Hacking News
-
@Bulb said in Hacking News:
@Kamil-Podlesak said in Hacking News:
in its original design (70s?),
… and because the system can't be replaced all at once, it has to maintain compatibility with existing components at all times, and that makes it very hard to replace at all. Together with the fact it requires very thorough testing that it will reliably stop the trains when there is actual emergency. And any additional logic just makes that reliability harder to ensure.
this is supposed to be solved by the police. Which is not actually so bad expectation in a police state.
It is not a bad expectation in any working legal state. The legal system has the flexibility needed for dealing with people problems.
Only if you manage to catch the people first. Which is tricky if the cops need to worry about stuff like constitutional rights, habla corpse, mirinda rights and similar stuff. In police state, you just arrest people for Standing Near Tracks Looking Suspicious.
-
Difference from previous exploits: no longer a side-channel. CPU actually leaks contents from AVX registers of another process (which could be another user / container / VM on the same machine). Bonus points: AVX is used everywhere thanks to
memcmp
,strcmp
and similar. Yay.
-
@Kamil-Podlesak said in Hacking News:
habla corpse
The D&D thread is
Seriously, I like this new name for it.
-
@cvi The preceding video
is also interesting. Fuzzing a CPU is a neat trick.
-
-
@Bulb That was a good watch. I've browsed documentation on performance counters before ... they're a mess. Serializing between instructions is interesting. Even though it's a different type of attack (not side-channel), it's still the same class of bug. Hmm.
It also reminded me a bit of some older talks:
https://youtu.be/KrksBdWcZgQ
https://youtu.be/_eSAF_qT_FY
They were scanning for undocumented instructions by just trying to execute generated bit patterns.
-
At least this one has a good chance of being practical.
-
In the context of obstacles to catching people, @Kamil-Podlesak said in Hacking News:
habla corpse, mirinda rights
"habeas corpus" (but like @Benjamin-Hall I like your version) applies only to people who've already been caught, and therefore isn't an obstacle to catching them. The same applies to Miranda rights.
-
@Zecc said in Hacking News:
@Kamil-Podlesak said in Hacking News:
habla corpse
Dead people don't talk, Spanish or otherwise.
Tell that to the DEA interrogators.
-
@Steve_The_Cynic said in Hacking News:
In the context of obstacles to catching people, @Kamil-Podlesak said in Hacking News:
habla corpse, mirinda rights
"habeas corpus" (but like @Benjamin-Hall I like your version) applies only to people who've already been caught, and therefore isn't an obstacle to catching them. The same applies to Miranda rights.
People doing nefarious activities on behalf of a foreign nation tend to not want to get caught in the first place, especially when doing things that could be easily construed as detrimental to national security. Getting caught tends to be severely career-altering, if only because then your picture gets published with the label "suspected spy and saboteur" and that makes future activities a whole lot more risky.
-
@Kamil-Podlesak said in Hacking News:
In police state, you just arrest people for
Standing Near Tracks Looking SuspiciousTrespassing on Railway Property.FTFN
-
@Bulb holy wow, I had no idea there are so many weird-ass performance counters.
-
@topspin said in Hacking News:
I had no idea there are so many weird-ass performance counters.
The "Things people say about " thread is
-
@topspin said in Hacking News:
@Bulb holy wow, I had no idea there are so many weird-ass performance counters.
Filed under: xkcd 37
-
@Zecc There's probably more of those than you'd expect too.
-
-
@Bulb said in Hacking News:
Fuzzing a CPU is a neat trick.
-
As long as your CPU uses a PGA package. LGA packages are much less effective for that.
-
@Zerosquare said in Hacking News:
As long as your CPU uses a PGA package. LGA packages are much less effective for that.
LGA CPUs have to be used in a more definition of grooming.
-
Notepad++ is popular among some people. Now enjoy beautiful security issues. You just need a document where a conversion of encodings is required, and a little bad code...
-
@BernieTheBernie From the timeline:
- 2023-05-11: Created private security advisory for GHSL-2023-112 with a fix suggestion.
- 2023-05-15: Notepad++ v8.5.3 without the fixes was released.
[…] - 2023-06-18: Notepad++ v8.5.4 without the fixes was released.
[…] - 2023-08-09: Notepad++ v8.5.5 without the fixes was released.
- 2023-08-15: Notepad++ v8.5.6 without the fixes was released.
… so the software apparently is maintained, but they clearly don't care about bugs that cause crashes and possibly security issues.
Who said somewhere around here that their company no longer allows having notepad++ installed? Might actually be a founded decision after all.
-
@Bulb Let me tern this around, though, and ask: what better alternatives are there that you know to a sufficient degree of confidence aren't similarly neglected?
-
@Applied-Mediocrity
notepad.exe
?
-
Email spoofing is an old idea, in the good old times I enjoyed sending emails as
president@whitehouse.gov
orosama@alqaida.org
. Then it got a little more complicated. But actually, not so much:
-
@Applied-Mediocrity said in Hacking News:
@Bulb Let me tern this around, though, and ask: what better alternatives are there that you know to a sufficient degree of confidence aren't similarly neglected?
VS Code. It's written in JavaScript so it has no bugs.
-
@topspin Yeah … given the other serious issue Microsoft has with their OAuth2 issuer, anything from Microsoft is probably not the most trustworthy either.
-
@Applied-Mediocrity said in Hacking News:
@Bulb Let me tern this around, though, and ask: what better alternatives are there that you know to a sufficient degree of confidence aren't similarly neglected?
vim
-
@LaoC I … went to check already. And I was surprised to see that it has a LOT of CVEs in the repository. Apparently someone somewhat recently tried fuzzing it or something and made a lot of entries at https://huntr.dev/. But they are chewing through it and fixing it—and I don't think there are suggested fixes in this case, just reproduction steps and backtraces from valgrind—so it does appear a bit better maintained.
-
I don’t know if Sublime having so few entries is a good thing or a bad thing.
-
@Bulb said in Hacking News:
@LaoC I … went to check already. And I was surprised to see that it has a LOT of CVEs in the repository. Apparently someone somewhat recently tried fuzzing it or something and made a lot of entries at https://huntr.dev/. But they are chewing through it and fixing it—and I don't think there are suggested fixes in this case, just reproduction steps and backtraces from valgrind—so it does appear a bit better maintained.
Yeah, it's C But yes, they have a pretty good track record of fixing shit that comes up.
-
@LaoC said in Hacking News:
they have a pretty good track record of fixing shit that comes up
And that's the problem.
When someone discloses the problem, it's been a problem for quite some time already.
-
@LaoC said in Hacking News:
@Bulb said in Hacking News:
Yeah, it's CNotepad++ is C++, that's not much better, especially since it's probably quite old style.
-
@Bulb The logical conclusion obviously being that we need Notepad_rs
-
@ixvedeusi There is https://lapce.dev/.
… but really, memory safety is only 70% of the vulnerabilities, so what we really need is more defense in depth.
-
@Bulb said in Hacking News:
There is https://lapce.dev/.
Pre-alpha Stage
Get the fuck back into the shed you crawled out from and do it properly until it's done, you crap-sucking moron clowns!
-
@Bulb Wait until somebody starts fuzzing the various plugins for code completion and so on. I'd be expecting a massacre.
That said, I'd be expecting that with more or less all editors, not just vim. VS-proper used to have a pile of intellisense/highlighting crashes, and although the obvious ones have been fixed, it'll still go haywire, corrupt its caches and similar, none of which is really a good sign.
-
@Applied-Mediocrity said in Hacking News:
@LaoC said in Hacking News:
they have a pretty good track record of fixing shit that comes up
And that's the problem.
Bug free software would be nice, wouldn't it?
-
@Applied-Mediocrity said in Hacking News:
Pre-alpha Stage
In their defense, in my experience GUI programming in Rust is currently Not Fun.
-
@ixvedeusi ... and it turns out the GUI library they use is "being discontinued by the core developers".
-
@LaoC And since that is practically unattainable, the next best thing is to realize that all software sucks ass. Including vim.
@ixvedeusi said in Hacking News:
In their defense, in my experience GUI programming in Rust is currently Not Fun.
That very much sounds like their problem.
@ixvedeusi said in Hacking News:
@ixvedeusi ... and it turns out the GUI library they use is "being discontinued by the core developers".
-
@Applied-Mediocrity said in Hacking News:
all software sucks ass. Including vim.
*starts sharpening keyboard*
-
@cvi said in Hacking News:
@Applied-Mediocrity said in Hacking News:
all software sucks ass. Including vim.
*starts sharpening keyboard*
*weaponizes tabs and spaces*
-
-
@cvi Hey, I just shat on your favorite text editor, no need to call me names like that
-
@Applied-Mediocrity Yeah, that was going a bit far. Here, have an apology in vimscript:
:echom 'Sorry.'
-
@Applied-Mediocrity said in Hacking News:
@Bulb Let me tern this around, though, and ask: what better alternatives are there that you know to a sufficient degree of confidence aren't similarly neglected?
EditPad Pro
-
@MrL said in Hacking News:
@Applied-Mediocrity said in Hacking News:
@Bulb Let me tern this around, though, and ask: what better alternatives are there that you know to a sufficient degree of confidence aren't similarly neglected?
EditPad Pro
-
-
@Watson said in Hacking News:
No support either
Well, it is free, you know!
You become responsible, forever, for what you have released, you know.
-
@Applied-Mediocrity said in Hacking News:
@MrL said in Hacking News:
@Applied-Mediocrity said in Hacking News:
@Bulb Let me tern this around, though, and ask: what better alternatives are there that you know to a sufficient degree of confidence aren't similarly neglected?
EditPad Pro
What's wrong with it?
You become responsible, forever, for what you have released, you know.
You're not responsible for anything ever - the OS way.