712 karma · joined March 12, 2014
That's why I was really extatic when Windbg devs introduced a standard script engine, only to learn later on that was JavaScript ...
I'm not saying Samasource does not profit from this situation, they clearly do, but Silicon Valley taught me that money spent paying developers through the nose ends up mainly in the landlord's pocket.
The real issue for the EU is the lack of financial and political solidarity. You can bankrupt a EU country and expect the others to pick up the tab, even if there nothing written down in the EU constitution saying so. The Syrian migration issue is a glaring example of a lack of political collaboration.
EU countries needs to acknowledge the fact they are actually tightly bounded to the union and make changes in the way the EU works to reflect that situation.
If it's for blogging, you can also take a look at Blogger, half the programming & security blogs I follow are on it.
The only issue is that QubesOS rely on paravirtualization (it's a Xen hypervisor underneath) for process isolation.
(By the way Windows is taking the same path with ApplicationGuard)
Project Centennial is an amazing piece of virtualization but it has its caveats (https://docs.microsoft.com/en-us/windows/uwp/porting/desktop...): it won't be able to convert every legacy software (why isn't Office on the Windows Store for example ?).
At best, it will target locked down hardware like consoles and tablets, but isn't what Windows S was created for ?
I'm not entirely sure AI is currently fit to solve cat-and-mouse games such as ad blocking.
x86_64 have calling conventions (namingly __fastcall) which are more inconvenient to decode than x86 _cdecl or __stdcall where every arguments are passed on the stack. Most symbolic engines usually works only on x86 for the same reason.
Patrick Wardle has reversed the C2 com protocol and found it had "advanced" capabilities (remote exec, key and mouse sniffing, screenshot, etc.). The malware was found on several thousands Macs too (mostly in the US).
The binding is a bit funky (lots of `ref` and `gcnew` keywords sprayed here and there) but it works.
Basically he says that even Google is puny (in terms of production units) in front of Intel or Samsung, and cannot ask for custom firmwares.
Hardware security is currently a shit show because of global monopolies/"oligopolies".
I haven't seen them used anywhere, but that's an okay solution I guess.
NB : by the way, love your blog :p
Scriptless 0day RCE is still possible in a ROP+ALSR world, but exploitation is a real bitch. Ex : https://scarybeastsecurity.blogspot.fr/2016/11/0day-exploit-...
Once you decide not to support Python2 anymore, just drop the imports. They also have a Py2/3 compat cheet sheet : http://python-future.org/compatible_idioms.pdf
Having worked in the areospace industry, I've seen France lose some "in the bag" public markets by letting other countries lobby and spin bid's technical specifications to their advantage.
It seemed they learned the lesson, at least for this bid.
Have you never worked a custom written crypto algo in your line of work ? For example, countries' army are the bane of sysadmins since they implement about every standard of networking since computer exists.
Working in infosec, you hardly have to crack an akbash cipher, but I'm pretty sure you'd had to understand a closed source algorithm.
Problem is you need a reference time clock. On monolithic arch, is easy : the backbone bus timestamp the paquets it sees. On networked arch you need a time server a la NTP, otherwise you have time skew and loopbacks.
Even with a accurate time clock, you may also need to correct for timing issues due to cable length.