full-disclosure - Mozilla Firefox "Host:" Buffer Overflow Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun Sep 11 21:24:54 2005
From: steve at unixwiz.net (Steve Friedl)
Subject: Mozilla Firefox "Host:" Buffer Overflow Exploit

On Sun, Sep 11, 2005 at 11:08:32PM +0300, Georgi Guninski wrote:
> the most common examples of MS who^H^H^H zealots are:
> 1. "MS is giving me money, so billg is good"
> 2. "i can't do anything except winblows, so i have winblows dependency.
> no MS, no money, no love...."

... and then there are those who have real, actual cross-platform
experience who recognize that there are solid foundations of both and
are able to see the benefits of each without having a stroke.

I have my own list of "Windows sucks" issues, but I have them with *ix too
(IPC, mainly). As someone who writes communications controllers, I'd MUCH
rather do it under Win32 than under *ix because the operating system API
is so much stronger (though BSD's kqueue is totally a step in the right
direction).

I don't know anybody with deep, broad experience with both APIs at the
systems-programming (non GUI app) level who doesn't see the shining points
of Win32.  Once you've used WaitForMultipleObjects(), you never go back.

This doesn't mean that I run IIS for my webserver, that I don't get
sick of rebooting my Windows box every time the wind changes, or approve
of everything that BillG does, but it does mean that I don't blather like
a nutbar when the W word is mentioned.

Steve (UNIX Wizard and Microsoft MVP: *two* experts in one)

P.S. - Win95/98/ME don't count - they suck

-- 
Stephen J Friedl | Security Consultant |  UNIX Wizard  |   +1 714 544-6561
www.unixwiz.net  | Tustin, Calif. USA  | Microsoft MVP | steve@...xwiz.net