Americans are prude

A few weeks ago, I read a blog from a woman who worked in the adult industry for a good chunk of years. I think her current job was to make up non-offensive descriptions for sex toys, so she had the ability to think of several dozen terms for 'penis', as well as at least two dozen to describe a rimjob. I can't remember the URL or name of the blog, but in one of her posts she argued that contrary to popular belief, Americans are not prude. Coming from someone who works in the adult industry, I slightly doubt how objective that statement was. Maybe Americans are just publicly prude, and are really rampaging sex mongers in private.

Anyway, case in point:
Job #1 for America's Attorney General: porn, not terrorism

When FBI supervisors in Miami met with new interim U.S. Attorney Alex Acosta last month, they wondered what the top enforcement priority for Acosta and Attorney General Alberto Gonzales would be.

Would it be terrorism? Organized crime? Narcotics trafficking? Immigration? Or maybe public corruption?

The agents were stunned to learn that a top prosecutorial priority of Acosta and the Department of Justice was none of the above. Instead, Acosta told them, it's obscenity. Not pornography involving children, but pornographic material featuring consenting adults.

[via BoingBoing]

After you've picked yourself up from the floor, either from LMAO, shock or surprise (depending on your nationality), tell me Americans aren't prude. Well, if they aren't, the government sure is making up for anyone who isn't.

Regedit vulnerability: Hiding Registry values

Last week I started getting emails that there is a vulnerability in the Windows Registry Editor (Regedit.exe and Regedt32.exe) that can cause it to hide certain Registry values with absurdly long names. Here are a few links on the subject:
http://isc.sans.org/diary.php?date=2005-08-24 (also 3 or 4 pages following it)
http://secunia.com/advisories/16560/
http://www.frsirt.com/english/advisories/2005/1519

So the Regedit utility won't show these Registry values, but they're still there. It probably took malware writers only 1.5 second to figure out this means they can hide autorun Registry values, since - unfortunately - the Windows system itself does not hide these values and faithfully runs them at startup when present.

As far as I can see from my tests, this is because the vulnerable utilities use the RegEnumValue() function with a name buffer size of only 260 bytes (the standard, ironically this is normally used as a constant named MAX_LENGTH). Since this buffer receives the name of the Registry value during enumeration of all values in a Registry key, it will fail when the value name is longer than 260 bytes.
Due to an unfortunate coding convention, the error itself is often not checked and assumed to be ERROR_NO_MORE_ITEMS - like a few of my apps do as well - and the enumeration stops there, confident that it listed all values. This also means that, in addition to not showing the value with the really long name, it will also fail to show and values following that, long name or not. Note that this means NEWER values, not ones following it in an alphabetic list.

While messing with a few Registry values with names varying from 100 characters to 100,000 characters (on WinXP+SP2), I noticed a few things:

• The size limit for the value name is 16383 bytes, which means 14 bytes are reserved for this name. The page on Microsoft.com about Registry Element Size Limits seems to confirm this. It also says that the limit for Win9x/ME is 255 characters, making those Windows versions immune to this vulnerability.
  
• RegEnumValue(), when it can't retrieve a value and/or its data when either is too large for the buffer, is supposed to return the error ERROR_MORE_DATA and say what the required size for the buffer should be. However, it seems to do this only when the buffer to receive the actual data is too small. When the buffer that receives the value name is too small, it just returns ERROR_MORE_DATA (possibly explaining the cases of programs crashing on long Registry value names caused by infinite loops).

So it seems to me the easiest way to fix this problem, is to use two buffer sizes for the value name, depending on the Windows version:

• For Windows 95/98/98SE/ME: use a buffer length of 260 bytes - since the system can't handle setting values with longer names anyway.
  
• For Windows NT4/2000/XP/2003/Vista: use a buffer length of 16400 or so bytes - since the maximum allowem by the system is 16383.

So there you have it. The problem, the cause, and the solution. Case closed. :)

GoogleTalk goes live-ish

Yesterday, it seems the rumour that Google could be working on an IM client has been confimed not to be a rumour at all. Introducing GoogleTalk!

The service runs on Jabber and has its own server. Google is offering its own IM client, called GoogleTalk, as well as lots of instructions for connecting to GoogleTalk with other IM clients. Note that some of the links on the aforementioned URL are dead, as well as the 'don't see your IM client here? tell us about it' link.

Since using GoogleTalk, Jabber or GAIM is, of course, too easy for me, I decided to be lazy and use my fav IM client Miranda to connect to it. A Jabber plugin for this client is included within the default install, so I figured no problem.

A bit of tweaking, cursing and searching later I have found the following instructions work:

• Username: Gmail username, without @gmail.com
  
• Password: your Gmail password
  
• Login server: gmail.com (this is not a login server, but just the domain of your email address)
  
• Check 'Manually specify connection host'
  
• Host: talk.google.com
  
• Post: 5223 (not 5222!)

Since a picture says more than a 1000 words (and the above is a bit short of that), click below to see a pic of the setup:



Note that searching for users (with their Gmail username, no @gmail.com) always seems to return a hit, even if you search for one that does not exist.

Beauty is only skin deep, but stupidity goes down to the bone.

Not wanting to sound like a teenager in heat, but still being moderately excited about finding the awesomeness that is TheSuperFicial.com, here's some celebrity news that caught my eye.

Renée Zellweger is slipping down some road she only knows. See below 'after' and 'before Hollywood mainstream' pic. Also note the IMDb pic from link above is pretty old. Poor girl.

Scarlett Johansson is cute. I know of no other way to describe this woman after reading this article. Well, other than talented, sexy, pretty, etc.



Tom Cruise is insane. And that's a medical term for his condition. Apart from believing the complete nonsense that is Scientology, marrying Katie Holmes (who's 14 years younger) and assimilating her, he's generally being a condescending asshole and will be raising his children to be exactly like him. O_o
He also may or may not be very gay.

Today's post was brought to you by TheSuperFicial.com. Because you're ugly.