Venom – A security vulnerability in virtual floppy drive code • Hacker News Board

Re: Venom – A security vulnerability in virtual floppy drive code

#121

Post by TheLoneWolfling » Fri, May 15, 2015, 8:12 PM UTC

yellowapple wrote: post #120

TheLoneWolfling wrote: post #118

Earlier quoted context omitted.

What for, may I ask?

My main use of QEMU is to run (in isolation, preferably) old software, whether it's some ancient game or some ancient accounting software or what have you. Said software is usually distributed as floppies (or, nowadays in a world where virtualization is hot shit) floppy images. Thus, even in virtualized environments, there's still a use case, for me at least. I can use DOSBox for a lot of this, I'm sure, but not all…

Good answer, and what ancient games, may I ask?

Re: Venom – A security vulnerability in virtual floppy drive code

#122

Post by fche » Tue, May 19, 2015, 11:45 PM UTC

sneak wrote: post #42

duaneb wrote: post #23

Earlier quoted context omitted.

And the alternative?

Tell the entire market the information you have and let them do with it as they will, versus telling your friends first and letting everyone else go to hell.

As long as those friends don't misuse the information (spreading it to blackhats), what's the difference? If it's "hell" for everyone else on day N, it would be "hell" for everyone on day 0.

Re: Venom – A security vulnerability in virtual floppy drive code

#123

Post by breakingcups » Thu, May 21, 2015, 2:33 PM UTC

thrownaway2424 wrote: post #56

alricb wrote: post #26

The missing reset of the fifo is in one of the handlers defined at http://git.qemu.org/?p=qemu.git;a=blob;f=hw/block/fdc.c;hb=2... fdctrl_stop_transfer() might be one of the incriminated functions.

I like how I had to read 100 comments on Hacker News to learn this information. Vulnerability disclosure just isn't what it used to be.

The diff is literaly linked in the article.

Re: Venom – A security vulnerability in virtual floppy drive code

#124

Post by thrownaway2424 » Fri, May 22, 2015, 8:30 PM UTC

breakingcups wrote: post #123

thrownaway2424 wrote: post #56

Earlier quoted context omitted.

I like how I had to read 100 comments on Hacker News to learn this information. Vulnerability disclosure just isn't what it used to be.

The diff is literaly linked in the article.

The original site, and my comment, are from 9 days ago. The linked diff is from 7 days ago.