Tag Info

New answers tagged

5

I just asked a similar question; mine was about how Apple will fix this though, not necessarily what the bug does that causes the phone to crash. As @LvB suggested, it seems to be a bug in the SpringBoard notification text processing, where the program infinitely reads the Unicode string into memory, taking up all the available memory. Then, the SpringBoard ...


0

From the many, many articles, it appears that the banner messaging system on stock iOS (non-jailbroken) has trouble processing the unicode and crashes. What are the exact internal issues? Apple hasn't explained that yet. Jailbroken phones resort to 'safe mode' instead of a hard crash. This is not a new bug.


2

It seems that this question did not attracted a lot of attention, however being still curious on the subject, wanting to know an answer and having a few spare time I decided to roll up my sleeves and check this by myself :). First thing first, true PID randomness is indeed a cause of security weakness. "PID randomness" is designed to bring better security ...


1

When you type "sudo [software]", it will Always assume the software needs admin rights. Thus, the OS will ask for the password, Before the process [software] has a chance to run at all. However, you have a risk, and that is when you have sudo set to "remember" your authorization for a preset time. This is default behaviour, and I Think the time is set to 5 ...


1

how is such a hack tool guarded against? Prevent your computer to boot from an external media by setting appropriate options at the BIOS level and protecting this configuration using a BIOS password, Use Trusted Boot where TPM chip is available (most professional laptops have one, this Dell Latitude has one), Use full disk encryption, this ...


4

It's best to consider a Docker container to be the same as running an application on the host system. There are some attempts to lock down the Docker daemon by removing Linux Kernel capabilities, but this is not really a guarantee. If you do run Docker, there are a few things you can do to help mitigate some of this risk. SELinux - Enabling this will ...


0

With Docker specifically, in my experience, you can trust the vast majority of stuff out there in the open source community (like stuff on Github) to not be deliberately malicious. You can read the Dockerfile, and verify it's pulling in code from official repos if any (versus using some random person's fork). If it's pulling in code from somewhere strange, ...


5

In essence, I argue it is the same question as whether open source software is trustworthy. But I think the risk of using community Docker containers is somewhat higher at present than the risks of using open source software. First, as you mentioned, there is no signing and verification now. Good open source packaging systems today include this, at least ...


1

You can build trust in the source by a quick investigation but a more fundamental concern is the relative immaturity of the overall security profile as suggested by the need to use root access to run your container. Since you suggest we focus on popular solutions let's consider that we are using a controlled Git based repository like Docker Hub to pull down ...


19

At the moment there is no way to easily work out whether to trust specific docker containers. There are base containers provided by Docker and OS providers which they call "trusted" but the software lacks good mechanisms as yet (e.g. digital signing) to check that images haven't been tampered with. For clarification to quote the recently released CIS ...


7

Trust it as much as any unsigned code that you run on your systems. Containers are just processes with some extra namespace protections on them, so that's all the protections they get. They still talk to the same kernel underneath.


-2

Assume the default stance of not trusting anything you want to bring into your environment from the outside. If it is something you really want to use, minimize the risk as much as possible by sequestering it, analyzing it, and making sure it will not do any harm. Give it as little access to your environment as possible in order to let it do what you ...


-3

you can never open the encrypted files if you don't have the certification keys for the OS where you encrypt this file.


-3

USB Tethered to wrist. (Overkill) Run an entire OS temporarily from a USB stick. When you want to log in, shut down comp, enter USB stick, load from it, log into your accounts, when done, log out, shutdown computer, unplug USB stick. No traces (that lead to credential parsing), easy to destroy, easy to hide... Safe? Adding a jumper module onto the USB ...


0

Every OpenBSD user have a file located at /etc/signify/ directory to check downloaded installation files for next OpenBSD version (ex. 5.6 -> 5.7 upgrading). Also, each directory of OpenBSD site (and mirrors) have a file named SHA256.sig. You may read signify(1) manpage to find out how to verify a directory containing SHA256.sig and files inside that ...



Top 50 recent answers are included