141–150 of 152 posts
Earlier quoted context omitted.
All DLLs or just specific ones? I'd heard a while ago they were going to blacklist specific ones instead of just making it so a user has to purposely decide to download a file. I'm surprised they finally did something since we've been warning people not to use Chrome because of this issue for years.
>blacklist specific ones Enumerating badness has always been a very bad idea.
Secure software design and development is what I do for a living, so perhaps I am a bit more paranoid than the casual user - but this is one of the most widely deployed security tools in an enterprise, this shouldn't be "okay". Some defensive efforts are just common sense and are recommended by your compiler (eg. don't use sprintf and strcpy when you can snprintf and strncpy). Also, it doesn't hurt to check error conditions consistently.
PS. To echo what a lot of folks have already said, how on earth can the author implement cryptographic algorithms and simultaneously think there is any value in publishing a hash of the binary "for security". Using a hash as a means of integrity validation in the context of security raises huge red flags about the authors mindset.
Earlier quoted context omitted.
I find the corporate environment thing suspicious. I could imagine that if you don't have admin access, you can't install to Program Files, but couldn't you still install to your home directory, and still get those lovely start menu shortcuts?
Not really. Windows, by default requests elevated rights from the user (the UAC dialog) if you run any exe that has 'setup' or 'install' in the name, or if the manifest inside/alongside the exe defines a requirement for elevated rights. You can spot these files as they have a little Windows 'shield' overlay on their icons (Windows overlays that itself if it detects a file needing elevated rights). So, unless you can…
Earlier quoted context omitted.
Not really. Windows, by default requests elevated rights from the user (the UAC dialog) if you run any exe that has 'setup' or 'install' in the name, or if the manifest inside/alongside the exe defines a requirement for elevated rights. You can spot these files as they have a little Windows 'shield' overlay on their icons (Windows overlays that itself if it detects a file needing elevated rights). So, unless you can…
Huh. I think that's a poor design choice on the part of the Windows folks, but they probably know things I don't.
Earlier quoted context omitted.
I don't use PuTTY either for the same reasons as you, but I do continue to use Pageant. I use a mix of Windows and Linux tools and I only really want to enter my SSH cert credentials at start-up. So I still end up installing it. I also use Bitvise for tunneling on the Windows side as well.
You can use Pageant with oter tools than Putty's own tools?
With git and tools that use Git, PuTTY distributes plink.exe, which acts as a helper. So you set something like...
GIT_SSH=c:\Program Files\Putty\plink.exe
Earlier quoted context omitted.
Huh. I think that's a poor design choice on the part of the Windows folks, but they probably know things I don't.
You know in order to secure an old house, you just nail boards over all the openings? Well, yeah, that's the Windows security model that is. :)
Earlier quoted context omitted.
Similarly, I use Git Bash, haven't used Putty in at least 3 years.
I always preferred putty's terminal window, not sure why, even though git bash's can be customized as well.. can you save sessions in git bash?
Now if only I could click a link and have it open in a browser.