Forgot your password?
Close
typodupeerror

Comment Re:Explain it to non-technical users (Score 1) 94

In 2035, ISRG Root X1 will expire... game over for your (old) devices.
Only dreamers think that manufacturers will provide an update before the certificates expires for the computers or other devices bought this year.

Tic tac tic tac tic tac

Broken by design [TM]

Submission + - You Can Bypass Authentication on HPE iLO4 Servers With 29 "A" Characters (bleepingcomputer.com)

Submitted by Anonymous Coward
An anonymous reader writes: Details and public exploit code have been published online for a severe vulnerability affecting Hewlett Packard Enterprise Integrated Lights-Out 4 (HPE iLO 4) servers. The vulnerability is an authentication bypass that allows attackers access to HP iLO consoles. Researchers say this access can later be used to extract cleartext passwords, execute malicious code, and even replace iLO firmware. But besides being a remotely exploitable flaw, this vulnerability is also as easy as it gets when it comes to exploitation, requiring a cURL request and 29 letter "A" characters, as below:

curl -H "Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

Because of its simplicity and remote exploitation factor, the vulnerability —tracked as CVE-2017-12542— has received a severity score of 9.8 out of 10. HP silently released patches last year, but details only emerged this spring after researchers started presenting their work at security conferences.

Comment Re:Moral dilemma for the IT community (Score 2) 411

by pallmall1 (#45050595) Attached to: US Intelligence Chief Defends Attempts To Break Tor
I think that you are right about the justifications being a bunch of crap. And here's the dilemma:

... so that we can disrupt their plans and prevent them from bringing harm to innocent Americans.

Just who is deciding who is innocent? They decide who is innocent, and do so without the constitutionally guaranteed protections for the innocent.
I agree with the poster above and oppose the surveillance state.

Am I still innocent now? Was I ever? ...

Comment Re:Say what? Streisand effect on security perhaps? (Score 1) 100

by pallmall1 (#43315137) Attached to: Security Fix Leads To PostgreSQL Lock Down

Since they use git ... I would say that would be what happened.

That's interesting, because the git.postgresql.org page you linked shows recent work desicribed as "Fix page title for JSON Functions and Operators." Couple that with the fact that the Slashdot summary has a link to a Parity News page that contains a link to the Postgresql announcement, and the Parity News link is loaded with javascript in the url.

I wonder if Parity News is trying to demonstrate the Postgresql flaw?
Electronic Frontier Foundation

DOJ Often Used Cell Tower Impersonating Devices Without Explicit Warrants 146

Posted by Unknown Lamer from the bending-the-rules dept.
Via the EFF comes news that, during a case involving the use of a Stingray device, the DOJ revealed that it was standard practice to use the devices without explicitly requesting permission in warrants. "When Rigmaiden filed a motion to suppress the Stingray evidence as a warrantless search in violation of the Fourth Amendment, the government responded that this order was a search warrant that authorized the government to use the Stingray. Together with the ACLU of Northern California and the ACLU, we filed an amicus brief in support of Rigmaiden, noting that this 'order' wasn't a search warrant because it was directed towards Verizon, made no mention of an IMSI catcher or Stingray and didn't authorize the government — rather than Verizon — to do anything. Plus to the extent it captured loads of information from other people not suspected of criminal activity it was a 'general warrant,' the precise evil the Fourth Amendment was designed to prevent. ... The emails make clear that U.S. Attorneys in the Northern California were using Stingrays but not informing magistrates of what exactly they were doing. And once the judges got wind of what was actually going on, they were none too pleased:"

Comment Re:Intractably horrible. (Score 1) 354

by pallmall1 (#43095469) Attached to: In Defense of Six Strikes

That's just using a DIFFERENT flawed system, not fixing the root cause.

From the point of view of the big media cartels and their Obamasite supporters, Six Strikes is not a bug, it's a *feature*.

Welcome to Obama's vision of the future. Six Strikes is just a glimpse.

Slashdot Top Deals

1000 pains = 1 Megahertz

Close