182 karma · joined February 2, 2018
https://dilbertblog.typepad.com/the_dilbert_blog/2007/07/car...
About our new discovery, Daniel J. Bernstein issues the following statement:
"https://cr.yp.to/qmail/guarantee.html has for many years mentioned
qmail's assumption that allocated array lengths fit comfortably into
32 bits. I run each qmail service under softlimit -m12345678, and I
recommend the same for other installations."
And from his "guarantee"In May 2005, Georgi Guninski claimed that some potential 64-bit portability problems allowed a ``remote exploit in qmail-smtpd.'' This claim is denied. Nobody gives gigabytes of memory to each qmail-smtpd process, so there is no problem with qmail's assumption that allocated array lengths fit comfortably into 32 bits.
Under mitigations they list:
As recommended by Daniel J. Bernstein, qmail can be protected against all three 2005 CVEs by placing a low, configurable memory limit (a "softlimit") in the startup scripts of all qmail services.
Alternatively:
qmail can be protected against the RCE (Remote Code Execution) by configuring the file "control/databytes", which contains the maximum size of a mail message (this file does not exist by default, and qmail is therefore remotely exploitable in its default configuration).
Unfortunately, this does not protect qmail against the LPE (Local Privilege Escalation), because the file "control/databytes" is used exclusively by qmail-smtpd.
Alternatively:
- an updated version of qmail-verify will be available at https://free.acrconsulting.co.uk/email/qmail-verify.html after the Coordinated Release Date;
- the developers of notqmail (https://notqmail.org/) have written their own patches for the three 2005 CVEs and have started to systematically fix all integer overflows and signedness errors in qmail.
There are issues with both industrial and academic research, but I do think that industrial research is more transparent in its motivations.
Also, I assume the complaints were for outside of any clean room environment since inside a cleanroom you are obviously wearing facial covering at all times. I do wonder about virus circulation inside a cleanroom though since there is a high volume of laminar flow and the filters are designed for particulates much larger than virus-sized.
The question is whether it is productive to maintain large investment funds unrelated to their stated goals of education and research.
I think the OP would be happier if those endowments were drawn down on research with uncertain benefits rather than just invested in natural resource extraction companies.
That is an awful default error for validating the type. The program knows it failed to parse as an Int but doesn't tell you anything about that.
Error: The value 'ZZZ' is invalid for '<high-value>' of type Int
Also, the help should automatically tell you the expected types as well.
ARGUMENTS: <high-value>: Int The highest value to pick.
Now, if someone could come up with a privacy-preserving solution to advertisers quality assurance problem of buying advertisements on the internet, that would be big business.
Its a not very well kept secret of internet advertising that it's so much more "measurable" than other types of advertising, but it's not actually measuring anything useful most of the time. There is the traditional quote that "I am wasting half my advertising budget, but I can't tell which half" With internet remarketing ads the answer might very well be both ;)
Also, that revenue growth is half of what it was 6 months ago, which is the dramatic slowing referenced.