« first day (2773 days earlier)   

1:18 AM
@HamZa I don't think you could really sell it for all that much.
 
 
2 hours later…
3:37 AM
0
A: How does full memory encryption in newer processes protect against DMA attacks?

forestHow does memory encryption impact DMA attacks? Full-memory encryption is not designed to protect against DMA attacks. That is what an IOMMU is for. The IOMMU is configured using a type of ACPI table called DMA Remapping, or DMAR. This table contains a list of regions used by each DMA-capable dev...

If anyone with a greater knowledge of x86 hardware notices any mistakes, do tell me. I do not know much about TME or SME and have not read the documents in detail so I'm just going off some (hopefully reasonable) assumptions.
 
 
3 hours later…
6:58 AM
@forest well, maybe not for financial gain, but there might be some bragging rights included
well, there is some capital involved.. now that I think about it
 
 
1 hour later…
8:08 AM
after Arminius disclosed the details, yes i agree that you can't really sell it
But if it was persistent xss then i think it would
 
Are XSS really being sold?
 
@HamZa and the real goal there was to get SE to get it sorted.
 
@BenoitEsnard i could imagine it would be useful in some sense on a big website such as SE
@JourneymanGeek of course, my point is: some people don't have the same patience as @Arminius has.
 
@HamZa well, the ball certainly was dropped
But ya, it depends on who finds something like that, and why
 
8:36 AM
I guess it takes some dedication for an attacker to really put an XSS to use on a platform like SE which is mostly public anyway
 
It might be useful for advanced phishing, to attack a mod, spread malware but it's not like there are credit card details to steal
 
especially for you web guys
 
@Arminius spreading malware and also reputation damage
 
Yeah
Also, wormable XSSes are interesting, but likely wouldn't work with that one
 
8:50 AM
yeah, and there's some 20 million USD of venture capital in SE as a company and afaik thy still need more. it's hard or at least harder to get new funding after you get hit by something like that
 
 
6 hours later…

« first day (2773 days earlier)