The SHA256 of that file is exactly that of Firefox Setup Stub 35.0.1 (Win32), so of course Authenticode checks out. I'm not 100% sure why some people thought it was a malicious file, but the comments on Virustotal…
Their conclusion is simply that "the major part has been fixed" in MS12-024, and that you should be careful if you write a self-extracting installer. No big deal.
Interesting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.
I'm not talking about a "trusting trust" attack, which is difficult to pull off and requires special compiler knowledge because it needs to survive bootstrapping. Here the attacker just needs to patch a binary once and…
Yes, the number of reported vulnerabilities isn't a good metric to judge the security of a project. It often means that few people bothered to look, and that when developers fixed a bug they didn't try to find out…
Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.
Thank you. To be clear, I don't mean that as a criticism of the developers, who as the parent points out do very useful work and do it for free. But I feel that it's important to have an objective look at the current…
Can you give me pointers about authenticode flaws? After a quick search the two issues I found were with MD5 collisions (solution: the signer should never emit MD5 certificates) and certificate padding (solution: the…
I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a malicious ".zip" file on Windows could…
I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The…
There is some very shady SEO going on here. The French translation link goes to a Wordpress blog with a very bad translation of the introduction. The root of the translation website is a completely unrelated Dutch used…
I'll pile on the bandwagon. I just downloaded the dataset, and color is such a powerful feature that training a random forest on images downsampled to a single pixel results in 95% and 98% accuracies! (for the…
The grant is for the DAL project [1], which presumably fits the "ground-breaking, high-risk" label. In such a project, some tasks will be high-risk, some tasks will be low-risk. Quantifying the branch predictor of…
> the one other researchers (which I respect much more) discovered in 2006 You seem to be blissfully unaware that they're in fact the same researchers: André Seznec is a co-author of the paper. This paper is valuable in…
There are no absolute values in the summands, so in your example pairs of consecutive terms sum to 0 when you choose b = 2. The theorem seems entirely correct to me. You can prove it with these sub-steps: (1) the set of…
What the article doesn't state clearly is that this assumes the strong exponential time hypothesis: it assumes that SAT cannot be solved in time 1.9999^n -- in other words that it's impossible to do better than the…
I see the article climbing back up the front page, and I want to make it abundantly clear that I don't believe that there is necessarily a causal relation from breastfeeding vs formula to IQ. I could control for…
The contest was hosted on TopCoder. The name of the organization who provided the data and funded it is not public, but I'm told it will be made public at some point.…
I found a big improvement to my model just after the contest was over, so I made a proposal to develop the improved model and do some more in-depth analysis. I'm currently waiting for their reply! If they accept I'll…
I can't edit any more, so I'm posting as a reply. I compared my dataset and their data, and it turns out that even in Brazil there is significant correlation between mother education and breastfeeding, barely less so…
Just 2 weeks ago, I won a machine learning contest with a $20,000 prize pool where the goal was to predict the IQ of a child at age 7, based on various biological measurements and demographic indicators. The data…
The SHA256 of that file is exactly that of Firefox Setup Stub 35.0.1 (Win32), so of course Authenticode checks out. I'm not 100% sure why some people thought it was a malicious file, but the comments on Virustotal…
Their conclusion is simply that "the major part has been fixed" in MS12-024, and that you should be careful if you write a self-extracting installer. No big deal.
Interesting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.
I'm not talking about a "trusting trust" attack, which is difficult to pull off and requires special compiler knowledge because it needs to survive bootstrapping. Here the attacker just needs to patch a binary once and…
Yes, the number of reported vulnerabilities isn't a good metric to judge the security of a project. It often means that few people bothered to look, and that when developers fixed a bug they didn't try to find out…
Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.
Thank you. To be clear, I don't mean that as a criticism of the developers, who as the parent points out do very useful work and do it for free. But I feel that it's important to have an objective look at the current…
Can you give me pointers about authenticode flaws? After a quick search the two issues I found were with MD5 collisions (solution: the signer should never emit MD5 certificates) and certificate padding (solution: the…
I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a malicious ".zip" file on Windows could…
I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The…
There is some very shady SEO going on here. The French translation link goes to a Wordpress blog with a very bad translation of the introduction. The root of the translation website is a completely unrelated Dutch used…
I'll pile on the bandwagon. I just downloaded the dataset, and color is such a powerful feature that training a random forest on images downsampled to a single pixel results in 95% and 98% accuracies! (for the…
The grant is for the DAL project [1], which presumably fits the "ground-breaking, high-risk" label. In such a project, some tasks will be high-risk, some tasks will be low-risk. Quantifying the branch predictor of…
> the one other researchers (which I respect much more) discovered in 2006 You seem to be blissfully unaware that they're in fact the same researchers: André Seznec is a co-author of the paper. This paper is valuable in…
There are no absolute values in the summands, so in your example pairs of consecutive terms sum to 0 when you choose b = 2. The theorem seems entirely correct to me. You can prove it with these sub-steps: (1) the set of…
What the article doesn't state clearly is that this assumes the strong exponential time hypothesis: it assumes that SAT cannot be solved in time 1.9999^n -- in other words that it's impossible to do better than the…
I see the article climbing back up the front page, and I want to make it abundantly clear that I don't believe that there is necessarily a causal relation from breastfeeding vs formula to IQ. I could control for…
The contest was hosted on TopCoder. The name of the organization who provided the data and funded it is not public, but I'm told it will be made public at some point.…
I found a big improvement to my model just after the contest was over, so I made a proposal to develop the improved model and do some more in-depth analysis. I'm currently waiting for their reply! If they accept I'll…
I can't edit any more, so I'm posting as a reply. I compared my dataset and their data, and it turns out that even in Brazil there is significant correlation between mother education and breastfeeding, barely less so…
Just 2 weeks ago, I won a machine learning contest with a $20,000 prize pool where the goal was to predict the IQ of a child at age 7, based on various biological measurements and demographic indicators. The data…