slipstream-

Being "clean" doesn't help when OEM drivers have security issues too (example: https://rol.im/asux/ )

The former; red X means it's bad.

I've found enough issues in OEM-preinstalled/OEM-provided stuff that this isn't a surprise at all. (most have been fixed by now, at least. Not sure about the Asus one, as that got reported by someone else over a year prior to my full disclosure.)

http://lizardhq.org/2015/11/25/dell-foundation-services.html

http://lizardhq.org/2015/12/01/dell-foundation-services.2.ht...

http://lizardhq.org/2015/12/05/dell-system-detect.html

http://lizardhq.org/2015/12/05/lenovo.html

http://lizardhq.org/2015/12/05/toshiba-service-station.html

https://rol.im/asux/

And that's why I use a nice helpful userscript that aims to work around these things: https://github.com/adsbypasser/adsbypasser

uh, Windows does support other architectures than x86: currently, it supports x86, x64, ARM and ARM64. (and as Windows Server 2008 R2 is still supported, the IA64 version is also still suppored)

I've been investigating PUPs for the last month or so.

These kind of bundlers now drop not only adware (browser extensions, or those that drop MITM proxies that break TLS), but also winlockers and fakealert trojans of Indian origin ("CALL OUR [FAKE] TECH SUPPORT TO RESOLVE THE ISSUE").

A long shot, but just in case...

Even shady 1990s warez CDs need to be preserved :)

Someone did try (I believe it was called wecanhasthetechnology or something), but it didn't last long.

Would be nice to see the text of those offers, like the way the rpi foundation released the text of the offer they got (I've started to investigate the PUP ecosystem, and now said ecosystem includes the shittiest Indian winlockers and fakealert trojans, designed to get less knowledgeable user to call fake tech support)

I wonder if it's China again.

I was working on this at one time back in late 2014. A bunch of people used scripts I made to start downloading all the file areas. Then... AOL removed the files in January 2015. They also removed support for AOL 4.0 or 5.0 and below last April, and that was the version that a very incomplete Python client was claiming to be.

The research I did into archiving AOL helped me find this: http://lizardhq.org/2015/12/05/aol-desktop.html

Hopefully I'll do enough reversing to fix and finish the custom client one day. Newer clients wrap the login and just the login in some form of SSL/TLS. Which I still need to figure out.

Maybe people can help. There's a channel at efnet #aohell and plenty of information on the archiveteam wiki.

I believe 4am is a single person, not a group.

Maybe that's the joke.

"adlessness can be a luxury for those who choose to buy ad blockers so their webpages load faster."

Wait, buy ad blockers? I understand some ad blockers, mainly on iOS, are paid, but on other platforms they are generally FOSS...

of course, people may pay for VPNs for other reasons too and just see the piracy opsec thing as a bonus.

PUPs are everywhere these days.

Most of the Windows ones I see these days are even more malware-like, with exe packers, anti-VM, and even kernel mode drivers that hook functions.

Here's a github link to the emulator: https://github.com/OBattler/PCem-X

Low-tech winlocker ransomware! That's interesting. Never heard of that being done before by fake tech support scammers.

I have a couple of windows and osx binaries for such software, forgotten the name of the one i have. Interestingly it has anti-VM!

Wouldn't the browser still make the request even with the CORS headers, because the server needs to send such headers?

If the origin used a self-signed cert, doesn't cloudflare use certificate pinning?

Well, this looks like interesting times ahead for the D language. Hopefully this is a good thing, I've loved D since I first came across it. :)

Link doesn't seem to work for me?

and those archiving the AOL walled garden today are rediscovering said research. Back in December I coded a custom AOL .tol to send arbitrary tokens :)

You can't do that now. AOL dropped support for clients <= 3.0 back in January this year, and a month or so ago dropped support for clients <= 5.0.

the AOL client software.

Haha.

(I really wish I had better upload speed.)

AOL floppies even. Which could have been reused.

When I was busy a few months ago archiving the AOL download areas, I found some undocumented file areas full of AOL betas. I downloaded over 10gb of them.. at 100-200kb/s. There were more, but I figured the rest of the channel I was working with (related to archiveteam funnily enough) would get them... and then AOL killed the downloads back in January this year. (They probably still exist on the servers though - you can still get at the metadata!)

Anyway, I figured a friend of mine might want them; he said he did, so I uploaded them to him (at my crappy 768kbit/s upload speed it took an entire weekend!). Upon completion he said he no longer wanted them.

Um.

Anyway, I just contacted Jason Scott. Hopefully he'll be willing to wait a few days. Or I could just burn the file to a BD-R, I have a bluray burner and a spindle of BD-Rs somewhere that I've never used.

Nice. A bunch of friends of mine play Minecraft, but I never really got into it. So I decided to look into the protocol, and coded a chat-only minecraft server in dlang, which the Mojang client can connect to. (I never released it, even though I meant to as OSS)