@LucasKauffman yeah red-eyes to London are never a fun experience.. especially when you have to do something requiring intelligence at the other end... but hey that's consultancy :)
@Tinned_Tuna It does, but it also has a database of known bad locations. Some of these it turns out are actually also used legitimately. That's my experience running rkhunter regularly on my box.
For what it's worth, as I understand it chkrootkit has similar issues.
Provided you're prepared to dig carefully into the results, both are good.
@Ninefingers unfortunately, I was hoping to have something that I can set to run in cron every night and just get an 'Ok!' without having too much trouble...
@TerryChia Ultimate is the one that has everything, same as with Windows editions.
Whether or not that's the one you want, is a different question.
Odds are, you wont have any use for 90% of the added features that you only get with Ultimate, at least.
And then you're just stuck with an overly heavy suite, flooded with features you dont need and dont even know what they are, making it harder to find the ones you should be using.
@TerryChia free from money, but not from other resources...
even though I have full license available, I insisted on installing only the free Express version for my daughter. No need to waste time with dozens of tools she doesnt understand, when just about everything she would need is already there.
Well, I have plenty of disk space and RAM on my workstation, so it isn't a concern. Clutter might be more troublesome to deal with, but it's working out decently so far.
Are there any new features that are useful or notable over the 2010 edition?
My main holiday project is gonna be attempting to write a C# implementation of the Google Authenticator. There doesn't seem to be a port out there, unless any of you knows of one?
@Tinned_Tuna Contrarily, it's the merchants who could drive the departure. Most buyers who are using PayPal would just as easily use a credit/debit card directly on the merchant's site.
Reading the faq will make it clear why this one is a wee bit different
Ask Patents was designed in collaboration with the United States Patent and Trademark Office (USPTO) and Peer To Patent, whose efforts empowering citizens to help find prior art inspired the crowdsourced approach you see h...
and my highest question is a stupid one on Skeptics:
Edited, as every site I found in my search last night gave me sites that all say the same thing:
The perception is that the world is a really dangerous place for children these days
But the statistics I seem to find online seem to imply that despite the media hype around kindapping, serial kill...
@Iszi so I found some stuff about changing the accepted answer for your own questions, but in this case it ain't one of mine. I'll try pinging the questioner
@ScottPack It's still a bit like this, only the right hand side has been powerlined (apparently this means some lines are thickened). Next session the left gets powerlined. Then a new glyph gets posted at the top, then highlighting and UV reactive bits added, then finally some colour...
Hey, does anyone have any reasonably high profile examples of viruses (or just malware in general) that used a heap-based buffer overflow to get on the system? I've been able to find ones that use stack-based overflows but Google isn't so helpful with heap-based ones. Didn't know if this would be a good question for the site so thought I'd ask here first.
@Peanut As it falls into the realm of "open-ended list questions" it is definitely not a good question for this (or any SE) site. Good for chat, though.
YouTube ads are really starting to piss me off. Used to feel like I only got hit with them on about 1 in every 5 views (or even less often) and could skip them about 50% of the time. Now it seems like I get them 2/3 of the time and can only skip about 1/3.
@Iszi yeah I'm suprised at the rise in unskippable ads. I remember when they put them on I read an article that they realised that leaving the skip there actually helps retention on the site
And where's the damn "I'm married - I don't care about dating services!" button for YouTube? That ZOOSK "follow your heart" ad was cute the first time - really old and annoying now.
@RoryMcCune To be fair, I totally could have skipped the movie trailer. But they managed to actually catch my interest first. I think they finally figured out that by putting the MPAA rating warning up front people were skipping the ad before they even saw what the movie was - so they put a teaser clip ahead of it to catch your attention.
Sorry @Peanut - we rarely stay on the site topic for long, here. The topics listed in the room description are roughly in the order of priority they take here.
@ScottPack @RoryMcCune @RoryAlsop @AviD @ThomasPornin - Any of you guys have an answer for @Peanut? He's trying to find an example of high-profile malware that used a heap-based buffer overflow (as opposed to stack-based) to exploit the system.
It is (was) a USB device which induces an overflow in the PS3 operating system by sending different decide ID strings. The data overflows over the vtable for a C++ object (i.e. function pointers) which is just after in the heap.
@ThomasPornin Thanks for that, I'll have a look into it. I think I found an iPhone jailbreak that uses one as well however I was more after something with nefarious intent rather than a jailbreak.
Sorry about the title. This is just something i´m thinking about very seriously...
I've read many Lovecraft stories but my memory is cheating me.
I´ve read a short story as it were a Lovecraftian story. There are two girls in the 20's, one of them is provocative, she is so sexy (maybe very near...
@Iszi For what it's worth, Lovecraft had been raised by quite a puritan mother who considered that there was nothing more rotten or evil than sex. In Lovecraft's stories, when any kind of breeding is involved, it is rarely in a positive way.
@fgysin I work as a penetration tester. I am the .001% of software developers that solve the most difficult security problems that others deem impossible. This would not be the most difficult problem I have solved and I already have a partial solution. Also, Thomas Pornin's answer is awesome. — Rook55 mins ago
I choose to read this comment as: "I, Rook, am the best developer in the world; and yet I bow before the Bear."
@ThomasPornin 1 in 100,000. The population of the US is around 300 million. That means for 3,000 pentesters to exist in this country, everyone must be a software developer.
Now that I've actually read the question (and not just @ThomasPornin's awesome answer), it seems less and less an SE question to me. It's more of a "here's a generic problem - let's fix it" question - a bit too broad and open for this format.
@Iszi Well, yes, it is not really a question; it is more the starting point for a discussion thread. Threads do not map well into the Q&A format of SE sites (and, as far as I know, this is intentional).
@Iszi > "What do you mean?" he said. "Do you wish me a good morning, or mean that it is a good morning whether I want not; or that you feel good this morning; or that it is morning to be good on?"
@Jeff, your comment-then-close might be seen, in a particular light, as slightly abusive. You know you are technically right, and I know it, but the "public at large" might not be as astute as you and me, especially the individual who was sufficiently unastute to ask this particular question.
Could you address the suggestion @CodesInChaos posted in comments - chaining of hashes? I can easily see how it might complicate things over time (and especially after multiple changes of hash mechanisms) but I'm sure there's more depth to it than that if *you've* chosen to omit it from *your* post.
And seriously, why does Markdown just refuse to work on multi-line messages?
We don't store any credit card information. It is gathered via an HTML form, then processed by a PHP script which uses the API from Intuit to charge the credit card. After calling the API to charge the card, all credit card information is disposed of.
Here are my questions regarding the securi...
Ideal solution, I think, would follow the following process:
1. User attempts to log into system. 2. System hashes password+salt with new method, compares to stored hash. If match, permit entry. Else, go to step 3. 3. System hashes password+salt with old method, compares to stored hash. If no match, deny entry. Else, grant entry and go to step 4. 4. System generates newsalt. Hashes password+newsalt with new method, replaces existing stored salt & hash data.
@CodesInChaos Perhaps, but reasonably-concise answers here can't cover every potential risk profile - they can only really address "best" or "most secure" practices. Otherwise, a lot of questions/answers here would be too broadly-scoped (not that some aren't) for the SE format.
Then again, @ThomasPornin has never really been known for concise answers anyway.
@JeffFerland It is a bit crude, but I am ready to call it "cryptanalysis" if it makes communication easier. I am not a maniac when it comes to enforcing strict usage of terms which have never been defined with precision.
We don't store any credit card information. It is gathered via an HTML form, then processed by a PHP script which uses the API from Intuit to charge the credit card. After calling the API to charge the card, all credit card information is disposed of.
Here are my questions regarding the securi...
