9

Air Force Veteran Wins HVAC Contractor's A/C Giveaway

Don Kuhl, a U.S. Air Force veteran and civil servant, secured the most public votes and won an a/c unit in the giveaway, which honors the sacrifices of local veterans, active-duty service members, and their families.




9

Project Files: Episode 49 — Downtown Denver Rooftop Replacement

The cooling towers located on the roof of Granite Tower in Denver were meant to last 20 years. But at nearly 40 years, the cooling towers and fluid coolers were well past their life expectancy.




9

HVAC Industry Victory Against EPA Cylinder Ban 'Official'

“While the recent news is a formality, it makes the victory over these burdensome regulations official."




9

Access Inc. Joins Johnson Controls-Hitachi Manufacturers' Sales Rep Team

Access Inc. will be the new manufacturers' representative for Hitachi VRF systems and SmartFlex™ systems in eastern Michigan and Northwest Ohio




9

Fujitsu General Mini-Split Systems Qualify for Energy Star 2019 Most Efficient Listing

Many of Fujitsu General America’s Halcyon mini-split system products now qualify for Energy Star Most Efficient certification.




9

Letters From Our Readers: December 2, 2019

I’ve heard a lot about power bills, even with new a/c units. New units show increased savings, but it’s nothing like the mini splits of today.




9

The 9 Types of Heat Pumps

As the U.S. moves toward electrification, heat pumps are becoming more popular, which will likely increase sales in the coming years. The key is to know which type of heat pump will work best for an application, as there is a wide range of equipment from which to choose.




9

Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables

Posted by Xen . org security team on Nov 12

Xen Security Advisory CVE-2024-45819 / XSA-464
version 2

libxl leaks data to PVH guests via ACPI tables

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

PVH guests have their ACPI tables constructed by the toolstack. The
construction involves building the tables in local memory, which are
then copied into guest memory. While actually used...




9

Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets

Posted by Solar Designer on Nov 12

NIST doesn't appear to provide their own CVSS vectors/scores lately.
However, they republish (with attribution) some third-party ones, this
time from CISA-ADP. The CISA-ADP CVSS vector for this vulnerability
specifies that it not only is network-reachable, but also that it has
High impact not only on Availability, but also on Confidentiality and
Integrity. This results in a CVSSv3.1 score of 9.8. Even merely
correcting the vector not to...




9

Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets

Posted by Clemens Lang on Nov 12

Hi,

I think the source for the CISA-ADP data is at [1]. For this specific CVE, the relevant file would be [2]. Their readme
has a section at the bottom, where they encourage feedback:

I’m aware of at last one prior case where a similar case of (IMHO) overblown CVSS scores was discussed in an issue on
this particular GitHub project [3].

Somebody seems to already have opened a ticket for this CVE, too: [4]

[1]:...




9

RE: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets

Posted by Joel GUITTET on Nov 12

Hello
First thanks to Alexander for reposting because I was not able to do so!
You're right Clemens, I have myself ask the question on this github
(https://github.com/cisagov/vulnrichment/issues/130), but still no information for the moment.
Joel




9

Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables

Posted by Andrew Cooper on Nov 12

Data are leaked into the PVShim guest, but it is the shim Xen
(exclusively) which has access to the ACPI tables.

The guest which has been shim'd can't architecturally access the leaked
data.

~Andrew





9

Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables

Posted by Demi Marie Obenour on Nov 12

Is this unconditional (perhaps because the relevant data gets zeroed out
by the shim), or does it only apply when the PV guest can't extract data
from the shim's memory? For instance, 32-bit PV guests aren't security
supported anymore, but the PV shim isn't supposed to rely on the
security of the shim itself, only of the rest of the system.




9

2019 Dealer Design Awards: Commercial Controls

Intuitive usability helped the CS7500 win a Gold award in The NEWS’ 2019 Dealer Design Awards in the realm of Commercial Controls.




9

Snort Subscriber Rules Update 2024-10-29

Posted by Research via Snort-sigs on Oct 29

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-firefox,
malware-cnc, malware-other, os-linux and server-webapp rule sets to
provide coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




9

possible false positive for 'INDICATOR-SHELLCODE x86 setgid 0' can someone confirm

Posted by John via Snort-sigs on Oct 29

When I attempt to download the following xz file, my IPS blocks it with the below populating the snort log. I suspect
this is a false positive unless there is some code in the xz file that is truly malicious. Can someone with more
knowledge about the rule please comment?

Link to file that triggers the match:
http://fl.us.mirror.archlinuxarm.org/armv7h/extra/qt5-base-5.15.15%2Bkde%2Br136-1-armv7h.pkg.tar.xz

Entry from snort log:...




9

Nmap 26th Birthday Announcement: Version 7.94

Posted by Gordon Fyodor Lyon on Sep 01

Dear Nmap community,

Today is Nmap’s 26th birthday, which reminded me that I hadn’t yet
announced our Nmap 7.94 release from May. And it’s a great one! The biggest
improvement was the Zenmap and Ndiff upgrades from the obsolete Python 2
language to Python 3 on all platforms. Big thanks to Daniel Miller, Jakub
Kulík, Brian Quigley, Sam James, Eli Schwartz, Romain Leonard, Varunram
Ganesh, Pavel Zhukov, Carey Balboa, and Hasan Aliyev for...




9

Nmap 7.95 released: OS and service detection signatures galore!

Posted by Gordon Fyodor Lyon on May 05

Dear Nmap Community,

I just arrived in San Francisco for the RSA conference and am delighted to
announce our Nmap Version 7.95 release! I'm most excited that we finally
tackled our backlog of OS and service detection fingerprint submissions.
We're not talking about dozens or hundreds of them-we processed more than
6,500 fingerprints!

For OS detection, we added 336 signatures, bringing the new total to 6,036.
Additions include iOS 15...




9

DOE Issues 95% AFUE Rule For New Gas Furnaces

Manufacturers will have five years, from the date the rule is published in the Federal Register, to ensure that new gas furnaces comply with the new minimum.




9

Risks Digest 34.39

Posted by RISKS List Owner on Aug 03

RISKS-LIST: Risks-Forum Digest Saturday 3 Aug 2024 Volume 34 : Issue 39

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.39>
The current issue can also be found at
<...




9

Nmap PR #2909

Posted by Vahagn Vardanian via dev on Sep 17

Hello there,
My name is Vahagn, and I am the co-founder and CTO of RedRays.
A few weeks ago, we created a pull request to Nmap Github to add a new
check for detecting the most popular information disclosure in SAP systems.

You can get list of SAp systems using this google dork: inurl:/irj/portal
Thank you




9

Re: Nmap PR #2909

Posted by Sinan Doğan on Oct 21

thanks

Vahagn Vardanian via dev <dev () nmap org>, 17 Eyl 2024 Sal, 18:59 tarihinde
şunu yazdı:




9

Old Infosec Talks: Metlstorm's Take on Hacky Hacking

Posted by Dave Aitel via Dailydave on Oct 31

The Anatomy of Compromise

One of my demented hobbies is watching old infosec talks and then seeing
how well they hold up to modern times. Recently I excavated Metlstorm's
2017 BSides Canberra
<https://www.youtube.com/watch?v=OjgvP9UB9GI&list=TLGGvAY1CcIr-AcyNjEwMjAyNA>
talk on "How people get hacked" - a pretty generic topic that gives a lot
of room for opinion, and one a lot of people have opined on, but the talk
itself...




9

Episode 9: Remoting Pt.1 and Listener Feedback

This Episode as well as the next one take a look at remoting infrastructures such as CORBA, .NET Remoting or Webservices. In this first part we will take a look at why remote communication is necessary in the first place, what remoting middleware can do for you as well as which other middleware technologies exist in addition to OO-RPC systems, such as messaging middleware. Finally, we conclude with a brief overview of what the broker pattern can do for us in the context of remoting middleware.




9

Episode 19: Concurrency Pt. 2

In this second part of our concurrency series Michael and Alexander talk about basic patterns for concurrent programming, such as Active and Monitor Object, Scoped Locking and Futures. Further, they discuss some architectural considerations regarding the number of threads and resource usage in general. For more information, see the references for part one as well as the following links




9

Episode 29: Concurrency Pt.3

The third part of our concurrency series by Michael and Alexander discusses how to build highly scalable servers. The discussion focusses especially on event-driven servers. As possible solution patterns a reactor-based design is suggested along-side several patterns for multi-threading issues: Reader/Writers Locks, Thread Pools, and Leader/Followers.




9

Episode 39: Interview Steve Vinoski

This episode is an interview with Steve Vinoski. Steve works as the Chief Engineer for IONA. He's what you'd call a middleware guru, he was for example deeply involved with CORBA. So, this interview centers mainly around middleware. We begin by talking about his own history wrt. middleare and ORBs and how ORBs evolved over time. We then talked about whether coarse-grained, stateless components might be a better abstraction for distributed systems than "objects". We then covered the future of CORBA, it's use in ethe embedded space as well as the practical relevance of the POSA patterns when building ORBs. Then we switched topics and addressed the role of web services as a "middleware middleware" and the maturity of WS-* specifications. We then looked at what Steve is working on these days, which is e.g. the Advanced Message Queueing Protocol (AMQP) as well as dynamic languages. We concluded the interwiew with his view on SOA.




9

Episode 49: Dynamic Languages for Static Minds

In this Episode we talk about dynamic languages for statically-typed minds, or in other words: which are the interesting features people should learn when they go from a langauge such as Java or C# to a language like Python or Ruby. We used Ruby as the concrete example language.

We started the discussion about important features with the concept of dynamically changing an object's type and the idea of message passing. We then looked at the concepts of blocks and closures. Next in line is a discussion about functions that create functions as well as currying. This lead into a quick discussion about continuations. Open classes, aliasing and the relationship to AOP was next on our agenda.

We then looked considered a somewhat more engineering-oriented view and looked at the importance of testing and what are the best steps of getting from static programming to dynamic programming. Finally, we discussed a bit about the current (as of October 2006) state of dynamic languages on mainstream platforms.




9

Episode 59: Static Code Analysis

This episode is a discussion with Jonathan Aldrich (Assistant Professor at CMU) about static analysis. The discussion covered theory as well as practice and tools. We started with an explanation of what static analysis actually is, which kinds of errors it can find and how it is different from testing and reviews. The core challenge of such an analysis tool is to understand the semantics of the program and reduce its possible state space to make it analysable - in effect reconstructing the programmer's intent from the code. The user can "help" the tool with this challenge by using suitable annotations; also, languages could do a better job of being analysable. The conceptual discussion was concluded by looking at the principles of static analysis (termination, soundness. precision) and how this approach relates to model analysis. The second more practical part started out with a discussion of how Microsoft successfully uses static analysis in their Windows development. We then discussed some of the tools available; these include Findbugs, Coverity, Codesonar, Clockwork, Fortify, Polyspace and Codesurfer. To conclude the discussion of tools, we discussed the commonalities and differences with architecture visualization tools as well as metrics and heuristics. Part three of the discussion briefly looked at how to introduce static analysis tools into an organization's development process and tool chain. We concluded the discussion by looking at situations where static analysis does not work, as well as at the FLUID research project at CMU.




9

Episode 69: Nico Josuttis on SOA (SOA Pt. 3)

This Episode is part five in our (probably ongoing) series on service oriented architecture. In this episode we talk to Nico Josuttis, who has recently published a book on this topic. As its title "SOA in Practice" suggests, it is a very pragmatic book based on Nico's experience as architect and project lead in a number of enterprise-level projects - not all of them had been called SOA, since they at the time the term was not yet coined. The episode discusses some technical aspects of SOA (such as loose coupling, messaging and ESBs), but mainly focusses on non-technical aspects of implementing an SOA.




9

Episode 79: Small Memory Software with Weir and Noble

In this Episode we're discussing patterns for small memory software with the authors of the like-named book Charles Weir and James Noble. We look at various aspects of the small memory problem: How can you manage memory use across a whole system? What can you do when you have run out of primary storage? How can you fit a quart of data into a pint pot of memory? How can you reduce the memory needed for your data? How do you allocate memory to store your data structures? Answers to all those questions are provided in this Episode, and of course in their book.




9

Episode 89: Joe Armstrong on Erlang

In this Episode we're talking about Erlang with its creator Joe Armstrong. We started by looking at the history of the Erlang language and why it is so relevant today. We then looked at Joe's approach to Concurrency Oriented Programming and its main ingredients: share nothing, lightweight concurrency and pure message passing. We also compared this to the classic shared memory approach to concurrency. We then looked at other interesting aspects of Erlang, such as its functional nature (and why this is important to concurrency) and pattern matching. Next we discussed how to implement distribution and fault tolerance, and we took a look at OTP, the "application server" for Erlang. We concluded the conversation with a littel discussion about how Erlang was designed, it's current community as well as its future.




9

Episode 90: Product Line Engineering, Pt. 3, with Charles Krueger

In this episode Charles Krueger, a well-known member of the product line engineering community, talks about his long term experiences in the field. Charles is also the founder and CEO of a company that provides tooling for variability management and product derivation. Besides some clarifications on terms like product line architecture and reference architecture, you also learn what kind of preconditions need to exist before product line engineering can be applied successfully.




9

Episode 91: Kevlin Henney on C++

In this episode, we talk with Kevlin Henney about the C++ programming language. We look at the history and the culture of the language, and how it went through several phases in its evolution. We also take a look at some of the special language features of C++ and their overall influence.




9

Episode 92: Introduction to Game Development

In this Episode, Arno talks with Oliver Jucknath about the art of writing computer games. A lot of myth is attached to this area of computing, and while a game technically is just another program, it is written in a different context than typical business applications. This is true at the code level, where aggressive optimization is a focus throughout development. It also applies at the team level, where collaboration between specialists is pronounced. And the business context is different as well, which in turn influences the development effort as a whole.




9

Episode 93: Lessons Learned From Architecture Reviews with Rebecca Wirfs-Brock

In this episode, Markus talks to Rebecca Wirfs-Brock on what she has learned from architecture reviews. This is a very complement to the earlier episode on architecture evaluation.




9

Episode 94: Open Source Business Models with Dirk Riehle

In this episode we're talking to Dirk Riehle about open source business models. We started looking at the way OS projects work and defined different kinds of open source projects. In the main part of the discussion we looked at various ways of how to make money with open source: consulting, support contracts, commercial variant of an open source project, etc. We then looked at the chances and risks of each of these approaches. The next part focused on different open source licenses and how they are suitable for open source business. We concluded the episode by discussing a couple of specific questions and loose ends. After the show, Dirk informed me about the following three corrections: Black Duck Software's main product is called protexIP not IP Central, there are presently 70 licenses approved by the Open Source Initiative, and EnterpriseDB has so far acquired $37M in venture capital




9

Episode 95: The New Guardian.co.uk website with Matt Wall and Erik DoernenBurg

In this episode we talk to Matthew Wall (Guardian News and Media) and Erik Doernenburg (Thoughtworks) about their work on the new guardian.co.uk website. We discuss the challenge of scalability and interactivity, their use of Domain Driven Design, some of the technical building blocks as well as the approaches they use for performance measuring and scalability tuning.




9

Episode 96: Interview Krzysztof Czarnecki

This episode is the long-awaited (and much requested) interview with Krzysztof Czarnecki, the author, together with Ulrich Eisenecker, of the book Generative Programming. In the interview we discussed the state of generative programming today and related it to model-driven development and DSLs. We then talked a little bit about product lines in general. We then discussed his current field of research, which currently focusses on framework-specific modeling languages and non-trivial roundtrip engineering.




9

Episode 97: Interview Anders Hejlsberg

In this episode we have the pleasure of talking to Anders Hejlsberg, Chief Language Strategist at Microsoft. We started by discussing his more distant past, namely, his involvement with Turbo Pascal and Borland's Delphi. We then looked at the influences Delphi had on C# and how C# evolved from Delphi. In the next section we discussed a couple of general language design issues, among them components and checked vs. unchecked exceptions. Next, we discussed interesting issues about languages of the future, static vs. dynamic typing, functional programming, meta programming as well as the importance of good support for concurrency. We concluded the discussion by looking at the interplay between languages and IDEs.




9

Episode 98: Stefan Tilkov on REST

In this episode we discuss REST (Representational State Transfer) with Stefan Tilkov. We started out by discussing the 5 steps to REST: IDs, links, Standard Methods, multiple representations and stateless communication. We then looked at how to use HTTP for REST, and discussed about how to use it for Web Services. We then we discussed whether and how to use REST for enterprise applications, and not just for apps on the internet. We concluded the discussion with a couple of recommendations.




9

Episode 99: Transactions

This episode takes a close look at transactions from different angles, starting with their fundamental properties of Atomicity, Consistency, Isolation, Durability but also investigating advanced topics like distributed or business transactions.




9

Episode 109: eBay’s Architecture Principles with Randy Shoup

In this episode we discuss with Randy Shoup, Distinguished Architect at eBay, about architectural pinciples and patterns used for building the highly scalable eBay infrastructure. The discussion is structured into four main ideas: partition everything, use asynchrony everywhere, automate everything, and design the system keeping in mind that everything fails at some point in a large distributed system.




9

Episode 119: DSLs in Practice with JP Tolvanen

In this episode, Markus talks with Juha-Pekka Tolvanen about using DSLs and code generation in practice. The main part of the episode is the discussion about a number of case studies that show how DSLs and code generation are used in practice.

  • Omega Tau, Markus' new podcast mentioned in the beginning of the show



    9

    Episode 129: F# with Luke Hoban

    This episode is a discussion about F# with Microsoft's F# program manager Luke Hoban.




    9

    Episode 139: Fearless Change with Linda Rising

    This episode is once again with Linda Rising, this time on the book she coauthored with Mary Lynn Manns on introducing ideas into organizations. The talk is another one of the SE Radio Live sessions recorded at OOP 2009 - thanks to SIGS Datacom and programme chair Frances Paulisch for making this possible.




    9

    Episode 145: Spring in 2009 with Eberhard Wolff

    In this episode we discuss the current state of the spring framework. We talk about core features (dependency injection, AOP) but also about the spring universe, i.e. some of the more specific frameworks such as Spring Batch.




    9

    Episode 146: Interesting Patterns at EuroPLoP 2009

    This episode is a discussion with various authors of patterns reviewed at EuroPLoP 2009. Topics include Product Line Engineering, Distributed Development, Open Source and Embedded Systems




    9

    Episode 149: Difference between Software Engineering and Computer Science with Chuck Connell

    Michael discusses with his guest Chuck Connell the differences between software engineering and computer science. What makes software engineering so unpredictable, with so few formal results? And how can we advance the field of software engineering without these results?