131 reputation
3
bio website blogs.oracle.com/alanc
location California
age 40
visits member for 3 years, 4 months
seen 12 hours ago

Software engineer at Sun Oracle working on the X Window System for Solaris, OpenSolaris, and Linux. Active member of the X.Org community.


Apr
26
answered I work on an open source project. Is there a “standard” to reporting security vulnerabilities that we can use?
Jan
28
awarded  Teacher
Jan
27
answered Can hackers find secret tokens passed to HTTP GET requests?
Dec
11
comment Vulnerabilities of Secure Shells
No, because ssh clients don't automatically set up tunnels for ftp, smb, netbios or http - only for X11.
Dec
11
comment Vulnerabilities of Secure Shells
It's a service on my machine the remote host cannot connect to until I ssh into it and ssh sets up the tunnnel and authentication to allow that remote machine to connect back to it over the ssh connection.
Dec
10
comment Vulnerabilities of Secure Shells
"no access to your machine"... unless you are using ssh with X11 Forwarding enabled, in which case the remote server may be able to grab screen images, monitor keystrokes, etc. from your X server.
Aug
19
comment Is there repetition in the Solaris 11 hash routine? Can I add some?
For crypt options, the Solaris equivalent is crypt.conf and the information on the default number of rounds is in the man page for each crypt module, such as crypt_sha256(5).
Aug
19
comment Is OpenSSL secure enough?
The Solaris support package repo has newer releases of OpenSSL packages, but those are only available to customers with a current support contract.
Aug
19
comment Can Solaris' shadow hashes be created by better algorithms than the default DES-based hash?
dropsafe.crypticide.com/article/1389 is a blog post from one of the co-authors of the Solaris enhanced crypt() (as well as the classic Crack password cracker) with more implementation details.
Nov
29
awarded  Supporter
Nov
29
awarded  Autobiographer