<?xml version="1.0" encoding="utf-8" ?>
<?xml-stylesheet href="/templates/default/atom.css" type="text/css" ?>

<feed 
   xmlns="http://www.w3.org/2005/Atom"
   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
   xmlns:dc="http://purl.org/dc/elements/1.1/"
   xmlns:admin="http://webns.net/mvcb/"
   xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
   xmlns:wfw="http://wellformedweb.org/CommentAPI/">
    <link href="http://www.provos.org/index.php?/feeds/atom.xml" rel="self" title="Niels Provos" type="application/atom+xml" />
    <link href="http://www.provos.org/"                        rel="alternate"    title="Niels Provos" type="text/html" />
    <link href="http://www.provos.org/rss.php?version=2.0"     rel="alternate"    title="Niels Provos" type="application/rss+xml" />
    <title type="html">Niels Provos</title>
    <subtitle type="html">systrace, spybye and other things.</subtitle>
    
    <id>http://www.provos.org/</id>
    <updated>2010-08-20T00:31:31Z</updated>
    <generator uri="http://www.s9y.org/" version="1.3.1">Serendipity 1.3.1 - http://www.s9y.org/</generator>
    <dc:language>en</dc:language>

    <entry>
        <link href="http://www.provos.org/index.php?/archives/85-Anatomy-of-a-PDF-Exploit.html" rel="alternate" title="Anatomy of a PDF Exploit" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2010-08-20T00:10:08Z</published>
        <updated>2010-08-20T00:31:31Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=85</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=85</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/3-Hacking" label="Hacking" term="Hacking" />
            <category scheme="http://www.provos.org/index.php?/categories/6-Malware" label="Malware" term="Malware" />
            <category scheme="http://www.provos.org/index.php?/categories/7-Security" label="Security" term="Security" />
    
        <id>http://www.provos.org/index.php?/archives/85-guid.html</id>
        <title type="html">Anatomy of a PDF Exploit</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                PDF has become the de-facto standard for formatting print documents.  Over the years, it has evolved into a <a href="http://www.adobe.com/devnet/pdf/pdf_reference.html">feature rich and very complex system</a>.  PDF supports embedded Javascript that can be used for form validation and contains support for different image formats and 3D models, etc.  As a result, PDF implementations have numerous vulnerabilities that can be exploit by adversaries to gain control over a user’s computer.   Here are a number of CVEs that are currently being exploited in the wild: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5659">CVE-2007-5659</a>, <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2992">CVE-2008-2992</a>, <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0927">CVE-2009-0927</a>, <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2994">CVE-2009-2994</a>, <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324">CVE-2009-4324</a>, <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188">CVE-2010-0188</a>.<br />
<br />
In this blog post, we are going to look at current exploitation of CVE-2010-0188: An integer overflow in the parsing of the dot range option in TIFF files.   The vulnerability was publicly <a href="http://www.adobe.com/support/security/bulletins/apsb10-07.html">announced in February 2010</a>.  Examples of <a href="http://www.exploit-db.com/exploits/11787/">exploit code</a> are readily available on the Internet and a very good explanation of how the exploit works has been provided by <a href="http://blog.fortinet.com/cve-2010-0188-exploit-in-the-wild/">Fortinet</a>.<br />
<br />
The exploit described by Fortinet utilizes an AcroForm described in XML.  The XML contains an image field with an embedded TIFF image that triggers the vulnerability.<br />
<br />
<!-- s9ymdb:12 --><img class="serendipity_image_left" width="691" height="209" style="border: 0px; padding-left: 5px; padding-right: 5px; padding-bottom: 10px;" src="http://www.provos.org/uploads/image2.png" alt="" /> <br /><a href="http://www.provos.org/index.php?/archives/85-Anatomy-of-a-PDF-Exploit.html#extended">Continue reading "Anatomy of a PDF Exploit"</a>
            </div>
        </content>
        <dc:subject>exploit</dc:subject>
<dc:subject>malware</dc:subject>
<dc:subject>pdf</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/84-Heat-treating-the-Wakizashi.html" rel="alternate" title="Heat treating the Wakizashi" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2010-07-31T03:33:16Z</published>
        <updated>2010-07-31T03:33:16Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=84</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=84</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/3-Hacking" label="Hacking" term="Hacking" />
    
        <id>http://www.provos.org/index.php?/archives/84-guid.html</id>
        <title type="html">Heat treating the Wakizashi</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                <div style="float:left"><object width="640" height="385"><param name="movie" value="http://www.youtube.com/v/gy0QDfS9kiU&amp;hl=en_US&amp;fs=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/gy0QDfS9kiU&amp;hl=en_US&amp;fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed></object></div>Heat treating a sword using a water quench is a tense affair as the sword my crack and many hours of work may be lost.   This video shows heat treating a wakizashi I made from forge welded cable that was folded several times.   The Japanese differential heat treat calls for coating the back of the blade with a clay layer that retards the quench and allows the covered part of the steel to remain softer.   The border between harder and softer steel becomes visible as hamon.   Although, the heat treating was successful, the blade developed a welding flaw and at this point it looks like 20 hours of work might have been lost.   
            </div>
        </content>
        <dc:subject>bladesmithing</dc:subject>
<dc:subject>wakizashi</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/83-Folding-Steel.html" rel="alternate" title="Folding Steel" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2010-05-31T02:26:51Z</published>
        <updated>2010-05-31T02:26:51Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=83</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=83</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/3-Hacking" label="Hacking" term="Hacking" />
    
        <id>http://www.provos.org/index.php?/archives/83-guid.html</id>
        <title type="html">Folding Steel</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                <a href="http://www.flickr.com/photos/nielsprovos/4651011415/" title="Blacksmith Knife by provos@monkey, on Flickr"><img src="http://farm5.static.flickr.com/4006/4651011415_20e3531968_m.jpg" width="240" height="160" alt="Folded Steel" class="serendipity_image_left" style="border: 0px none ; float: left; padding-left: 5px; padding-right: 5px;" /></a>When examining a traditionally forged Japanese sword, the steel structure (<a href="http://www.ncjsc.org/hada-1.html">hada</a>) often looks like wood grain.  This structure is a result of folding and forge welding <a href="http://en.wikipedia.org/wiki/Tamahagane">tamahagane</a>.  To simulate such hada without using expensive tamahagane, I took 24in of 1in diameter steel cable and forge welded it into a single piece of steel.   That steel was then folded 7 times with some surface manipulation and then forged into a small wakizashi.  The picture shows the tang after the scale was removed, polished and then lightly etched to show the grain.   The steel structure seems similar to mokume hada.   Now, I just need to find the time to shape, heat treat, polish and mount the sword.  Expect progress pictures as work permits - probably in a few months. 
            </div>
        </content>
        <dc:subject>bladesmithing</dc:subject>
<dc:subject>forge</dc:subject>
<dc:subject>wakizashi</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/82-Railroad-Spike-Knife.html" rel="alternate" title="Railroad Spike Knife" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2010-03-24T06:05:57Z</published>
        <updated>2010-03-24T06:05:57Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=82</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=82</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/3-Hacking" label="Hacking" term="Hacking" />
    
        <id>http://www.provos.org/index.php?/archives/82-guid.html</id>
        <title type="html">Railroad Spike Knife</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                <a href="http://www.flickr.com/photos/nielsprovos/4446434635/" title="Blacksmith Knife by provos@monkey, on Flickr"><img src="http://farm3.static.flickr.com/2743/4446434635_6feea28de1_m.jpg" width="240" height="180" alt="Blacksmith Knife" class="serendipity_image_left" style="border: 0px none ; float: left; padding-left: 5px; padding-right: 5px;" /></a>The is a knife made from a high carbon railroad spike.   The blade is flat ground and about 4.5in long. The whole knife is a little bit longer than 10in.    The twist in the handle feels nice in the hand.  HC in this case apparently means 1030 which is pretty low carbon content for a knife.   While it got to be very sharp, the edge is probably not going to stay that way for very long.<br />
<p style="clear:both"><br />
<a href="http://www.flickr.com/photos/nielsprovos/4452276651/" title="Blacksmith Knife (finished) by provos@monkey, on Flickr"><img src="http://farm3.static.flickr.com/2695/4452276651_881539915f_m.jpg" width="240" height="159" alt="Blacksmith Knife (finished)"  class="serendipity_image_left" style="border: 0px none ; float: left; padding-left: 5px; padding-right: 5px;" /></a>Forging this was a lot of fun and using the spring fuller really helped with separating the steel from the handle and the blade.   Making this knife actually didn't take very long.  About an hour of forging time, a couple hours of grinding and polishing.<br />
<br />
<p style="clear: both"> 
            </div>
        </content>
        <dc:subject>bladesmithing</dc:subject>
<dc:subject>knife</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/81-Libevent-2.0.4-alpha-released.html" rel="alternate" title="Libevent 2.0.4-alpha released" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2010-03-06T07:32:00Z</published>
        <updated>2010-03-06T07:32:00Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=81</wfw:comment>
    
        <slash:comments>1</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=81</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/4-Libevent" label="Libevent" term="Libevent" />
            <category scheme="http://www.provos.org/index.php?/categories/5-News" label="News" term="News" />
    
        <id>http://www.provos.org/index.php?/archives/81-guid.html</id>
        <title type="html">Libevent 2.0.4-alpha released</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                Libevent 2.0.4-alpha is now available for download:<br />
<br />
 <a href="http://monkey.org/~provos/libevent-2.0.4-alpha.tar.gz">http://monkey.org/~provos/libevent-2.0.4-alpha.tar.gz</a><br />
 <a href="http://monkey.org/~provos/libevent-2.0.4-alpha.tar.gz.sig">http://monkey.org/~provos/libevent-2.0.4-alpha.tar.gz.sig</a><br />
<br />
The complete change list is available <a href="http://bit.ly/bnH6OT">here</a>.<br />
<br />
Some of the feature improvements include:<br />
<ul><li>bufferevents can now be rate limited</li><li>http connections can now resolve host names asynchronously</li><li>a facility for lock debugging</li><li>arc4random() for evdns</li></ul><br />
However, we (that means mostly Nick) have also made a large number of bug fixes and stability improvements across many platforms.    Many thanks to everyone who helped by providing bug reports and patches including Brodie Thiesfield, Dagobert Michelsen, Evan Jones, Joachim Bauch, Pavel Plesov, Roman Puls, Sebastian Hahn, William Ahern, Yasuoka Masahiko and Zhuang Yuyao.<br />
<br />
In a separate email, Nick also provided a much more <a hef="http://archives.seul.org/libevent/users/Mar-2010/msg00003.html">verbose description</a> of what all changed.<br />
 
            </div>
        </content>
        <dc:subject>libevent</dc:subject>
<dc:subject>release</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/80-Cable-Tantos.html" rel="alternate" title="Cable Tantos" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2010-02-15T03:16:18Z</published>
        <updated>2010-03-06T07:31:44Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=80</wfw:comment>
    
        <slash:comments>1</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=80</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/3-Hacking" label="Hacking" term="Hacking" />
    
        <id>http://www.provos.org/index.php?/archives/80-guid.html</id>
        <title type="html">Cable Tantos</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                <a href="http://www.flickr.com/photos/nielsprovos/4344876391/" title="Cable Tanto by provos@monkey, on Flickr"><img src="http://farm3.static.flickr.com/2714/4344876391_af98c14087_m.jpg" width="240" height="113" alt="Cable Tanto" class="serendipity_image_left" style="border: 0px none ; float: left; padding-left: 5px; padding-right: 5px;" /></a>Although, I have made various attempts at forging knives, this tanto is the first knife I have completed. It's a shinogi-zukuri tanto with choji hamon.   The steel was made from <a href="http://www.youtube.com/watch?v=rP9uoK4Lvec">forge-welded high carbon cable</a>. Originally, this was supposed to become a wakizashi, but due to a bad hammer blow when forging the sunobe, I had to fold it over and no longer had enough steel for a longer blade.   As a result, the blade is only about 9in long. The habaki was made from brazed copper and the shira-saya was carved from a popular blank. <br />
<p style="clear:both"><br />
<a href="http://www.flickr.com/photos/nielsprovos/4357631679/" title="Cable Tantos by provos@monkey, on Flickr"><img src="http://farm5.static.flickr.com/4045/4357631679_bcf5ec16a2_m.jpg" width="240" height="135" alt="Cable Tantos" class="serendipity_image_left" style="border: 0px none ; float: left; padding-left: 5px; padding-right: 5px;" /></a>The picture to the left shows two more cable tantos in various stages of progress.  The top one had some rough grinding done to it whereas the bottom one is straight from the forge.  Only about 10% of the time is actually spent forging the blades.   The rest of time is spent grinding, polishing and working on the habaki as well as on the saya and everything else.<br />
<p style="clear: both"> 
            </div>
        </content>
        <dc:subject>blacksmithing</dc:subject>
<dc:subject>bladesmithing</dc:subject>
<dc:subject>forge</dc:subject>
<dc:subject>tanto</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/79-OpenSSL-Client-Certificates-and-Libevent-2.0.3-alpha.html" rel="alternate" title="OpenSSL Client Certificates and Libevent-2.0.3-alpha" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-12-05T02:02:15Z</published>
        <updated>2009-12-05T02:21:32Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=79</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=79</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/4-Libevent" label="Libevent" term="Libevent" />
    
        <id>http://www.provos.org/index.php?/archives/79-guid.html</id>
        <title type="html">OpenSSL Client Certificates and Libevent-2.0.3-alpha</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                Tom Pusateri reported success with using OpenSSL client certificates and libevent's builtin OpenSSL support.  Here is what he wrote on the mailing list:<br />
<blockquote><br />
I tried 2.0.3 alpha against the Apple Push notification feedback service which requires a client key/certificate and it works great.<br />
<br />
One hint... Make sure you add the key and cert to the SSL context before calling SSL_new(). Otherwise, you'll get an error that looks like:<br />
<dl><dd><em>sslv3 alert handshake failure in SSL routines SSL3_READ_BYTES</em></dd></dl>Here's the working code:<br />
<br />
<font size="2"><pre>
static void
init_feedback_service(struct event_base *ev_base,
    struct evdns_base *dns)
{
   int rc;
   struct bufferevent *bev;
   SSL_CTX *ssl_ctx;
   SSL *ssl;

   ssl_ctx = SSL_CTX_new(SSLv3_method());

   rc = SSL_CTX_use_certificate_file(ssl_ctx, "my_apple_cert_key.pem",
       SSL_FILETYPE_PEM);
   if (rc != 1) {
       errx(EXIT_FAILURE, "Could not load certificate file");
   }
   rc = SSL_CTX_use_PrivateKey_file(ssl_ctx, "my_apple_cert_key.pem",
       SSL_FILETYPE_PEM);
   if (rc != 1) {
       errx(EXIT_FAILURE, "Could not load private key file");
   }

   ssl = SSL_new(ssl_ctx);
   bev = bufferevent_openssl_socket_new(ev_base, -1, ssl,
       BUFFEREVENT_SSL_CONNECTING, BEV_OPT_CLOSE_ON_FREE);
   bufferevent_setcb(bev, feedback_read_cb, NULL,
       feedback_event_cb, NULL);
   rc = bufferevent_socket_connect_hostname(bev, dns, AF_INET,
       "feedback.sandbox.push.apple.com", 2196);
   if (rc < 0) {
       warnx("could not connect to feedback service: %s",
             evutil_socket_error_to_string(EVUTIL_SOCKET_ERROR()));
       bufferevent_free(bev);
       return;
   }
   bufferevent_enable(bev, EV_READ);
}
</pre></font></blockquote> 
            </div>
        </content>
        <dc:subject>libevent</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/78-Libevent-2.0.3-alpha-release.html" rel="alternate" title="Libevent-2.0.3-alpha release" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-11-21T05:23:55Z</published>
        <updated>2009-11-21T14:58:32Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=78</wfw:comment>
    
        <slash:comments>3</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=78</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/4-Libevent" label="Libevent" term="Libevent" />
            <category scheme="http://www.provos.org/index.php?/categories/5-News" label="News" term="News" />
    
        <id>http://www.provos.org/index.php?/archives/78-guid.html</id>
        <title type="html">Libevent-2.0.3-alpha release</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                It has been a while since the last alpha release of libevent-2.0. Yesterday, we released 2.0.3-alpha which can be downloaded from<br />
<br />
 <a href="http://monkey.org/~provos/libevent-2.0.3-alpha.tar.gz">http://monkey.org/~provos/libevent-2.0.3-alpha.tar.gz</a><br />
<br />
Please, give it a spin and let us know if you run into any problems. There have been a lot of changes since the last release, mostly due to Nick's hard work.  Here are just some highlights, the ChangeLog contains the full story:<br />
<br />
 - SSL/TLS support on bufferevents, using the OpenSSL library<br />
 - Improved searching on evbuffer objects<br />
 - Improved support for Windows<br />
 - More efficient memory allocation for event_bases that use epoll<br />
 - Improved thread-safety<br />
 - The IOCP bufferevent backend is now exposed on Windows; many thanks to Christopher Davis for his work.<br />
<br />
Many thanks to everyone who helped with patches and bug reports including Rocco Carbone, Brodie Thiesfield, Caitlin Mercer, David Reiss, Alexander Pronchenkov, Jacek Masiulaniec, Ka-Hing Cheung, Christopher Davis, Ferenc Szalai, and Ryan Phillips.<br />
<br />
<em>Edited to fix the link.</em> 
            </div>
        </content>
        <dc:subject>libevent</dc:subject>
<dc:subject>release</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/77-Libevent-1.4.13-stable-released.html" rel="alternate" title="Libevent 1.4.13-stable released" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-11-18T04:16:10Z</published>
        <updated>2009-11-18T04:16:10Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=77</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=77</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/4-Libevent" label="Libevent" term="Libevent" />
            <category scheme="http://www.provos.org/index.php?/categories/5-News" label="News" term="News" />
    
        <id>http://www.provos.org/index.php?/archives/77-guid.html</id>
        <title type="html">Libevent 1.4.13-stable released</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                We just released a new stable version of <a href="http://www.monkey.org/~provos/libevent/">Libevent</a> that fixes the following problems:<ul><li>If the kernel tells us that there are a negative number of bytes to read from a socket, do not believe it.  Fixes bug <a href="http://sourceforge.net/tracker/?func=detail&aid=2841177&group_id=50884&atid=461322">2841177</a>; found by Alexander Pronchenkov.</li><li>Do not allocate the maximum event queue and fd array for the epoll backend at startup.  Instead, start out accepting 32 events at a time, and double the queue's size when it seems that the OS is generating events faster than we're requesting them.  Saves up to 512K per epoll-based event_base.  Resolves bug <a href="http://sourceforge.net/tracker/?func=detail&aid=2839240&group_id=50884&atid=461322">2839240</a>.</li><li>Fix compilation on Android, which forgot to define fd_mask in its sys/select.h</li><li>Do not drop data from evbuffer when out of memory; reported by Jacek Masiulaniec</li><li>Rename our replacement compat/sys/_time.h header to avoid build a conflict on HPUX; reported by Kathryn Hogg.</li><li>Build kqueue.c correctly on GNU/kFreeBSD platforms. Patch pulled upstream from Debian.</li><li>Fix a problem with excessive memory allocation when using multiple event priorities.</li><li>When running set[ug]id, don't check the environment. Based on a patch from OpenBSD.</li></ul><br />
A new alpha release of libevent 2.0 is on its way, too.   Thanks to everyone who submitted patches and bug reports.<br />
<br />
The source code is available at <a href="http://www.monkey.org/~provos/libevent-1.4.13-stable.tar.gz">http://www.monkey.org/~provos/libevent-1.4.13-stable.tar.gz</a>.  Don't forget to verify the <a href="http://www.monkey.org/~provos/libevent-1.4.13-stable.tar.gz.sig">signature</a>. 
            </div>
        </content>
        <dc:subject>libevent</dc:subject>
<dc:subject>release</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/76-San-Mai-Knife.html" rel="alternate" title="San Mai Knife" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-10-15T21:48:38Z</published>
        <updated>2010-03-25T20:54:21Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=76</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=76</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/3-Hacking" label="Hacking" term="Hacking" />
    
        <id>http://www.provos.org/index.php?/archives/76-guid.html</id>
        <title type="html">San Mai Knife</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                <a href="http://www.flickr.com/photos/nielsprovos/4013107612/" title="Failed San Mai Attempt by provos@monkey, on Flickr"><img src="http://farm3.static.flickr.com/2611/4013107612_a6135c6575_m.jpg" width="240" height="159" alt="Failed San Mai Attempt" class="serendipity_image_left" style="border: 0px none ; float: left; padding-left: 5px; padding-right: 5px;" /></a> A while ago, I forged a <a href="http://www.flickr.com/photos/nielsprovos/3601778013/">San Mai billet</a> with the hope to turn it into a tanto.  Unfortunately, the forge I was using had a very oxygen rich atmosphere and the welds did not take very well.   Over the last couple of days, I spent some time grinding and heat treating the remaining steel into a knife for practice purposes.   The cable structure of the knife came out very nicely with repeated applications of lemon juice and metal polish to remove the oxides left by the lemon juice etch.<br />
<br />
I also figured out how to take decent pictures of the steel.   The trick was to use direct light rather than diffused light that shines directly on the blade, and then have black surfaces inside the light box.  The angle of the knife needs to be so that the black is reflected do the camera.   Although, this is a failed knife due to all the welding flaws, it still was an interesting experiment. 
            </div>
        </content>
        <dc:subject>bladesmithing</dc:subject>
<dc:subject>knife</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/75-Forging-a-Wakizashi.html" rel="alternate" title="Forging a Wakizashi" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-09-14T18:43:26Z</published>
        <updated>2009-09-14T18:43:26Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=75</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=75</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/3-Hacking" label="Hacking" term="Hacking" />
    
        <id>http://www.provos.org/index.php?/archives/75-guid.html</id>
        <title type="html">Forging a Wakizashi</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                <a href="http://www.flickr.com/photos/nielsprovos/3913846940/" title="Wakizashi by provos@monkey, on Flickr"><img src="http://farm4.static.flickr.com/3481/3913846940_26cc91d776_m.jpg" width="240" height="208" alt="Wakizashi" class="serendipity_image_left" style="border: 0px none ; float: left; padding-left: 5px; padding-right: 5px;" /></a>I just finished taking the <a href="http://www.tomboyama.com/">5-day basic forging class</a> taught by Michael Bell at <a href="http://www.dragonflyforge.com/">Dragonfly Forge</a>.   The wakizashi in the picture is the result of it.   The blade is about 18in long and was forged from forge-welded cable.    The forge welding of the cable conducted by Michael and his son Gabriel took the better half of the first day.  Afterward, the steel was forged into a sunobe which has the basic taper for the tang and point of the sword.   We then forged in the ji and the shinogi ji.   The remainder of the time was spent grinding in preparation for heat treatment.   Before the clay was applied, we draw filed the blade so that all file marks were parallel with the edge rather than the perpendicular marks left by the belt grinder.   Applying the clay was a three step process; a light coating of the whole blade, applying the ashi lines, and then coating everything that should remain soft.   You can see the ashi and where the clay was applied on the middle picture.   After heat treating, the blade took on a nice curve and it was back to the grinder.  During the last day there was a little bit of time to polish on stones which showed hints of some very wild hamon as well as some mune yaki.  The whole class was a great experience. 
            </div>
        </content>
        <dc:subject>bladesmithing</dc:subject>
<dc:subject>forge</dc:subject>
<dc:subject>wakizashi</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/74-LEET-10-Call-for-Papers.html" rel="alternate" title="LEET '10 Call for Papers" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-08-29T19:35:46Z</published>
        <updated>2009-08-29T19:42:11Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=74</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=74</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/6-Malware" label="Malware" term="Malware" />
            <category scheme="http://www.provos.org/index.php?/categories/5-News" label="News" term="News" />
            <category scheme="http://www.provos.org/index.php?/categories/7-Security" label="Security" term="Security" />
    
        <id>http://www.provos.org/index.php?/archives/74-guid.html</id>
        <title type="html">LEET '10 Call for Papers</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                The call for papers for the <strong>3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats</strong> (LEET '10) Botnets, Spyware, Worms, and More just went out.   It will be held on <strong>April 27, 2010</strong> in San Jose, CA.<br />
<br />
<a href="http://www.usenix.org/event/leet10/cfp/">LEET '10</a> will be co-located with the 7th USENIX Symposium on Networked Systems Design and Implementation (NSDI '10), which will take place April 28–30, 2010.<br />
<br />
<strong>Important Dates</strong><br />
<ul><li>Submissions due: Thursday, February 25, 2010, 11:59 p.m. PST</li><li>Notification of acceptance: Wednesday, March 24, 2010</li><li>Final papers due: Monday, April 5, 2010</li></ul><br />
<strong>Workshop Organizers</strong><br />
<em>Program Chair</em><ul><li>Michael Bailey, University of Michigan</li></ul><em>Program Committee</em><ul><li>Dan Boneh, Stanford University</li><li>Nick Feamster, Georgia Institute of Technology</li><li>Jaeyeon Jung, Intel Labs, Seattle</li><li>Christian Kreibich, International Computer Science Institute</li><li>Patrick McDaniel, Pennsylvania State University</li><li>Fabian Monrose, University of North Carolina, Chapel Hill</li><li>Jose Nazario, Arbor Networks, Inc.</li><li>Stefan Savage, University of California, San Diego</li><li>Matt Williamson, AVG Technologies</li><li>Yinglian Xie, Microsoft Research</li><li>Vinod Yegneswaran, SRI International</li><br />
</ul>Go submit your work! 
            </div>
        </content>
        <dc:subject>cfp</dc:subject>
<dc:subject>malware</dc:subject>
<dc:subject>research</dc:subject>
<dc:subject>security</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/73-Ask-Googles-Anti-Malware-Team.html" rel="alternate" title="Ask Google's Anti-Malware Team" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-08-16T23:42:12Z</published>
        <updated>2009-08-16T23:42:12Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=73</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=73</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/6-Malware" label="Malware" term="Malware" />
            <category scheme="http://www.provos.org/index.php?/categories/5-News" label="News" term="News" />
            <category scheme="http://www.provos.org/index.php?/categories/1-SpyBye" label="SpyBye" term="SpyBye" />
    
        <id>http://www.provos.org/index.php?/archives/73-guid.html</id>
        <title type="html">Ask Google's Anti-Malware Team</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                Google's Anti-Malware team has prepared a moderator page where web masters and users <a href="http://moderator.appspot.com/#15/e=a77ea&t=a9521">can ask questions</a> and vote which questions they would like to see answered.   The voting period ends on Friday, August 28th at which point the Anti-Malware team will prepare answers for some of the top-rated questions. 
            </div>
        </content>
        <dc:subject>malware</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/72-New-Libevent-Releases.html" rel="alternate" title="New Libevent Releases" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-07-29T04:17:43Z</published>
        <updated>2009-07-29T04:26:14Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=72</wfw:comment>
    
        <slash:comments>1</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=72</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/4-Libevent" label="Libevent" term="Libevent" />
            <category scheme="http://www.provos.org/index.php?/categories/5-News" label="News" term="News" />
    
        <id>http://www.provos.org/index.php?/archives/72-guid.html</id>
        <title type="html">New Libevent Releases</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                Nick just announced two new libevent releases.  Here is his summary.<br />
<br />
<strong>Libevent 1.4.12-stable:</strong><br />
You can find the source in the usual place:<br />
<br />
   <a href="http://monkey.org/~provos/libevent-1.4.12-stable.tar.gz">http://monkey.org/~provos/libevent-1.4.12-stable.tar.gz</a><br />
<br />
This is a bugfix-only release, and some of the bugs were kind of nasty.  I'd recommend that you upgrade, especially if you are writing code that uses epoll or evdns.<br />
<br />
Changes in 1.4.12-stable:<br />
<ul><li>Try to contain degree of failure when running on a win32 version so heavily firewalled that we can't fake a socketpair.</li><li>Fix an obscure timing-dependent, allocator-dependent crash in the evdns code.</li><li>Use <u>_VA_ARGS_</u> syntax for varargs macros in event_rpcgen when compiler is not GCC.</li><li>Activate fd events in a pseudorandom order with O(N) backends, so that we don't systematically favor low fds (select) or earlier-added fds (poll, win32).</li><li>Fix another pair of fencepost bugs in epoll.c.  [Patch from Adam Langley.]</li><li>Do not break evdns connections to nameservers when our IP changes.</li><li>Set truncated flag correctly in evdns server replies.</li><li>Disable strict aliasing with GCC: our code is not compliant with it.</li></ul><br />
<strong>Libevent-2.0.2-alpha:</strong><br />
The first alpha release in the long-promised Libevent 2.0 series is finally out.  You can download Libevent 2.0.2-alpha from:<br />
<br />
  <a href="http://monkey.org/~provos/libevent-2.0.2-alpha.tar.gz">http://monkey.org/~provos/libevent-2.0.2-alpha.tar.gz</a><br />
<br />
This is an alpha release.  Libevent 2.0 is not finished.  There will be bugs, and we make no promises about the stability of any APIs introduced in the 2.0.x-alpha releases.  When you find bugs, please let us know.<br />
<br />
Libevent 2.0 is intended to be backward compatible with the Libevent 1.4 APIs[*].  Any program that worked with Libevent 1.4 should still work with Libevent 2.0, unless we screwed up.  Please test your programs when you have a chance, so that if we <u>did</u> screw up, we can notice soon.<br />
[*] Unless you were messing around with the internals of internal structures.<br />
<br />
This release adds many new features to the previous alpha release, and fixes many bugs.  See the ChangeLog for full details.  Highlights include:<br />
<ul><li>evdns is now threadsafe, with locking support</li><li>There's an evconnlistener type that you can use to abstract cross-platform differences in accepting connections.</li><li>The evbuffer interface (and therefore bufferevents) now supports zero-copy much better.</li><li>About a zillion fixes for tricky bugs in the new Libevent 2.0.1-alpha code.</li></ul><br />
Special thanks to everybody who helped find bugs and improve the code, especially James Mansion, Zack Weinberg, and Joachim Bauch. 
            </div>
        </content>
        <dc:subject>libevent</dc:subject>
<dc:subject>release</dc:subject>

    </entry>
    <entry>
        <link href="http://www.provos.org/index.php?/archives/71-Aikido-in-Hamburg.html" rel="alternate" title="Aikido in Hamburg" />
        <author>
            <name>Niels Provos</name>
                    </author>
    
        <published>2009-07-16T09:53:43Z</published>
        <updated>2009-07-16T10:03:47Z</updated>
        <wfw:comment>http://www.provos.org/wfwcomment.php?cid=71</wfw:comment>
    
        <slash:comments>0</slash:comments>
        <wfw:commentRss>http://www.provos.org/rss.php?version=atom1.0&amp;type=comments&amp;cid=71</wfw:commentRss>
    
            <category scheme="http://www.provos.org/index.php?/categories/5-News" label="News" term="News" />
    
        <id>http://www.provos.org/index.php?/archives/71-guid.html</id>
        <title type="html">Aikido in Hamburg</title>
        <content type="xhtml" xml:base="http://www.provos.org/">
            <div xmlns="http://www.w3.org/1999/xhtml">
                Yesterday, I managed to practice <a href="http://www.aikido-schule-charlottenstrasse.de/">Aikido in Hamburg</a> for the first time in almost twelve years.  The dojo at Charlottenstraße was beautiful with windows to the outside and plenty of light.   The training was interesting and very enjoyable.  I even managed to practice with a few folks from university times.  Next week, it's back to the US and Aikido practice in <a href="http://aikidomv.com/">Mountain View</a>. 
            </div>
        </content>
        <dc:subject>aikido</dc:subject>

    </entry>

</feed>