Collaborate Disseminate
Using assert() creates better code, as programmers double-check assumptions. But only if used correctly. Unfortunately, bad programmers tend to use them badly, making code worse than if no asserts were used at all. They are a nuanced concept … Continue reading Assert() in the hands of bad coders
As revealed in last week’s CIA #Vault7 leaks, the CIA has some 0days. This has ignited the debate about whether organizations like the CIA should be disclosing these 0days so that vendors can fix them, rather than “stockpiling” them. There seems to be … Continue reading Some confusing language in the 0day debate
As revealed in last week’s CIA #Vault7 leaks, the CIA has some 0days. This has ignited the debate about whether organizations like the CIA should be disclosing these 0days so that vendors can fix them, rather than “stockpiling” them. There seems to be … Continue reading Some confusing language in the 0day debate
As revealed in last week’s CIA #Vault7 leaks, the CIA has some 0days. This has ignited the debate about whether organizations like the CIA should be disclosing these 0days so that vendors can fix them, rather than “stockpiling” them. There seems to be … Continue reading Some confusing language in the 0day debate
As CNN reports, the FBI seems to be looking into that connection between Trump and Alfa Bank. Here are some things to look for.First, get your own copy of the logs from root name servers. I don’t trust the source of the original logs. I suspect they’ve… Continue reading FBI: what to look for in the Trump/AlfaBank connection
As CNN reports, the FBI seems to be looking into that connection between Trump and Alfa Bank. Here are some things to look for.First, get your own copy of the logs from root name servers. I don’t trust the source of the original logs. I suspect they’ve… Continue reading FBI: what to look for in the Trump/AlfaBank connection
The RAND Corporation has a research report on the 0day market [ * ]. It’s pretty good. They talked to all the right people. It should be considered the seminal work on the issue. They’ve got the pricing about right ($1 million for full chain … Continue reading Some notes on the RAND 0day report
The RAND Corporation has a research report on the 0day market [*]. It’s pretty good. They’ve got the pricing about right ($1 million for full chain iPhone exploit, but closer to $100k for others). They’ve got the stats about right (5% chance somebody e… Continue reading Some notes on the RAND 0day report
There’s nothing in the CIA #Vault7 leaks that calls into question strong attribution, like Russia being responsible for the DNC hacks. On the other hand, it does call into question weak attribution, like North Korea being responsible for the … Continue reading A note about "false flag" operations
There’s nothing in the CIA #Vault7 leaks that calls into question strong attribution, like Russia being responsible for the DNC hacks. On the other hand, it does call into question weak attribution, like North Korea being responsible for the … Continue reading A note about “false flag” operations