Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror

Comment Re:Run only is not a limitation or mitigation (Score 1) 65

So... it's compiled... like literally every other program every made?

What exactly makes compiled code special? EXEs are compiled code. The term "run-only" is stupid. You have to be able to read the thing to run it, and the computer can read bytes just fine, so... where's the problem?

Comment Re:Browsing (Score 1) 83

Why are you touching all those paper towels? Grab one, throw in the cart, get on with your damn day.

Most people do not take that kind of time to comparison shop. If they can just deliver me the damn towels, then that's fine, I do not have brand loyalty toward most household products, nor do I need to molest my items in order to determine that it's a paper towel.

Comment COBOL programmers aren't all old (Score 1) 383

There's a COBOL shop in my small town that contracts for corporations and the government. I know several COBOL specialists in their 30s. It's actually an extremely lucrative field to get into these days, with good pay and job security.

Rewriting all that COBOL code in some other language would be bound to cause major problems.

Submission + - Badlock Vulnerability Falls Flat Against Hype (threatpost.com)

msm1267 writes: Weeks of anxiety and concern over the Badlock vulnerability ended today with an anticlimactic thud.

Badlock was the security boogeyman since the appearance three weeks ago of a website and logo branding the bug as something serious in Samba, an open source implementation of the server message block (SMB) protocol that provides file and print services for Windows clients.

As it turns out, Badlock was hardly the remote code execution monster many anticipated. Instead, it’s a man-in-the-middle and denial-of-service bug, allowing an attacker to elevate privileges or crash a Windows machine running Samba services.

SerNet, a German consultancy behind the discovery of Badlock, fueled the hype at the outset with a number of since-deleted tweets that said any marketing boost as a result of its branding and private disclosure of the bug to Microsoft was a bonus for its business.

For its part, Microsoft refused to join the hype machine and today in MS16-047 issued a security update it rated “Important” for the Windows Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD). The bulletin patches one vulnerability (CVE-2016-0128), an elevation of privilege bug in both SAM and LSAD that could be exploited in a man-in-the-middle attack, forcing a downgrade of the authentication level of both channels, Microsoft said. An attacker could then impersonate an authenticated user.

Comment Re: plugin has been suppressed from the wordpress (Score 2) 76

Actually, as soon as we were notified of the issue, the plugin was closed and hidden on a temporary basis until we had time to evaluate the problem. Once we had done so, I personally created a new version of the plugin, without the malicious code, and pushed it to the repository in order to get the update out to the affected users. The existing committers were all removed, leaving the plugin entirely in the hands of the plugin team. The latest version is now safe and will not be otherwise until we determine the full details of what happened here.

Full disclosure is great, but some advance notice longer than a day or so helps a lot. We will always protect our users to the best of our ability, but sometimes, we get blind sided. It happens. Nobody posts about the dozens of other times we fix things before they get exploited. Not judging, just saying.

Slashdot Top Deals

No line available at 300 baud.

Working...