Forgot your password?
typodupeerror

Comment: Re:I have an idea (Score 1) 163

by hweimer (#48033983) Attached to: Apple Fixes Shellshock In OS X

I just tried and successfully passed the variable "_BASH_FUNC_thingy" with the value "my_attack" through my apache web server to a CGI script using a url entered into a browser.

No, you get something like QUERY_STRING="_BASH_FUNC_thingy=my_attack", which is harmless because function definitions inside QUERY_STRING are not being evaluated after the last update.

Comment: Re:I have an idea (Score 2) 163

by hweimer (#48029033) Attached to: Apple Fixes Shellshock In OS X

Unless of course the malefactors know this and stick BASH_FUNC_ in front of their exploit strings.

This won't work because an attacker will only be able to manipulate the content of some environment variable, but not its name. And being able to manipulate arbitrary environment variables has always been equivalent to being able to execute arbitrary code. Think LD_PRELOAD or IFS, for example.

Comment: Re:I have an idea (Score 1) 163

by hweimer (#48026527) Attached to: Apple Fixes Shellshock In OS X

How about releasing a version of bash that has function passing disabled.

People are using this feature and taking it away will break stuff. The latest update (not sure whether Apple already ships it) stores all function definitions with a prefix of BASH_FUNC_, and function definitions are disabled for all variables not starting with the prefix. This allows to retain the feature, but prevents the execution of malicious code at the same time.

+ - DHL Goes Live With "Parcelcopter" Drone Delivery Service

Submitted by jones_supa
jones_supa (887896) writes "In December, Amazon announced that it intended to deliver packages to customers using drones. But its initiative was widely ridiculed for being an over-hyped announcement with little to show for it. This summer, Google demonstrated its own drone-based delivery service, using a fixed-wing aircraft to deliver little packages to farmers in the Australian outback. But now, German delivery firm DHL has beaten the tech firms to the post, announcing a regular drone delivery service for the first time, nine months after it launched its "parcelcopter" research project in December 2013. The service will use an quadcopter to deliver small parcels to the German island of Juist, a sandbar island 12km into the North Sea from the German coast, inhabited by 2,000 people. Deliveries will include medication and other urgently needed goods. Flying under 50 meters to avoid entering regulated air traffic corridors, the drone takes a fully automated route, carrying a special air-transport container that is extremely lightweight as well as weatherproof."

+ - Remote exploit vulnerability found in bash->

Submitted by kdryer39
kdryer39 (1210976) writes "A remotely exploitable vulnerability has been discovered by Stephane Chazelas in bash on Linux and it is unpleasant. The vulnerability has the CVE identifier CVE-2014-6271. This affects Debian as well as other Linux distributions.

The major attack vectors that have been identified in this case are HTTP requests and CGI scripts. Another attack surface is OpenSSH through the use of AcceptEnv variables. As well through TERM and SSH_ORIGINAL_COMMAND. An environmental variable with an arbitrary name can carry a nefarious function which can enable network exploitation."

Link to Original Source

Comment: Re:Anonymous public peer review (Score 1) 167

by hweimer (#47972655) Attached to: Anonymous Peer-review Comments May Spark Legal Battle

As I am not a user of the PubPeer platform, I cannot judge if comments meant to attack the reputation of an other due to private disputes commonly occur. Furthermore, such attacks with other motive as pure improvement of scientific publication quality are difficult to spot, because this is what anonymous commenting enables to do.

If somebody presents evidence for image manipulations, then why would you care whether this was posted because someone has an axe to grind?

Comment: Re:Anonymous public peer review (Score 1) 167

by hweimer (#47972139) Attached to: Anonymous Peer-review Comments May Spark Legal Battle

Anonymous review is usual in the peer-review processes of most journals, but these comments are in general non-public or at least reviewed by an editor before publication. Some reviewers choose to do their peer-review work without the cover of anonymity and I encourage this. If you have constructive criticism on the work of an other and can this criticism is well founded, you can very well do it openly.

No, you can't. Most active scientists do not have tenure and therefore openly criticizing the work of a bigwig in the field would be extremely dangerous, even when perfectly justified.

Something like PubPeer is extremely tricky. It's an open door to abuse and for commenter to wash their dirty linen in public.

Can you provide an example of someone using a service like PubPeer to wash dirty linen? I have a hard time to imagine how this could be done, especially if you want others to take your allegations seriously.

Comment: Re:Easy solution (Score 2) 348

by hweimer (#47878571) Attached to: When Scientists Give Up

I wouldn't be surprised to see countries such as BRIC members, EU members, or other countries start trying to woo the best and brightest for economic gains.

I think this focus on the "best and brightest" is actually a part of the problem. Sure, you'll need certain skills to run a research group, but these skills are found in many people and not just in the top of the batch. Beyond a certain point, the individual abilities of a researcher tend to be only weakly correlated with the actual research outcomes. There are many examples of people doing amazing science even though they are generally not considered to be top-notch scientists, even including Nobel laureates.

Science is an inherently risky business, with most scientists not finding out anything really exciting during their entire career and only very few ones will hit something that turns out to be really big. But you cannot possibly know in advance what this next big thing is going to be and who will find it, otherwise this wouldn't be science at all. In such an environment, the best investment strategy is to allocate your funds evenly across as many scientists as possible (I think it was Taleb who showed that). Of course, you have to make sure that each scientist gets enough money to run his or her group, but this optimal strategy is exactly the opposite of the current trend towards mega-chairs involving multiple labs and dozens of grad students and postdocs.

Comment: Re:Mandatory linux 4.3 upgrade (Score 1) 174

by hweimer (#47805099) Attached to: Tox, a Skype Replacement Built On 'Privacy First'

Correct me if I'm wrong but doesn't pulse running at the user level only allow ONE user and system-wide utilization is vehemently discouraged by the developers for SECURITY reasons?

No, it's the other way round: Running PulseAudio as a system daemon (as opposed to the default way of per-user sessions) has security implications.

+ - Amputee is German long jump champion

Submitted by hweimer
hweimer (709734) writes "German long jumper Markus Rehm has written sports history yesterday, becoming the first disabled athlete to win a national able-bodied championship. His jump to 8.24 meters put him on the 9th place of the current season rankings and make him egligible to compete in the upcoming European championships, further sparking the debate whether his prosthetic leg provides him with an unfair advantage."

Comment: Re:DON'T PANIC (Score 1) 98

by hweimer (#47504133) Attached to: Researcher Finds Hidden Data-Dumping Services In iOS

So, please, tell us, how are Android, Windows or BlackBerry phones any better?

Many Android vendors have well-documented procedures how to unlock the bootloader of the device and install a custom ROM, which can be mostly built from source (the remaining proprietary blobs come from non-US companies and/or are unlikely to contain backdoors because of the greatly reduced codebase). None of the other major players allow this.

Comment: Re:Incoming international flights (Score 1) 702

by hweimer (#47407161) Attached to: TSA Prohibits Taking Discharged Electronic Devices Onto Planes

Where have you ever been re-screened after boarding the first flight.

Just a few examples off the top of my head:

  • FRA always has re-screening when you change from non-Schengen to Schengen
  • MUC usually has re-screening right before the gate for US-bound flights
  • IIRC, SIN has re-screening at every gate
  • When you change between carriers that operate out of different terminals, you usually have re-screening because most airports do not have a connected security area.
  • Or, of course, if you have to change airports within a city, like the infamous LHR-LGW run

Comment: Re:interesting times... (Score 4, Insightful) 221

by hweimer (#47376255) Attached to: IeSF Wants International Game Tournaments Segregated By Sex [Updated]

so a lot of people think that there should be no gender seperation in shooting sport competitions, and I tend to agree. but for some reason, the top females can never quite break into the top levels with the top males.

This is simply not true. Margeret Murdock won a silver medal at the 1976 Olympics (she lost the battle for gold under very controversial circumstances) and set four individual world records. In the eighties, most shooting sports became gender-segregated, the only exceptions being skeet and trap, which became gender-segregated right after a woman (Zhang Shan) had won the gold medal in the skeet competition in 1992. There are other examples as well.

So, if today's women are no longer competitive with men, then that's certainly a consequence of gender segregation and not an argument for it.

Today's scientific question is: What in the world is electricity? And where does it go after it leaves the toaster? -- Dave Barry, "What is Electricity?"

Working...