Viewing profile — paulfr

The SHA256 of that file is exactly that of Firefox Setup Stub 35.0.1 (Win32), so of course Authenticode checks out. I'm not 100% sure why some people thought it was a malicious fil…

Their conclusion is simply that "the major part has been fixed" in MS12-024, and that you should be careful if you write a self-extracting installer. No big deal.

Interesting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.

I'm not talking about a "trusting trust" attack, which is difficult to pull off and requires special compiler knowledge because it needs to survive bootstrapping. Here the attacker…

Yes, the number of reported vulnerabilities isn't a good metric to judge the security of a project. It often means that few people bothered to look, and that when developers fixed …

Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.

Thank you. To be clear, I don't mean that as a criticism of the developers, who as the parent points out do very useful work and do it for free. But I feel that it's important to h…

Can you give me pointers about authenticode flaws? After a quick search the two issues I found were with MD5 collisions (solution: the signer should never emit MD5 certificates) an…

I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a m…

I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage d…

There is some very shady SEO going on here. The French translation link goes to a Wordpress blog with a very bad translation of the introduction. The root of the translation websit…

I'll pile on the bandwagon. I just downloaded the dataset, and color is such a powerful feature that training a random forest on images downsampled to a single pixel results in 95%…

The grant is for the DAL project [1], which presumably fits the "ground-breaking, high-risk" label. In such a project, some tasks will be high-risk, some tasks will be low-risk. Qu…

> the one other researchers (which I respect much more) discovered in 2006 You seem to be blissfully unaware that they're in fact the same researchers: André Seznec is a co-author …

There are no absolute values in the summands, so in your example pairs of consecutive terms sum to 0 when you choose b = 2. The theorem seems entirely correct to me. You can prove …

What the article doesn't state clearly is that this assumes the strong exponential time hypothesis: it assumes that SAT cannot be solved in time 1.9999^n -- in other words that it'…

I see the article climbing back up the front page, and I want to make it abundantly clear that I don't believe that there is necessarily a causal relation from breastfeeding vs for…

The contest was hosted on TopCoder. The name of the organization who provided the data and funded it is not public, but I'm told it will be made public at some point. http://commun…

I found a big improvement to my model just after the contest was over, so I made a proposal to develop the improved model and do some more in-depth analysis. I'm currently waiting …

I can't edit any more, so I'm posting as a reply. I compared my dataset and their data, and it turns out that even in Brazil there is significant correlation between mother educati…

Just 2 weeks ago, I won a machine learning contest with a $20,000 prize pool where the goal was to predict the IQ of a child at age 7, based on various biological measurements and …