_notreallyme_

I read "Be He", not "Be the"

"sampling limitations"

"Studio APPROVED"

I can't work out "F?96" and "messea"...

From my experience, there are conferences where sponsors have a lot of influence on the content. But these conferences are mostly commercial-oriented: talks presenting products rather than talks about the state of the art in the domain.

For the venue, it is possible to get it almost for free. Partnering with a (private) engineering school did work several times for me. It's free advertising for them and they are already equipped for such events. Another way is a partnership with an artist collective, provided that their situation with the municipality is well defined.

Note that the command they use, poll, requires to login first, which means they also had some valid credentials somehow.

In addition, they seemed to have access to the source code, whereas the opensource version hasn't been updated in more than 8 years.

Maybe this is the result of a whitebox security audit?

I can confirm that indeed Strongswan is written in OOP C.

This is relatively common in software with a modular architecture that is intended to run on embedded systems and whose design dates back from a time when C++ standard library was not really well supported on such systems. This is also useful when performance is highly important and you can't afford the C++ vtable overhead.

This might be exploitable in some cases. There has been a "heated" discussion in 2014 about off-by-one NUL byte heap overflow that lead to this blogpost from projectzero:

https://googleprojectzero.blogspot.com/2014/08/the-poisoned-...

There have been other examples where only a 1 could be written.

I don't think it would actually be the case: Banning hunting as a hobby would be a massive win.

There is an artificial imbalance in the ecosystems introduced by hunters who feed specific animals at certain times in order to have more, and thus easier to hunt, preys. Because of that, there is a need to restore a viable ecosystem in some areas.

This kind of thing should not be let to the "elite", but to professionals...

Before closing the tab, I check if View -> Page Style -> No Style gives the text I was interested in reading. If i arrived on the page, chances are that there might be some information I'm looking for.

The actual claim is that NSA may have already spent a lot of time and effort to analyse PQC algorithm underlying problems without making their findings public.

DJB seems to suspect that they may influence NIST to select algorithms and parameters within the range of what they already know how to break.

Ahah, I think it was to avoid the takedown of websites talking about it. The term is still in use to advertise CCcam and the like.

This was the nagravision encryption mentionned at the end of the article.

Old "decodeur pirates" wouldn't work past 1995. They were standalone and didn't require a PC.

After that, you had to use a tv card (mine was PCI) with a "compatible" chip like BT848 if memory serves. Some plugins for tv applications existed to bruteforce the key every month (deschtroumpfer used to be a keyword to find such plugin).

For what it's worth, I understood at first sight "Mauvaisement, le <honorific title> Bertram a dit" which happend to be the intended meaning.

I actually had more trouble with "Bacin" starting with a capital B which would indicate a proper name. That's the only line I wasn't sure of.

I was surprised by the fact I could understand that while I know I can hardly understand anything from the 16/17th century old french. Thanks for your input for clarifying that.

No, signing is done with asymmetric keys. Someone sign with their private key so you can verify it with their public key, basically. Symmetric keys are used to encrypt the code for updates, generally to prevent unintentional leak of secrets or just to prevent reverse engineering.

I'm not in the jailbreaking space, but I guess that what it means here is that some people may find flaws in the code and leverage them to potentially bypass the signature verification, although this might prove very difficult to do. It might also help emulating the PS5 behavior which in turns could lead to some modding/cheating for some games. Who knows ?

He didn't start at 0% BAC, otherwise he would likely be experiencing delirium tremens.

Alcoholics tend to maintain a high BAC all the time, enough so that even after sleeping they still have enough alcohol in their blood to avoid delirium tremens.

So he probably drank much less than two hard liquor bottles.

To be fair, there is also some whining involved on the "white hat hacker" side. Triaging reports is not an easy task.

The issue I have often witnessed, is a higher up wanting to play down a vulnerability, or even make so nobody hears about it because they fear it will impact the stock price. You should not forget that there is a financial impact...

After reviewing most of the arguments in favor of a lab leak origin, I eventually concluded that when confronted to their counter arguments, the Occam's razor would be in favor of a natural origin for the sars-cov2.

Indeed, when I heard of the report about WIV workers being sick with covid-like symptom I immediately checked who reported that, and ended up with the same conclusion as you.

While a lab leak origin cannot be entirely dismissed, one should keep in mind that all this fuss is politicaly motivated.

I meant that passport were ot required for traveling inside Europe before WWI. Crossing borders didn't require to obtain a document beforehand.

I guess it's "elitist circles". There were no enforced borders before WWI. It was common for people who could afford it to travel between big European cities. So there is a big chunk of shared culture actually.

It doesn't seem to be this point here.

From my understanding of the proposal, they want the social media platforms (above a certain amount of connections) to be regulated like the TV is regulated: by the CSA (Audio Visual Concil).

They also force the TOS to precisely explain how and when they can ban/suspend an account, give all the details about a ban/suspension, and provide a mean to appeal.

They also have to appoint a contact for all legal matters with the government.

This proposal is an amendment for the law against separatism that is currently reviewed at the lower house.

Well, obviously a french version is easy to find : https://www.assemblee-nationale.fr/dyn/15/amendements/3649/C...

The guy who came up with the tool used to help decipher is not a major in any of these fields.

Moreover, this kind of puzzle is generally done by hobbyists, while some of them are scientists, it is not the scientific approach that guides them.

The investigators have most probably followed the puzzle hobbyist trail considering the time and resources that have been used for the investigation...

Well, there is a driver for ACPI. I have the vague souvenir of Linus Torvalds calling BIOS/UEFI dev "monkeys on crack" or something along the line...

I did the same while in high school. Someone asked me to mod his PS1 so I copied the pic12c508 he provided to me so I could do it again for cheaper.

For the sales, it was actually a rather good business, I had between 1 and 3 console a week to mod, for almost a year, and I didn't even put an ad.

It ended because someone with the latest model (SCPH 8xxx if memory serves) inisted I try to mod his PS1 despite me not having proper equipement to solder at the needed accuracy. It did failed obviously. I had a hard time making it work again, it was so stressful that I ended up stopping it altogether except 2 or 3 times after that for some close friends.

From my personal experience:

I had a customer once who wanted a security assessment of their payment terminal. Apparently one was stolen and they wanted to know how difficult it would be for an attacker to... well... "you know the name of the attack where they steal credit card info and such ?". So I replied "skimming". The attack actually did happen where they reversed the terminal to find vulnerabilities and used that to steal a database with payment information. No physical device was used for the attack, but the name "skimming" seemed relevant.

Bottom line is, you use the word you and involved people know to describe the threat we face.

They might have been interested in having the MAC addresses to check some suspects alibi, or even to find some links between groups of persons, not specifically PII.

Grenoble is under scrutiny for some time now, it has a bad reputation regarding drug trafficking and the government uses it to show its "strength" with police operations covered by the media. This might be linked.

Have you ever heard of PHP ?

It is obviously a misinterpretation of the original idea behind "security by obscurity is bad". Same goes for "goto considered harmful", which is not always true.

Although, Kerckhoffs's principle are a good way of describing how a secure cryptosystem should behave. This is what people should have in mind.

Obscuring will just add some delay as you state, but it might be irrelevant in many situations.

Well, I see 2 reasons here: 1/ when an attack is deemed a low-profile one, it is a way to say that the targeted company might be to blame, at least in part, for not having adequate security protocols; 2/ in this instance, some people might be frustrated that the DM of high profile people won't leak on the internet because of a lack of preparation from the attackers.

Most of the time, the "character assassination routine" is to emphasize the first point.

During the first test, the brakes didn't work and it knocked down a brick wall. It was in Paris close suburbs, not in Paris intra-muros. I am not aware that he was thrown in jail for that, it seems unlikely.

> No...

Why ?

> in this scenario the attacker has the victim’s new private key

You don't want to keep your private key in cleartext on your email provider servers, do you ?

It means if someone you want to impersonate uses the Web Of Trust, i.e. their key is signed by other people whose keys have been signed the same way, you can generate a GPG key for which all of these signatures are still valid.

For example, if an attacker gains access to a victim email account, they could send to their contacts a "trusted" key (as explained above) and then use it to send signed documents to the victim's contacts.

This would defeat an adversary "paranoid" enough to check a key signature, but not paranoid enough to obtain a clear explaination/confirmation of why the key changed...