NoMachine NX was thrilled to have their remote control capabilities featured on the cover of the Linux Pro Magazine December 2007 issue. This article brought to light a possible security issue with the suspend and resume functionality of NX. Here at NoMachine, we are always grateful to get feedback on our product, whether it is positive or negative, so that we know how we are performing and can address any issues that arise. We take suggestions such as this very seriously as we strive to have the best product possible.
The question raised was, "Could an attacker extract critical session data from the NX cache on a stolen or comprised laptop?" While we feel that our cache implementation is no less secure than what is used by the major web browsers, we also agree that a more secure alternative would be helpful. This concern is currently being addressed, as we have decided to implement something similar to the "kiosk mode" made available by all web browsers, and have opened a Feature Request to implement this functionality:
* http://www.nomachine.com/fr/view.php?id=FR12E01974
* http://www.nomachine.com/ar/view.php?ar_id=AR12E00492
Thank you for bringing this topic to our attention so that we can improve our product and provide a more secure and flexible remote computing environment for our customers.
The NoMachine Team
With reference to Michael Schilli's article in LM 87 February 2008, there is a much simpler way to calculate the day on which a given date falls.
For each year, there is a day, which I will call the year's calendar day - or C-day for short, on which easily remembered dates fall. Thus, the 4th of April, the 6th of June, the 8th of August, the 10th of October and the 12th of December all fall on C-day, as do the 5th of the September (9th month) and the 9th of May (5th month), and likewise the 7th of November and the 11th of July. (Mnemonic: I work from 9-5 and relax from 7-11.) The last day of February, including leap years, is a C-day, from which it follows that the 7th of March is also a C-day. For January, the 4th is a C-day in leap years (mnemonic: 4 for leap years) and the 3rd for non-leap years.
For 2004, C-day was Sunday (day 0 say) and for 2005-2007, it advanced by one day each year until the leap year 2008, when it advanced by two days to give Friday (day 5). The day on which Michael Schilli's article was written, 4th October 2007, is easily determined, since C-day 2007 is a Wednesday, and that gives the 10th, and hence the 3rd, of October as Wednesday. Therefore, the 4th of October 2007 was Thursday.
For 1901 to 2003 the C-day number (Sunday as 0) is given by the formula:
<I>C-day=(2*((2004-4*(y div 4))div 4) + y mod 4) mod 7 --- (1)<I>
whilst for 2004 to 2099 it is given by:
<I>C-day=(5*((4*(y div 4)-2004)div 4) + y mod 4) mod 7 --- (2)<I>
where y is the year in question. For the years 1801 to 1900 inclusive, 1 must be added to the result from formula 1, since 1900 was not a leap year.
Gordon Oulsnam
| LM |
Mike Schilli writes:
Works great, thanks! I couldn't help but write a Perl script to confirm your revised formulas. By the way, according to the script, the formula works for the year 1900 as well.