560 reputation
214
bio website
location
age
visits member for 2 years, 8 months
seen Oct 16 at 2:55

Mar
21
comment Is it possible to execute a php script in an image file?
Please tell us what check you already perform on the file. Do you check the extension at least? Some answers make assumptions on that.
Feb
27
answered Is a Tor router really safer than a proxy?
Feb
27
answered Perl CPAN modules in a PCI-DSS environment
Feb
22
comment How to proceed if a new hash algorithm for passwords is introduced?
@CodesInChaos: Changing the hash algorithm is done for a reason. Else the change can occur over time as users will need to change their passwords. It's worth pointing out that if the old hashes were leaked this solution wouldn't be useful. It's useful if you want to answer the need of changing the hash algorithm transparently, as a user I like it, but as an admin, I see no added value. Sure, now the hashes are harder to break, but that's only one of the thing we wanted to avoid with this decision.
Feb
22
answered How to proceed if a new hash algorithm for passwords is introduced?
Feb
5
awarded  Yearling
Jan
26
awarded  Nice Answer
Dec
14
answered Possible ways to track down anonymous mail senders?
Jun
5
comment Configure Linux to allow network activity based on binary?
@curiousguy: I think people need an antivirus/malware/etc for this feature, and they should leave packet filtering to packet filters (known as firewall). You can accept/deny/drop connections without touching the packet filter. It will come on Linux since it's becoming very popular, but really not yet
May
31
comment Configure Linux to allow network activity based on binary?
@curiousguy: Hum, it's too long to demonstrate and explain thoroughly, some pointers: a program name can be changed, a firewall is a packet filter, packets are going though the network cards and pass a filter before being processed, this is what a firewall does. As a matter of fact no, I am careful, but others aren't and need this feature. Linux is a kernel, it just takes care of hardware basically, an OS is more than that, it's all the programs that run: WM, DE, web browser, shell, etc. Different people work on these, the kernel is a whole world apart which just provides interfaces.
May
31
comment Physical machines not detected from a Backtrack VM
Can your 2 VMs communicate directly? Isn't there a firewall or anything between them? Do you use nmap to detect the OS? Does it work if it's not in a virtualized environment? I'd like to know then answer as well. Bridging should leave IP traffic untouched. BTW, I strongly discourage the use of BT in a VM, use a usb stick instead: BT has a lot of drivers for all kind of hardware, emulated interfaces may not implement what you want/need, it's limiting.
May
31
comment Configure Linux to allow network activity based on binary?
BTW, I'd guess that windows implement this as a antivirus, by placing hooks on network library functions. Which with some level of reverse engineering, can be bypassed. There are many ways to bypass it, it's not a cutting edge security feature at all, it's here to cut down malware infection which is very important on windows. Maybe it'll change in your favorite distribution over time, but for now, it's not a good idea.
May
31
comment Configure Linux to allow network activity based on binary?
@curiousguy: A firewall is just a packet filter, it only pays attention to network traffic, and not to application running. Moreover, firewalls are not usually workstations, but dedicated machines who filter traffic, you don't run any program you don't know/trust on it like you'd do on a workstation. Userland is separated from the kernel, "The Linux kernel is developed and maintained separately from userland." en.wikibooks.org/wiki/Guide_to_Unix/Linux#Kernel This is true for all UNIX-like systems.
May
31
comment Configure Linux to allow network activity based on binary?
@Jez: Because you don't want to calculate the checksum manually for each binary (especially if you upgrade them often as you usually do on linux). Without this, cp malware /tmp/firefox will bypass your security.
May
30
awarded  Revival
May
30
comment Configure Linux to allow network activity based on binary?
Moreover, the 'firewall' on windows, is more an antivirus/malware/etc than a firewall (packet filter).
May
30
comment Configure Linux to allow network activity based on binary?
they only have one Desktop Environment, which makes it easy to integrate notification from the kernel. By design in Unix systems userland is strictly separated from the kernel. System calls can be used to ask the kernel specific tasks (access to IO, etc). One could imagine this kind of improvement on some distribution of Linux, but I doubt this would get accepted upstream. It's not just iptable to upgrade and maintain. A firewall doesn't run application, so no need to deny/accept anything interactively, a firewall should be a headless (CLI) and at the network border.
May
30
comment What do I need to configure, to make sure my software uses /dev/urandom?
Blocking is a bad choice, it could reveal keystrokes (used to generate entropy among other things) for instance.
May
30
answered Firefox Flash plugin malware?
May
30
comment X.509 certificate policies question
Will -> SHOULD. It's correct but as you MAY know, RFC are often poorly implemented, especially to fit one's business needs. Many factors can influence this, in both good and wrong way.