81–90 of 106 posts
Earlier quoted context omitted.
He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.
Is there a good alternative to 7-zip?
Earlier quoted context omitted.
He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.
Is there a good alternative to 7-zip?
Earlier quoted context omitted.
He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.
Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.
Earlier quoted context omitted.
I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…
Yeah, anti-virus is a crap idea. Real security is proactive security (exploit mitigation, sandboxing, correct code, safe languages). Reactive security kinda sucks. You have to patch known vulnerabilities , sure, but detecting exploits? Ugh. Eww. Do not like. And indeed users mostly install malware these days, because self spreading (actual "viruses") is hard (we're not in the DOS/Win9x days anymore). So users should…
Instead, today, we see more companies invest in what's called "incident response". Part of a healthy incidence response program is signature detection - AV plays a role in this.
If you don't have good detection capabilities you're missing a huge portion of what makes an organization secure.
Relying on proactive users is also a recipe for disaster and not a realistic goal at all, nor should it be.
Earlier quoted context omitted.
Right? He should be using a pile of frameworks on top of frameworks on top of a managed code environment with all the latest performance killing mitigation strategies. That's how we do things in 2018: keep adding crap until the software is slow and bloated. It is understandable if you don't agree with this guy's approach to doing things, but it would be difficult to argue with its success. 7zip is a popular as it is…
I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.
Earlier quoted context omitted.
It would be interesting to have a comparison based on locally built binaries both with and without these features enabled. Performing the tests on packing the actual 7-Zip source code (as shipped without extras) would be a valid reference suite.
I assume you mean a performance comparison? The runtime performance cost of ASLR on Windows is zero once a binary has been loaded, since the code is relocated at load time. Stack canaries might cause a slight performance hit, but it is usually below one percent, since it creates only a small cost per function call for a fraction of all functions.
Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming…
"If you want more effective programmers, you will discover that they should not waste their time debugging, they should not introduce the bugs to start with."
Earlier quoted context omitted.
You are completely right with the first comment. The antivirus product itself reuses parts of 7-Zip and is vulnerable itself. I mentioned this mainly because I did not analyze the original 7-Zip software, but only discovered that it was affected as well after I had found the bug in this antivirus product. I admit that this is confusing, so I'll probably try to rephrase this.
Seems like a possible license violation then (7-Zip is LGPL).
Earlier quoted context omitted.
Seems like a possible license violation then (7-Zip is LGPL).
LGPLG is let's you use a library without distributing the source code of the whole program.
Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming…
On the other hand, Dijkstra also has this quote which suggests he is not too fond of "mitigation" either: "If you want more effective programmers, you will discover that they should not waste their time debugging, they should not introduce the bugs to start with."