lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20100724205242.97F.0@paddy.troja.mff.cuni.cz>
Date: Sat, 24 Jul 2010 22:08:15 +0200 (CEST)
From: Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: In-band signalling (was: Re: NuralStorm
 Webmail Multiple Vulnerabilities)

On Sat, 17 Jul 2010, Dan Kaminsky wrote:

> Out of band signaling can be made to work in small networks.

What does "out of band" mean in that sentence?

The original meaning of "out of band" was "out of the frequency band
used to transmit end-to-end voice communication". As frequency division
multiplexing was replaced by other (mostly digital) methods of signal
encoding and multiplexing, the term acquired a more abstract meaning with
"band" denoting any kind of multiplexed channel. Out-of-band signalling in
this abstract sense is one of the major features of SS7. I do not think
you want to call the global SS7-based phone network "small".

> In larger networks and systems, the problem is -- what makes you think
> you have simply two planes?  We call them n-tier, not 2-tier after all.

If you know how to split a communication channel into two separated
subchannels then you can apply the approach recursively and get any number
of subchannels and any number of tiers you want (as long as you do not hit
physical limits).

> So the game, as I see it, isn't to demand out of band operations. The  
> game is to engineer systems that can strongly maintain separation  
> between contexts, in band.

Again, what does "out of band" (and "in band") mean in that sentence?

In fact, "the need to engineer systems to maintain strong separation
between contexts" is more or less the lesson to be learned I talked about.

BTW: Between? What makes you think you have simply two contexts? :)

-- 
Pavel Kankovsky aka Peak                          / Jeremiah 9:21        \
"For death is come up into our MS Windows(tm)..." \ 21st century edition /


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ