Skip to content
I T S S
  • Welcome
  • Hardware
  • Internet
  • Networking
  • Security
  • Data Recovery
  • Support
  • Contact
  • Webmail

pfSense / Wireguard / Bad Code / Close Call

By itss | 26/03/2021
0 Comment

A nice write-up of how a whole bunch of bad code very nearly ended up in FreeBSD 13 due to several bad calls on the part of pfSense. https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/

Category: Technology
Post navigation
← Apple Continues Its Trip To The Dark Side With The Release of MacOS 17 (Big Sur) A Nice Little Cryptography Primer →

Recent Posts

  • Hardware Exploits?
  • Why Quake3 was so fast : Fast Inverse Square Root
  • A Nice Little Cryptography Primer
  • pfSense / Wireguard / Bad Code / Close Call
  • Apple Continues Its Trip To The Dark Side With The Release of MacOS 17 (Big Sur)

Slashdot

News for nerds

  • Startup Set To Brick $800 Kids Robot Is Trying To Open Source It First
    by BeauHD on 21/12/2024 at 10:00 am

    Last week, startup Embodied announced it was closing down, and its product, an $800 robot for kids ages 5 to 10, would soon be bricked. Now, in a blog post published on Friday, CEO Paolo Pirjanian shared that Embodied's technical team is working on a way to open-source the robot, ensuring it can continue operating indefinitely. Ars Technica reports: The notice says that after releasing OpenMoxie, Embodied plans to release "all necessary code and documentation" for developers and users. Pirjanian said that an over-the-air (OTA) update is now available for download that will allow previously purchased Moxies to support OpenMoxie. The executive noted that Embodied is still "seeking long-term answers" but claimed that the update is a "vital first step" to "keep the door open" for the robot's continued functionality. At this time, OpenMoxie isn't available and doesn't have a release date. Embodied's wording also seems careful to leave an opening for OpenMoxie to not actually release; although, the company seems optimistic. However, there's also a risk of users failing to update their robots in time and properly. Embodied noted that it won't be able to support users who have trouble with the update or with OpenMoxie post-release. Updating the robot includes connecting to Wi-Fi and leaving it on for at least an hour. "It is extremely important that you update your Moxie with this OTA as soon as possible because once the cloud servers stop working you will not be able to update your robot," the document reads. Embodied hasn't said when exactly its cloud servers still stop working. Read more of this story at Slashdot.

  • Axiom's Private Space Station Could Arrive As Early As 2028
    by BeauHD on 21/12/2024 at 7:00 am

    Axiom Space has revised its plan for assembling its commercial space station by launching the Payload, Power, and Thermal module first, enabling it to operate as a free-flying platform as early as 2028 -- two years ahead of the original timeline. Space.com reports: NASA awarded Axiom Space a contract in 2020 to attach one or more modules to the International Space Station (ISS), which is set to retire by 2030 at the earliest. The original plan called for Axiom to detach a multi-module group from the ISS, creating a commercial outpost in low Earth orbit that will continue operating after the ISS is gone. But that plan has now been altered. To create its space station, Axiom plans to launch five modules: a payload/power/thermal element, an airlock, a research/manufacturing hub, and a pair of habitat modules. The original plan was for Axiom to launch the Habitat 1 module to the ISS first, followed by the additional elements. The new assembly sequence will see the Payload, Power and Thermal module launch to the ISS first. This module could detach from the station -- and become a free flyer called Axiom Station -- as soon as 2028, according to the company. After that happens, Axiom will continue assembling the outpost, launching the Habitat 1 module to meet up with it. Habitat 1 will be followed by the airlock, the Habitat 2 module, and then the research and manufacturing facility. Angela Hart, a manager for the Commercial Low Earth Orbit Development Program at NASA's Johnson Space Center in Houston, said: "The updated assembly sequence has been coordinated with NASA to support both NASA and Axiom Space needs and plans for a smooth transition in low Earth orbit." Read more of this story at Slashdot.

  • 10 Years Later: Malaysia To Resume Hunt For Flight MH370
    by BeauHD on 21/12/2024 at 3:30 am

    An anonymous reader quotes a report from Reuters: Malaysia has agreed to resume the search for the wreckage of missing Malaysia Airlines Flight MH370, its transport minister said on Friday, more than 10 years after it disappeared in one of the world's greatest aviation mysteries. Flight MH370, a Boeing 777 carrying 227 passengers and 12 crew, vanished en route from Kuala Lumpur to Beijing on March 8, 2014. [...] MH370's last transmission was about 40 minutes after it took off from Kuala Lumpur for Beijing. The pilots signed off as the plane entered Vietnamese air space over the Gulf of Thailand and soon after its transponder was turned off. "Our responsibility and obligation and commitment is to the next of kin," Transport Minister Anthony Loke told a press conference. "We hope this time will be positive, that the wreckage will be found and give closure to the families." Further reading: Could Sea Explosions Finally Locate the 2014 Crash Site of Flight MH370? Read more of this story at Slashdot.

  • Cory Doctorow's Prescient Novella About Health Insurance and Murder
    by BeauHD on 21/12/2024 at 2:10 am

    Five years ago, journalist and sci-fi author Cory Doctorow published a short story that explored the radicalization of individuals denied healthcare coverage. As The Guardian notes in a recent article, the story "might seem eerily similar" to the recent shooting of UnitedHealthcare's CEO. While it appears that the alleged shooter never read the story, Doctorow said: "I feel like the most important thing about that is that it tells you that this is not a unique insight." Doctorow continued: "that the question that I had is a question other people have had." As an activist in favor of liberalizing copyright laws and a proponent of the Creative Commons organization, it's important to note that Doctorow advocates for systemic reform through collective action rather than violence. Here's an excerpt from the The Guardian's article: In Radicalized, one of four novellas comprising a science fiction novel of the same name, Doctorow charts the journey of a man who joins an online forum for fathers whose partners or children have been denied healthcare coverage by their insurers after his wife is diagnosed with breast cancer and denied coverage for an experimental treatment. Slowly, over the course of the story, the men of the forum become radicalized by their grief and begin plotting -- and executing -- murders of health insurance executives and politicians who vote against universal healthcare. In the wake of the December 4 shooting of UnitedHealthcare CEO Brian Thompson, which unleashed a wave of outrage at the U.S. health system, Doctorow's novella has been called prescient. When the American Prospect magazine republished the story last week, it wrote: "It is being republished with permission for reasons that will become clear if you read it." But Doctorow doesn't think he was on to something that no one else in the U.S. understood. [...] In one part of the story, a man whose young daughter died after an insurance company refused to pay for brain surgery bombs the insurer's headquarters. "It's not vengeance. I don't have a vengeful bone in my body. Nothing I do will bring Lisa back, so why would I want revenge? This is a public service. There's another dad just like me," he shares in a video message on the forum. "And right now, that dad is talking to someone at Cigna, or Humana, or BlueCross BlueShield, and the person on the phone is telling that dad that his little girl has. To. Die. Someone in that building made the decision to kill my little girl, and everyone else in that building went along with it. Not one of them is innocent, and not one of them is afraid. They're going to be afraid, after this." "Because they must know in their hearts," he goes on. "Them, their lobbyists, the men in Congress who enabled them. They're parents. They know. Anyone who hurt their precious children, they'd hunt that person down like a dog. The only amazing thing about any of this is that no one has done it yet. I'm going to make a prediction right now, that even though I'm the first, I sure as hell will not be the last. There's more to come." Read more of this story at Slashdot.

  • 'Yes, I am a Human': Bot Detection Is No Longer Working
    by BeauHD on 21/12/2024 at 1:30 am

    The rise of AI has rendered traditional CAPTCHA tests increasingly ineffective, as bots can now "[solve] these puzzles in milliseconds using artificial intelligence (AI)," reports The Conversation. "How ironic. The tools designed to prove we're human are now obstructing us more than the machines they're supposed to be keeping at bay." The report warns that the imminent arrival of AI agents -- software programs designed to autonomously interact with websites on our behalf -- will further complicate matters. From the report: Developers are continually coming up with new ways to verify humans. Some systems, like Google's ReCaptcha v3 (introduced in 2018), don't ask you to solve puzzles anymore. Instead, they watch how you interact with a website. Do you move your cursor naturally? Do you type like a person? Humans have subtle, imperfect behaviors that bots still struggle to mimic. Not everyone likes ReCaptcha v3 because it raises privacy issues -- plus the web company needs to assess user scores to determine who is a bot, and the bots can beat the system anyway. There are alternatives that use similar logic, such as "slider" puzzles that ask users to move jigsaw pieces around, but these too can be overcome. Some websites are now turning to biometrics to verify humans, such as fingerprint scans or voice recognition, while face ID is also a possibility. Biometrics are harder for bots to fake, but they come with their own problems -- privacy concerns, expensive tech and limited access for some users, say because they can't afford the relevant smartphone or can't speak because of a disability. The imminent arrival of AI agents will add another layer of complexity. It will mean we increasingly want bots to visit sites and do things on our behalf, so web companies will need to start distinguishing between "good" bots and "bad" bots. This area still needs a lot more consideration, but digital authentication certificates are proposed as one possible solution. In sum, Captcha is no longer the simple, reliable tool it once was. AI has forced us to rethink how we verify people online, and it's only going to get more challenging as these systems get smarter. Whatever becomes the next technological standard, it's going to have to be easy to use for humans, but one step ahead of the bad actors. So the next time you find yourself clicking on blurry traffic lights and getting infuriated, remember you're part of a bigger fight. The future of proving humanity is still being written, and the bots won't be giving up any time soon. Read more of this story at Slashdot.

  • EU Wants Apple To Open AirDrop and AirPlay To Android
    by BeauHD on 21/12/2024 at 12:50 am

    The EU is pushing Apple to make iOS more interoperable with other platforms, requiring features like AirDrop and AirPlay to work seamlessly with Android and third-party devices, while also enabling background app functionality and cross-platform notifications. 9to5Google reports: A new document released (PDF) by the European Commission this week reveals a number of ways the EU wants Apple to change iOS and its features to be more interoperable with other platforms. There are some changes to iOS itself, such as opening up notifications to work on third-party smartwatches as they do with the Apple Watch. Similarly, the EU wants Apple to let iOS apps work in the background as Apple's first-party apps do, as this is a struggle of some apps, especially companion apps for accessories such as smartwatches (other than the Apple Watch, of course). But there are also some iOS features that the EU directly wants Apple to open up to other platforms, including Android. [...] As our sister site 9to5Mac points out, Apple has responded (PDF) to this EU document, prominently criticizing the EU for putting out a mandate that "could expose your private information." Apple's document primarily focuses in on Meta, which the company says has made "more interoperability requests" than anyone else. Apple says that opening AirPlay to Meta would "[create] a new class of privacy and security issues, while giving them data about users homes." The EU is taking consultation on this case until January 9, 2025, and if Apple doesn't comply when the order is eventually put into effect, it could result in heavy fines. Read more of this story at Slashdot.

Archives

  • September 2022
  • November 2021
  • June 2021
  • March 2021
  • November 2020
  • October 2020
  • September 2020
  • February 2020
  • January 2020
  • October 2019
  • August 2018
  • July 2018
  • April 2018
  • February 2018
  • January 2018
  • December 2017
  • October 2017
  • September 2017
  • August 2016
  • July 2016
  • March 2016
  • February 2016
  • August 2015
  • May 2015

Categories

  • Innovation
  • Security
  • Software
  • Technology

Tags

backdoor cisco coding json laziness patterns public information announcement security vulnerability
© 2017 IT Sales & Services Ltd
Quality IT solutions in Tanzania since 2010
Iconic One Theme | Powered by Wordpress