Reputation
1,605
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
11 12
Newest
 Enlightened
Impact
~58k people reached

1d
comment How to prevent illegal file transfer or copying of video files from a PC?
See my ancient answer on StackOverflow (before IS.SE): stackoverflow.com/a/1790206/19746 TL;DR: you can't.
Mar
16
comment Are Ubuntu updates signed by a central authority?
It all boils down to the people holding the keys. Are two trusted people enough? Ten? Fifty? Or perhaps differently, is there a duress system that successfully signs the code, but flips a bit "I was forced to do this against my will"?
Mar
10
comment How to open a file from the Internet in a secure way?
@rox0r: Does that strike you as likely? (Spoiler: no) cvedetails.com/vulnerability-list/vendor_id-7294/Libpng.html
Mar
9
comment Beside GIFAR are there any other known polyglot files?
@Mindwin: Doesn't make much sense to me. Moreover, I don't think that my comment actually answered the question (as it stood then), it's more of a technical aside. Two files glued back-to-back are not really a "polyglot", IMNSHO; something like this fits the description better: blackhat.com/docs/eu-14/materials/…
Mar
8
comment Beside GIFAR are there any other known polyglot files?
@symcbean: GIF file has a header; JAR file has a footer, neither cares about padding. Therefore, a file created by cat foo.gif bar.jar > baz.gifar will be a valid GIF and/or a valid JAR - depending on whom you ask, and even on the order of magic byte checks ;) Same trick can be done with any combination of such header/footer formats - e.g. EXE/ZIP (I believe some self-extracting archives use this trick - don't want to run the executable? Just rename it and voila, it's the ZIP archive!)
Mar
2
comment Safe email validation
@Zymus: Gmail allows what Gmail allows; if I run a wildly successful webmail which only allows people to register with usernames matching /^[d-q5-8]{24}_[a-c]{3,5}$/, I'm not creating a new standard that's mandatory for everyone else to follow, just limiting what the acceptable local part is at my own servers. In other words, GMail only allowing you to create a username in a subset of possible local parts does NOT mean that this is the only possible local part.
Mar
1
comment Is Torrent safe for sharing legitimate files (file verification)? Does it use SHA1 or SHA256?
Note: chunks are of a given length, which IMNSHO rules out a large part of chosen-prefix attacks; getting an auto-assembly system to generate just the chunk you want (without jiggling other data around, e.g. for OS ISOs) is a fairly tall order.
Mar
1
awarded  Enlightened
Mar
1
awarded  Guru
Feb
29
awarded  Good Answer
Feb
29
awarded  Mortarboard
Feb
29
awarded  Nice Answer
Feb
29
revised Download an OS image via torrent
important part first, summary
Feb
29
comment Why is there no smartphone OS-style app isolation on PC systems?
For example, qubes-os.org/tour/#what-is-qubes-os does exactly this, using a set of tools that have been available for ages.
Feb
29
answered Download an OS image via torrent
Feb
29
comment Additional options to protect from bad USB devices in ubuntu
The problem is this: there's no way to verify data sent from device. So, if the device says "my ID is 045e:00db," how does the computer know that it's not actually abad:d00d? (It doesn't.)
Feb
29
comment How can I prevent Ubuntu from automatically using an USB keyboard?
This could be possible with udev - instead of automatically loading the keyboard driver for a device, open a GUI instead (see a somewhat-related question here: askubuntu.com/questions/531445/… ). Of course, that brings us back to square 1 - with what do you authenticate the device? Another device, which needs to be authenticated with...turtles all the way down. (my newish laptop has no PS/2 keyboards: even the internal one seems to be connected over USB)
Feb
24
comment Apple's open letter - they can't or won't backdoor iOS?
@PhilFrost: Yes, I'm aware of this. To adapt my comment to that pop-cultural reference: why would you bother with a delicate black-op, when you could roll through the front gate with tanks and take whatever you want, 800-pound-gorilla style? As for direct effect, both get you what you wanted; as for PR, both is a declaration that the state no longer feels bound by its own laws. One is a bit easier to pull off, IMNSHO. (Again, I do not find this likely to happen, as it's more of a South-American junta scenario; just note that things like that do happen even in countries presumed-civilized)
Feb
24
comment Apple's open letter - they can't or won't backdoor iOS?
@Phil Frost: "Impossible" is a big word. Really big. Consider this: a large scale, boots-on-the-ground armed raid plus a planeful to a nonexistent extralegal prison. That is well within the means of a determined agency. Would that be legal? Probably not. Would that be an open declaration of a police state? Indeed. (Would that get popular support? That would depend on opinion makers; e.g. bg has already indicated so.) So, not impossible - just unlikely.
Feb
23
comment iphone, Electron Microscope can see the ROM cell states
...plus there's a lot of bits. A LOT.