December 2003 - Legacy - lists.gtalug.org

God help us all...
by rufmetal-MwcKTmeKVNQ＠public.gmane.org 04 Dec '03

04 Dec '03

On Mon, 1 Dec 2003 18:08:36 -0500 JoeHill <joehill-rieW9WUcm8FFJ04o6PK0Fg at public.gmane.org> wrote: > ...ya, until this part kicks in: > > "The software running their brakes will upgrade itself wirelessly." > > That ought to be a fun experience coming down the 427 and running into > a line of slow-moving transports...Windows Update patches your brake > software and you end up a red smear on some guy's "How's My Driving?" > bumper sticker. Pop-up window on the windshield HUD: Hi, it looks as if you're trying to pass someone. Do you want me to: + Increase speed + Honk the horn + Search the internet for tips about safe driving + See more about passing and right of way... Looks like you forgot to un-check the box which says "Show this window every time I accelerate" ~ C -- That's like banging rocks together and being proud that you've re-derived fire from first principles. ~ Jamie Zawinski -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

C considered harmful
by plp-ysDPMY98cNQDDBjDh4tngg＠public.gmane.org 04 Dec '03

04 Dec '03

On Thu, 4 Dec 2003, Anthony de Boer wrote: > Peter Hiscocks wrote: > > So, it is an interesting challenge to the language writers to create > > something that has the power of the C language and still does (say) > > automatic checking of array bounds. > > This idea may be fine within an application, but it breaks down at > security boundaries like the user/kernel interface, since the kernel had > better not trust the user program's claim of the size of an array (this And it does not. The kernel invariably verifies the access rights on the passed data field, whose size is explicitly passed to the kernel, before doing anything else. If it does not, then there is a bug in the kernel, not in C. Peter -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Got a license for that Code?
by grant.cullen-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 04 Dec '03

04 Dec '03

This as absolute madness. While I don't earn my living specifically by writing code, I do write some for customers as needed. The thought of submitting an annual fee to some draconian organisation makes me sick. This must not happen. Grant Cullen JADALL Consulting Ltd. grant.cullen-rieW9WUcm8FFJ04o6PK0Fg at public.gmane.org 416-706-4447 -----Original Message----- From: owner-tlug-lxSQFCZeNF4 at public.gmane.org [mailto:owner-tlug at ss.org]On Behalf Of JoeHill Sent: Thursday, December 04, 2003 08:07 To: TLUG Subject: [TLUG]: Got a license for that Code? "It looks like the Microsoft front organizations are pushing licensing for software writers. Of course, the usual suspects, the BSA and ITAA are involved in writing the laws." Link: http://newsvac.newsforge.com/article.pl?sid=03/12/03/1640223 -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "Behind every great fortune is a crime." -- Balzac -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by adb-tlug-AbAJl/g/NLXk1uMJSBkQmQ＠public.gmane.org 04 Dec '03

04 Dec '03

Robert Brockway wrote: > Most exploits discovered these days are found by those who launch a > concerted effort to detect them. By sheer number and amount of effort > most of the people who discover exploits are in the security establishment > and are not Black Hats. > > I, along with most security professionals, maintain that the > vendors/developers are better off receiving some amount of warning before > the exploit goes public. ... I find it useful to consider three shades of hat; besides the black hat who will exploit a bug, and the white hat who honestly wants the bug fixed, there's the gray hat who discovers bugs for fame and fortune, and cares more for counting coup with his name in Bugtraq than for actually getting it fixed. -- Anthony de Boer -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

C considered harmful
by adb-tlug-AbAJl/g/NLXk1uMJSBkQmQ＠public.gmane.org 04 Dec '03

04 Dec '03

Peter Hiscocks wrote: > So, it is an interesting challenge to the language writers to create > something that has the power of the C language and still does (say) > automatic checking of array bounds. This idea may be fine within an application, but it breaks down at security boundaries like the user/kernel interface, since the kernel had better not trust the user program's claim of the size of an array (this being an approximation of how Debian got burned), also since the kernel is dynamically carving out chunks of memory for things, and since "one man's program is another man's data" (the whole program may be one array of mere data to the kernel). There's a lot that can be fixed with opaque handles to structures (eg. Dan Bernstein's string library as opposed to the traditional C library's simple char * string implementation); C++ formalizes some such ideas, but a prudent C programmer can write better code without needing C++'s extra baggage. -- Anthony de Boer -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

C considered harmful: was Debian attacker may have used new exploit
by marcus.brubaker-H217xnMUJC0sA/PxXw9srA＠public.gmane.org 04 Dec '03

04 Dec '03

On Thu, 2003-12-04 at 04:27, Tim Writer wrote: > Marcus Brubaker <marcus.brubaker-H217xnMUJC0sA/PxXw9srA at public.gmane.org> writes: > > > On Wed, 2003-12-03 at 23:30, Henry Spencer wrote: > > > On Wed, 3 Dec 2003, Peter Hiscocks wrote: > > Hell, even Prolog and the many species of LISP-type-languages are > > interesting in their own right (though not terribly useful in my mind). > > LISP not useful? Sacrilege! I'm responding to this with Gnus, still > arguably one of the best mail/news clients, running within Xemacs, still > arguably one of the best programmers' editors (vi/emacs flame wars > notwithstanding), written in a dialect of LISP. > Alright alright, I give, LISP is certainly more useful than a lot of languages and people have done some interesting things in them :) > > But if you fit well into a specific category of application development > > then there is a whole host of better choices for you. For instance, next > > major GUI application I write will probably be in Java [....] > > You might find this article, by one of the LISP community's greats, both > interesting and on topic: > > http://www.paulgraham.com/javacover.html To each their own opinion but if you want to do OOP then there really isn't a better language out there than Java. From my point of view Java is C++ done relatively right from the language perspective. Regards, -- Marcus Brubaker <marcus.brubaker-H217xnMUJC0sA/PxXw9srA at public.gmane.org> -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

video plugin for mozilla on linux
by Kpanchoo-bJEeYj9oJeDQT0dZR+AlfA＠public.gmane.org 04 Dec '03

04 Dec '03

for redhat 9 -- take a look at http://media4redhat.frontspace.org -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

C considered harmful: was Debian attacker may have used new exploit
by phiscock-g851W1bGYuGnS0EtXVNi6w＠public.gmane.org 04 Dec '03

04 Dec '03

Marcus - Thanks for the references. I may be incorrect, but I believe Heather Hinton was involved with the 'stackguard' project. She's now with IBM it Austin, Texas. Peter On Wed, Dec 03, 2003 at 11:36:04PM -0500, Marcus Brubaker wrote: > On Wed, 2003-12-03 at 22:55, Peter Hiscocks wrote: > > OK, I hate to flog a dead horse but really: > > > > Hmmmm, this is likely to start a looooong drawn out flame thread. > Language arguments almost always do. So, with trying to prevent that in > mind, I will avoid standing up for my general language of choice and > instead offer an alternative. > > > This exploit, like others against Unix machines many years ago, was based on > > a buffer overflow dumping the user into supervisor space. This, in turn, is > > a direct result of the fact that the C programming language does not check > > or enforce limits on a string length or buffer size - that's left up to the > > individual programmer. > > > > Surely, given the importance of security, it should be possible to fix the C > > language (or my preference, use a different one) to do systems programming. > > After all, C is not so much a systems programming language as a high-level > > version of assembly language. > > > > "Fixing" C in the sense you're imagining will never happen and people > often do use other languages for specific tasks. However, other > languages are not immune to buffer overflows as most of them are > actually written in C themselves. > > The better solution is things like stackguard[1] and execshield[2] which > actually fix the root problem: the stack should NOT be executable and > neither should most of the heap and likewise portions of memory which > are actively executable shouldn't be writable from userspace. > > > (Incidentally, a former profs at Ryerson, Heather Hinton, was working on > > such a mechanism to prevent stack overflows. I guess it's never been widely > > adopted.) > > Hinton...any relation to Geoffrey Hinton? At any rate, many people have > (and continue) to work on stack guards and similar solutions. See [1] > and [2]. As with all security measures, its just a question of getting > people to use them. > > -- > Marcus Brubaker <marcus.brubaker-H217xnMUJC0sA/PxXw9srA at public.gmane.org> > > [1] http://www.immunix.org/stackguard.html > [2] http://seclists.org/lists/linux-kernel/2003/May/0371.html and http://people.redhat.com/mingo/exec-shield/ > > -- > The Toronto Linux Users Group. Meetings: http://tlug.ss.org > TLUG requests: Linux topics, No HTML, wrap text below 80 columns > How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml -- Peter D. Hiscocks Department of Electrical and Computer Engineering Ryerson University, 350 Victoria Street, Toronto, Ontario, M5B 2K3, Canada Phone: (416) 979-5000 Ext 6109 Fax: (416) 979-5280 Email: phiscock-g851W1bGYuGnS0EtXVNi6w at public.gmane.org URL: http://www.ee.ryerson.ca/~phiscock -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

C considered harmful
by phiscock-g851W1bGYuGnS0EtXVNi6w＠public.gmane.org 04 Dec '03

04 Dec '03

OK, you have an excellent point, Henry, that people have chosen C for good reasons. I actually was on the receiving end of this kind of academic scorn at one point. I had developed a computer controlled sound system for use in the theatre, and this being 1982 or so, I had to use what was available, the Commodore PET. The system was written in a combination of Commodore Basic and 6502 assembly language. I was at a party of comp sci academics and one of the profs - a guy who specialized in human interfaces - expressed some interest in the system. When he heard that the system was programmed in basic he turned to his neighbour and said 'We have to stop these people from programming in basic'. and then walked away. The system was used in a number of shows in Toronto and then the concept was adopted by another company and made into a successful product. At the time, I thought of your point: people liked those Basic languages (which does have some appalling shortcomings as a language) for a number of good reasons - they were a friendly development environment, and easy to interface to assembly language. Furthermore, you couldn't get any other language for the Commodore PET. A competent engineer works with what they have available. Incidentally, a modern version of Basic is Tcl/Tk, which has many of the same properties that made Basic popular. So, it is an interesting challenge to the language writers to create something that has the power of the C language and still does (say) automatic checking of array bounds. Peter On Wed, Dec 03, 2003 at 11:30:28PM -0500, Henry Spencer wrote: > On Wed, 3 Dec 2003, Peter Hiscocks wrote: > > This exploit, like others against Unix machines many years ago, was based on > > a buffer overflow dumping the user into supervisor space. > > Actually, no, as I understand it (with the caveat that I haven't really > gone investigating), this one is *not* a buffer overflow, exactly. It's > the result of *integer* overflow in (essentially) a buffer-overflow check. > A language with automatic buffer-overflow checks could easily have the > same vulnerability, if the implementor wasn't careful. > > > This, in turn, is > > a direct result of the fact that the C programming language does not check > > or enforce limits on a string length or buffer size - that's left up to the > > individual programmer. > > As has often been said, C gives you all the rope you need to hang yourself. > > > After all, C is not so much a systems programming language as a high-level > > version of assembly language. > > Oddly enough, it has pushed most "real" systems programming languages out > of the business. And this is *not* because of sharp marketing tactics or > firm backing by a big organization or dot-com hype -- quite the contrary. > It succeeded because people with work to do find it easier to get results > in C than in "real" systems programming languages, and so it spread and > prospered despite inept or nonexistent marketing, uncertain support, and a > marked dearth of hype. > > It behooves people who aspire to design systems programming languages to > *PAY* *ATTENTION* *DAMMIT*, rather than just casting aspersions on the > intelligence and judgement of the customer. It is their own damn fault; > their languages keep failing, and C keeps succeeding despite its nasty > flaws, because they keep ignoring the needs of the real language users. > People went with C because it did what they wanted, instead of telling > them they shouldn't want that. > > > Years ago, Philipe Khan of Borland said that 'C is a disease and the > > Americans are spreading it.' Maybe he had this kind of thing in mind. > > I don't think it is impossible to keep C's virtues while eliminating its > more grievous faults. But it will not be done by people who look down > their long aristocratic noses at C, and scorn it as a peasant's language > of no interest to them. > > Henry Spencer > henry-lqW1N6Cllo0sV2N9l4h3zg at public.gmane.org > > > -- > The Toronto Linux Users Group. Meetings: http://tlug.ss.org > TLUG requests: Linux topics, No HTML, wrap text below 80 columns > How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml -- Peter D. Hiscocks Department of Electrical and Computer Engineering Ryerson University, 350 Victoria Street, Toronto, Ontario, M5B 2K3, Canada Phone: (416) 979-5000 Ext 6109 Fax: (416) 979-5280 Email: phiscock-g851W1bGYuGnS0EtXVNi6w at public.gmane.org URL: http://www.ee.ryerson.ca/~phiscock -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

video plugin for mozilla on linux
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 04 Dec '03

04 Dec '03

On Thu, 04 Dec 2003 08:28:41 -0500 Jason Shein <jason-gaRZxGPHtpBxZtjKW1aY+1aTQe2KTcn/(a)public.gmane.org> wrote: > You can get the Macromedis Flash rpm's here > > http://sluglug.ucsc.edu/macromedia/site_ucsc.html > > > And mozplugger if you do not already have it installed > > http://freshmeat.net/redir/mozplugger/37064/url_rpm/mozplugger-1.3.2-1.i586… Got 'er all workin' fine now, I wasn't paying attention (surprise) and missed Lloyd's link to libstdc++2.10, once I got that installed it was good to go. Thanks! -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "I have the South in front of me and the bankers behind me -- and for my country, I fear the bankers most."-- Abraham Lincoln -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0