RSS Feeds

Анализ телеметрии, сетевого взаимодействия и механизма установки плагинов

Автор статьи: - Гришаев Юрий, специалист по анализу защищённости веб-приложений и ПО под Windows. Тимлид в АБП2Б. Сертифицированный специалист OSCP+, багхантер.

Remmina — популярный клиент удалённого доступа для Linux, поддерживающий RDP, VNC, SSH и другие протоколы. Он входит в стандартные репозитории многих дистрибутивов и используется для подключения к удалённым серверам и рабочим станциям.

Поводом для исследования стало предупреждение о том, что Remmina передаёт на серверы разработчика отпечаток рабочей станции. Возникли вопросы: какие именно данные собирает приложение, при каких условиях они отправляются и можно ли увидеть их содержимое?

Для проверки были изучены бинарный файл клиента, сетевые запросы и процесс формирования телеметрии в изолированной среде. Все проверки проводились на Remmina 1.4.43 из официального репозитория Arch Linux. Учётные данные в примерах синтетические.

Привет, Хабр!

Сегодня хочу рассказать про боль, которая, думаю, знакома многим, кто хоть раз сталкивался с поддержкой устаревших Windows-систем. А также про то, как небольшая консольная утилита на C# решила проблему, которая годами заставляла меня и моих пользователей хвататься за голову.

С чего всё началось

Всё началось с проекта BELPORTAL — набора решений для работы с государственными порталами Беларуси. Среди прочего там есть клиент для доступа к порталам, и вот с ним-то и возникла проблема.

Пользователи ставили BELPORTAL на Windows 7, Windows XP, на терминальные серверы — словом, туда, где всё ещё жил старый добрый софт. И примерно через одного получали вот такую картину:

Не удается установить защищенное соединение с сервером

или на более свежих системах:

Ошибка 0x800B0101

или классическое:

Сертификат сервера не является доверенным

При этом HTTP-сайты открывались, интернет работал, антивирус молчал. Но HTTPS — ни в какую.

Диагностика: в чём оказалась проблема

Копнув глубже, я выяснил банальную вещь: устаревшее хранилище корневых сертификатов. Windows хранит список доверенных корневых сертификатов в реестре по пути:

HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates

Microsoft регулярно обновляет этот список через Windows Update. Проблема в том, что:

На Windows XP Windows Update для сертификатов уже давно не работает.
На Windows 7 обновления сертификатов прекратились с окончанием поддержки.
На корпоративных машинах политиками часто отключён Windows Update целиком.
На терминальных серверах обновление сертификатов — это отдельный квест.
На изолированных системах (POS-терминалы, банкоматы, медицинское оборудование) интернета нет вообще.

Вы вводите запрос и сразу получаете готовый ответ над ссылками. Откуда он берётся, почему иногда выглядит странно и когда на него можно опереться? Собрали независимые измерения точности, разобрали, в чём спорит с исследователями сам Google, и составили понятную схему проверки: от простого факта до налогов и здоровья.

• Slovenian star is averaging 38.3 points per game

• Antetokounmpo offers high praise to fellow All-Star

Giannis Antetokounmpo has offered high praise to his fellow All-Star Luka Dončić after the Los Angeles Lakers star went on another scoring tear on Monday night.

Dončić scored 42 points in the Lakers’ 138-117 win over Antetokounmpo’s Heat to bring the Slovene’s scoring average this season to 38.3 points per game, the best in the NBA.

Beijing launches diplomatic salvo to woo Gulf leaders and bolster its influence in the region

China has held a flurry of meetings with Gulf leaders in a sign that Beijing is stepping up its diplomatic efforts in the Middle East.

The diplomatic salvo comes before a highly anticipated meeting between Donald Trump and Xi Jinping when the US president is expected to attend the Apec conference in Shenzhen, China, on 18 and 19 November.

Stopgap measure does not solve fundamental problem that millions can’t afford the healthcare they need, experts say

Some of the millions of Americans who collectively owe billions of dollars for medical expenses have seen their debt forgiven in recent years, and there has been a dramatic uptick in aid this year.

But the relief still only covers a small fraction of the outstanding balance and is just a stopgap measure that does not solve the fundamental problem: people in the US get into serious financial trouble because they can’t afford the healthcare they need, experts say.

Federal court says group likely to win its free speech claim and tells officials to approve application within seven days

A federal judge ordered state officials in Iowa on Monday to permit a local Satanic Temple organization to hold a holiday event in the rotunda of the state capitol after years of denying the group’s application.

The religious organization and Iowa Republican state officials have been in a legal battle over the group’s applications to hold a holiday event at the state capitol in recent years.

Garden Climate Assessment Tool will allow users to predict a plant’s response to the projected climate in a given location

“In the 20th century, we could pretty much grow the same things with confidence, we could learn from previous generations,” said Prof Sam Brockington, a curator at Cambridge University Botanic Garden.

“But now we’re moving into climate scenarios that we just don’t have the traditions to understand fully.”

Beijing launches diplomatic salvo to woo Gulf leaders and bolster its influence in the region

China has held a flurry of meetings with Gulf leaders in a sign that Beijing is stepping up its diplomatic efforts in the Middle East.

The diplomatic salvo comes before a highly anticipated meeting between Donald Trump and Xi Jinping when the US president is expected to attend the Apec conference in Shenzhen, China, on 18 and 19 November.

Cop30 host sets out steps to break link with coal, oil and gas as it aims to move focus from negotiating to implementing

All countries can start to break their dependence on fossil fuels now without needing to wait for new technologies or economic changes, Brazil’s government has said ahead of a global climate summit.

Brazil, the host of last year’s UN climate conference, set out the world’s first global “roadmap” for phasing out fossil fuels on Tuesday, showing that countries could boost their economies and pull people out of poverty while breaking the link with coal, oil and gas.

The Guardian’s picture editors select photographs from around the world

Elsinore is in contention for 12 Bifas, including for Scott’s highly praised performance, while Clio Barnard’s I See Buildings Fall Like Lightning, Ashley Walters’ Animol and Mike Leigh’s Tender Loving Care are also recognised

Elsinore, the drama in which Andrew Scott plays the actor Ian Charleson as he takes on Shakespeare’s Hamlet in the last months of his life, before he died of Aids in 1990, has emerged as the leading contender for the British independent film awards (Bifas).

The film, which is directed by Simon Stone and co-stars Olivia Colman, Billie Piper and Johnny Flynn, received 12 nominations, including best British independent film, best director for Stone and best lead performance for Scott. Elsinore has collected rave reviews since its premiere at the Telluride film festival in September, with the Guardian’s Benjamin Lee describing it as “a devastating movie [that] is a reminder of Charleson’s strength and the many men like him and it implores us to remember them too”. Scott is also already being tipped as the favourite for the best actor Oscar – and he would be the first out gay actor to win.

Exclusive: While tenants are challenging increases in record numbers, renters and landlords say system is ‘not working for anyone’

The rent tribunal system is “not working for anyone”, tenants and landlords have said, as rent increases of up to 88% continue to be approved despite Labour’s pledge to curb unfair rises.

Tenants are challenging rent increases in record numbers since the Renters’ Rights Act came into effect in May, making the process easier and less risky for renters.

Сотрудник с адресами, контактами и словарями: в EF Core это 54 таблицы и 31 Include, в redb Pro один класс. Замеры на 100 тыс. объектов: где кто быстрее.

Один сотрудник из наших примеров в EF Core читается 62 SQL-запросами и почти две секунды. В redb Pro тот же сотрудник, на тех же данных и в том же виде, читается за 131 мс и девять запросов, а в повторном прогоне за 36 мс и пять. Разница не в том, что один движок «быстрый», а другой «медленный». Разница в том, сколько таблиц приходится собрать, чтобы получить из базы один бизнес-объект.

Ниже разбор: что именно сравнивали, почему граф дорог в нормальной форме, как redb Pro научился читать его без полной свёртки, и где EF Core честно быстрее. Таких мест немало, и они тоже в таблицах.

Slowly cooked, sticky sausages sauteed with onion, soy and perhaps a bit of Marmite … our panel even has bangers with bangs for bonfire night

What are the best, comforting sausage dinners for autumn?
Rachel, by email
Sausages defy the seasons, being just as at home inside buns in the summer as they are simmering in stews come autumn. “Sausages are one of the most adaptable ingredients – they go with almost anything,” says Ali Stoner, author of Scran. “Obviously, there’s the classic Scottish sausage stovies, which, for me, is one of the most comforting of dishes, but then there are stewed sausages.” For this, she starts by frying sausages until “kind of browning”, then sets aside. “Caramelise lots of onions in the fat left in the pan, then stir in a little flour, pop the sausages back in with a bit of stock, a splash of soy, maybe a squeeze of Marmite – that always freaks people out – and simmer.” That’s then good to go with a big mound of mash or rice.

If it’s a sausage-and-beans kind of night, David Gingell, co-founder of Primeur, Westerns Laundry and Jolene, all in London, colours a couple of rashers of streaky bacon and some fennel sausages in a heavy-based pan. “Take them out, and you should be left with a good amount of fat in which to sweat an obscene amount of finely diced onions with some salt and a couple of crushed garlic cloves, until sticky and delicious.” Add some chopped carrots, too, should the mood take you, but Gingell often doesn’t bother. Add a good glug of cider, white wine (or sherry), followed by some bay leaves and a couple of jars of butter beans. “Pour in chicken stock, return the sausages to the pot and get them in a medium-hot oven for 30-40 minutes, until caramelising on top.” Crucially, they’ll then need a 30-minute rest: “Chop up the fried bacon, chuck that in, too, and serve with cabbage cooked with olive oil and/or butter and onions, plus a pot of mustard.”

Got a culinary dilemma? Email feast@theguardian.com

For the first time since 1937, no open permits to hunt ruffed grouse in Ohio have been issued due to falling numbers

Every November, hundreds of hunters descend on four designated wilderness areas in southern Ohio in pursuit of the elusive ruffed grouse.

But not this year.

Two days after pivotal US midterm elections, join Jonathan Freedland and our Guardian panel as they discuss the winners and losers, and what the results could mean for America – and the world.

Date: Thursday 5 November
Times: 7.30pm-9pm (GMT)

• Book tickets – in person or livestream

Donald Trump heads into these midterm contests with some of the lowest approval ratings in presidential history, finding himself on the wrong side of US public opinion on everything from AI data centres to building work at the White House. Will voters punish his party, even though his name is not on the ballot paper? Will his promise to give $5,000 to every US adult if Republicans triumph turn things around? Or do his failed attempts to ram through changes to the US voting system, coupled with the daily cost of ongoing war with Iran, mean a Democratic blue wave is now unstoppable?

Guardian columnist and host of the Politics Weekly America podcast Jonathan Freedland will join global editor Devika Bhat and the Edward Orsborn Professor of US Politics & Political History, Prof Adam Smith, in London, along with Mary Trump, clinical psychologist, author, and political commentator, Washington bureau chief David Smith and leading US commentator and co-Founder, CEO The Seneca Project Tara Setmayer live from the US. They’ll discuss the results and their implications for the future of Trump, the US and global politics. They’ll explore the key questions, ranging from the politics of artificial intelligence to whether a new age of US instability lies ahead – and ask who might succeed Trump in the White House in 2028.

Book tickets – in person or livestream

Cop30 host sets out steps to break link with coal, oil and gas as it aims to move focus from negotiating to implementing

All countries can start to break their dependence on fossil fuels now without needing to wait for new technologies or economic changes, Brazil’s government has said ahead of a global climate summit.

Brazil, the host of last year’s UN climate conference, set out the world’s first global “roadmap” for phasing out fossil fuels on Tuesday, showing that countries could boost their economies and pull people out of poverty while breaking the link with coal, oil and gas.

Привет, Хабр!

Я помню время, когда фронтендеры активно делились своими велосипедами. Буквально каждый день я встречал статьи, где автор рассказывает, какую классную штуку он придумал.

Я, конечно, не такой умный. Ничего нового я не придумал, но мне хочется показать вам мой набор базовых стилей, которые я использую для всех проектов. В нём есть старые фишки, есть малоизвестные, а есть и новые.

Давайте посмотрим, что я вам подготовил.

Elsinore is in contention for 12 Bifas, including for Scott’s highly praised performance, while Clio Barnard’s I See Buildings Fall Like Lightning, Ashley Walters’ Animol and Mike Leigh’s Tender Loving Care are also recognised

Elsinore, the drama in which Andrew Scott plays the actor Ian Charleson as he takes on Shakespeare’s Hamlet in the last months of his life, before he died of Aids in 1990, has emerged as the leading contender for the British independent film awards (Bifas).

The film, which is directed by Simon Stone and co-stars Olivia Colman, Billie Piper and Johnny Flynn, received 12 nominations, including best British independent film, best director for Stone and best lead performance for Scott. Elsinore has collected rave reviews since its premiere at the Telluride film festival in September, with the Guardian’s Benjamin Lee describing it as “a devastating movie [that] is a reminder of Charleson’s strength and the many men like him and it implores us to remember them too”. Scott is also already being tipped as the favourite for the best actor Oscar – and he would be the first out gay actor to win.

Exclusive: While tenants are challenging increases in record numbers, renters and landlords say system is ‘not working for anyone’

The rent tribunal system is “not working for anyone”, tenants and landlords have said, as rent increases of up to 88% continue to be approved despite Labour’s pledge to curb unfair rises.

Tenants are challenging rent increases in record numbers since the Renters’ Reform Act came into effect in May, making the process easier and less risky for renters.

Google выводит Dreambeans за пределы США: первым международным рынком экспериментального приложения стала Индия. Сервис создаёт иллюстрированные истории на основе информации из подключённых приложений Google. Пользователю достаточно разрешить доступ к выбранным источникам — темы для ежедневной подборки ИИ предложит сам.

В Индии Dreambeans доступно на Android и iOS пользователям от 18 лет. Приложение поддерживает английский и 13 местных языков. Вместе с новой аудиторией Google получает проверку своей идеи: насколько людям нужна лента, которая сама выбирает темы из их личной информации.

Стандартный технический скрининг и классический live coding стремительно теряют смысл: на онлайн-собеседованиях кандидаты массово используют невидимые ИИ-суфлёры (вроде Ghost GPT), а типовые алгоритмические задачки любая современная LLM решает за пару секунд. Пытаться победить это одними запретами и прокторингом — тупиковый путь. В какой-то момент мы в SymbioWay решили пойти от обратного: официально разрешили кандидатам использовать ИИ-агентов прямо на интервью, но изменили сами задачи так, чтобы без глубокого понимания архитектуры и кода нейросеть человеку не помогла. Под катом расскажу, какие навыки мы теперь проверяем у разработчиков и как устроены такие задачи.

• Father says Rachel Apa died from rhabdomyolysis

• Runner was former college athlete in ‘perfect shape’

A 24-year-old woman died after collapsing during the final stages of Sunday’s New York City Marathon, her father has said.

Rachel Apa’s father, Steve Apa, told the New York Times his daughter was in Central Park, two miles from the end of the race, when she collapsed. It was Rachel’s first marathon and she was running as part of the Parkinson’s Champions team in honor of her late grandfather, who suffered from the disease.

• Father says Rachel Apa died from rhabdomyolysis

• Runner was former college athlete in ‘perfect shape’

A 24-year-old woman died after collapsing during the final stages of Sunday’s New York City Marathon, her father has said.

Rachel Apa’s father, Steve Apa, told the New York Times his daughter was in Central Park, two miles from the end of the race, when she collapsed. It was Rachel’s first marathon and she was running as part of the Parkinson’s Champions team in honor of her late grandfather, who suffered from the disease.

Каждая новая реплика запускает то же приложение, но JIT снова с нуля ищет горячие методы, собирает профиль и компилирует код.

Казалось бы, пусть первая JVM сохранит результат, а остальные его заберут. Но машинный код JIT зависит от состояния конкретного процесса. От иерархии классов, загруженных реализаций и реального трафика.

Чтобы перенести один метод, нужно быстро проверить тысячи предположений. Причём даже полностью корректный код может оказаться медленным для другой реплики.

В статье разбираемся, почему поделиться результатами JIT гораздо сложнее, чем просто положить их в кеш.

В первой статье я запустил Директ Коммандер на Linux и сделал вывод: официальный установщик под Wine сломан везде, чинить его бессмысленно, программу надо доставать из него архиватором. Во второй выкинул из схемы Bottles и разобрал, почему не работает автообновление.

It is polling day in the US, so Jonathan Freedland is chatting to the humour writer Alexandra Petri of the Atlantic to run through this election cycle’s most effective ad campaigns, surprising alliances and embarrassing gaffes

The significance of the poet and playwright’s homosexuality was repressed in Spain for decades – but a spate of recent work, including the film La Bola Negra, is redressing the balance for a new generation

Patricia Langa parades on to an invisible stage in a basement room of Instituto Cervantes in central London, locked into the character of Conchita, a professional mourner loosely based on the sorrowful heroines of Federico García Lorca’s 1936 play, The House of Bernarda Alba.

“His voice was too loud, too queer, too alive for those around him, filled with jealousy and hatred,” she tells her imagined audience. “So they silenced him.”

One motion considers reining in political spending while another proposes to municipalize the grid in sign of anger with datacenters and high bills

Two citizen-led ballot initiatives seek to rein in Michigan’s powerful electric utilities as residents say politicians have failed to address pressing issues around controversial datacenters, high energy rates and poor electric reliability.

On Tuesday, voters statewide will consider a nation-leading ban on political donations by the state’s deeply unpopular regulated utilities. At the same time, organizers in Ann Arbor, one the state’s largest cities, are proposing to banish utility giant DTE Energy by municipalizing the grid. It would establish a public power company to deliver energy.

Расскажу  подход в оживлении цепей и функциональных блоков в своей среде разработки под ПЛК. Я не использую  никаких графических фреймворков и библиотек, тут как раз случай когда самому сделать быстрее чем изучать что то новое. Все функциональные блоки программы  отображающие в среде на ПК : рисуют примитивами (прямоугольниками, линиями, точками,текстом etc...) .