开云体育

Dave Wade wrote:

> Gentles,
> There was, at one time, issues with FileZilla and security,

Which, after looking at the referenced CVE, unless I'm misunderstanding things (which wouldn't be the first time!), I call bullshit on. The write of the exploit on :

? *

specifically states:

? ?"Attackers need to compromise the victim device
? ? to exploit this Vulnerability."

and if your device is already compromised, as we all know, anything goes! So basically what they're saying is, you need to compromise the user's system first and THEN you can steal the user's FTP id and password!

Well DUH!! :)

But from what I'm reading, this so-called FileZilla <cough!> "exploit" <cough!> can only be executed ON AN ALREADY COMPROMISED SYSTEM (but does *not* otherwise provide any means for the attacker to compromise the victim's computer in the first place!).

So it doesn't sound like much of a FileZilla vulnerability to me.

Yes, I agree that account ids and their associated passwords should most certainly *not* be kept in anywhere in memory once they've been used (and especially not in clear text!). I agree with that. So yes, FileZilla could certainly do with some better handling in that regard.

But to call this a FileZilla vulnerability that users should be seriously concerned about? Nah. I ain't worried about it, and I doubt most other FileZilla users are either. The only person that seems concerned about it is the person that discovered the so-called "vulnerability".


> so I always suggest that folks do their own research
> and check the current situation before installing it.

THAT is *always* good advice.


> There is still some info on Reddit, but discussion on
> the official FileZilla forums was removed by the owner
> of FileZilla.

Oh? I wasn't aware of that. Can the Internet Archive Wayback Machine maybe be used to retrieve the original discussion? I find such removal to be highly unusual and quite concerning. UNLESS... maybe the discussion contained information on how to exploit this so called vulnerability? Or otherwise contained sensitive information the forum owner did not want to make public? (Such as userids and passwords or some such?)

What I'm getting at here is, I seriously doubt the FileZilla people are trying to cover anything up.


> Those with Windows may wish to note that "explorer", that
> is the tool you use to explore the local filestore still
> supports FTP but you may need to jump through hoops to get
> it to work on Windows/11

Windows's FTP client has always sucked.

--
"Fish" (David B. Trout)
Software Development Laboratories

mail: fish@...

OK, so what does the 3830 do with that? Or the 3880?

On Fri, Dec 23, 2022 at 7:44 PM Joe Monk <joemonk64@...> wrote:

The 3350 manual says:

When pressed, the Attention pushbutton starts a Rezero operation. Rezero moves the heads to cylinder zero, resets the address registers, and signals Attention to the controller.

Joe

On Fri, Dec 23, 2022 at 6:45 PM Bertram Moshier <herc370390vm@...> wrote:

If the I command won't cause the breaking of an active CCW for a device, what is the proper method for doing it?

I know with real iroon on a 3350 device, I was able to break an active CCW chain (in a loop).? Given (I thought Hercules reproduces real iron) what would be the equivalent?

Thank you.

On Fri, Dec 23, 2022, 17:33 Fish Fish <david.b.trout@...> wrote:

Tony Harminc wrote:
> Joe Monk wrote:
> > Bertram Moshier wrote:
> >
> > > So, how does one on Hercules interrupt a CCW program in
> > > an infinite loop?
> >
> > That would be the "I" (capital letter I) console command.
> >
> > I 0194
>
> I don't think so. That would just generate a standalone Device
> End (and/or Attention?).

Attention --- *IF* it were possible of course (which it's not because the device is still busy; you can only generate an attention interrupt for idle devices).

(And the command does NOT need to be capitalized either. A simple "i <devnum>" is all that is needed. It can be capitalized if you want to enter the command that way (I think), but it's certainly not necessary.)


> It's possible that might effectively interrupt a running
> channel program,

Nope. Not possible. Attention interrupts cannot be generated for devices that are still busy executing an I/O. Only idle devices can have an attention interrupt generated for them via the "i" command.

--
"Fish" (David B. Trout)
Software Development Laboratories

mail: fish@...

--

Jay Maynard

The 3350 manual says:

When pressed, the Attention pushbutton starts a Rezero operation. Rezero moves the heads to cylinder zero, resets the address registers, and signals Attention to the controller.

Joe

On Fri, Dec 23, 2022 at 6:45 PM Bertram Moshier <herc370390vm@...> wrote:

If the I command won't cause the breaking of an active CCW for a device, what is the proper method for doing it?

I know with real iroon on a 3350 device, I was able to break an active CCW chain (in a loop).? Given (I thought Hercules reproduces real iron) what would be the equivalent?

Thank you.

On Fri, Dec 23, 2022, 17:33 Fish Fish <david.b.trout@...> wrote:

Tony Harminc wrote:
> Joe Monk wrote:
> > Bertram Moshier wrote:
> >
> > > So, how does one on Hercules interrupt a CCW program in
> > > an infinite loop?
> >
> > That would be the "I" (capital letter I) console command.
> >
> > I 0194
>
> I don't think so. That would just generate a standalone Device
> End (and/or Attention?).

Attention --- *IF* it were possible of course (which it's not because the device is still busy; you can only generate an attention interrupt for idle devices).

(And the command does NOT need to be capitalized either. A simple "i <devnum>" is all that is needed. It can be capitalized if you want to enter the command that way (I think), but it's certainly not necessary.)


> It's possible that might effectively interrupt a running
> channel program,

Nope. Not possible. Attention interrupts cannot be generated for devices that are still busy executing an I/O. Only idle devices can have an attention interrupt generated for them via the "i" command.

--
"Fish" (David B. Trout)
Software Development Laboratories

mail: fish@...

If the I command won't cause the breaking of an active CCW for a device, what is the proper method for doing it?

I know with real iroon on a 3350 device, I was able to break an active CCW chain (in a loop).? Given (I thought Hercules reproduces real iron) what would be the equivalent?

Thank you.

On Fri, Dec 23, 2022, 17:33 Fish Fish <david.b.trout@...> wrote:

Tony Harminc wrote:
> Joe Monk wrote:
> > Bertram Moshier wrote:
> >
> > > So, how does one on Hercules interrupt a CCW program in
> > > an infinite loop?
> >
> > That would be the "I" (capital letter I) console command.
> >
> > I 0194
>
> I don't think so. That would just generate a standalone Device
> End (and/or Attention?).

Attention --- *IF* it were possible of course (which it's not because the device is still busy; you can only generate an attention interrupt for idle devices).

(And the command does NOT need to be capitalized either. A simple "i <devnum>" is all that is needed. It can be capitalized if you want to enter the command that way (I think), but it's certainly not necessary.)


> It's possible that might effectively interrupt a running
> channel program,

Nope. Not possible. Attention interrupts cannot be generated for devices that are still busy executing an I/O. Only idle devices can have an attention interrupt generated for them via the "i" command.

--
"Fish" (David B. Trout)
Software Development Laboratories

mail: fish@...

Tony Harminc wrote:
> Joe Monk wrote:
> > Bertram Moshier wrote:
> >
> > > So, how does one on Hercules interrupt a CCW program in
> > > an infinite loop?
> >
> > That would be the "I" (capital letter I) console command.
> >
> > I 0194
>
> I don't think so. That would just generate a standalone Device
> End (and/or Attention?).

Attention --- *IF* it were possible of course (which it's not because the device is still busy; you can only generate an attention interrupt for idle devices).

(And the command does NOT need to be capitalized either. A simple "i <devnum>" is all that is needed. It can be capitalized if you want to enter the command that way (I think), but it's certainly not necessary.)


> It's possible that might effectively interrupt a running
> channel program,

Nope. Not possible. Attention interrupts cannot be generated for devices that are still busy executing an I/O. Only idle devices can have an attention interrupt generated for them via the "i" command.

--
"Fish" (David B. Trout)
Software Development Laboratories

mail: fish@...

Bertram Moshier wrote:

> If I remember correctly, on the 3350? it was the attention button
> I pressed to generate the interrupt to break the CCW chain.

We had 3350s at the shop I was at too, but I don't personally recall whether they had an attention button or not. Maybe they did, but we certainly never used it.

Now I do recall 3330s had a device address "plug" that you could "pop" (unplug and then plug back in again) and I do recall it being used once or twice, but it was an extremely rare occurrence and I don't recall under what circumstances it was used.

> Thanks for the "I addr" command.

It's just "i" (lower case). It doesn't need to be capitalized unless you want to. BUT... it's not going to help you any in the situation you described (looping channel program) as it can ONLY be used on non-busy (i.e. idle) devices, and in the situation you described, the device would by definition always be busy.

I recommend using whatever guest O/S facility is available (if any) to cancel/abort the currently active I/O.

--
"Fish" (David B. Trout)
Software Development Laboratories

mail: fish@...