like the ninja joke.  If someone says he's a ninja, he's not. :)  One reason those rules are in place also, is that if someone has CSC and people know that they have CSC, then the information that they have is now in jeopardy.  Given the right influence and enough time, anyone will crack.  Security through obscurity...

9119
Whistle-blowers should be protected if by releasing classified documents they prove that somebody has done something wrong (from the law point of view). I know this is the law in some countries.

I don't think so.  This puts too much of a nebulous status on the word classified.  There should be some process (which I think there is) for shedding light on classified documents.  Someone with the classification to see them that these things can be reported to.  And I think that does exist (especially in this age of senate oversight).

How do you allow someone in an analyst position to make the call that something is wrong enough to make classified documents public?  And what about the collateral damage if what they release isn't sanitized enough to protect the identities of those peripherally involved?

When something is marked classified, it should be black and white IMO... especially considering operational security for those who put their lives on the line based on the fact that this is so.

9120
I'm a sarcopath)
Please, get off the path and back  to your phagus!
-cranioscopical (June 07, 2010, 03:35 PM)

You *really* want to make sure you keep that turkey badge, don't you?  ;)

9121
But I'm not talking about the nebulous "Issues of National Security."  It's more the classified tag.  Some things are declared issues of national security after the fact or that's just an excuse used not to comment on something.  But if something is labeled classified, that's pretty unequivocal IMO... and you signed an agreement when you took the job that says you will behave in a certain way toward that data, no matter what it is.

9122
Living Room / More anti-apple fodder
« on: June 08, 2010, 12:52 PM »
You know, I try to retain a reasoned approach to apple and its practices, then they do something douchebaggy like this.

*sigh*

Apple blocks non-Safari browsers from HTML5 demo
http://www.tgdaily.c...sers-from-html5-demo


9123
http://www.wired.com...leak/?intcid=postnav

While unpopular, I know that my view is that classified information is just that- classified.  And if you release it for *whatever* reason outside of the correct procedures, you should be prosecuted.  That's the only way to ensure that intelligence remains actionable and assets that are in place for our security remain safe.  National security is not a pass to violate the rule of law, but there is a definite procedure to bring such things to prosecution- and one Specialist can't decide that information needs to be made public just because he thinks so.

9124
Living Room / Re: The digital age comes to comics...
« on: June 08, 2010, 11:39 AM »
The price actually seems to drop faster on digital games, though.  I bought Supreme Commander 2 for $11 this weekend- and it just came out a little bit ago.

9125
Living Room / The digital age comes to comics...
« on: June 08, 2010, 08:27 AM »
...and it's priced too high!

http://www.newsarama...iron-man-100607.html

And a reaction that I agree with...

http://www.pvponline...-man-annual-digital/

Pages: prev1 ... 360 361 362 363 364 [365] 366 367 368 369 370 ... 403next