- Talk - lists.gtalug.org

CITL - Vulnerability Testing of Binaries
by Russell 28 Mar '17

28 Mar '17

Another Defcon presentation. Sarah Zatko has the best line in the whole thing, "fuzzing is expensive, math is cheap." Cyber Independent Testing Lab This is a slideshow presentation of their own heuristic reporting model, sort of a Consumer Reports mechanism for end users of security. https://youtu.be/GhO9vyW1f7w -- Sent from my Android device by K-9 Mail

1 0

Re: [GTALUG] BOOST moved into a IDE using APT-Get
by dank＠enggrp.com 26 Mar '17

26 Mar '17

Hello all, Kevin Cozens and/or Stewart C. Russell wrote: > I didn't know anything about Boost until I had to deal with it as a set of dependencies on something I wanted to compile. > Some of the imaging libraries I use as part of my document filing system use Boost. Thankfully, all of them can be coerced to use library versions installed by: > sudo apt install libboost-all-dev > I wouldn't want to venture further than that. Dan says: The official BOOST site has a bit of disparaging dialog on repackaging efforts of various sorts. I think if your target system is x86, then apt-get is probably a fine choice. But if you have to either x-compile, or worry about updates, or want to enable non specific improvements in the indefinite future of any calling app, the the hard way is the easy way ! I'm just leaning into asio now, the sockets and file system interface package. I have a commercial app running with it all made form Berkeley sockets, and this is ok. But I think the customer base is hankering for more security ( not just http ) etc and all the stuff I don't understand is probably in there someplace. So as a contingency, Im constructing the alternative while the first few hundred users squeek like Guinea pigs some now. regs Dan my ref: boost, gtalug

2 2

Can the speakers from last night post their names?
by David Collier-Brown 21 Mar '17

21 Mar '17

I wanted to update the page (and have added my talk), but I also wanted to know who spoke about being a maintainer: I was his opposite number at Sun, looking after libraries, APIs and educating folks about resource management. The latter was /hard/ to explain (;-)) --dave -- David Collier-Brown, | Always do right. This will gratify System Programmer and Author | some people and astonish the rest davecb(a)spamcop.net | -- Mark Twain

8 8

Re: [GTALUG] BOOST, the big package with the bad install instructions
by dank＠enggrp.com 21 Mar '17

21 Mar '17

Hello to all, I'm a Toronto linux dev guy and have been lurking on this email reflector a while, this is the first thing I thought I have thats possibly meaningful to contribute. If you never heard of the "Boost library" that's odd as its pretty self promotional, and is also very high in quality. About it: http://www.boost.org/users/index.html A lot of whats in it is test bed-ish to go into next official c++ versions. I have a commercial SBC for telecom that uses it. When moving up a version, its occurred to me after days of grueling effort, the install instructions are pretty wacky, that is, the process itself is fine, but the instructions are 2 years old and the particular mistakes ( mostly of omission ) make it hard to get results. Im making a LaTeX PDF of the misadventure and more importantly, its fixes. So if you are a BOOST success story, stuck or whatever, ask and I will post it someplace, etc. Maybe, maybe an actual f2f talk on it, if theres a lot of folks trying to figure out how to wedge it into ( your ? ) projects. Look at all the fancy stuff in there ! Look at this list of really high quality source code: http://www.boost.org/doc/libs/ You can save months of labor and get pretested stuff, but you know, you have to 'get' how to make it hop to your wishes, and its a little bit messy in reality.... Regards, Dan Kolis my ref: boost, gtalug

5 4

Feedback on GTALUG Meeting Format
by Myles Braithwaite 👾 18 Mar '17

18 Mar '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I'm are looking for feedback on how the format of the GTALUG meetings are going. We have tried some new formats in the past two years and I'm wondering if they are going over while with people who are attending (regular or otherwise). What meeting format have you enjoyed, where can we make improvements, what have we gotten wrong? You can reply here on the mailing list or directly to me @ <myles(a)gtalug.org>. - -- Have an awesome day, and happy open-sourcing :-). -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJYyXz0AAoJEKSaZN9bQjWQ2CEP/i7ZLp4HF2BsYgDc4yLQnLev tcKIeJMQtYE7bJXtoWp/skUALALWI2yGFsDkh8c0rbLdSR1kEjChq2YwKviVaVVR 5g0htLnpEndLOSOs19REnWN+vMN8y100zCe558g4YobRsDIQTiCb9M66sKfiUE9Q PNJXHm1H2JRcvQV1R71FRjk8ksto9C4nrWU+CzDiLAQfLnbGYqTGuN7co0JGfrUm lscWfHEwccv9aDWIvjzcHiHPtF7uXoLILNCSb00LYurnxfEsJG5h/U592J3akIeR DVLnSUYUNn6U7XJ1VNDz9ZTsHSb7kApVLfU7AY43ZKWZZvpRpC2ueZCl7IOMc83m ZrDNCkNAfd4O+ptlZZWEPiTISjQFE0wP1DEY1hEJO076SIfUcMN/ikKeOLBCwrMx 7Lfq20IF2I1DmVSmTIzolIdp+qh2IM5wFgIaCxXDnPHBYXT7tiGLFfmskGn25gN8 kfzT7fZCYWcPaniDiNvMKGoD/ojsFb5hNFt9F3Qj/u4DsNvTM4Q/3cUOf2k7i63g c01vf8aXyb+sg/ixCGMAfWedqcBti720J9NsA1vqjaZ4zWXyie1Fu8IMw0NwUEsE eyMZzEh+NjkEXlUKRjywZAZX9xyVX1X55MtJGfz0K9yn3RVJRsZW23DfAGJ2BMO5 wl/kgCbh7hDTOumQOcRf =28St -----END PGP SIGNATURE-----

4 3

Fwd: Re: DMA kernel attacks
by Russell Reiter 18 Mar '17

18 Mar '17

I sent this forwarded msg to you only Lennart, its not in the archive. I was trying to be nice to you, yet you are as always, since you first joined this list, so very nasty to me. Read what you previously posted about how its the videos fault for starting near the end that you didnt understand what it was about. Thats a pretty lame thing to say. Its even lamer than pretending you get something you dont really get. Three posts in a row, your comments on this thread. Two of them responded to where I had sent private messages like the one below and you sent your reasoning to the list. Thats a particular kind of nasty that you exhibit towards me for whatever disfunctional reason that motivates you. I dont have to prove anything from the archives in order to show anyone else on the list just how disfunctional you are. You do it every time you say something stupid with the intent to show how smart you are. ---------- Forwarded message ---------- From: "Russell Reiter" <rreiter91(a)gmail.com> Date: Mar 13, 2017 10:50 AM Subject: Re: [GTALUG] DMA kernel attacks To: "Lennart Sorensen" <lsorense(a)csclub.uwaterloo.ca> Cc: On Mar 13, 2017 10:27 AM, "Lennart Sorensen" <lsorense(a)csclub.uwaterloo.ca> wrote: On Sat, Mar 11, 2017 at 01:02:45PM -0500, Russell Reiter via talk wrote: > Another DEFCON talk. This is a hardware attack on M$, OSX & Linux, PCIleech > = 150mbs over usb3. > > https://www.youtube.com/watch?v=fXthwl6ShOg&list=PL9fPq3eQfa aAvXV3hJc4yHuNxoviVckoE&index=15#t=2508.995164 Well first you have to install your PCIe card in the target machine, which means you would have to shut it down first, which could make booting it again difficult. Ummm ... PCIe is hot plugable with the right software. I thought initially they found a flaw in USB3, but no that is not the case. So it doesn't do anything we didn't already have a problem with in firewire years ago. So yes if you get to put your own PCIe hardware in a machine, you can DMA memory. And it's a bit faster than a firewire card was. The firewire and thunderbolt issues in the past seem much more of a concern than this because they were hardware already present in the target machine. This is pretty much just irrelevant. Maybe to you. I dont consider increase of transfer rate from 3mbs to 150mbs irrelevant by any means. Just because I highlight one bit of information which I gleaned from a source and wanted to share, as a matter of general interest; this doesent mean I didn't want you to learn from the post. I did it because I do want you to learn from it. Like you just now learned PCIe can be accessed without rebooting. -- Len Sorensen

2 3

Re: [GTALUG] DMA kernel attacks
by Russell Reiter 17 Mar '17

17 Mar '17

<rreiter91(a)gmail.com> Date: Mar 16, 2017 12:49 PM Subject: Re: [GTALUG] DMA kernel attacks To: "Lennart Sorensen" <lsorense(a)csclub.uwaterloo.ca On Mar 13, 2017 10:50 AM, "Russell Reiter" <rreiter91(a)gmail.com> wrote: On Mar 13, 2017 10:27 AM, "Lennart Sorensen" <lsorense(a)csclub.uwaterloo.ca> wrote: On Sat, Mar 11, 2017 at 01:02:45PM -0500, Russell Reiter via talk wrote: > Another DEFCON talk. This is a hardware attack on M$, OSX & Linux, PCIleech > = 150mbs over usb3. Sorry, I wasn't clear here. The PCI card goes in the attacking machine. The steal is over USB. Two tries for the linux box. > > https://www.youtube.com/watch?v=fXthwl6ShOg&list=PL9fPq3eQfa aAvXV3hJc4yHuNxoviVckoE&index=15#t=2508.995164 Well first you have to install your PCIe card in the target machine, which means you would have to shut it down first, which could make booting it again difficult. Ummm ... PCIe is hot plugable with the right software. I thought initially they found a flaw in USB3, but no that is not the case. So it doesn't do anything we didn't already have a problem with in firewire years ago. So yes if you get to put your own PCIe hardware in a machine, you can DMA memory. And it's a bit faster than a firewire card was. The firewire and thunderbolt issues in the past seem much more of a concern than this because they were hardware already present in the target machine. This is pretty much just irrelevant. Maybe to you. I dont consider increase of transfer rate from 3mbs to 150mbs irrelevant by any means. Just because I highlight one bit of information which I gleaned from a source and wanted to share, as a matter of general interest; this doesent mean I didn't want you to learn from the post. I did it because I do want you to learn from it. Like you just now learned PCIe can be accessed without rebooting. Among other things. -- Len Sorensen

3 7

Dell Venue 11 pro at Factory direct
by D. Hugh Redelmeier 15 Mar '17

15 Mar '17

I was asked if this is still available. <http://www.factorydirect.ca/Canada-Downtown%20Toronto/Ipads__Tablets___Erea…> Stock seems very low: two stores might have them. If you go to a FD store, they might be able to phone Barrie or London to see if any are in stock. Thy might be willing to get it shipped to your store (free). I've done that in the past. These were used by a Texas school board for a couple of years. Mine was still within the Dell warranty and I was able to get a repair. They are called "refurb" but this would not be by Dell. They are definitely used.

1 0

Looking for an extrovert (or a noisy introvert) to M.C. tonight's meeting
by Myles Braithwaite 👾 14 Mar '17

14 Mar '17

We are looking for a someone who would M.C. tonight’s meeting. Basically you say who is speaking next and what they are going to be talking about. You can find a current list of people presenting here: <https://wiki.gtalug.org/meeting:2017-03#lightning_talks>. It’s a fun job.

4 3

Watching a network folder: is there a smart way of doing this?
by Stewart C. Russell 14 Mar '17

14 Mar '17

I need to watch a folder on a network share (a scanner) and see when new files are created. There are a couple of special things about this location: * It's over CIFS. There's nothing I can do about that. I think that means I can't use Inotify. * It doesn't have an accurate clock for timestamping. There's nothing I can do about that, either. * If the share is being written to by the device, it effectively disappears: stat() complains loudly. * It reuses the lowest available file name of the form “EPSON%03d.(PDF|JPG)”, so synching the share to a sensible filesystem might overwrite files accidentally. * I don't need to watch it very often; a few times per hour would be fine. I tried using Perl's File::ChangeNotify::Watcher, which is supposed to pick the smartest method available. Unfortunately, this seems to be calling stat() every two seconds, resulting in: 1. Messages (one per existing file on the share) saying that the scanner has deleted them. This happens when someone starts scanning 2. An error message from stat() every two seconds while the device is scanning 3. Messages saying that all of the old files (plus the new one) have been created. I was naïvely hoping for a mechanism that would report “Hey, you have a new file called $filename” but that seems to have been a pipedream. What do People Who Actually Know What They're Doing use, please? cheers, Stewart

11 17