Hacker News: ef47d35620c1

OpenBSD ASLR versus Linux ASLR

ef47d35620c1 — Fri, 02 May 2014 15:26:50 +0000

Article URL: http://aboutthebsds.wordpress.com/2014/01/12/openbsds-aslr-weak-not-very-random-and-not-truly-aslr/

Comments URL: https://news.ycombinator.com/item?id=7686249

Points: 2

# Comments: 0

New comment by ef47d35620c1 in "Linux file write patterns: So you want to write to a file fast"

ef47d35620c1 — Thu, 01 May 2014 16:14:49 +0000

I've had very good reliability from my SSD drives as well. Some have been running almost continuously since 2009.

New comment by ef47d35620c1 in "The slow death of purposeless walking"

ef47d35620c1 — Thu, 01 May 2014 16:09:55 +0000

I'm learning to do this again. At first, I had to make myself, but now I really enjoy it. I typically walk during lunch and in the evenings, just for the sake of walking and thinking. I find that it reduces stress and helps me to think more clearly.

New comment by ef47d35620c1 in "GNU Screen v.4.2.1"

ef47d35620c1 — Wed, 30 Apr 2014 12:18:44 +0000

tmux is included in OpenBSD base too. So if you use OpenBSD, it's there by default.

New comment by ef47d35620c1 in "Tails 1.0 is out"

ef47d35620c1 — Wed, 30 Apr 2014 12:15:41 +0000

You could also remove the hard drive. It's very easy to do and would prevent any accidental write.

New comment by ef47d35620c1 in "Stanford study finds walking improves creativity"

ef47d35620c1 — Wed, 30 Apr 2014 12:09:01 +0000

I very much agree. When that happens to me, it's usually because I'm thinking about the issue in the wrong way because of how I have read (or perceived) the code and how I think the code should be. Wrong notions, assumptions, etc. Getting away from the code, allows me to carefully focus only on the problem. Then things become clear.

New comment by ef47d35620c1 in "Symptoms of Dysfunction in Software Teams"

ef47d35620c1 — Mon, 28 Apr 2014 22:39:41 +0000

The post was deleted, but it implied that all software closes TCP with a FIN. Some software sends a RST, no FIN.

The issue is that the answer is relative. There are no absolutes. So yes, it does depend and yes there is always an explanation as to why it depends. Just because something works this way on this system does not mean it works the same way on that one.

To believe that something is the same everywhere on every system for every user is foolish at best and reckless at worst. And, people who think that (typically non-technologists) think that they have the answer as well... let's rewrite it to be the same everywhere. This is when all the engineers dust off their resumes and bail.

New comment by ef47d35620c1 in "Symptoms of Dysfunction in Software Teams"

ef47d35620c1 — Mon, 28 Apr 2014 21:50:30 +0000

The 'it depends' answers are good and I would not cite them as evidence of a problem. You employee people who understand what they are talking about and who also understand the importance of an accurate answer. They are probably very good engineers.

How does X close a TCP connection... it depends on the operating system in question. What cipher does my browser use when talking to X website... it depends on what ciphers are supported/available and how the client/server are configured. Which router do these packets go through... it depends. Is my password secure... it depends on the string you chose, the hash type used to store the password and who the attacker is and what their resources and time frames are.

There is hardly anything absolute in technology/software. And, people who want an absolute answer are only indicating that they do not understand the fundamental complexity issues that we deal with as technologists.

New comment by ef47d35620c1 in "Boycott systemd"

ef47d35620c1 — Thu, 24 Apr 2014 12:33:17 +0000

I don't know much about systemd, so I can't say either way.

So long as I can still get syslog style plain text logs, then I have no objections. Unix and text log parsing is unparalleled. If simple text log parsing and manipulation is removed (all binary with only xml or json), then I'd be very opposed to systemd.

New comment by ef47d35620c1 in "LibreSSL: FIPS mode is not coming back"

ef47d35620c1 — Wed, 23 Apr 2014 17:34:53 +0000

Also, I believe that only binaries can be FIPS certified, not source code, so there are times when one has to use an old, out-dated openssl binary in order to be compliant.

New comment by ef47d35620c1 in "LibreSSL: FIPS mode is not coming back"

ef47d35620c1 — Wed, 23 Apr 2014 17:33:16 +0000

That's part of the culture. It's nothing personal. Don't take it to heart if what they say offends you.

New comment by ef47d35620c1 in "Linux /dev/urandom and concurrency"

ef47d35620c1 — Fri, 18 Apr 2014 20:13:03 +0000

Would a possible solution be to check how many people are using the random generator...?

One preson may have multiple processes reading from /dev/urandom.

New comment by ef47d35620c1 in "The Linux Security Circus: On GUI isolation"

ef47d35620c1 — Fri, 18 Apr 2014 02:15:10 +0000

Yes. Here's a Windows keystroke logger (with source code) that uses GetAsyncKeyState. I wrote this years ago to show an IT auditor that a restricted user could run a keystroke logger (he was adamant that was not possible). It works on Windows XP to Windows 8.

http://16s.us/software/16k/

New comment by ef47d35620c1 in "How Americans Die"

ef47d35620c1 — Thu, 17 Apr 2014 16:31:19 +0000

I agree, and I think that the COPD is probably worse than the cancer.

I only meant to point out that many people in affluent western countries smoke, over eat, drink excessively and do other physically unhealthy things (because they have the money) in order to reduce mental and emotional stress. If we could reduce stress in general then we'd probably live longer, healthier lives.

General social issues lead to general health issues.

New comment by ef47d35620c1 in "How Americans Die"

ef47d35620c1 — Thu, 17 Apr 2014 16:10:05 +0000

I heard once that one cigarette a day as a stress relief may actually extend your life. I'm not sure about that, but I do think we need to be mentally and emotionally healthy too. Our health and well-being is not purely physical.

I would think that happy people who are not constantly under stress live longer.

New comment by ef47d35620c1 in "Those Who Say Code Does Not Matter"

ef47d35620c1 — Wed, 16 Apr 2014 19:59:47 +0000

Thanks. I did not know that.

New comment by ef47d35620c1 in "Those Who Say Code Does Not Matter"

ef47d35620c1 — Wed, 16 Apr 2014 19:19:26 +0000

What language is he implying to be "good"?

It's obvious that he thinks C, C++, C# and Java are bad (due to syntax). The world mostly runs on those, so I guess we're all doomed. But if they are so "bad", then what does he consider "good"? I read it, but must have missed that part.

New comment by ef47d35620c1 in "TrueCrypt Security Assessment [pdf]"

ef47d35620c1 — Mon, 14 Apr 2014 17:36:28 +0000

I do not think this is significantly new as it has been documented in the official TC source code and various 3rd-party source code (TCHead, tcplay, etc.) for many years.

I was the first to crack the majority of the TrueCrypt volumes in the 2012 Defcon - Crack Me if You Can password cracking contest using TCHead running on an old Intel Celeron processor.

Write-up: http://16s.us/software/wm/Defcon/cmiyc_2012.txt

Contest Page (3rd table down): http://contest-2012.korelogic.com/stats.html

TCHead: http://16s.us/software/TCHead/

New comment by ef47d35620c1 in "Hacker School banning “feigned surprise” is absolutely brilliant"

ef47d35620c1 — Thu, 10 Apr 2014 13:46:10 +0000

If I went around lording my specific domain knowledge over others, I would never learn anything new myself. What a waste of my life and human interactions that would be.

New comment by ef47d35620c1 in "When Life Gives You Lemons"

ef47d35620c1 — Wed, 09 Apr 2014 22:13:58 +0000

The truth stands on its own.