Re: [Haifux] The Heartbeat vulnerability in OpenSSL (and hence ssh/https)

2014-04-14 Thread Michael Vasiliev

  
  
If any of you guys and gals think this
  isn's serious, think twice. The CloudFlare SSL Heartbleed
  challenge site's SSL key was stolen within hours of being
  announced. There is a wave of security compromises all over the
  world and sane CAs are offering free renewals of SSL certificates.
  
  On 04/11/2014 08:35 AM, Eli Billauer wrote:


  Hi all,

I suppose that the security freaks already know about this, and still, 
this seems important enough for an alert.

In a nutshell, a bug in the mechanism that allows keepalive messages to 
be sent to maintain an SSL link, also allows, accidentally, a remote 
attacker to read a segment of up to 64 kBytes from the server's memory. 
It's doesn't give access to any chunk of 64 kBytes, but it's a segment 
which is likely to be dirty with data that belongs to the process 
running openSSL. So there's a chance that data related to private keys 
and passwords is revealed this way.

See http://en.wikipedia.org/wiki/Heartbleed

I haven't found any tool checking a local SSH server, say as source code 
in C. I suppose it's being avoided for the sake of not supplying the 
almost-finished attack to script kiddies.

Hag Sameah,

Eli




  

___
Haifux mailing list
Haifux@haifux.org
http://haifux.org/mailman/listinfo/haifux


Re: [Haifux] [HAIFUX LECTURE] Mesh Networks:Hacking the T3lc0 Model by Amir Sagie

2011-08-31 Thread Michael Vasiliev
On 08/28/2011 03:59 AM, Eli Billauer wrote:

 On Monday, August 29th (TOMORROW), at 18:30, Haifux will gather to
 hear Amir Sagie talk about


  Mesh Networks:Hacking the T3lc0 Model


 Abstract


 Want to build your own Telco? You'll probable need mesh power. Avoid
 past mistakes by learning about the history of mesh networks, hear how
 the first wi-fi router was liberated and be sure to checkout what
 we're doing in project Arig ( http://arig.org.il), here in Israel! Be
 sure to attend the router emancipation party afterwords: bring your
 wi-fi router and wash away all it's sins by flashing it with a FOSS OS
 such as OpenWRT. Complete redemption guaranteed.

Follow-up to the lecture:
The inverted Internet joke on the bandwidth thief I've mentioned is
hosted here:

http://www.ex-parrot.com/pete/upside-down-ternet.html

Amir, this could be a good start for the split-network router configuration.

--
Sincerely Yours,
Michael Vasiliev
___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] Tentative lecture proposal

2011-08-26 Thread Michael Vasiliev
On 08/14/2011 12:04 AM, Shachar Shemesh wrote:
 I would like to provide a tentative proposal for a lecture. Tentative
 means that I'd love to give the lecture, but cannot, yet, say whether
 I'll have the time to.

 The lecture is the same one I gave at AP2011, about the birth of SI1452
 (the Hebrew keyboard layout), but with enough time to actually discuss
 the things I wanted to, i.e. - why things changed they way they did,
 what compromises were done, and why. What the dynamic of a standard
 committee actually is.

 Any buyers?


Me.

--
MichaelV
___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] MCTIP computer technician course

2011-02-21 Thread Michael Vasiliev
On 02/20/2011 09:23 AM, Orna Agmon Ben-Yehuda wrote:
 How about starting your CS BSc instead? The open U is free for all,
 even if you do not have the bagrut yet, and the Technion has special
 programs for good students - some start at 16 or earlier.
I'm replying to this reply, since I did not get the original letter
(ugh, again!), and can't figure out whose mail server is to blame.

Even though more than good 13 years passed since I was in that exact
situation, I'd like to share some insights, based on nothing else but
actual experience. Let's say you are, like I was, a young hacker in his
teen years looking for a job. You have some computer, network, linux,
and programming knowledge, and lacking relevant experience, you're
looking into persuading the employer in your abilities. You are, like
all people have a resource, time, which you want to invest wisely.

First of all, if you think that a prospective employer would take a teen
off the street, with or without courses and let him manage expensive
equipment and business-critical data, you're so wrong. Wrong, wrong,
wrong. I cannot emphasize it any further. Unlest that employer is your
close relative, the best you're looking at is laying LAN cable or
assembling computers from parts, both below minimum wage (sic!). The
kind of jobs you have the lowest chance to make a mistake at, from the
employer's view. Delegate-able, mundane, tiring, minimal possible loss
jobs. Worst part of it, these are also available right now, without any
courses. Nowadays, every business is an information business, and were
IT business a Zen monastery, that's the kind of jobs you were doing in
your first year. Except that in Zen monastery, you get to learn later
on, and here you're not. Every job you can get, you can continue doing
for the rest of your life, because there's no shortage of the same dull
tasks, and every single one of these jobs is both a career dead-end and
a constant insult to your intelligence.

Let's talk courses now. These credit-less courses are on the level of
advanced OS user at best, the programming ones are on the level of
novice programmer, it's nothing you don't know already. They're thriving
since the days of the hi-tech bubble, and only during these crazy days
they were somewhat effective. Back then, with the shortage of hands and
abundance of shareholder's money, you could actually get a position
doing absolutely nothing of value whatsoever. All course graduates hired
back then found themselves unemployed when the bubble burst. But people
still try the easy way to high-tech salary. Isn't that the all-around
marketing slogan? That's how it will be: the course will be filled with
naive people who don't know two bits about computers and want to switch
from another field, unrelated to exact sciences. By offering yourself as
a lowest bidder in terms of knowledge you'll get, on these courses
you'll be taught by (surprise!) -- a lowest-bidder lecturer, which is at
best a university or college student or dropout, an unlucky jobless
teacher, or, in vast majority of cases, a graduate of the very same
courses on minimum wage. I was both the student and lecturer in
similar circumstances, and I feel bad for doing both. The kind of nasty
feeling if you have personal ethics for your vertebrae column and know
that despite your best efforts, you're doing a half-arsed job. Pardon
the wording.
This budget you describe can pay tuition fees for one year of proper,
regular CS university courses or a university preparatory program you
could use to improve your school grades. Or you can study for a
psychometric exam (best of such study is, surprisingly, not a course,
but gathering course books of all your friends and sitting on your butt
solving them with pencil, eraser and stopwatch in the privacy and
comfort of your own home, which is another lesson I've learned the hard
way). Time and budget permitting, try to get into excellent student
program in your school, that will get you university courses for a
credit to use later. Try to get the best grades you can while still IN
SCHOOL, or improve the one you already have.

To summarize: I've been on that very road, and I cannot say anything but
don't waste your time taking such courses. It's nothing but ripoff and
a complete waste of your precious time. Please, I'm begging you. I
wholeheartedly wish someone persuaded me otherwise back then. Make your
decision on a field and work relentlessly towards getting a proper
degree. If you can't figure out what field you like, but you think it's
something from exact sciences, start with math(preferrably) or physics.
Both can give you a solid math background, a hardcore skeleton of your
knowledge, a basic science firmware for your brain you can use for
switching to any field of study. Math courses in university are unbeaten
in being accepted everywhere for credit towards exact sciences degree.
Math is the language of science, and the only way to speak it is
speaking it fluently.

Army is 

[Haifux] Invitation to connect on LinkedIn

2011-02-07 Thread Michael Kruglos
LinkedIn


   
I'd like to add you to my professional network on LinkedIn.

- Michael

Michael Kruglos
Independent Computer Software Professional
Israel

Confirm that you know Michael Kruglos
https://www.linkedin.com/e/-blt5gq-gjvidylp-1g/isd/2283354269/k9IfXkQ_/


 
-- 
(c) 2011, LinkedIn Corporation___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] Refreshments

2011-01-17 Thread Michael
If I didn't study in Tel-Aviv on Mondays, I would have visited all, or
almost all lectures. I didn't see anything on the list, yet, that would be
completely uninteresting to me.
I hope to be free (as in freedom :) )  during the next semester and hope not
to stay until late hours at work on Mondays, and wouldn't mind to chip in as
well ;).

On 6 January 2011 15:55, boazg boaz.ge...@gmail.com wrote:

 decent point. i retract my claim and would be happy to chip in.

 On Thu, Jan 6, 2011 at 15:33, Shachar Shemesh shac...@shemesh.biz wrote:

 On 06/01/11 14:49, boazg wrote:

 a small budget for members is nice. however i don't like the idea of
 bribing people to show up at haifux.

 This isn't a bribe. It is a method to get people who are otherwise only
 marginally interested into the area. It's marketing. Only a small percentage
 will come because of the refreshments, and only a small percentage of those
 will stay, but still.

  the club is by us, for us.

 Yes, but who is this us you are talking about? The real question is how
 to have more of us than there currently are.


  we have different platforms to spread the word. i therefore oppose the
 chipping in on principle.

 You oppose to us chipping in so that us will have more to eat?

 Shachar

 --
 Shachar Shemesh
 Lingnu Open Source Consulting Ltd.
 http://www.lingnu.com



 ___
 Haifux mailing list
 Haifux@haifux.org
 http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


[Haifux] Testing!

2010-08-22 Thread Michael
This is just a test, please ignore.

___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


[Haifux] Coputer stores in Haifa with Linux in mind

2010-08-22 Thread Michael
Doesn anyone know of a computer store in Haifa, that cares about Linux.
That is, I can ask them to recommend me a Linux-compatible Desktop, and
the answer won't be Oh, I'm sorry, but we don't support Linux, we 
recommend Windows 7, but rather they would attempt to help me build
a system , where I won't have unsupported piece of hardware (even if I 
don't use this specific piece of harware, but it's just on-board).
It's not that I cannot build a Linux compatible computer myself, It's
rather my laziness and my good intention to support a store, that would 
not be reluctant to help when they hear the word Linux.


___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] Coputer stores in Haifa with Linux in mind

2010-08-22 Thread Michael
Maxim and Eli, thanks for your answers.

Eli, by supported harware, I mean hardware, that will run on resonably
popular distribution (Fedora, Debian, Ubuntu, OpenSUSE) and on its
reasonably current version. The drivers should either run out of the
box, or I can compile them from source. This is what I mean by
supported. I don't expect support for RedFlag here in Israel for 
example.

Maxim, I meant the first, and you're difintely right, they won't close,
but I'll feel better, knowing, that I gave my money to someone who 
doesn't only care about single OS :).
Will help you with a specific single question, like Can you tell me if
a card XXX is supported by Linux OS?
Yes, but that is only if the vendor specifies Linux in the list of 
supported OSes, which some vendors don't, still the hardware may have
working drivers written by hackers (which the vendor doesn't care 
about).

I guess, I'll have to take my time and build an adequate harware list,
to make sure, that most stuff is supported.

Thanks everyone.

___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] Lecture proposal: Packaging in Debian

2010-08-17 Thread Michael
Sounds interesting.

On Mon, 2010-08-16 at 22:35 +0300, Ohad Lutzky wrote:
 Debian is one of the more popular Linux distributions, well-known for
 its excellent package management. Debian has also been known to be the
 base for many other distributions, such as knoppix and ubuntu. I can
 show how to build packages, how to build repositories, how to
 version-control the whole thing by example of git, as well as a short
 overview of the extensive documentation available on the subject.
 
 ___
 Haifux mailing list
 Haifux@haifux.org
 http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] Haifos?

2010-04-07 Thread Michael Vasiliev
On 07/04/2010 19:20, Shachar Raindel wrote:
 But why are you throwing a bucket of water on Shlomi's bon-fire?
 I know its bit early for lag-baomer, but easter is here, so we kind of
 have an excuse for fire ;).

 --Shachar

 On Wed, Apr 7, 2010 at 4:28 PM, Orr Dunkelman orr.dunkel...@gmail.com wrote:
   
 On Wed, Apr 7, 2010 at 4:25 PM, Shlomi Fish shlo...@iglu.org.il wrote:
 
 Oh well. Let the flames begin!? ;-)
   
 No flames to follow, please.
It's not the name, but the deeds.

-- 
Sincerely Yours,
Michael Vasiliev
___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] Lightning talk! LEHITPAKED

2008-07-13 Thread Michael Vasiliev
On Wednesday July 9 2008, Rami Rosen wrote:
  If anyone has a ding (that is, a small counter-top bell), bring it :)
  Would it not be simpler to implement it in sw ?!
Perhaps, a la the (in)famous high-pitched Please stop, I'm so bored (C) 
Miss Sweety Poo, Ig Noble prize ceremony ?

-- 
Sincerely Yours,
Michael Vasiliev

...  one of the main causes of the fall of the Roman Empire was that,
lacking zero, they had no way to indicate successful termination of
their C programs.  -- Robert Firth
___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] My Stop Using (and Teaching) C-Shell and Tcsh Page

2007-10-20 Thread Michael Vasiliev
On Friday October 19 2007, Shlomi Fish wrote:
 Hi Orr!

 For some reason, I'm receiving the emails that you send to me, but not the
 emails you send to the mailing list. It's a bit annoying. And I do receive
 emails that get sent to the mailing list.

I believe there is a mailman setting for not sending the same message twice. 
Check out the web interface for your list subscription.



-- 
Sincerely Yours,
Michael Vasiliev

There's no heavier burden than a great potential.
___
Haifux mailing list
Haifux@haifux.org
http://hamakor.org.il/cgi-bin/mailman/listinfo/haifux


Re: [Haifux] [HAIFUX LECTURE] DVD Authoring with Linux

2006-11-05 Thread Michael Vasiliev
On Sunday November 5 2006 08:41, Muli Ben-Yehuda wrote:
 On Sat, Nov 04, 2006 at 06:32:03PM +0200, Eli Billauer wrote:
  We are always looking for new lecturers and topics, and are scheduling
  the 2006 season. Got something interesting you wish to talk about? Got
  something new you want to learn, and need the drive of a lecture to make
  you learn it? Talk to us - [EMAIL PROTECTED]

 FYI, and just in case the announcement for the next talk ends up going
 out 30 minutes before the talk - we are going to have a guest talk on
 Nov 13 that many of you will find highly interesting:

 KVM (Kernel Based Virtual Machine) - Avi Kivity
 Abstract

 KVM (for Kernel-based Virtual Machine) is a new virtualization
 hardware driver for Linux. kvm allows one to run multiple virtual
 machines (guests) on a single Linux host. Guests are isolated from
 each other and from the host. It is similar to Xen and VMware but
 differs in some important respects. The talk will cover the kvm
 architecture and will include a short demonstration.

Can anyone do me a big favor of carrying an mp3 player and recording it? As 
usual, I am studying full 12 hours on Mondays, from 8am to 8pm.

-- 
Sincerely Yours,
Michael Vasiliev

The day after tomorrow is the third day of the rest of your life.

-
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]



Re: [Haifux] Lists are back up

2006-10-30 Thread Michael Vasiliev
On Monday October 30 2006 11:02, Alon Altman wrote:
 Hello all,
Please DO NOT send any more test messages!

The haifux mailing list is back up using the usual addresses. It is now
 hosted on Hamakor's server and should have no major trouble in the future.
 The previous annoucement in this regard by Adir was an error. Now the list
 does really work.

Except the fact that the x-mailing-list header I used to filter on is no 
longer available. What should I really use instead?

-- 
Sincerely Yours,
Michael Vasiliev

Real Programmers don't play tennis, or any other sport that requires you to 
change clothes.  Mountain climbing is OK, and real programmers wear their 
climbing boots to work in case a mountain should suddenly spring up in the 
middle of the machine room.

-
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]



Re: [Haifux] Linux Day Ad

2006-06-17 Thread Michael Vasiliev
On Saturday June 17 2006 16:29, Adir Abraham wrote:
 Hi,

 I attached the ad which I created for the current Linux Day.
 Please put it in your working or studying places, if you can.
What's up with the asymmetric right alignment and line breaks in the middle 
of sentence?
Also the logos should be larger and retouched, currently they look like they 
were pulled out of some website with a screen grabber... I'll do that if you 
want...

-- 
Sincerely Yours,
Michael Vasiliev

Computer Science is no more about computers than astronomy is about 
telescopes.
-- Attributed to Edsger Wybe Dijkstra

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] Linux Day: Choosing the right distribution

2006-06-16 Thread Michael Vasiliev
On Friday June 16 2006 18:05, Ohad Lutzky wrote:
 Umm... What's wrong with Gentoo's Hebrew support? I mean, yeah, okay,
 Ubuntu's is better, but Gentoo's isn't BAD.
Well, I never said it is BAD (tm). I like Gentoo. I run Gentoo everywhere I 
can. I just can hardly imagine myself bootstrapping Gentoo on 20 different 
machines simultaneously in the Linux day environment, even from stage3. It 
is, after all, a Linux _Day_. As for the hebrew support, I give you this as 
an example:

http://bugs.gentoo.org/show_bug.cgi?id=77751

Note the submission date...
Speaking for myself only, there are at least twenty l10n/i18n bugs I am 
personally interested in, that are in solved state, but not inserted to 
portage. In my opinion, the sad situation when I have to sync on a dozen 
undead portage overlay servers to get what I want looks too much like what's 
going on with binary distros. Then I have my own local overlay which I have 
to update constantly. And don't get me wrong, I love code diving and rolling 
patches. I just don't like to do it when i know perfectly well that it's a 
waste of both my time and the time of hundreds, if not thousands of users 
that are doing the same. It was supposed to be a system of joined efforts, 
not the every one for itself jungle. Of course one can always waste another 
half an hour and find a solution on Gentoo bugzilla/forums, but let's not 
forget that the choice of that distribution was because of it's powerful 
package system, the almighty portage tree.

-- 
Sincerely Yours,
Michael Vasiliev

Program testing can be a very effective way to show the presence of bugs, but 
is hopelessly inadequate for showing their absence.
-- Edsger Wybe Dijkstra

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] Linux Day: Choosing the right distribution

2006-06-15 Thread Michael Vasiliev
On Sunday June 11 2006 14:51, boazg wrote:
 me and the farm crowd strongly stand behind ubuntu. 

First of all, it is very nice to hear that the farm crowd still exists. I 
certainly would like to hear more about it.

 the 6.06 release takes 
 simple to a whole new level. it has hebrew, a new, much nicer, clearlooks 
 derivative theme, and apt is quite the leader in package management.
 they;ve also put a frontend on apt simpler than synaptic for people who
 want to save time. backed by automatix, a script making installation of
 common non-ubuntu things (like swiftfox, or w32codecs), very simple, and by
 HebUbuntu which sets up in one stroke most things needed for the israeli
 crowd, i believe ubuntu will be the simplest most elegent choice.
 and please tell me FC5 is nothing like RHEL4.

It's better when it comes to managing the system without tribal dancing around 
it, but not that good if we speak about a beginner's box. It should come with 
a little adjustable headband cushion to protect you from all the rakes you 
are going to step on...

I vote for Ubuntu, though I've never used it :) Well, not enough to call it 
a use really. I am a Gentoo guy myself, that's why I vote for another 
distro to be chosen :) Also, hebrew support is crucial, and with the lack of 
devs that care about it, it is not a strong side of Gentoo.

-- 
Sincerely Yours,
Michael Vasiliev

Confidence is the feeling you have before you understand the situation.

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




[Haifux] FatNS code + Ruby for loop

2006-06-06 Thread Michael Bar David

hi all
Where can I get FatNS code ? I want to review it.

Moreover, Boaz said there are no for loops in Ruby. If this isn't a
for loop, I don't know what to say:

for i in 1..5
  puts #{i}
end

works on Ruby 1.8 and 1.9

Michael

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] Fwd: [Haifux] T2 vim configuration

2006-06-04 Thread Michael Bar David

cool !


setenv TERM linux

made vim colorful, backspace behaves well

setenv TERM xterm

no changes

(works in tcsh)

should also solve (3) in most of the cases.

I think, if there's only one option it works, else not (reset is
auto-completed, vi not)

Orr, thanks a lot

Michael

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




[Haifux] T2 vim configuration

2006-05-30 Thread Michael Bar David
hi all 

I'v some problems with vim on my T2 account, may somwone can help:
1.its black-white (mabye global bash config ?)
2. backspace doesn't work most of the times
3. all the numbers in the right side, don't work as numbers (numlock on)
4. I can't delete lines - if hit return, and then backspace, it doesn't work, and I must use dd

I guess these are only config problems, but I don't know what settings to change

thanks
Michael 


Re: [Haifux] programming in linux lecture

2006-05-14 Thread Michael Vasiliev
On Sunday May 7 2006 22:37, Orna Agmon wrote:
And so, is there a lecture this Monday? And if so, what is it about?

(eek, I am top-posting, I feel so dirty inside)

 Hi Boaz,

 In the future, please coordinate lecture slots with [EMAIL PROTECTED],
 and not with the hundreds of people on the mailing list [EMAIL PROTECTED]

 Regarding the date - Orr, the 15th is Lag Baomer's evening. If there is no
 problem with that, than Boaz can get the slot.

 Orna.

 On Sun, 7 May 2006, boazg wrote:
  Date: Sun, 7 May 2006 00:32:47 +0300
  From: boazg [EMAIL PROTECTED]
  To: Orr Dunkelman [EMAIL PROTECTED], haifux@haifux.org
  Subject: Re: [Haifux] programming in linux lecture
 
  so can we finalize a programming in linux for the 15'th? i dont want
  less than a week's notice, so it would be nice to set this now. unless
  anyone anyone really wants to give this one, i'll be mor happy ot take
  it.
 
 
  boazg
 
[skipped]

-- 
Sincerely Yours,
Michael Vasiliev

... Any resemblance between the above views and those of my employer, my 
terminal, or the view out my window are purely coincidental.  Any resemblance 
between the above and my own views is non-deterministic.  The question of the 
existence of views in the absence of anyone to hold them is left as an 
exercise for the reader.  The question of the existence of the reader is left 
as an exercise for the second god coefficient.  (A discussion of 
non-orthogonal, non-integral polytheism is beyond the scope of this article.)

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] Security issues in Linux

2006-05-09 Thread Michael Vasiliev
On Tuesday May 9 2006 11:12, Orr Dunkelman wrote:
 According to what they claim, the source code was undocumented, and they
 had to work hard to make it into a readable pseudo-code.

 It reminds me a time I had to reverse engineer a circuit diagram I got.
 Took me hours just to understand what the machine does (and I had the
 circuit diagrams).

Looks like every time my favorite mailing list, or my personal address is 
picking up another strain of MyDoom, Beagle, or any other MS pandemic, and I 
am in my free time and curiosity digging through mail headers, or some 
poorly-written _undocumented_ code which is always a copy of another 
months-old once-0day IE exploit, excluding the comments, with the payload 
slapped in, I am actually reverse-engineering... Who would have thought

Clearly and objectively, I am a uneducated newb when it comes to kernel and 
security. I may miss some points here and there. I didn't read all the 
sources the authors reference to. However, I've read the paper and didn't get 
my revelation. 
The Why reverse-engineering the LRNG is not easy part left me thinking about 
the decisions that were made by the authors. I cannot confirm the hours of 
rebuild and installation on every small kernel change claim, neither the 
claim about undocumented, unreadable code.
The short excourse into RNG internals was highly educational, however almost 
all practical attacks on the algorithm revolve around the security classic - 
running out of entropy eventually. I agree completely with the claim that 
feeding the entropy pool off the system state itself is foolish, at least 
theoretically, but authors completely ignore the fact that anyone serious 
enough will feed the pool off hardware generator(s) anyway, the existence of 
the projects that provide this easy to set up feature, just for example:

http://www.av8n.com/turbid/

For the less security aware, there is the kernel support for hardware  
generators on the motherboard in the current kernel that is about as hard to 
get as running make menuconfig and enabling an option. (Well, maybe they 
miss it because they analyze the kernel source snapshot of December 2004, can 
anyone confirm?)

Apparently, the whole issue is not Linux PRNG is faulty but OSS is not so 
secure!. Isn't that the old OSS is less secure because everyone can see the 
security hole FUD, raising it's head every once and so often? A bleak 
eleventh pirate copy of a copy of Linux ate my data/hard drive/neighbor on 
fresh steroids, only able to cause a stir among the ignorant?
Is it because the A hole discovered in MS Doors have about the same chance 
of making a newspaper hard-sell headline as A rain expected in Haifa this 
Wednesday, but finding a dirty spot on some fresh player's clothes is such a 
exciting little game? Even if it's the same spot, over and over and over 
again?

What I can't figure out is how the fact that just about any teenager is able 
to spot the security hole in your closed-source program, provided that our 
average Joe managed it through two months of reading software cracking 
tutorials and another month of exploiting for dummies. How that fact can 
provide a false sense of security to anyone is beyond my understanding.

-- 
Aggravated,
Michael Vasiliev

We must not put mistakes into programs because of sloppiness, we have to do 
it systematically and with care.
-- Attributed to Edsger Wybe Dijkstra

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] user interface

2005-12-13 Thread Michael Greenberg
On 12/13/05, yakoub abaya [EMAIL PROTECTED] wrote:
 i want to create an application with a console based user interface .

 what i mean to do is something similar to the configuration tool
 used when compiling a kernel : make menuconfig .

 how do i create such a Display that is interactive to user keyboard input ?
  ( what Howto and Documentation should i search for ..)

The kernel menuconfig uses an adapted version of the program
dialog, which is included in most Linux distributions.  It is
well-suited to question/answer programs, but not so much to fully
interactive programs (e.g., top).

In general, the curses or ncurses library provides good bindings
for console GUIs.  There are many libraries built on top of curses and
ncurses, some offering (semi-) feasible upgrade paths to X
Window/Win32 GUIs.

HTH,
Mike

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] Ride to IBM HRL compilers and architecture seminar

2005-11-28 Thread Michael Greenberg
On 11/28/05, Orna Agmon [EMAIL PROTECTED] wrote:
 It would be rather helpful if you said where you need the ride FROM.

An excellent point.  I'd be looking for a ride (or directions) from
the Technion.

Michael

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] dvorak and hebrew

2005-06-21 Thread Michael Vasiliev
On Tuesday June 21 2005 00:24, Tzafrir Cohen wrote:
 Hi

 To answer a question from the lecture:

 I haven't tried it myself, but frankly I can't see any conflict between
 the Israeli layout and the Dvorak layout. Try something like:

   setxkbmap dvorak,il
The default layout for il is il(basic), at least it's what I see on my screen 
ATM.


 One minor conflict is between the si1452 variant and dvorak with the
 keys for {}. But:

 * This is not the only layout that has conflicts with the si1452
   variant. Practically any non-default layout has similar conflicts

 * you use lyx and not si1452, right?

No.
si1452 inherited the AD11, AD12 conflict from il(basic) layout, note the
 include pc/il(basic) line. Then, it overwrites the conflicting lines to 
provide some third-level key mappings. So the si1452 does not have the 
problem and the basic layout is the one to blame here, more specifically the 
part labelled parens mirroring. On the other hand, lyx layout seems to have 
the same issue, once you try: setxkbmap dvorak,il(lyx), you have three 
(sic!) braces, two right ones and one left, which is even more confusing for 
a novice. That is because lyx layout overwrites the AD11 (minus/underscore) 
to provide third-level holam key.

-- 
Sincerely Yours,
Michael Vasiliev

The day after tomorrow is the third day of the rest of your life.

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] Dvorak and Hebrew

2005-06-21 Thread Michael Vasiliev
On Tuesday June 21 2005 17:25, Tzafrir Cohen wrote:
   * you use lyx and not si1452, right?
 
  No.
  si1452 inherited the AD11, AD12 conflict from il(basic) layout, note
  the include pc/il(basic) line.

 In the basic layouts AD11 and AD12 remap only group 1. That is: they
 only change they layout when you use a hebrew keymap.
 
Ok, let me get myself clear. I am talking about four problematic keys. AE11, 
AE12, AD11 and AD12. Not all of them get remapped when you switch to 
hebrew, resulting in more than one pair of braces/brackets.

 The Hebrew layout is indeed a qwerty one. If you wish to provide a better
 one, please do. 

Hebrew Dvorak? Something like this?
http://people.musc.edu/~adelmaas/Adelmanian_keyboard/
I will be more than happy to do that, if anyone is interested. Or didn't I 
understand you correctly? What do you mean when you say qwerty layout when 
referring to Hebrew? The second level (capitalized) mappings?

  Then, it overwrites the conflicting lines to
  provide some third-level key mappings. So the si1452 does not have the
  problem and the basic layout is the one to blame here, more specifically
  the part labelled parens mirroring. On the other hand, lyx layout seems
  to have the same issue, once you try: setxkbmap dvorak,il(lyx), you
  have three (sic!) braces, two right ones and one left, which is even more
  confusing for a novice. That is because lyx layout overwrites the AD11
  (minus/underscore) to provide third-level holam key.

 Have you actually tried it?

Yes. I wrote my answer after looking carefully at the map files and testing 
all Hebrew layout variants with Dvorak English keymap as a first loaded one.
Why?

-- 
Sincerely Yours,
Michael Vasiliev

... Any resemblance between the above views and those of my employer,
my terminal, or the view out my window are purely coincidental.  Any
resemblance between the above and my own views is non-deterministic.  The
question of the existence of views in the absence of anyone to hold them
is left as an exercise for the reader.  The question of the existence of
the reader is left as an exercise for the second god coefficient.  (A
discussion of non-orthogonal, non-integral polytheism is beyond the scope
of this article.)

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] please help

2005-04-09 Thread Vasiliev Michael
On Saturday April 9 2005 20:20, yakoub wrote:
  yakoub wrote:
  i have problems with linux2.6
  that i 've been trying long to solve , but failed
  i attached dmesg logs
 
  i have failure errors about ide drives ,
  sometimes it is so critical that dma is disabled

It's one of these generic kernels, right? 

-- 
Sincerely Yours,
Vasiliev Michael

Quark!  Quark!  Beware the quantum duck!

--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]




Re: [Haifux] W2L promotional material

2003-09-02 Thread Vasiliev Michael
On Monday 01 September 2003 15:34, Ron Artstein wrote:
 Very simple reason: I don't speak Russian.

 If someone gives me a translation, I'll typeset it in the same
 format as the other posters. A Russian translation should include
 the phrase all the lectures will be given in Hebrew (this appears
 in the Arabic poster).

I can do it. Could you private mail me the details and the format you want it 
in?

-- 
Sincerely Yours,
Vasiliev Michael

NP: XMMS is not loaded.


--
Haifa Linux Club Mailing List (http://www.haifux.org)
To unsub send an empty message to [EMAIL PROTECTED]