Forgot your password?

typodupeerror
Networking

Misconfigured Open DNS Resolvers Key To Massive DDoS Attacks 179

Posted by Unknown Lamer
from the check-your-sources dept.
msm1267 writes with an excerpt From Threat Post: "While the big traffic numbers and the spat between Spamhaus and illicit webhost Cyberbunker are grabbing big headlines, the underlying and percolating issue at play here has to do with the open DNS resolvers being used to DDoS the spam-fighters from Switzerland. Open resolvers do not authenticate a packet-sender's IP address before a DNS reply is sent back. Therefore, an attacker that is able to spoof a victim's IP address can have a DNS request bombard the victim with a 100-to-1 ratio of traffic coming back to them versus what was requested. DNS amplification attacks such as these have been used lately by hacktivists, extortionists and blacklisted webhosts to great success." Running an open DNS resolver isn't itself always a problem, but it looks like people are enabling neither source address verification nor rate limiting.

Comment: Re:printf (Score 1) 425

Just adding my 2 cents. I agree with you that crashing is never acceptable (as in you have something broken), but a forced exit out of the program through an assertion is the most sane thing to do when the error handling has failed and you have an inconsistent state. The best choice of bad ones so to speak. You should not continue hoping things will turn out good (imagine you were talking about a life critical system), but just exit and avoid further damage and restart the program. You might of course be able to write code to take you out of the situation and fix itself, but that is not assertions then, it is error handling.

Comment: Re:Tim Cook's first big fuckup. (Score 1) 376

There is an inherent flaw in this thinking, and this flaw also shows us why large powerful governments are a bad idea,. That flaw is trust, or more specifically, trust in a single entity. Think about it. Almost every malware attack vector starts with exploiting a common point of trust (eg. You trust java or flash or your browser). When trust is centralized, the baddies only need to focus their efforts on subverting that single point. This is true in both government, and information security. My point is, creating an eco system that relies on a central point of trust is setting us up for failure. (sorry for typos, using a tablet)

While I absolutely agree with you that a single authority is a dangerous thing to have, what is even worse is to mix different levels of trust. That is what we have have been living with up to this point. There hasn't really been any restrictions on what applications can do on the system in the context of the user running it. It takes only one malicious or badly written software to compromise the security of your whole system. By sandboxing the different pieces of software in the system, the security of the whole system would no longer be equal to the security of the lowest common denominator. (Up to this point, I rarely install any software simply because I have no control or assurance what it is doing on the system. With iOS I felt for the first time somewhat confident to install 3rd party apps from developers I never heard about)

Comment: Re:Tim Cook's first big fuckup. (Score 1) 376

I'm not saying that there aren't any issues. I just think that the security benefits overweigh the downsides of a more controlled environment. From a technological standpoint, this is absolutely the way to go in the consumer market. If this leads to some applications getting rejected, it is not a technological problem. It just means that it needs to be solved in some other way. For instance, allowing users to install root certificates for 3rd party "app stores". This could be the case for instance how MacPorts and other other package management systems would work in the future.

PS. It was probably also a smart move to deny emulators in iOS. I'm already somewhat skeptical about games because of concern for battery life. Running something inside emulators does not sound good until we have phones running on supercapacitors or some better power source.

Comment: Re:Tim Cook's first big fuckup. (Score 1) 376

The way I see this is going, this might be the case by default. Typical users get their software through Apple. Controls the user experience by denying applications they don't want for their users for whatever reason. On the upside users get safer downloads and applications with at least some level of quality. The fact that applications are being sandboxed and what they can do are controlled by "entitlements" given by Apple will eventually increase the security of OS X. Too long has the access rights of a process equaled the access rights of the user. Whitelisting applications will be much more effective than blacklisting (= virus scanners). I'm not quite sure why most people see this as a bad thing.

For the users on the other side of the spectrum, e.g. developers, I would not worry too much. Unlike iOS, OS X is being used to create applications. Software just don't magically appear in their final form on the doorstep of Apple. You may need to sign your software before being able to run it, but the option will be there. But why should this be enabled by default? Most people will never touch the code.

Comment: Re:So, it just run, shoot, run, respawn (Score 1) 313

by Fulkkari (#39029959) Attached to: <em>Twisted Metal</em> Designer Rails Against Storytelling Games

I would like to compare Battlefield Bad Company and Battlefield Bad Company 2. The first game had a singleplayer consisting of short clips of what is going on. Otherwise you'd be quite freely running/driving/flying around, do whatever you want with plenty of routes to choose. You could drive straight into an enemy base, or you could avoid the base entirely, maybe snipe a few guys along the way. The game has lots of replay value for this reason; nobody dictates how to play it.

In Bad Company 2 however, you're not given any choice. The game is trying to give this "cinematic" experience, and it is totally boring. There is only one path to move forward across and the experience is "dumbed" down to be the same for everyone. For instance, there was that one place where a burning guy was running towards you. Not so impressive, because I did not do anything to make that happen (and I actually had seen it before in the trailer). It always happens. An other example was a place in single player where there was just one narrow route forward, no cover. It was so obvious that there would be an ambush there. I would have tried to flank, but as there were no alternative routes I threw some grenades on the route forward and got some kills. After that I continued, and had one of the AI squad mates shout "ambush!"... Yeah, nice except I already killed all the enemies. Total mood killer.

Everybody plays differently and me for instance, I always try to take the non-obvious paths (the ones without the ambush). Cinematic experiences hardly ever work the right way if you play like this. And even if they do, there is no replay value. I don't think real cinematic experience comes from having some predefined animations or events that occur when you stumble upon them. Cinematic experience comes when some totally random stuff occurs, would it be single- or multiplayer. It is like having an RPG fly very close by or managing to take cover from a tank... And these things just happen. They are never scripted.

I think that my main point is that everybody builds their own experience, and should come up with own goals rather than have the game developer decide how you should play.

Comment: Re:Hope they are realistic (Score 1) 102

by Fulkkari (#38537080) Attached to: UK Ministry of Defense Improves War Games For Console Generation
I used to play Tom Clancy's Ghost Recon (the original PC version) a lot, as well as the good old Rainbow Six series. I usually set up a game with 15 min rounds, no respawn, no threat indicators (a cursor that showed roughly in which direction the enemy is). The games were one shot, kill. Some people complained that it was boring, but I liked it. Your heart would beat like crazy at times. When your whole team was gone with only you left, you would definitely feel the pressure knowing the whole other team was hunting just for you. You should check some videos on YouTube.

Comment: This is simply Wifi positioning? (Score 1) 362

by Fulkkari (#35903698) Attached to: iPhone and Location: Don't Panic

My guess is that the data is fetched to the phone when other means of positioning fails. This data is probably not your location, but the location of nearby Wifi hotspots. By using the nearby Wifi hotspot locations the phone still approximates your location, which is ofcourse neat. According to the update in the article, Android phones would seem to do the same.

Buffering data on the device makes sense. Downloading it every time you visit a location be much bigger privacy issue. Ofcourse downloading it in the first place would reveal your approximate position to Apple (or is it Google?). In my opinion, there is two things that could be improved: 1) disabling of Wifi hotspot positioning entirely and 2) expiration of data (shorter, if there already is expiration) of maybe one month to a couple of months.

I don't have an iPhone so I have not analyzed any data, but this would seem logical to me. My bets are that this is not some evil scheme to "track your every move", so calm down.

Comment: Re:What is up with this site lately? (Score 1) 161

by Fulkkari (#33122484) Attached to: Xfire Purchased, Team Leaving
I'm sorry, but the NYT story was just stupid. I think I'm like many others in here: I come here for the news and the discussion. I don't care about the "social media". I don't want to have any "Facebook and Twitter integration". I don't care about what some guy wrote on his blogpost. And I don't care if some article is a day or half a day late - hardly ever are news really that important. And if I did not follow the link, then I probably just did not think the topic was worth my time.
Security

GSM Decryption Published 299

Posted by ScuttleMonkey
from the spend-the-money-on-tech-instead-of-lawyers dept.
Hugh Pickens writes "The NY Times reports that German encryption expert Karsten Nohl says that he has deciphered and published the 21-year-old GSM algorithm, the secret code used to encrypt most of the world's digital mobile phone calls, in what he called an attempt to expose weaknesses in the security system used by about 3.5 billion of the 4.3 billion wireless connections across the globe. Others have cracked the A5/1 encryption technology used in GSM before, but their results have remained secret. 'This shows that existing GSM security is inadequate,' Nohl told about 600 people attending the Chaos Communication Congress. 'We are trying to push operators to adopt better security measures for mobile phone calls.' The GSM Association, the industry group based in London that devised the algorithm and represents wireless operators, called Mr. Nohl's efforts illegal and said they overstated the security threat to wireless calls. 'This is theoretically possible but practically unlikely,' says Claire Cranton, a GSM spokeswoman, noting that no one else had broken the code since its adoption. 'What he is doing would be illegal in Britain and the United States. To do this while supposedly being concerned about privacy is beyond me.' Simon Bransfield-Garth, the chief executive of Cellcrypt, says Nohl's efforts could put sophisticated mobile interception technology — limited to governments and intelligence agencies — within the reach of any reasonable well-funded criminal organization. 'This will reduce the time to break a GSM call from weeks to hours,' Bransfield-Garth says. 'We expect as this further develops it will be reduced to minutes.'"
Security

Bug In Most Linuxes Can Give Untrusted Users Root 281

Posted by kdawson
from the patchin'-place dept.
Red Midnight and other readers brought to our attention a bug in most deployed versions of Linux that could result in untrusted users getting root access. The bug was found by Brad Spengler last month. "The null pointer dereference flaw was only fixed in the upcoming 2.6.32 release candidate of the Linux kernel, making virtually all production versions in use at the moment vulnerable. While attacks can be prevented by implementing a common feature known as mmap_min_addr, the RHEL distribution... doesn't properly implement that protection... The... bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature. ... [Spengler] said many other Linux users are also vulnerable because they run older versions or are forced to turn off [mmap_min_addr] to run certain types of applications." The register reprints a dialog from the OpenBSD-misc mailing list in which Theo De Raadt says, "For the record, this particular problem was resolved in OpenBSD a while back, in 2008. We are not super proud of the solution, but it is what seems best faced with a stupid Intel architectural choice. However, it seems that everyone else is slowly coming around to the same solution."
Software

Apple's Grand Central Dispatch Ported To FreeBSD 205

Posted by ScuttleMonkey
from the new-toys-to-play-with dept.
bonch writes "Apple's Grand Central Dispatch, which was recently open sourced, has been ported to FreeBSD and is planned to be included by default in FreeBSD 8.1. Also known as libdispatch, the API allows the use of function-based callbacks but will also support blocks if built using FreeBSD's clang compiler package. There's already discussion of modifying BSD's system tools to use the new technology." The port was originally unveiled last month at the 2009 Developer Summit in Cambridge. Slides from that presentation are available via the Dev Summit wiki.

Comment: Re:Fahrenheit: It's for telling temperature (Score 1) 1233

by Fulkkari (#29594723) Attached to: At What Temperature (F) Do You Prefer Your Nerd Cave?

Okay, so I got a few replies basically asking what is the difference in having these points at 0 and 100, instead of 32 and 212 (with Fahrenheit) or for example 0 and 3 with "Geekoid scale", so here is a one.

One degree change in Celsius equals one degree change in the SI-unit Kelvin. Only the reference point is at a different place (absolute zero). Thus conversion between Celsius and Kelvin is as easy as subtracting or adding 273,15 depending on which way you want to go. With Fahrenheit or the "Geekoid scale" you need to do multiplication as well.

At the end of the day, we could put these points wherever we'd like and it would be okay. In practice, I think that there are demand for two common units. One for scientific use and one for everyday use. Which fits Kelvin better? Celsius, which differs only in reference point and has a scale that makes sense in every day life? Or Fahrenheit, which requires scaling and where 0 F really does not matter in everyday life. If you want to measure fever, the zero point could as well have been put to 100 Fahrenheit.

I'd pick Celsius. But hey, I admit that I am biased.

Comment: Re:Fahrenheit: It's for telling temperature (Score 3, Insightful) 1233

by Fulkkari (#29557431) Attached to: At What Temperature (F) Do You Prefer Your Nerd Cave?

Basically, I say that they are both roughly as useful (but celsius in far more used).

The advantage of Celsius over Fahrenheit is that it is bound to two very useful points: the temperature water freezes (0 Celsius) and the temperature water boils (100 Celsius). These can be used to predict things more easily, like is there a risk for icing on the roads, how does the frozen lake/sea hold weight and so on. Or just to know if a surface is above 100 degrees. Put some water on it and see if it vaporizes.

Transportation

Honda's Answer To the Segway 247

Posted by timothy
from the will-change-how-cities-are-built dept.
lcreech writes with an excerpt from the Daily Mail's description of a new Segway-style one-person vehicle being shown off by Honda: "The vehicle looks like a very modern unicycle and to ride it you simply lean your weight in the direction you want to go, whether that's forward, backwards or even sideways. It maintains its own balance travelling up to 3.7MPH. Not very fast."

When it is incorrect, it is, at least *authoritatively* incorrect. -- Hitchiker's Guide To The Galaxy

Working...