Comment screamers (Score 1) 313
Start with land mines.
Good god no! that's the plot device for the movie screamers.
Start with land mines.
Good god no! that's the plot device for the movie screamers.
takes on a whole new meaning.
Autonomous intelligent self propelled evolving landmines turn on humans. 'nuff said.
another way is to convert it to jpeg and store it in facebook.
I use slashdotFS which is a markovian random comment generator which effectively embeds data in a stegenographic comment. The FS handles the details of creating and saving these so it's all transparent and mounts on your desktop like a regular drive. It's slow but it's capacity seems unlimited and frequently gets modded insightful
Perhaps that explains why my company bUber (pronounced Boob Urge) has bee so tied up in the courts. The concept is simple our company iPimp arranges meetings of escorts in hotel rooms. The contractors are all independent contractors, making a little money, but really they are their to give their single serving friends, we call them rides, a hand. This is completely different from normal prostitution, it's a different bussiness model even though it fills the same niche. In places where whore houses are well regulated, inspected and liscenced one can see that we don't need to meet such requirements since our service producers are independent contractors. Our rates are lower since were just making connections between people who might not be full time whores. They just notify us when they are available and we make use of what would otherwise would have been wasted time. We have surge pricing for conventions and with that can get more providers on the street when they are needed.
Recently Uber approached us because it fits well with there model. Our providers need delivery to addresses, and their drivers can act as sales agents for us as well. But they are reluctant to merge with us until we can shake these ridiculous legal problems. We certainly are not a traditional whore house.
setuid is for executables.
That command is a riddle and, forgive me, but I think your explanation is wrong.
the final sudo -s is not there to create an error. it's a perfectly fine command and is that to just make you root on the spot.
I think a partial explanation of what goes on is this:
the first bin just creates the text you want to shove into the sudoers file. that's clear enough.
the pass to >&3 is saying send this text to file descriptor 3. This doesn't exist..yet...but it will shortly.
So how does the file open happen? Well if you put an environment variable definition in front of a command, what happens is the command runs with that environment variable temporarily set for the duration of the command. thus
DYLD_PRINT_TO_FILE=/etc/sudoers newgrp
says create the env DYLD_PRINT_TO_FILE temporarily and set it to
newgrp doesn't actually do anything at all here other than launch a new shell which promptly quits. However it does run with setuid root privilege.
guessing here: And while it's running but not doing anything the system goes, oh, I better open a stream to the DYLD_ file because there might be some output to log there. So it opens that file pre-emptively and duly assigns it to file descriptor 3 for input.
unfortunately DYLD has inherited the permission of newgrp to do that, so its doing a file open as root too.
So we can now write to 3 and DYLD_ redirects that into the file.
at this point I'm not sure what happens exactly. One possibility is the obvious which is that what we write to file descitor 3 goes into the file represent file descriptor 3. that's simple if that's what bash would do. However the explanation of the exploit notes that DYLD_ also fails to close it's file descriptors. In which case what happens is that the newgrp command just exits but because the pipe made it a child, it's parent inherits the dangling filedesciptor. and then that's why we can write to that. I really don't know my bash well enough to say which of those might be the right mechanism here. if either.
anyone alse want to explain?
Another point I'm fuzzy on here is whether the writer needs to have the same setuid as the reader.
Reading the explanation here: https://www.sektioneins.de/en/...
I don't fully understand how it works, but it seems to be more complex than what you just said. I suspect it depends on a parent process inheriting a child procesess setuid for accessing a file.
the bash script however is a riddle to me. I don't understand how the pipe to channel 3 ends up in the
What does the environment variable look like as this executes? which parts of it execute when? and how does the echo get to the file.
the final sudo -s I understand.
can someone break this down for me?
Interestingly this isn't the first time this happened.. When they first started Isotopic dating there seemed to be no lab pure enough to get the lead out. Even water taken from the widdle of the ocean had the wrong lead isotope ratios. Eventually, years, they realized it was in the air from all the lead in gasoline. The gasoline companies had the guy's funding cut off to suppress this, and trotted out a bunch of "tobacco scientists" to ridicule the guy who discovered it. But eventually this too became fact. Now it's used in reverse, the isotopic ratio of lead is used to track gasoline spill origins.
I would have thought the answer to that is obvious: most guns with folding stocks are a lot easier to conceal, and someone wanting to do something bad with a rifle would want to take one that they can conceal en-route. An old Lee-Enfield 303 with a wooden stock isn't so easy for the school shooter to conceal on his way to committing the crime.
This sounds awfully familiar...OpenSSL had a critical vulnerability because they had decided to write a custom allocator instead of using the one provided by the OS. You would think IE developers, with their product being WIndows-only and strongly tied to Windows would never dream of reinventing the allocation wheel, especially as Windows memory management in general has had a huge amount of work done on it in the last few years to make it harder to exploit memory allocation bugs.
It really depends on where you live.
I would say 'no' where I live now. Although there is a bus stop almost outside my house, it takes three times as long to get to work by bus than it does to drive - my drive being around about 20 minutes, and the bus journey (plus walk at the end) being an hour. I can actually beat the bus journey on my bicycle, and it's 12.5 miles (hilly miles, too). The bus not only goes "around the houses" taking a route much longer and slower than my direct route, it stops all the time, and it only goes within a mile of my workplace. It would be 1.2 hours every day longer on the daily route to work.
On the other hand if I lived in a big city such as Madrid I wouldn't even bother owning a car, regardless of whether public transport was free or not. The car becomes more of a liability than an asset once you live in a densely populated city.
We likely don't know the full story here. I suspect it could have gone like this:
* Someone has their phone plugged into a socket labeled 'Not for public use'.
* PCSO notices, says "SIr, can you unplug your phone, that socket isn't for public use".
* Man gets belligerent and argues with the PCSO and refuses to unplug.
No mention of Concorde in the summary, which could do this at over Mach 2?
How have the economics changed that this will be viable where Concorde wasn't? IIRC, British Airways only managed to fly it profitably because they got the aircraft for £1 each. Concorde's engines were thermodynamically very efficient when in supercruise, and the aircraft burned as much fuel as a B747 while hauling only about 1/4 to 1/3rd of the passengers. I don't think there's much that can be done to get the fuel burn down per passenger seat, and due to the nature of supersonic flight it's always going to be more of a maintenance nightmare than a subsonic airliner.
The moon is made of green cheese. -- John Heywood
