nion's blog

I know there is some setting in adobe acrobat reader to switch of monitoring of the X paste buffer (which I couldn't find now) and it seems one really wants that. I was very surprised today when I tried to paste a password using pwsafe and observed the following:
$ pwsafe -p fandango
Enter passphrase for /home/nion/.pwsafe.dat:
You are ready to paste the password for hosts.fandango from PRIMARY and CLIPBOARD
Press any key when done
Sending password for hosts.fandango to acroread@hostname via CLIPBOARD

So apparently acrobat reader is stealing my password from the X paste buffer if the application is running. Especially given all the javascript, malicious pdf file kungfu that is around these days I of course don't find this very amusing.

Lesson learned: Use xpdf whenever I can even though it really lacks features :/

Today I had a nice WTF moment. I was looking into when gcc is going to print (null) rather than segfaulting on trying to dereference a NULL pointer. I knew newer gcc versions are doing that in some situations. But it turns out this is more complex than I initially thought.

So here we have 5 little test programs:

Now I expected some kind of consistent behaviour at least apart from the last snippet as from the C programming point of view the source does exactly the same. But it seems this is not the case.

The first snippet is straightforward, even in the generated assembler the code dereferences a NULL pointer in puts and therefore results in a segfault. But wasn't it printf from the GNU libc that replaces such cases with (null)? Yes it was but it turns out only in some cases. Now here is the fun part. If we look at the generated code for the first example we see:



Huh? puts? Now that is interesting. It seems like gcc sees the format string "%s\n" and after that a pointer (void *) so it assumes the usage of puts does make sense so it optimizes the call.
Now for the second code snippet this is not the case:


In this case gcc sees the format string and an integer so it can't just use this with puts in a way that makes sense. printf is used and the result is (null).

Until this point the behaviour is somehow predictable at least if you know that.
But it becomes even more strange. The third and the fourth example both result in the usage of printf and therefore the displayed result is (null). In my opinion it seems that gcc is testing exactly for "%s\n" (as puts prints a newline at the end anyway). So these two examples don't segfault as well. If there's a newline gcc is - or at least that's my impression - already concatenating the format string with the pointer value.

In the last case the newline is present again. However there is a leading string in front of the format string %s. Here gcc is not seeing this as a whole thing concatenating it and calling puts. It's using printf again and results bla: (null).

I have no idea what the reason behind this behaviour is, I guess there are good arguments for that by the gcc people. But honestly, it SUCKS and is highly inconsistent, *grrr*. The whole behaviour isn't even consistent between different gcc versions.

The above results are tested with gcc (Debian 4.3.4-2) 4.3.4. I also tested with gcc (GCC) 3.4.3, in this case all of the above examples result in a segmentation fault (not sure when this (null) replacement feature in the glibc was introduced though). You can also disable this "optimization" by using -fno-builtin-printf btw.

I just tried the new 10 beta version of opera and I have to say it feels shitty (or at least not better than older releases).
One of the new features that was announced by the opera people is a configurable speeddial. There are 3 new things I noticed. The first thing is a configuration dialog which allows you to change the number of speed dials:


While some people might find this nice it somehow sucks as the values are predefined and there is a much more flexible way of configuring that (~/.opera/speeddial.ini):

With 10 beta you can also hide the speeddial. This is really neat as this wasn't possible before from what I know and some people seem to don't like it.
The dialog also allows you to set a background image to your speeddial. WTF, this is a browser, not my desktop

Another new feature I noticed is the possibility to expand the tab listing and pull it down so they show up with included screenshots.

There is no shortcut to open/close this but you have to do this with the mouse + I think this is really annoying while browsing, it's just too big and doesn't add much information while it's open if you don't intend to change the tab.

The most positive impression is that this version finally scores 100% in the acid 3 test!

One new feature left that really bugs me: Opera Turbo (F12). With this enabled opera behaves like opera-mini meaning you are sending every HTTP request to an opera server, get it back compressed and you render the compressed version. This should be useful for people with low bandwidths. I have no idea if this is more effective than just switching of images or other parts of the content but this is really a security/privacy no-go. For mobile devices it might makes sense as the bandwidth is almost always limited (though there is a lot of change in progress) but for desktop end user browser!? At least there should be a big fat privacy notice pinned to this option and naming it Opera Proxy instead of Turbo would also be very nice!

UPDATE: another thing came to my mind, what about censorship in countries? Does the opera compression server enforce laws from countries? If not Turbo is at least a nice and end-user friendly way to avoid censorship in the www.

There are a lot of discussions out there whether functions like strcpy are dangerous and shouldn't be used in C programs.
But Heise security made my day:

The problem is caused by the use of the unsafe C function printf in crypto_recv in ntpd/ntp_crypto.c.

Beware of the evil printf!

Im rather disappointed by the overall quality of the heise security news anyway but of course they seem to have misread the original advisory and the bug report. They mean sprintf

EDIT: they fixed it

Then check out the new linux.com website.

This community is awesome! You can get Guru points for contributing to it and if you are the Uberguru even more:

The top Linux.com user will be recognized each year as the “ The top five contributors to Linux.com annually will receive invitations to the Linux Foundation Collaboration Summit and have a seat at the annual Linux.com planning meeting as community representatives. Ultimate Linux Guru” and be given a fully loaded “dream” Linux notebook, personally autographed by Linux creator Linus Torvalds, as recognition of his or her guru status.

Huh! A notebook with an autograph of Linus. I'm looking forward to the people blacking out in face of their Opensource-Super-Rockstar!
This hype is just too much (as well as the hype about RMS, there are a LOT more people contributing to the kernel and making Linux what it is today.

Sorry but this is the most ridiculous thing I've read recently (note that travel fees aren't even included in the invitations to the LFCS : )
I don't see the point of this. Sure giving people some kind of motivation for contributions is not wrong but please... not this way. Translating the website into other languages would've been a
way more useful job. I'm also pretty sure that this hurts the "community" more than it helps. People will put even more useless tutorials and howtos on the net - increasing the noise in the availability of information - in order to increase their guru status and gain "respect".

Looks like the Linux version of the good old MCSE.

Dear Opera developers...
even I find it hard to believe that your fraud protection is of a real use for anyond (besides the technical implementation: doing an http request for each unvisited site to http://sitecheck2.opera.com/?host=HOST really sucks) it might help some people.

BUT why on earth are you doing this for private ip ranges??? FAIL!

UPDATE: the documentation states that this is not done, however I only recognized this because I saw that it is exactly doing that in a packet dump and I can reproduce this:
192.168.1.212 - - [14/Sep/2008:21:22:09 +0200] "GET http://sitecheck2.opera.com/?host=192.168.1.4&hdn=1jefsNeoBNollcGHqAYxxA== HTTP/1.1" - - "-" "Opera/9.50 (X11; Linux i686; U; en)"

So either urlsnarf is buggy here (which I don't believe as the request should never go through a socket) or opera has a bug.

While some people think that Googles new open source webbrowser Chrome is a great example of code reuse I think the opposite is true. He found at least 25 open source libraries used by the browser. So far this is not a problem but what is a problem is that it embeds all of them in the upstream source tarball instead of depending on the system-wide copies. I know that it might be problematic if people have to install 25 libraries on their own (they could provide static builds though) but for distributors this is just a nightmare if security issues pop-up in one of the used libraries (famous libraries who had issues in the past: webkit, libpng, libjpeg, libxml, ...).

In this case the distributors can't just fix the security issue in the shared library and all applications using it are fixed, no they also have to fix all the copies in software like Chrome. Same if you installed Chrome from source, if a security issue pops out in one of the embedded libs you have to go and install a new Chrome version. Google also needs to additionally maintain upstream and security fixes in their embedded code copies but I guess they have enough manpower to do so.

I didn't yet look at the Chrome source code but I hope it has at least a way to link against the system-wide copies without patching the makefiles.

Security companies like coresecurity often notice vendors about found flaws before they are going to publish the vulnerability details to public resources.
Corelabs found a denial of service vulnerability in a product called SuiteLink. I never saw such a big vendor FAIL like in this case:

2008-02-29: Vendor acknowledges reception of the report and states that it understands the seriousness
of the problem and that its development team will look into it.
2008-02-29: Vendor asks for a copy of the proof of concept code used to demonstrate the vulnerability.
2008-03-03: Core sends proof-of-concept code written in Python.
2008-03-05: Vendor asks for compiler tools required to use the PoC code.
2008-03-05: ore sends a link to http://www.python.org where a Python interpreter can be downloaded.
2008-03-10: Vendor requests more information about the network and the firewall settings used during the tests and inquires about conformance
(or lack thereof) of the tested network with the vendor's security policies and recommendations.
2008-03-10: Vendor asks for details about how the advisory will be published.
2008-03-12: Core responds that the workstation running the vulnerable service had no firewall activated in the tests, but since the Wonderware
SuiteLink Service allows incoming connections it is assumed that the corresponding port should be allowed to receive inbound session
establishment packets.
...
2008-04-29: Vendor provides an official statement and indicates that versions of SuiteLink prior to 2.0 patch 01 are vulnerable. Multiple
products use SuiteLink.
...read on

Fixing this bug took the vendor 3 months!
(sorry for the bad formatting ;- P

Not sure what this is about but dilbert is based on flash now while .gif images worked fine since 1995. FAIL!



UPDATE: looks like all the rants worked, the strips can be seen without flash again!

At least that's what I thought when people started complaining to me about:

<foo@bar.de>: host mailin.rzone.de[81.169.145.102] said:
554 5.7.1 Blocked by policy: blacklisted URL in mail (in reply to end of DATA command)

and I got several "<mailinglist> has received bounces from you" messages. So that means they scan my incoming mail for blacklisted data.

So far so good, I thought this would come to an end if I contact strato cause they are handling most of my email aliases.
I contacted them so they stop this because I never clicked any button to allow them to scan incoming mail bodies for URLs on their blacklist. To be more specific I explicitly checked a box in a web interface to never reject spam messages but mark the subject of them. So from my point of view this is violating § 206. Anyway, I am not a lawyer, I just want to get my mails.

The first reply (sorry German) is already bullshit. They are telling me that they know about this and this is because they were accidently added to one of the realtime spam blacklists like for example spamcop.
They also reference the wikipedia article about DNSBLs for whatever reason. I mean it's not new that companies hire more or less competent people to reply to support mails and phone calls but this is just ridiculous.

I was patient then and again explained the problem to them (note this happens through the same web interface again, you can't reply to their mails).
But the second reply (German again) is even better.
They are telling me that the IP address I told them is not listed. WTF, what do they want to tell me by this apart from that their support line is handled by eliza bots?! They then tell me to tell them for what Email alias sending mails does not work and to which specific address. WTF?!

I know I could point the MX record to host under my control handling my mail. For historical reasons this is not the case and since everything worked fine until now and I "pay" for the service I don't really want that.

Any experience with this or any idea what I could do? Sure I also blog about this for the search engines

UPDATE: Today I called strato since I didn't get any confirmation mails for further support requests. "That's strange" the guy at the phone told me ;-P
Furthermore he admitted that strato does this kind of content filtering but he doubts that can be switched off. After telling him I clicked a button to only mark spam and not to reject it he didn't really know what to say and told me I could try the strato abuse address. Ok, that's the last thing I do before switching to another provider and reporting an offense. More to come...

UPDATE: After calling them yesterday and sending them a link to my blog I got another mail by the support confirming again that strato is scanning your/my mail content for blacklisted data. They also tell me because the content that got detected as spam is also on third-party blacklists and because of that they won't remove it from their blacklist.

They somehow didn't get that I don't want to have this specific viagra site on their whitelist but I want to stop them scanning my emails, the URL I gave them was just a PoC in case their support answers with nonsense again. They now give me the special possibility to except all my email aliases from this but still not realizing that they can't do this for others as well without getting the approval for this first.The support also told me that they are going to report an offense to the police if I mention any names in this blog (I am going to check that back with a lawyer and add them later if it's ok)
So that's what I call support! Searching for a new provider now...