http://www.purebasic.com
https://www.purebasic.fr/english/
This is no more dangerous than if CIA replace your whole notepad.exe. Ie. if they can do that, then you're already totally pwned :)purenet wrote:Hello,
This is not good.
https://wikileaks.org/ciav7p1/cms/page_26968090.html
https://notepad-plus-plus.org/news/note ... issue.html
How about ScintillaGadget in PB, same scilexer.dll problem?
its hardware like routers and modems i don't trust! at least with software i can look at it in a debugger, but with this black box with green LED lights in front of me I really hope keeping my fingers crossed is helpingLunasole wrote:No need to worry about such things, until your PC is not configured using philosophy like "Internet-Of-Stupid-Things-device". Nice firewall which sits in OS kernel makes such a children-level efforts futile, just don't forget to check if firewall itself is not exploited by something really evil :3
Yes, it is too doubtful to use those modern routers coming with questionable leaky linux builds and having really excessive hardware abilities, overloaded with plenty unnecessary & complicated functions in the name of pseudo-progress.Keya wrote:its hardware like routers and modems i don't trust! at least with software i can look at it in a debugger, but with this black box with green LED lights in front of me I really hope keeping my fingers crossed is helping
Security through obscurity is not secure. Security through minimalism is also not secure, because thats simply obscurity by reducing the system components in my eyes. However, the probability that there is a security hole in a minimalistic system is far less than in a large, bloated system. That said, I would prefer using a modem in front of the router, but nowadays this is impossible with VDSL and so on.Lunasole wrote:"Security through minority", or obscurity or whatever ^_^
For smaller environments there are fine products (e.g. the european made Mikrotik devices or components from the originally japanese Allied Telesys) available which seems to do their job and nothing else...Keya wrote:its hardware like routers and modems i don't trust! at least with software i can look at it in a debugger, but with this black box with green LED lights in front of me I really hope keeping my fingers crossed is helping
Surely It is not secure (in meaning "for 100%"), but MUCH more secure than without it.DarkDragon wrote:Security through obscurity is not secure.
Most firmwares don't even implement classic POSIX policies let alone use chmod, SELinux, AppArmor or thrid-party "containers". Most of the big IoT and gateway stuff in the news isn't even buffer overflows or directory transverse it's simple configured authentication policy stuff. The team who did that firmware for the foundry who made your PCB doesn't care and in most cases don't even know about buffer overflows or basic policy. You'll buy it anyways.Lunasole wrote:Surely It is not secure (in meaning "for 100%"), but MUCH more secure than without it.DarkDragon wrote:Security through obscurity is not secure.
Any closed-sources soft requires much more efforts and skills to find vulnerability in it, unlike one with all sources published and you just sitting reading them and founding lot of places to attack. Unless you have huge army of ppl to analyze and fix opensource code, any closed thing is more secure.
Moving it to routers -- if take some 7 or 10-years old firmware coded in C on small ROM, and it didn't has known vulnerabilities, then it is almost zero probability that someone including those CIA can ever hack it in 2017, especially without even knowing HW/SW info (which looks impossible to collect remotely, at least I didn't know any tool able to do it with my 2 routers). Both obscurity and system complexity making a difference.
As well as "minority' -- the less it is mainstream or popular, the more secure it will be, there are enough small soft and hardware vendors having awesome quality.
The CIA and NSA have many people working for them day by day on finding security holes. Bricking a device is no problem for them, they just buy a new one. If they want to find a hole in a closed source system they will find it. By using an open source software you can ensure, that people around the world will check the system for security holes and eventually report them. CIA/NSA will never report them. See also: https://arstechnica.com/security/2016/0 ... for-years/Lunasole wrote:Surely It is not secure (in meaning "for 100%"), but MUCH more secure than without it.DarkDragon wrote:Security through obscurity is not secure.
Any closed-sources soft requires much more efforts and skills to find vulnerability in it, unlike one with all sources published and you just sitting reading them and founding lot of places to attack. Unless you have huge army of ppl to analyze and fix opensource code, any closed thing is more secure.
Moving it to routers -- if take some 7 or 10-years old firmware coded in C on small ROM, and it didn't has known vulnerabilities, then it is almost zero probability that someone including those CIA can ever hack it in 2017, especially without even knowing HW/SW info (which looks impossible to collect remotely, at least I didn't know any tool able to do it with my 2 routers). Both obscurity and system complexity making a difference.
As well as "minority' -- the less it is mainstream or popular, the more secure it will be, there are enough small soft and hardware vendors having awesome quality.
Stop overestimating them. 2 days ago I've spend 4+ hours learning that lot of data leaked from CIA, I can say the methods and tools they're using are generally primitive and targeted on stupid averaged user.DarkDragon wrote:The CIA and NSA have many people working for them day by day on finding security holes. Bricking a device is no problem for them, they just buy a new one. If they want to find a hole in a closed source system they will find it. By using an open source software you can ensure, that people around the world will check the system for security holes and eventually report them. CIA/NSA will never report them.
Code: Select all
BOOL IsThereADebugger()
{
__try
{
RaiseException(DBG_PRINTEXCEPTION_C, 0, 0, 0);
}
__except(GetExceptionCode() == DBG_PRINTEXCEPTION_C)
{
return FALSE;
}
return TRUE;
}
they "discovered" what i thought was one of the oldest tricks in the book by analyzing a commercial program? there is no date associated with that file though.CIA wrote:In the course of analyzing a commercial program for a requirement, Umbrage discovered that this commercial program utilized this technique in their licensing checks to prevent a debugger from starting the program, or attaching to a running instance of the program.
I don't know, so have not to kill :) Don't remember something like that leaked (just this one, but it says nothing https://en.wikipedia.org/wiki/Office_of ... ata_breach ).Keya wrote: But it makes me wonder about their income, as I would assume talented seasoned programmers can easily make a lot more than CIA can afford (what would be their max coder salary? $200k/yr?), so how long do their coders stick around for, and whats their average age/experience? Please don't tell me if you have to kill me