lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri Jun  9 02:05:43 2006
From: bill.stout at greenborder.com (Bill Stout)
Subject: Want to test this desktop barrier?
	(Unauthorized offer) 0day protection

 <<Re: [Full-disclosure] Want to test this desktop barrier? (Unauthorized offer) 0day protection>> Hi Thierry,

It is conceptually different than AV or AS products, which is which is why I fall back to analogies.  Even experienced security folk automatically categorize something new with existing products, and presuppose there is nothing new under the sun.

If you generally categorize anything that does virtualization as a sandbox, then it's a sandbox.  I mean, some people consider virtual machines a way to create a sandbox.  Wikipedia does.  Personally I think running VMware or Virtual PC just to run a browser securely is way too intrusive for the average user.  So to avoid the user experience of booting a virtual OS, why not create a virtual application instance that can't contaminate the computer?  I say that like it's easy, but it requires kernel knowledge to develop.  Otherwise you only virtualize a few directories and some registry entries, and are exposed to attacks which leverage system calls, COM objects, User Shell, etc..

I believe this list is read by some of the best and most aggressive hackers that exist, and this is the best place to expose a new security product.  I am interested in what the list has to say.  

Bill Stout

_____________________________________________ 
From: 	Thierry Zoller [mailto:Thierry@...ler.lu] 
Sent:	Thursday, June 08, 2006 3:04 PM
To:	Bill Stout
Cc:	full-disclosure@...ts.grok.org.uk
Subject:	Re: [Full-disclosure] Want to test this desktop barrier? (Unauthorized offer) 0day protection

Dear Bill Stout,

Your are posting to Full-disclosure, not your average mailinglist, you
don't need stories about toddlers and gloves, or "shots". ;)


>If you see a toddler?
>about to touch a dead animal, it's best they're wearing gloves rather?
>than being up to date on their shots.?

First it's a bad analogy, second it's plain wrong.

>?We refer to the virtual environment as?'x-space', or?'within?GreenBorder'. ?
let's stick to some standards should we ? S A N D B O X?


--?

http://secdev.zoller.lu

Thierry Zoller

Fingerprint : 5D84 BFDC CD36 A951 2C45 ?2E57 28B3 75DD 0AC6 F1C7

-------------- next part --------------
An embedded message was scrubbed...
From: "Thierry Zoller" <Thierry@...ler.lu>
Subject: Re: [Full-disclosure] Want to test this desktop barrier?
	(Unauthorized offer) 0day protection
Date: Thu, 8 Jun 2006 15:04:10 -0700
Size: 2040
Url: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060608/6434dc35/attachment.mht

Powered by blists - more mailing lists