Apple provides so many services for different parts of macOS that it’s hard to keep track of them. If you want to see a short summary, this article lists all service connections for enterprise network administrators, although it doesn’t detail which services use which servers, for example referring to “macOS updates” in many entries.
Many of you seem surprised to learn that Sequoia’s new XProtect updates come from iCloud, although Apple has been using iCloud for similar purposes for at least the last five years.
One good example that’s used every day on your Mac are the notarization checks sometimes run by Gatekeeper when macOS launches executable code, such as an app. In that case, com.apple.syspolicy processes the app’s notarization ticket looking up ticket: <private>, 2, 1
by trying to fetch its record from iCloud using CloudKit. That’s followed by log entries indicating the network access required to connect with iCloud and check the ticket. Success is reported by com.apple.syspolicy in CKTicketStore network reachability: 1, Mon Aug 26 09:15:45 2024
looking up ticket: <private>, 2, 0
and further lookups. I first reported those checks with iCloud back in Catalina, in 2019.
A simple way to illustrate the differences between this and using the general softwareupdated service is to compare what happens in the log when you ask if there are any updates available.
softwareupdate
When SilentKnight does this, it uses the only supported method, the softwareupdate tool, as used to keep XProtect up to date in all versions of macOS prior to Sequoia. That command hands over to the softwareupdated service to run the check. That in turn uses components of com.apple.SoftwareUpdateController to summarise the update state of that Mac, connect to the Software Update Server, check all the current versions and build numbers of macOS and its ancillaries, and arrive at a list of updates required. This is even more complex than it sounds, as com.apple.SoftwareUpdateController has to check key settings such as whether the root volume is sealed or not.
You can trace this through several thousand log entries, and after around 4.4 seconds and multiple network connections, softwareupdate finally informs SilentKnight that there are no updates available.
xprotect
Running the command sudo xprotect check
in Sequoia is far simpler and quicker, as it checks for just one component’s updates through iCloud. The command connects to XProtectUpdateService in the XprotectFramework private framework in macOS, which in turn fires up CloudKit to connect to iCloud. That fetches a database record and returns the result to XProtectUpdateService, and so back to the xprotect tool as its result. Total time taken is 0.5 second.
As Apple’s intent in changing the management of XProtect and its data appears to be to facilitate more frequent and macOS-specific updates, iCloud is an ideal platform to host this on.
Pinniped with tusks
There is, though, one last thing: what is the walrus? As that might seem an odd question, read these two log entries encountered when browsing what happened with the xprotect check command:
12:08:00.919841 com.apple.cdp XPC Error while fetching walrus status: Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.apple.cdp.daemon was invalidated: failed at lookup with error 3 - No such process." UserInfo={NSDebugDescription=The connection to service named com.apple.cdp.daemon was invalidated: failed at lookup with error 3 - No such process.}
12:08:00.919845 com.apple.cloudkit CoreCDP reports that walrus is undetermined for the logged in account. Error: Error Domain=NSCocoaErrorDomain Code=4099 UserInfo={NSDebugDescription=<private>}
The prospect of an undetermined walrus that can’t be fetched from inside my Mac might seem worrying
Following the conundrums of the group portraits of the first of these two articles, this shows some that appear more straightforward, although they still need to be approached by asking who, where and when.
Raphael’s Portrait of Pope Leo X with Cardinals Giulio de’ Medici and Luigi Rossi (1517-19) groups its three figures closely together. The Pope sits not on a throne, but more informally, a magnificent illuminated book (thought to be the ‘Hamilton’ Bible from about 1350) open in front of him and a magnifying glass in his left hand.
Augustin Théodule Ribot’s Breton Fishermen and Their Families (c 1880-85) is a gritty collection of nameless faces from the coast of the north-west of France. Their features are as hard as the weather that they must have faced.
Moving towards the end of the nineteenth century, and to the artist’s colony of Skagen at the northern tip of Jutland in Denmark, we come to PS Krøyer’s magnificent group portrait of many of the Nordic Impressionists who gathered there each summer. From the left, moving around the table, this shows: Martha Møller Johansen, Viggo Johansen, Christian Krohg, PS Krøyer, Degn Brøndum, Michael Ancher, Oscar Björck, Thorvald Niss, Helene Christensen, Anna Ancher, and Helga Ancher. While this may appear a spontaneous record of an actual event, in fact it was over four years in the painting, and it seems unlikely that this group ever met in these circumstances.
The French Naturalist artist Pascal Dagnan-Bouveret was technically one of the most brilliant of all Cabanel’s students. He could achieve realism of photographic quality, as shown appropriately in this Wedding at the Photographer’s from 1879. Here is a painted group portrait of a couple and their family being photographed for their group portrait.
Many of the greatest portrait painters also created fine group portraits.
Some of Sir Godfrey Kneller’s many portraits of the British gentry include children or groups, such as The Harvey Family, painted in 1721.
In Sir Joshua Reynolds’ portrait of Lady Elizabeth Delmé and Her Children (1777-9) his brushwork becomes painterly for their clothes and in the background.
Élisabeth Louise Vigée Le Brun painted more than thirty portraits of Marie Antoinette (1755-1793), wife of King Louis XVI, who was guillotined on 16 October 1793 during the French Revolution. This family portrait from 1787 shows Marie-Antoinette de Lorraine-Habsbourg, Queen of France, and Her Children. Vigée Le Brun started work on this on 9 July 1786, her sitter choosing a red dress fit for a queen. With her are Marie-Thérèse, the Duchess of Angoulême, Louis-Charles, who was to become Louis XVII of France, and Louis-Joseph, who became the Dauphin. The empty cradle was for Marie-Sophie-Béatrice, who died on 19 June, shortly before she would have been one.
My final paintings are all by artists of their families.
Benjamin West’s group portrait of The Artist and His Family from about 1772 gives insight into his peculiar circumstances. It shows, from the left, the Wests’ older son, Benjamin West’s wife Betsy, cradling their newborn second son in her lap, Benjamin West’s brother Thomas, and father John (who had been born in England), and standing in his lavender gown, holding palette and maulstick, is the artist himself.
Often compared with a traditional Nativity scene, it was described at the time as a “neat little scene of domestic happiness”. But looking at the directions of gaze, and the extraordinary detachment of Thomas and John West, who are staring into the distance, domestic happiness seems far away.
The short-lived Philipp Otto Runge painted this group portrait of We Three in 1805, the year after he had finished his Academy training, and shortly after his marriage. This shows his older brother Johann Daniel on the left, with the artist and his bride Pauline. This may have been painted after the couple had moved back to Hamburg later that year, although they soon returned to live with his parents in Wolgast.
During the summer of 1867, Frédéric Bazille started work on Portraits of the *** Family also known as The Family Gathering, which he didn’t complete until January 1868. This seems to have been one of his most carefully composed paintings, and he devoted a series of sketches to getting the arrangement of the figures and the terrace just right.
The figures include the artist, squeezed in last at the extreme left, an uncle, Bazille’s parents seated on the bench, Bazille’s cousin Pauline des Hours and her husband standing, an aunt and Thérèse des Hours (model for The Pink Dress) seated at the table, his brother Marc and his partner, and at the right Camille, the youngest of the des Hours sisters. This painting marked a special version of a regular summer meeting, as Pauline des Hours and Bazille’s brother Marc married the partners shown in the late summer of 1867.
At the time, such group portraits were exceptional in French art. It was exhibited at the Salon in 1868, and remains one of Bazille’s finest and most innovative works.
By contrast, Michael Peter Ancher’s family portrait on Christmas Day 1900, completed in 1902, looks funereal. A family bible is open on the table as they gaze grimly away from the magnificent triptych of waves behind them. I believe that the woman at the far right is Anna Ancher, then aged 40; she wears a distinctive necklace with an anchor, the Danish for which is anker.
One of Lovis Corinth’s most popular paintings from the early years of the twentieth century is this group portrait of The Artist and his Family (1909). All dressed up for what may have been intended to be a more formal group portrait, the artist’s wife Charlotte sits calmly cradling their daughter Wilhelmine, then just five months old, as the artist is struggling to paint them. Their son Thomas, aged five years, stands on a desk so that he can rest his hand on mother’s shoulder.
This week’s two articles about reading paintings consider some of the more famous and unusual depictions of the likenesses of three or more people. Individual portraits have long been popular, and for many artists have brought in the income they’ve needed to paint as a career. Painting three or more portraits in a single image presents greater challenges, and in many cases complicates their reading considerably. Among the paintings included in today’s article are some of the hardest of all to read, that remain controversial.
The first and key step in starting to read a group portrait is to discover who, where and when. For some, a little digging around in contemporary historical records may be sufficient.
When Lavinia Fontana was in Rome, she painted the remarkable family Portrait of Bianca degli Utili Maselli with six of her children (1604-5), showing this nobleman’s wife, five of her sons, and her daughter Verginia, whose image is labelled to distinguish her from her brothers. The mother died in September 1605 after giving birth to her nineteenth child. Their lapdog was a sign of fidelity, and Fontana’s depiction of clothing exquisite.
In 1617, Michiel van Mierevelt and his son Pieter, specialists in portraiture, painted The Anatomy Lesson of Dr. Willem van der Meer, one of the earliest portraits of a social group from the Dutch Golden Age. The members of this group are all ignoring the cadaver in front of them, preferring to look at the painter, and are thought to be members of the Surgeons’ Guild of the city of Delft, who commissioned this work.
Rembrandt painted his Anatomy Lesson of Dr. Nicolaes Tulp in 1632, as an early commission soon after his arrival in Amsterdam. It’s a group portrait of distinguished members of the Surgeons’ Guild in their working environment. Most remarkable is the fact that its principal, Dr Tulp, and most of his colleagues aren’t looking at the dissected forearm.
A decade later, Rembrandt’s vast group portrait of The Night Watch (1642) is perhaps the most famous of them all, although it’s more correctly titled Militia Company of District II under the Command of Captain Frans Banninck Cocq. It features the commander and seventeen members of his civic guard company in Amsterdam, and took the artist three years to complete from his first commission to paint this for display in the great hall of the guards.
Captain Frans Banninck Cocq (in black with a red sash), followed by his lieutenant Willem van Ruytenburch (in yellow with a white sash) are leading out this militia company, their colours borne by the ensign Jan Visscher Cornelissen. The small girl to the left of them is carrying a dead chicken, a symbol of arquebusiers, the type of weapon several are carrying.
Portraits of royal families have been regular commissions for their court painters. The best of these have greater artistic merit. Diego Velázquez’ Las Meninas, translated as The Maids of Honour, from about 1656-57 is another well-known example of a group portrait. In what is overtly a depiction of eleven people and a dog in a room in the Alcázar Palace, he uses composition and gaze to tell us more. Much depends on what we believe most of the figures are looking at. Reflected in the rectangular plane mirror on the far wall are King Philip IV and his wife Queen Mariana of Austria.
There has been dispute over whether the reflection shows the royal couple stood where the viewer is, or the mirror is reflecting their painted images on Velázquez’s canvas. How their images were generated is probably of secondary importance, as either way the gaze of most of the other figures is clearly directed not at the viewer, but at the King and Queen, who may be getting up to leave after sitting for Velázquez to paint them. In this reading, the most important people not in the painting only appear in reflection and the gaze of others.
In April 1800, Francisco Goya was commissioned by King Carlos IV to paint a family portrait, which proved to be the last of his royal commissions before the war with France, and his most important. It’s often said that Goya’s inspiration for his large canvas of Carlos IV of Spain and His Family (1800-01) was Las Meninas, but what he has painted is different in almost every respect other than the fact that the artist has taken the opportunity to include a self-portrait of himself painting the painting, as it were. Goya captures a moment of optimism when Spain and France were allies, and portrays his royal figures in stark reality.
In the mid-nineteenth century Gustave Courbet’s Painter’s Studio proved a turning point. One of the most unconventional group portraits, it influenced successors including Henri Fantin-Latour.
The Painter’s Studio from 1855 is one of the great ‘problem paintings’ that has been extensively analysed and ‘explained’ as allegory. Those classical approaches have recently been challenged by Herbert, who argues that trying to determine whether it is allegorical or realist is asking the wrong question.
The figures in the painting show individuals who had influence over Courbet’s life and artistic career. At the right are the artist’s friends and admirers, including his first patron Alfred Bruyas, critics Champfleury and Baudelaire who had been so positive in their reactions to his work, and others. At the left, a man with dogs has been interpreted as an allegory of the Emperor Napoleon III. Behind him are figures who were long assumed to be allegorical, but Hélène Toussaint has identified them as contemporary people, most of whom had been supporters of the Emperor’s regime.
Following a long series of studies, Henri Fantin-Latour’s first group portrait Homage to Delacroix was completed almost ten years later, in 1864. Its figures include two, Champfleury and Baudelaire, who had appeared in Courbet’s Painter’s Studio, together with those who Fantin rated as the brightest and best among modern painters, including his friends Whistler and Manet. Inevitably he included himself among such distinguished company.
But Fantin neither poses the puzzle of Courbet’s allegory, nor the social gathering of Manet’s Music in the Tuileries. Instead we have seven men looking at the viewer, and three gazing somewhere else. It almost looks like a ‘real’ group portrait, but lacking interactions between the figures, it’s clear that it’s eleven individual portraits, including that of Delacroix.
Fantin pressed on with his unusual group portraits, here in Studio at Les Batignolles from 1870, showing his friend Manet painting with a small group of friends peering over his shoulders. Its debt to Courbet is palpable. The figures were identified by the artist as:
Otto Schölderer (standing, left),
Pierre-Auguste Renoir,
Émile Zola,
Edmond Maître,
Frédéric Bazille,
Claude Monet (standing, right),
Édouard Manet (seated, left)
Zacharie Astruc (seated, right).
As a window into history, this is unique, showing Manet, Renoir, Zola, Bazille (who was to die that November in the Franco-Prussian War) and Monet in a fictional snapshot; it also inspired Bazille to paint a response and seems to have struck a chord with both artistic circles and the critics of the day. Although Fantin has integrated his figures better than in earlier paintings, this begs many questions such as what they’re all doing together, and whether the painting is about homage to Manet, who was still very much alive, or the meeting of an imaginary gentlemen’s club.
The sixth and last of Fantin’s group portraits, Around the Piano from 1885, shows members of a Wagner fan club in Paris at the time. They are each gazing at something different and not interacting in the least. Emmanuel Chabrier is playing the piano without looking at its keyboard or the music, and its other figures (bar one) appear distracted.
Maurice Denis was one of the few artists to take a deep interest in the late paintings of Paul Cézanne, and in 1900 paid his respects (although Cézanne didn’t die until 1906) in this Homage to Cézanne. The artist to whom this group of Nabis are paying their respects is represented by a painting, Cézanne’s Fruit Bowl, Glass and Apples. Although not entirely cohesive as a group, there are clear interactions taking place, and gazes reflect that, with Odilon Redon at the left and Paul Sérusier (foreground, at the right edge of the painting) clearly engaged with one another.
In 1902-03, Félix Vallotton painted a smaller group of Nabis in his Five Painters. Only Édouard Vuillard and Ker-Xavier Roussel seem to be joined in discussion, and there’s a strange array of hands around the centre of the canvas.
Tomorrow I’ll look at more conventional group portraits, including some featuring the families of artists.
尽管众多以文生图的 Ai 工具已经大幅度降低了创作门槛,但是在那之前,各种咒术、法门终究是拦住不少普通人接触 Ai 绘画的一块巨石。我自己也曾在用过某些 Ai 工具后,在一条展示初次接触的创作成果的视频里提醒大家,不要忽视它,但也不要过分害怕它。它一定会给我们的生活带来巨大的变化,只是目前还没积累到那一刻,仅此而已。
如果说有什么场景,类似发红包那样简单明了,人人都可以参与,我觉得有一个非常合适的应用场景,那就是用 Ai 生成定制头像。对于不具备绘画能力、不懂念咒语、不会使用绘图软件的大多数人而言,Ai 画头像就是各类修图美容软件一级的场景,既有尝新和娱乐,也有充分的社交属性,和红包非常相似。
最近试用了一下漫镜,一个感觉是,神情抓得不错,风格也足够多,用它来探索自己不同造型的可能性,还是挺有启发的!因此中途我想到一件事,如果这类产品的效率再高一些,跟各大连锁发型屋合作,预约时就上传几张照片,生成几套发型方案,人到了现场就让托尼老师根据效果图来剪,这不是非常好的体验升级么?谁说 Ai 必然逼得人失业呢?还得是看人怎么用。
因为我的 Home Assistant 是通过 Docker 安装的 HA Core,不支持 Add On,所以这里需要通过 Docker 来进行安装,之前提到过,我的 Home Server 运行的是 NixOS,所以可以很方便的配置 Docker,具体的配置项如下,将其改为 Docker Compose 也很方便,所以这里不再提供。
The Free and Prosperous Commonwealth ——An Exposition of the Ideas of Classical Liberalism 其它英文名: Liberalism ——The Classical Tradition Liberalism, a Socio-Economic Exposition
Fermat's Last Theorem ——The Story of a Riddle That Confounded the World's Greatest Minds for 358 Years 其它英文名: Fermat's Enigma ——The Epic Quest to Solve the World's Greatest Mathematical Problem
Thinking in Complexity ——The Computational Dynamics of Matter, Mind and Mankind 其它英文名: Thinking in Complexity ——The Complex Dynamics of Matter, Mind and Mankind
UNIX Systems Programming ——Communication, Cocurrency and Threads 其它英文名: Practical UNIX Programming ——A Guide to Concurrency, Communication and Multithreading
去年11月,苹果用户在一次影响广泛的宕机事故后才知道:苹果监视了用户打开和启动的每一个应用程序(编程随想注:上一期谈过这个重大丑闻【OCSP 事件】)
苹果为什么要这么做?最为善意的猜测是:此举旨在更早发现恶意程序。在一个充斥着恶意的网络世界里,这么做是必要的。安全专家 Bruce Schneier 将这种现象形容为“封建式安全”。
生活在21世纪的我们,面临各种数字强盗的围攻。从身份窃贼,到跟踪者,到企业和政府间谍,到骚扰者。我们是没有办法自保的。即使是身经百战的专家也无法和强盗相抗衡。为了抵抗强盗,你必须做到完美,不犯任何错误。而强盗只要抓住一个错误就能逮住你。因此为了安全起见,你必须和数字军阀结盟。苹果、Google、Facebook 和微软等建立了庞大的要塞,它们投入了大量金钱招募了最强的雇佣兵来保护要塞,为客户(包括你)抵御攻击者。
但如果军阀们转向了你,你对它们而言将是赤裸裸的。这种敌我难辨的情况在与军阀打交道的过程中一直发生着。比如 Google 调整 Chrome 以阻止商业监视(但不阻止它自己的商业监视)。Google 会努力阻止其他人监视你,但如果他们付钱了,Google 就会允许他们监视你。
如果你不在乎被 Google 监视,如果你信任由 Google 判断谁是骗子谁不是,那么这没问题。但如果你们之间存在不一致的意见,那么输的肯定是你。苹果在2017年按中国要求从其应用商店下架了保护隐私的工具。原因是苹果必须遵守中国的法律,它在中国有公司,有制造基地。军阀自身的安全是远甚于客户的。
编程随想注:
俺的观点是:要善于【扬长避短】——既要利用大公司提供的某些优质服务,同时又不让大公司窥探你的隐私。
当然啦,要做到这点,需要一些经验&技巧。
就拿本人的亲身经历举例——
一方面,俺用着 Google 的博客平台 Blogspot(它的安全性足够好,而且能抵御【国家级】的 DDOS 攻击)。
另一方面,俺不用 Google 搜索(俺用的是 Startpage,其搜索质量等同 Google);另外,俺也不使用 Google 开发的 Chrome 浏览器。
编程随想注:
该漏洞编号 CVE-2021-24093,影响 Windows 10 & Windows Server 2016。这是 Google 安全研究人员在去年11月发现并报告给微软。而微软直到今年(2021)2月的例行更新才修复。
漏洞位于 DirectWrite API 进行字体渲染的代码中(缓冲区溢出)。Windows 平台上的浏览器(Chrome、Firefox、Edge、IE)都会使用系统提供的 API 进行字体渲染,因此都会受此影响。
为了利用这个漏洞,攻击者可以创建一个 Web 页面,其中包含精心构造的字体,然后诱导受害者访问该页面。当受害者的浏览器打开该页面时,就中招了。由于此漏洞针对“字体渲染”,与 JS【无关】。因此,即使浏览器禁用了 JS 脚本,还是会中招。
在上一期的《近期安全动态和点评(2020年4季度)》中,俺介绍过另一个漏洞 CVE-2020-15999,与这个很类似。CVE-2020-15999 位于“FreeType 字体渲染库”。也是利用“Web 页面的字体”来实现远程代码执行。
在上一期,俺说过如下这句,今天再次贴出来:
假如你很注重安全性,为了更彻底地消除【字体】导致的攻击面,你可以定制浏览器,禁止在 Web 页面中加载外来的字体。
对 Firefox 的深度定制,可以参考教程《扫盲 Firefox 定制——从“user.js”到“omni.ja”》;对其它浏览器的深度定制,俺暂时还没写过教程。
The two RCE(注:Remote Code Execution)vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely in the short term. We believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release.
KrebsOnSecurity 援引消息来源报道,至少三万家美国机构——包括大量的小企业和各级政府被黑客组织利用微软电邮软件 Microsoft Exchange Server 的漏洞入侵。
微软本周披露,黑客正在利用 Exchange Server v2013 到 v2019 中的四个 0day 漏洞。在漏洞披露的三天内,安全专家称:同一黑客组织增加了对尚未修补的 Exchange 服务器的攻击,在入侵之后攻击者留下一个可以后续访问的 web shell。微软表示正与美国网络安全和基础设施安全局密切合作,为客户提供最佳的指南和缓解措施。
......
这些漏洞(CVE-2021-27363、CVE-2021-27364 和 CVE-2021-27365)存在于内核的 iSCSI 模块中。虽然在默认情况下该模块是没有被加载的,但是 Linux 内核对模块“按需加载的特性”意味着它可以很容易地被本地触发。安全专家在 Red Hat 所有已测试版本和其他发行版本中发现这些漏洞。
在 GRIMM 博客上,安全研究员 Adam Nichols 表示:“我们在 Linux mainline 内核的一个被遗忘的角落里发现了3个 BUG,这些 BUG 已经有15年的历史了。与我们发现的大多数积满灰尘的东西不同,这些 BUG 依然存在影响,其中一个可以作为本地权限升级(LPE)在多个 Linux 环境中使用”。
......
DNS-over-HTTPS(DoH)加密了 DNS 请求, 被用于规避 DNS 污染。
根据 greatfire.org 的测试结果:NextDNS、Quad9、AdGuard 在近日被屏蔽。防火墙对这些域名没有使用 DNS 污染, 而是使用检测 SNI 和 IP 黑洞的方法。Cloudflare 的 DoH 服务器还没有被屏蔽。
Google 周一宣布它可能找到了 cookies 的隐私友好替代。它测试了名为 Federated Learning of Cohorts(FLoC)的新 API,其源代码发布在 GitHub 上。
测试显示,相比基于 cookies 的广告,FLoC 广告的转化率至少达到 95%。FLoC 使用机器学习算法分析用户数据,然后根据用户访问的网站,将数千用户分成一组。数据是浏览器在本地收集的不会分享出去,但这群用户的数据会共享并被用于定向广告。也就是说 FLoC 广告是根据人们的普遍兴趣进行针对性展示。
编程随想注:
这个玩意儿到底是不是“隐私友好”?目前俺了解有限,暂时无法从技术角度发表意见。
考虑到 Google 的商业模式(主要利润来自于【在线广告收入】),俺不太相信所谓的“隐私友好”。
Google 在今年初宣布了 Cookies 的替代 Federated Learning of Cohorts (FLoC),声称它对用户隐私更为友好。但这一计划引发了美国司法部调查人员的关切,调查人员一直在问询广告行业的高管,以了解 Google 此举是否会妨碍规模较小的竞争对手。
消息人士表示,司法部调查人员的询问涉及到 Chrome 的各种政策,包括与 cookies 相关的规定,对于广告和新闻产业产生哪些影响。
Chrome 浏览器的全球市占率约 60%。消息人士并指出,调查人员正询问 Google 是否利用 Chrome 来避免对手广告公司通过 cookies 追踪用户,同时留下漏洞供自己用 cookies、分析工具、以及其他资源来收集资料,从而降低竞争。
Google Chrome Team 团队向 Linux 发行版开发者发去邮件通知,从3月15日起,在构建配置中使用 google_default_client_id 和 google_default_client_secret 的第三方 Chromium 版本,它们的终端用户将无法再登陆其 Google Accounts 账号。
Google 称,他们在最近的审计中发现部分基于 Chromium 的浏览器使用了原本只给 Google 使用的 Google API 和服务,其中最主要的是同步账号的 Chrome Sync API,它决定移除这些 API 的访问,声称这是为了改进用户数据安全。
Linux 发行版开发者表示过去十年他们一直这么做的,如果无法使用 Google 的同步功能,那么继续维护 Chromium 软件包也没有什么价值了。Chrome 的工程总监 Jochen Eisinger 在回复中表示他们的决定不会改变。Slackware Linux 和 Arch Linux 都表示考虑从仓库移除 Chromium。
When an iPhone has been off and boots up, all the data is in a state Apple calls 【Complete Protection】. The user must unlock the device before anything else can really happen, and the device's privacy protections are very high. You could still be forced to unlock your phone, of course, but existing forensic tools would have a difficult time pulling any readable data off it. Once you've unlocked your phone that first time after reboot, though, a lot of data moves into a different mode—Apple calls it "Protected Until First User Authentication", but researchers often simply call it 【After First Unlock】(注:简称 AFU).
If you think about it, your phone is almost always in the AFU state. You probably don't restart your smartphone for days or weeks at a time, and most people certainly don't power it down after each use. (For most, that would mean hundreds of times a day.) So how effective is AFU security? That's where the researchers started to have concerns.
The main difference between Complete Protection and AFU relates to how quick and easy it is for applications to access the keys to decrypt data. When data is in the Complete Protection state, the keys to decrypt it are stored deep within the operating system and encrypted themselves. But once you unlock your device the first time after reboot, lots of encryption keys start getting stored in quick access memory, even while the phone is locked. At this point an attacker could find and exploit certain types of security vulnerabilities in iOS to grab encryption keys that are accessible in memory and decrypt big chunks of data from the phone.
......
编程随想注:
关于“手机的危险性”,本博客已经唠叨过无数次了。俺反复告诫大伙儿(尤其是政治敏感人士),【不要】使用手机进行敏感的活动。
上述这篇洋文会告诉你,政府执法机构(警方 or 国安部门)破解手机其实比多数人想象的更容易,不论是 iOS 或 Android,都容易。
俺特意摘出上述三段洋文,其大意是:在【开机且解锁过一次】的状态下,即使手机屏幕已锁定,也很容易破解。关键在于,开机第一次解锁之后,全盘加密的【密钥】就会位于【内存】中。此时,“手机取证软件”只要能利用某种系统漏洞 or 软件漏洞,拿到内存中的“全盘加密密钥”,就 OK 啦。
作为对比,如果是在【关机】状态下,破解的难度就大得多(但依然有可能破解)。
假如你看不懂洋文,可以去看系列教程《TrueCrypt 使用经验》的第3篇——专门谈“加密盘的破解与防范”,其中有介绍【盗取密钥】这招的原理。
都柏林大学圣三一学院的 Douglas J. Leith 教授跟踪了(PDF)iOS 和 Android 设备向苹果和 Google 服务器发送的遥测数据,发现 Google 收集的数据二十倍于苹果。
Leith 教授称,研究考虑了操作系统本身收集的数据以及操作系统供应商提供的默认应用收集的数据,云端存储,地图/位置服务等,只计算遥测数据。
Leith 教授指出,即使用户选择退出遥测,iOS 和 Android 仍然会发送遥测数据。苹果收集了更多的信息数据类型,但 Google 收集的数据量要多得多。开机10分钟内,Pixel 手机向 Google 发送了 1MB 数据,而 iPhone 发送了 42KB;在闲置状态下,Pixel 手机每12小时向 Google 发送 1MB 数据,相比之下 iPhone 只向苹果发送 52KB 数据。
当新的 SIM 卡插入到设备中,相关信息会立即与苹果和 Google 共享。设备上预装的应用被发现在未启动或使用前就会连接苹果和 Google 服务器。Google 发言人用汽车收集数据为它收集数据辩护。
There's a Kaili Linux training suite available called Kali Linux Dojo, where users can learn how to customize their own Kali ISO and learn the basics of pentesting. All of these resources are available on Kali's website, free of charge. Kali Linux also boasts a paid-for pentesting course that can be taken online, with a 24-hour certification exam. Once you pass this exam, you're a qualified pentester!
Parrot OS
Why We Love Parrot OS:
The distro provides pentesters and digital forensics experts with the best of both worlds - a state-of-the-art "laboratory" with a full suite of tools accompanied by standard privacy and security features.
Applications that run on Parrot OS are fully sandboxed and protected.
Parrot OS is fast, lightweight and compatible with most devices.
BlackArch Linux
Why We Love BlackArch Linux:
BlackArch Linux offers a large selection of hacking tools and preconfigured Window Managers.
The distro provides an installer with the ability to build from source.
Users can install tools either individually or in groups with the modular package feature.
Whonix
Why We Love Whonix:
Whonix comes with the Tor Browser and the Tox privacy instant messenger application - ensuring fully-anonymous web browsing and instant messaging.
The OS employs an innovative Host/Guest design to conceal users' identity behind the anonymous proxy and prevent IP and DNS leaks.
The distro features pre-setup Mozilla Thunderbird PGP email.
编程随想注:
关于 Meltdown & Spectre 漏洞,去年和前年的《近期安全动态和点评》都有聊过。
在今年(2021)之前,对这俩漏洞还停留在“理论”阶段;到了今年2月份,在线查毒引擎 VirusTotal 首次发现与这两个漏洞相关的攻击代码,分别针对 Windows & Linux。这也就意味着:对这两个漏洞的研究,已经从“理论”上升到“实践”。
这两个漏洞源于 CPU 硬件的设计缺陷,很难根治;而且受影响的 CPU 很多,波及面从 x86 系列到 ARM 系列。
俺在《近期安全动态和点评(2019年1季度)》提到如下这段话:
一年前(2018年初)曝光的 Spectre 和 Meltdown 在信息安全界可以称得上是【划时代】滴!因为其利用的是 CPU 的【设计缺陷】(而且还是【根本性】缺陷)。
......
由于这两个漏洞涉及到 CPU 的【根本性】缺陷,极难搞定(就像两个幽灵,会在未来几年不断困扰 IT 行业)。
伊利诺伊香槟的三位研究人员在预印本网站 arXiv 发表论文,披露了针对英特尔 CPU 的最新侧信道攻击,该攻击被命名为 Lord of the Ring(s)。
随着芯片上的功能模块越来越多,英特尔为其 CPU 引入了片内总线,以实现各个模块之间的高速通信,它先后引入了 Ring Bus 和 Mesh Bus。最新侧信道攻击针对的就是 Ring Bus 的环形总线。研究人员首先逆向工程了 Ring Bus 的通信协议,设法构建了一个跨核心的隐蔽信道,利用环争用的细粒度时态模式去推动应用程序的秘密。从有漏洞的 EdDSA 和 RSA 实现中提取出密钥比特。对于 AMD 的 Zen 架构使用的片内总线 Infinity Fabric,研究人员表示需要进一步的研究,但相信他们的技术能应用于其它平台。
Google 资助了 Internet Security Research Group(ISRG)的一个项目:用 Rust 语言为 Apache HTTP web server 项目开发安全模块 mod_tls。
在 Apache web server 中,mod_ssl 用于支持建立 HTTPS 连接所需的加密操作,它是用 C 语言开发的。
新的 mod_tls 模块将使用 Rust 语言开发,领导该项目开发的是软件咨询公司 Greenbytes 的创始人和 Apache HTTP Server 开发者 Stefan Eissing。ISRG 希望,在完成开发之后 Apache HTTP web server 团队将采用 mod_tls 作为默认模块,取代年代悠久且不安全的 mod_ssl。