Aki

490 reputation

112

bio	website
	location
	age
visits	member for	1 year, 3 months
	seen	May 20 at 19:59
stats	profile views	18

	490 reputation	bio	website		visits	member for	1 year, 3 months
112 badges		location			seen	May 20 at 19:59

summary answers questions tags badges favorites bounties reputation activity

95 Actions

suggestions reviews revisions comments badges posts accepts all

May 20	awarded	Nice Question
Mar 21	comment	Is it possible to execute a php script in an image file? How do you display the image? The extension .gif at least reduces the possibility of code execution. If you use require() and not standard HTML then it's dangerous, else David Mah is right.
Mar 21	comment	Is it possible to execute a php script in an image file? Please tell us what check you already perform on the file. Do you check the extension at least? Some answers make assumptions on that.
Feb 27	answered	Is a TOR router really safer than a proxy?
Feb 27	answered	Perl CPAN modules in a PCI-DSS environment
Feb 22	comment	How to proceed if a new hash algorithm for passwords is introduced? @CodesInChaos: Changing the hash algorithm is done for a reason. Else the change can occur over time as users will need to change their passwords. It's worth pointing out that if the old hashes were leaked this solution wouldn't be useful. It's useful if you want to answer the need of changing the hash algorithm transparently, as a user I like it, but as an admin, I see no added value. Sure, now the hashes are harder to break, but that's only one of the thing we wanted to avoid with this decision.
Feb 22	answered	How to proceed if a new hash algorithm for passwords is introduced?
Feb 5	awarded	Yearling
Jan 26	awarded	Nice Answer
Dec 14	answered	Possible ways to track down anonymous mail senders?
Jun 5	comment	Configure Linux to allow network activity based on binary? @curiousguy: I think people need an antivirus/malware/etc for this feature, and they should leave packet filtering to packet filters (known as firewall). You can accept/deny/drop connections without touching the packet filter. It will come on Linux since it's becoming very popular, but really not yet
May 31	comment	Configure Linux to allow network activity based on binary? @curiousguy: Hum, it's too long to demonstrate and explain thoroughly, some pointers: a program name can be changed, a firewall is a packet filter, packets are going though the network cards and pass a filter before being processed, this is what a firewall does. As a matter of fact no, I am careful, but others aren't and need this feature. Linux is a kernel, it just takes care of hardware basically, an OS is more than that, it's all the programs that run: WM, DE, web browser, shell, etc. Different people work on these, the kernel is a whole world apart which just provides interfaces.
May 31	comment	Physical machines not detected from a Backtrack VM Can your 2 VMs communicate directly? Isn't there a firewall or anything between them? Do you use nmap to detect the OS? Does it work if it's not in a virtualized environment? I'd like to know then answer as well. Bridging should leave IP traffic untouched. BTW, I strongly discourage the use of BT in a VM, use a usb stick instead: BT has a lot of drivers for all kind of hardware, emulated interfaces may not implement what you want/need, it's limiting.
May 31	comment	Configure Linux to allow network activity based on binary? BTW, I'd guess that windows implement this as a antivirus, by placing hooks on network library functions. Which with some level of reverse engineering, can be bypassed. There are many ways to bypass it, it's not a cutting edge security feature at all, it's here to cut down malware infection which is very important on windows. Maybe it'll change in your favorite distribution over time, but for now, it's not a good idea.
May 31	comment	Configure Linux to allow network activity based on binary? @curiousguy: A firewall is just a packet filter, it only pays attention to network traffic, and not to application running. Moreover, firewalls are not usually workstations, but dedicated machines who filter traffic, you don't run any program you don't know/trust on it like you'd do on a workstation. Userland is separated from the kernel, "The Linux kernel is developed and maintained separately from userland." en.wikibooks.org/wiki/Guide_to_Unix/Linux#Kernel This is true for all UNIX-like systems.
May 31	comment	Configure Linux to allow network activity based on binary? @Jez: Because you don't want to calculate the checksum manually for each binary (especially if you upgrade them often as you usually do on linux). Without this, cp malware /tmp/firefox will bypass your security.
May 30	awarded	Revival
May 30	comment	Configure Linux to allow network activity based on binary? Moreover, the 'firewall' on windows, is more an antivirus/malware/etc than a firewall (packet filter).
May 30	comment	Configure Linux to allow network activity based on binary? they only have one Desktop Environment, which makes it easy to integrate notification from the kernel. By design in Unix systems userland is strictly separated from the kernel. System calls can be used to ask the kernel specific tasks (access to IO, etc). One could imagine this kind of improvement on some distribution of Linux, but I doubt this would get accepted upstream. It's not just iptable to upgrade and maintain. A firewall doesn't run application, so no need to deny/accept anything interactively, a firewall should be a headless (CLI) and at the network border.
May 30	comment	What do I need to configure, to make sure my software uses /dev/urandom? Blocking is a bad choice, it could reveal keystrokes (used to generate entropy among other things) for instance.