@ThomasPornin That said, as I understand it ARM have added new hypervisor opcodes to their processors. I know there's a big effort underway at the moment to add support for this to Linux/KVM, so I assume there's a similar effort for Xen. Might be worth seeing what the status of this ...
... with regards to whether or not the rasberry pi ships or will ship with these chipsets.
I was toying with the idea of a raspberry Pi cluster (say, a dozen of them to get things started), and using them to host a few dozen Xen-powered VM (with possibilities to migrate VM across the network) looked cool.
@ThomasPornin I'm not sure what the IO capabilities would be like - I think that's probably the biggest problem with virtualisation. For example, if you have a smartcard-type embedded storage built in that only supports a fixed number of writes before it dies, to the point projects like pfsense ship special builds for it which reduce writes to disk.
@ThomasPornin Well, this conversation is definitely 10x more interesting than the analysis assignment I am currently doing (yawn).
@Ninefingers A Raspberry Pi boots from a SD card, but it also has 100baseT ethernet. In a cluster environment, I would first try to store actual data on a network server (e.g. with NFS)
@ThomasPornin If they can manage that, I reckon you must be able to go from there and install Xen. It can't be that hard to install. Might involve patching the kernel and recompiling, but that's not impossible provided you're prepared to match to a potentially older kernel version.
For example, the PaX patches are often against older kernels, so to use them you need to build said old kernel, not the latest and greatest.
Which reminds me, I must have a go with the PaX patches again.
@ThomasPornin By the way, out of interest do you think Schneier's Block Cipher Cryptanalysis course is a good way to learn about the topic?
Been meaning to ask that for about two months now!
@ThomasPornin It is basically a list of papers to read and exercises to try - see schneier.com/paper-self-study.html. I have many of the papers now, and I almost have a working version of feal to test against. I just wondered if this was likely to be educational. I suspect it will, but, never hurts to ask an expert.
I was provided with Matsui's article, Schneier's "Applied Cryptography" for the description of DES, and the Biham-Shamir book on differential cryptanalysis for the correct description of DES (that damned Bruce got one permutation backwards).
@ThomasPornin Haha, the last thing you need is a bad algorithm description or test vector. I got myself rather confused with Salsa20 a few weeks ago because of the whole endianness thing.
@ThomasPornin Hmm ok. Well, this week I am going to implement feal in haskell (because I can, not for any other reason) and then I am going to (try to) break it.
@CodesInChaos I agree, although the driver stuff can be mixed, particularly if you're entering areas That Are Not Documented (tm) so stop trying to use them.
I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar.
The goal here is not efficiency but security. In other words I don't care about trading bandwith for security. My idea would be to serve every single character i...
@CodesInChaos An outrageous claim! I mean, what is wrong with in/out parameters in whatever order you feel like, typedefing away pointer symbols, typedefing everything into upper case, typedefing all your sizes into different names and then using them totally inconsistently and so on?
I answered a question and it it's now on the SuperCollider. It will soon get some traffic and I don't want to be epically embarrassed. So does anybody see anything wrong with it so I can try to correct it?
@Adnan while it doesnt look wrong to me, what is odd is that browsers are not supposed to send the current HTTPS URL in the Referer header when redirecting to an HTTP URL.
I'm sure Google knows better than I, but I doubt it.
@LucasKauffman I've worked in the Israeli Police (IT dept) for about 3 years. While most of them are good guys (if a bit "police-headed") there are some units - such as the "crowd control" units" - that are real bastards.
> If a website is accessed from a HTTP Secure (HTTPS) connection and a link points to anywhere except another secure location, then the referer field is not sent.[
@AviD LOL...And from what I've heard, they've quietly disappeared that motto in any case. Didn't like being expected to live up to it in the end, I guess.
anyway, bottom line - www. redirects you to an HTTP launchpage, whereas encrypted. does not, regardless of HTTPS-ishness?
@Adnan if you wanna aim for epicness, you should modify your answer to take all that into account. Prevent nitpicking arseholes like myself from considering your answer to be off.
Evening. @avid - just wasted ten minutes of my life reading that. Summary is 'I should be ranked up there along with these other geniuses. I am just misunderstood' and to summarise that : I have not learned anything. ..
@Adnan Because they want the site that's getting the traffic to know that it came from Google. They also want those sites to buy advertising in order to get the search terms that caused them to get the traffic. encrypted.google.com is just a tool that I expected they offer grudgingly to people who can find it to actually expect them to do things correctly.
@Adnan They're a very profitable company because they've been able to show people that they're a huge source of traffic. No referer == much harder to tell.
@Adnan No worries. In case it's non-obvious; the Listen Subscriptions list are my podcast subscriptions. All of them, not just technical or professional.
@Adnan I think an addendum would suffice. It's pretty good and accurate information that you have, it's just missing that one nitpicky piece. Most people would not be bothered by it.
@Xander Can you please confirm the following for me? "While using `ecnrypted.google.com`, if you click on a normal search result, the website will have no idea where you're coming from"
@Adnan It's less noisy by default, and it has HTTP specific tools which I like and use pretty regularly. I hate Wireshark. I only break it out when I have to do non-HTTP nastiness. Last time it was to hunt down Kerberos issues on a client's network.
@Xander Thanks. I use Fiddler at work, for security-related tasks (injecting SQL in the user agent, for example). Since I'm still new at this, I had to be sure.
According to Google, the difference is with handling referrer information when clicking on an ad.
After a note from AviD and with the help of Xander we conducted some tests and here are the results
1. Clicking on an ad:
https://google.com : Google will take you to an HTTP redirection page whe...
I want to learn about security. How to monitor systems, mobile devices, computers etc. What sort of stuff do I need to research to get into my own devices and monitor/change things, be fluent in Linux systems and code?
Thanks
I would like to know the best methods for learning to program. I've been directed towards the Python language because I was told it is good for beginners. I ultimately want to make games for OS X/iPhone.
My problem is that I understand what I read but I can't apply my knowledge to anything. I am...
@Ladadadada @AviD The SE question was also far more specific. "I've been told Python is a good language for beginners, my end goal is to make games for OS X/iPhone" That's a lot more to work with than "I want to get into IT Security and learn Linux"
And after dropping that bomb, I'm going to go iron some clothes. You may show your appreciation by upvoting all my things in such a way as to not trigger the abuse code.
I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar.
The goal here is not efficiency but security. In other words I don't care about trading bandwith for security. My idea would be to serve every single character i...
According to Google, the difference is with handling referrer information when clicking on an ad.
After a note from AviD and with the help of Xander we conducted some tests and here are the results
1. Clicking on an ad:
https://google.com : Google will take you to an HTTP redirection page whe...
