Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Re:overwrites previously allocated virtual memory (Score 1) 63

Here are 1.3 million pieces of evidence:
https://www.google.com/search?q=IE+security+zone+exploit

As explained US_CERT, the US Computer Emergency response team:

> There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model,
> local file system (Local Machine Zone) trust, the Dynamic HTML (DHTML) document object model (in particular,
> proprietary DHTML features), the HTML Help system, MIME type determination, the graphical user interface (GUI),
> and ActiveX. IE is integrated into Windows to such an extent that vulnerabilities in IE frequently provide an
> attacker significant access to the operating system.

Microsoft winked a acknowledgement the root of the problem yesterday with their advisory about this particular
vulnerability. Microsoft's advisory says:

> By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML
> email messages in the Restricted sites zone.

That's as opposed to the Local Intranet Zone, the Trusted Sites Zone, etc. IE opens content in the restricted zone (cage) and hope that there isn't a leak, like hoping that lion doesn't reach out of the cage. (and hope that IE picked the right zone to start with - web sites and batch files are both .com addresses.) Opera doesn't need to try to keep web sites from accessing functions in the local computer zone - there is no local zone, it just does web sites.

If your browser doesn't run shell batch files and registry patches, it doesn't have to decide which batch files to run in what context. It simply doesn't run batch files, or do anything else but show web pages.

Comment Re:overwrites previously allocated virtual memory (Score 1) 63

My language was unclear. In Explorer, you can go to "My Computer" and choose "Format Drive". Windows Explorer IS Internet Explorer, showing a different menu bar.

In Chrome, Firefox or Seamonkey, there is no "format drive" function. Browsers don't need, and should not have, the ability to reformat your hard drive. That decision to combine the system shell with the browser is the underlying cause of the severity of many Explorer security issues.

Comment overwrites previously allocated virtual memory (Score 2) 63

It sounds like the destruction of objects is incomplete, so the attacker can still write to that area of memory. It's certainly possible that it's writeable BECAUSE it's still associated with the process, which mean it runs in the context of that process. Additionally, it's likely that while the attacker can write to the memory, they can't arbitrarily execute it directly. Rather, they have to cause IE to execute it, in which case it would run with the privileges IE has when IE runs it.

A security problem there is that since IE4, IE has been integrated with the system shell. Therefore, IE privileges are shell privileges - anything the user can do, the browser can do. For this reason, I much prefer a browser that is only a browser, not another view of the system shell. A browser that's just a browser can only screw up web pages, not the entire system.

Yes, I'm aware that on Windows 8 Microsoft has attempted to sandbox the browser. Like putting a lion in a cage, that works until the lion reaches through the bars. It doesn't compare to using a browser such as Firefox which does not have the potential harmful abilities baked in. No need to sandbox something that doesn't exist.

Comment bcache does read, write back, and write through (Score 1) 297

Bcache does read caching and your choice of write through or write back. I believe that's the same thing ads offers. If you know of some difference in the caching, please specify what you are referring to.

Obviously ZFS is a volume manager, a filesystem, a file server AND a caching solution. Bcache does one thing and does it well - caching. Volume management is a separate thing handled by a volume manager such as LVM, though LVM can serve as a front end to bcache, allowing the user to manage both with one set of tools.

Comment lol, that's actually kind of true (Score 1) 47

That's funny, and even more so because it's somewhat true.
I found that one could break LVM or other layers by using it on top of a resyncing mdadm RAID.

The key was, I broke it REPEATABLY, so I could then confirm that a certain patch fixes it. When I could no longer make it break, it was known to be fixed.

Comment $1 million is less than 1% of what he has (Score 1) 225

> As you pointed out $50k is a drop in the bucket. But is $300k? $500k?

Yes, when you have a billion dollars and you're pissed, no amount ending in "k" is scary. On the extreme high side, a million dollars, that's well under 1% of his money.

Let's guess the average net worth in the US is about $50,000. 0.1% of that is $50. So a million dollars to this guy is like $50 to the average person.

* DoubleClick sold for $3 billion. I'm guessing O'Connor has about a billion.

Comment 2007 and 2010 were the years of the Linux desktop (Score 1) 101

I'd say the year of the Linux desktop has aalready come, twice.

On one weekend in 2007, over two million *nix desktops were booted for the first time. It just so happened that *nix was BSD based, and had an Apple GUI. The year of the "Linux" desktop was the year of OSX. Not the kernel we hoped for, but a mainstream POSIX system that will run all your GPL code.

Then in 2010, millions of new systems had the Linux kernel. Today, MOST new computers have Linux installed. By 2010, the ubiquitous consumer PC had shrunk to fit in your hand. All of these lovely Linux systems had a nice GUI from Google. Since most new computers are portable, not chained to the desktop, I don't know if any future year of the Linux DESKTOP matters too much.

Comment Apple WAS the only one, twice (Score 1) 101

> if Apple was the only phone OS maker I'm sure they would license o/sX to anyone who could prove decent hardware compatibility

A few years ago, Apple had the only credible smartphone OS. They didn't license their smartphone OS when they were the only one. Instead they gave the majority of market share to a company who DID license their OS.

Is that a mistake they would only make once? For several years they had the only GUI OS for desktop computers. Rather than license it, they left every other manufacturer stuck with DOS. Had Apple licensed their OS, few of us would remember Microsoft.

Comment RISC allowed 99% lower power and nobody cared (Score 0) 126

CISC couldn't go that fast without using 125 watts.
RISC could use 99% less power and go half as fast.

Everybody bought "Intel inside", even though it drew a hundred times more power.

Yes, mobile is one reason people now care more about power consumption. Waking up to it's effect on datacenter costs is another.

You said:
"The goal was always to make devices as efficient as possible"
If that were, CISC would have been dead on arrival.
Intel has pretty much admitted that CISC will be dead soon unless they cut power usage by 99% because suddenly power usage is more important than brute speed.

Slashdot Top Deals

Quantity is no substitute for quality, but its the only one we've got.

Working...