Two points. 1: @AviD, you shouldn't blame me for you being such a creeper. 2: @Gilles, I would like to have on the record that, no matter my place of origin, I am unlikely to be the product of incest.
Classic ASP used an encrypted Viewstate as a hidden field in a form. One of the benefits of this is that the cryptography was "authenticated", meaning that any tampering would be detected in addition to the privacy features available in an encrypted payload.
There are many many questions on thi...
@TerryChia yeah it does sound awesome, but I'd never play, I just don't have the time that you'd need to dedicate to it. What I thought was interesting was how they're developing their own social structures, economy and language.
Z'ers no Canada like French Canada, it's ze best Canada in ze land! The other Canada is a bullshit Canada, if you lived here for a day you'd understand!
@Polynomial curse you corporate proxy. apparently that site has been categorised and "hacking"... god forbid we should have developers learn about how to break into their programs, so that they can learn to write them more securely... grrr..
> After that, there are terrifying lunatics who know SO MUCH about Windows Internals that they write a WHOLE KERNEL from scratch for a bizarre stunt-OS that is binary compatible with Windows - presumably after a drunk bet got waaay out of hand.
actually scratch that, there are some even better lines in that announcement :)
"Changes the password used to protect the integrity of the key-store contents. The new password is new_storepass, which must be at least 6 characters long."
@LucasKauffman basically that keystore (usually) takes the place of the cacerts directory in a typical openssl install. However, it depends what you're using the keystore to
.. do. If you're using it to store non-default keys, then it can cause a problem
generally it'll only have publicly available CA certs
what I'm wondering is if it also has contains the private key of the server, for instance if I have the keystore, does it contain the key that would allow me to decrypt traffic between client and server
Some places don't have the servlet container do any SSL, they hand it off to an local apache/nginx install that does all the SSL. But I assume if your application is doing and SSL connections directly, then yes, a keystore leak might be a problem.
as a personal learning project, im going to see why its impossible to switch the cpu into kernel mode (via int 0x80), then to somehow trick it into staying in kernel mode while executing instructions i have control over. i know i will fail, but i think understanding why this is impossible should be a good thing to know, right?
If you can convince the kernel to put the interrupt table into pages that you can modify, then you could make the CPU jump to arbitrary places with ring 0 privileges
@lynks the CPU powers in "real mode". At some point, the bootloader sets a flag in the cr0 register, which switches to "protected mode" (where there are rings) and, indeed, it starts its life in ring 0
Ring 0 code has uncontrolled access to I/O ports (the in and out opcodes) which gives it quite some leverage on hardware
Including triggering firmware update procedures on hardware which has flashable firmware, so I guess this count as "damage"
In older times, privileged code could make the graphic card send high-frequency signals to the CRT display, and could damage it
@lynks Yes, could be done. But most motherboards have a failsafe which cannot be deactivated, and shuts down everything if the temperature rises too much
@Sadaluk: the aeskeygenassist opcode allows for managing two subkey words in parallel so that you can make key schedule twice faster. Indeed, the key schedule for a single AES allows for that.
@AviD Theoretically, quad-channel requires four identical modules and offers twice the bandwidth than dual-channel. If you have two distinct pairs, then you will probably do dual-channel
@Sadaluk: cross-unit opcodes are expensive in the CPU, which is why the keygen opcode works only on xmm registers (opcodes which handle both xmm and a 32-bit register are a special category). Since they were using xmm, they could fit two parallel key schedule units, so they did. It does not matter often (key schedule is not a frequent operation, with regards to block encryption).
@AviD I don't think that modules are specially marked with their originating "kit". As long as the four modules are identical with each other, they should qualify for quad-channel as well as a packaged "kit".
I'm contemplating between getting 4 modules of quad, or 2 modules of dual (both totalling the same GBs). Right now, I'd probably be better off with the 4 quads (price notwithstanding), but I'm looking for upgrayddability - If I can add another identical pair of duals later on, that will allow me to gracefully move to quad at double the size.
they will have generic purpose integer registers of size 128 bits when it will become relevant, i.e. when there will be more than 64 bits of address space to manage.
It may take a bit of time before reaching that point.
hehe, yeah, seen that stuff.... I couldnt really care less about how it looks. If I'm doing this right, I should never have to look away from my screen again, let alone peer into a dusty ol' case.
hell, I dont even want to see the case at all. it should be tucked away in some closet somewhere.
@lynks sure, for perfomance / noise / heat reasons. Still have no interest in climbing in there, except for purposes of working there (hopefully upgrades). I don't need to watch the pretty little lights, or show off my memory colors.
@ThomasPornin aha, you being the crypto authority on here, what is the risk if I have a PCKS12 store with a default password (key.p12) on IBM WebSphere?
@AviD very solid, aluminium throughout, painted black on all surfaces, click in/out HDD trays, rubber holes for cable tidying (i shall take a photo of mine later, you will see no cables :P)
hmm. Okay, so in a performance system (but not crazy overclocked gaming rig), which is more significant wrt RAM: and increase in clock speed, or lower timings?
@AviD generally you push up the bus speed and dram voltage until the RAM starts to freak out (memtest), then you push up the CPU multiplier and core voltage until the CPU starts to freak out
@AviD yeah absolutely, but pushing up the FSB frequency is what really makes the difference, the ultimate CPU clock speed is less important. add never running a swap, crucial ssds in raid, and you're flying :P
@AviD again, it all just comes down to your usage model, disk speed doesn't come into play much in what i do. i run long-lived apps that reside wholly in memory a lot of the time.
@ThomasPornin Ah, ofc. That makes a lot of sense. I didn't see there being any harm in the way they had done it, but aside from the parallel keyschedule (can't think how often that would be necessary) I couldn't see much point in it. Thanks, I knew you'd know!
This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a great deal.
The common advice is not to use dictionary words. I understand that. But what happen...
@LucasKauffman I don't know about Websphere, but a PKCS#12 with a known password is equivalent to just having the objects contained therein as so many plain files.
@ScottPack if you can fit a skateboard on, I think that adds to the cool factor too. At least if any of the TV shows I've seen involving US teenagers are accurate, anyhow.
The same goes for how viruses are typically represented. Viruses are a pain, but they can't damage your hardware, browse for porn under your name, or infect alien spacecraft. Dear LifeHacker: 2/3, unless you're controlling a centrifuge. Then 1/3. Unless the intelligent being really likes python, then 0/3 and @Scott will flip his shit.
Mainly I'm wondering if operating systems will always use ethernet for internet connections if it is available, falling back to wireless when it is not.
My thinking is based around the security threat of someone snooping on a wireless connection, and would prefer for that vulnerability to not be...
@Lucas I don't see the "too lazy to press a button" at all. It's a valid question regarding a scenario that's not uncommon. I see folks wire up (particularly in conference rooms) all the time without disabling wireless, and IMO it's useful to know if there are security implications here.
I have heard that security in earlier versions of word was not robust.
With Word 2010, if I use the File > Info > Protect Document > Encrypt with Password option, is this a secure way to protect a file?
Or is it trivial to crack the security provided by this option?
@Lucas I totally agree that it's easy to disable wireless as an individual user. But from a sysadmin perspective (and in real life I'm not, so this is purely theoretical for me, but not necessarily for people Googling this topic) what are the security implications for employees that don't turn off wireless?
Classic ASP used an encrypted Viewstate as a hidden field in a form. One of the benefits of this is that the cryptography was "authenticated", meaning that any tampering would be detected in addition to the privacy features available in an encrypted payload.
There are many many questions on thi...
Priority one: Clock speed. Higher numbers are better.
Priority two: Latency. Lower numbers are better.
Priority three: Voltage. Lower numbers are better.
Priority four: Heat sink. Cooler looking is better.
I have heard that security in earlier versions of word was not robust.
With Word 2010, if I use the File > Info > Protect Document > Encrypt with Password option, is this a secure way to protect a file?
Or is it trivial to crack the security provided by this option?
