Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
Thread beginning with comment 354216
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[3]: Comment by sadyc
by soonerproud on Fri 20th Mar 2009 22:06
in reply to "RE[2]: Comment by sadyc"
Member since:2008-03-05
No, I think everyone agrees that we should be paid for our talents. It is not the matter of getting paid, it is how you get paid. Charlie's pompous attitude and extortion like mentality is pretty low.
What if paramedics worked like this? "Sorry sir, I can stop that bleeding gash in your head if you pay my fee." NO MORE FREE FIRST AID!
What if paramedics worked like this? "Sorry sir, I can stop that bleeding gash in your head if you pay my fee." NO MORE FREE FIRST AID!
I fail to see where in that ZDnet interview where Charlie had a pompous attitude or an extortion type mentality. He very clearly says that Apple hires and pay people to find those exploits and that the work he does has market value. That is a statement of fact so I just don't see how you find that extorting or pompous?
Paramedics are a bad example because they may patch you up without charging up front, but they are damn quick to bill you $400 to $1000 just to put a bandage on you. You still are obligated to pay them and if you refuse they can sue you and garnish your wages. FIRST AID IS NOT FREE!
If Charlie is so smart, he would take his talents to a proper company or contract with companies to find vulnerabilities. Not holding on to the crap for a year to win a prize and try to extort the company...
On the last part, did you even bother reading the interview before commenting? I am directly quoting Charlie now.
What’s the ballpark value of that Safari bug?
It was probably more than that $5,000 prize I won. It’s much less than the IE 8 vulnerability (exploited separately by Nils) by about a factor of ten. I could get more than $5,000 for it but I like the idea of coming here and showcasing what I can do and get some headlines for the company I work for (Independent Security Evaluators).
It was probably more than that $5,000 prize I won. It’s much less than the IE 8 vulnerability (exploited separately by Nils) by about a factor of ten. I could get more than $5,000 for it but I like the idea of coming here and showcasing what I can do and get some headlines for the company I work for (Independent Security Evaluators).
http://blogs.zdnet.com/security/?p=2941
According to that post, Charlie works for a legitimate security firm and held on to the bug to display his talents and to promote his employer to gain business from companies like Apple. In fact, according to Charlie he lost money on this contest, not gained. That makes your entire criticism of what he did a moot point.
Edited 2009-03-20 22:07 UTC
Member since:2006-09-18
What if paramedics worked like this? "Sorry sir, I can stop that bleeding gash in your head if you pay my fee." NO MORE FREE FIRST AID! If Charlie is so smart, he would take his talents to a proper company or contract with companies to find vulnerabilities. Not holding on to the crap for a year to win a prize and try to extort the company...
So your doctor comes to your house and give you free medical exams? If he doesn't he's clearly evil. Letting you die from a preventable disease like that. Terrible!
News
Linked by Thom Holwerda on 05/20/13 22:43 UTC
The Verge pointed me to a blog post by Leap Motion - which reveals how their Kinect-like motion control works with Windows 8. "From the second you plug in your Leap Motion Controller, you'll be able to browse the web and interact with your computer just by moving your hands and fingers in the air. With Leap Motion technology and Windows, you can do everything that's possible with multi-touch inputs - without actually touching anything. This also means that existing applications in Windows 7 and 8 will respond to your natural hand and finger movements. Soon, we'll show you how Leap Motion will work with Mac OS X." Quite cool.
Linked by Thom Holwerda on 05/20/13 21:50 UTC
PocketNow interviews Marc Dillon, and there's an interesting note about why Jolla is keeping the display properties under wraps: "We're leaving some of those details out because we do understand that there are a lot of really big players in the market and they tend to take certain components in the market and dominate them. We created the ability to actually be able to run Sailfish on multiple hardware displays and be able to swap components, so this is part of the demand and supply planning phase. We are committed to this industrial design which is a 4.5-inch display, an 8 megapixel camera on the back and a front-facing camera at the front, and the exact specs of the display we'll provide when we're close to delivery." Something you rarely hear anything about.
Linked by Thom Holwerda on 05/19/13 23:15 UTC
"This is my NeXTstation Turbo Color booting the Mac System 7.1 Operating System using a hardware add-on called 'Daydream'. The Daydream has a Mac ROM and a few custom ICs in it and hooked up to the NeXTs DSP port. Turns your NeXT into a full fledged 68k powered Mac." So cool.
Linked by Thom Holwerda on 05/19/13 23:11 UTC, submitted by Drumhellar
"The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Please note that all fixes in the prior security/bugfix updates (NetBSD 6.0.1 and 6.0.2) are also in 6.1."
Linked by Thom Holwerda on 05/18/13 21:06 UTC
"At the end of a week in which Electronic Arts confirmed it wasn't developing a thing for the Wii U, one of the software engineers in EA Sports' Canada studio, in a series of since-deleted tweets, disparaged the console as 'crap' and suggested Nintendo should give up on hardware altogether. 'The Wii U is crap. Less powerful than an Xbox 360. Poor online/store. Weird tablet', tweeted Bob Summerwill, listed as a senior software engineer at EA Canada, in a reply to a tweet posting a link about EA's no-Wii U news. 'Nintendo are walking dead at this point'." The Wii U is turning into the 21st century's Virtual Boy.
Linked by Thom Holwerda on 05/18/13 7:37 UTC
"In NixOS, the entire operating system - the kernel, applications, system packages, configuration files, and so on - is built by the Nix package manager from a description in a purely functional build language. The fact that it's purely functional essentially means that building a new configuration cannot overwrite previous configurations. Most of the other features follow from this." Interesting approach. A Linux distribution, sure, but with some very refreshing ideas about system configuration.
Linked by fran on 05/18/13 1:38 UTC
Appfour added, among other features, C/C++ support to its new version of AIDE. From Android-IDE, "Now you can write parts of your app or your whole app in C/C++ on your device. AIDE supports the Standard Android NDK toolchain (GCC 4.6 + Bionic, STL, ...). No changes are necessary if you want to build an app developed on a PC with Eclipse. C/C++ development is fully integrated: Build errors appear in the error list and files can easily be navigated to with Go to file. The editor supports C/C++ syntax highlighting."
Linked by Thom Holwerda on 05/17/13 23:35 UTC, submitted by kragil
Ars nails it: "The answer is that Google did announce what amounts to a fairly substantial Android update yesterday. They simply did it without adding to the update fragmentation problems that continue to plague the platform. By focusing on these changes and not the apparently-waiting-in-the-wings update to the core software, Google is showing us one of the ways in which it's trying to fix the update problem."
Linked by MOS6510 on 05/17/13 22:22 UTC
"It is good for programmers to understand what goes on inside a processor. The CPU is at the heart of our career. What goes on inside the CPU? How long does it take for one instruction to run? What does it mean when a new CPU has a 12-stage pipeline, or 18-stage pipeline, or even a 'deep' 31-stage pipeline? Programs generally treat the CPU as a black box. Instructions go into the box in order, instructions come out of the box in order, and some processing magic happens inside. As a programmer, it is useful to learn what happens inside the box. This is especially true if you will be working on tasks like program optimization. If you don't know what is going on inside the CPU, how can you optimize for it? This article is about what goes on inside the x86 processor's deep pipeline."
Linked by Thom Holwerda on 05/17/13 22:15 UTC, submitted by Tom
"It was the only moment I heard regret slip into Otellini's voice during the several hours of conversations I had with him. 'The lesson I took away from that was, while we like to speak with data around here, so many times in my career I've ended up making decisions with my gut, and I should have followed my gut,' he said. 'My gut told me to say yes.'" The world would've been a much different place - Apple would have been less dependant on Samsung for its chips, which probably would've meant less money for Samsung to develop its Galaxy business.More News »
Sponsored Links
Member since:
2006-02-19
Charlie deserves to get paid for his work and I stand by his decision to offer no more free bugs. Apple doesn't give OSX away for free, so why should Charlie donate his work to Apple?
No, I think everyone agrees that we should be paid for our talents. It is not the matter of getting paid, it is how you get paid. Charlie's pompous attitude and extortion like mentality is pretty low.
What if paramedics worked like this? "Sorry sir, I can stop that bleeding gash in your head if you pay my fee." NO MORE FREE FIRST AID!
If Charlie is so smart, he would take his talents to a proper company or contract with companies to find vulnerabilities. Not holding on to the crap for a year to win a prize and try to extort the company...