lcamtuf

Great episode. lcamtuf's blog[0] is one that every engineer should follow. Though if you're reading this comment you probably already do :) [0]: https://lcamtuf.substack.com/

I believe he found new solace - woodwork[1][2]. Given the state of security and things in general in the IT, I definitely understand. Especially with the AI slop influx. His blog is quite interesting to read though, highly recommend. [1] https://lcamtuf.substack.com/p/how-do-wood-finishes-hold-up [2] https://lcamtuf.coredump.cx/woodworking/

Baffled that https://lcamtuf.substack.com/ or https://lcamtuf.coredump.cx/ isn't in there.

CVEs are being assigned recklessly these days. Most of them aren't even security bugs and or cannot be exploited. Be wary of CVEs and their practical utility. Also this is a good read from AFL creator lcamtuf: https://lcamtuf.substack.com/p/a-reactionary-take-on-memory-safety

> "The current trend of rewriting everything in Rust is out of control and misguided... EDIT: lcamtuf does a great job explaining my perspective on Rust push https://lcamtuf.substack.com/p/a-reactionary-take-on-memory-... " The current trend is people rewriting Unix command line utilities in Rust, as a hobby. Nobody is rewriting Adobe PhotoShop or Oracle in Rust. Can you name some projects which you class as "out of control"? [I don't use Rust, so this isn't "you should RiiR". Adobe isn't rewriting photoshop in Rust because of some Twitter/tech news hype. And if Adobe is rewriting Photoshop in Rust over the coming decades because of government guidance, is that really "out of control"?]

You may also like lcamtuf's current thingy, a substack https://lcamtuf.substack.com/

I follow lcamtuf on Mastodon and I am convinced he's made of different stuff than I am. A full-time job is enough for me, I can't imagine starting (and completing) so many cool side projects. To that point, right before this relay madness, he wrote up an article in a playable embedded Tetris clone: <https://lcamtuf.substack.com/p/mcu-land-part-10-blocks-all-the-way>…

I seem to remember really great interaction with lcamtuf (of AFL fame): https://lcamtuf.blogspot.com/2015/04/finding-bugs-in-sqlite-easy-way.h…

Very cool! I think fuzzers are SO interesting. One of my favorite examples is lcamtuf’s post on generating valid JPGs from nothing [1]. Just so awesome. 1: https://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.htm…

The (truly amazing) lcamtuf blog post you are referring to is this one: http://lcamtuf.blogspot.fr/2014/11/pulling-jpegs-out-of-thin-air.html

That pops up about once a year. See https://hn.algolia.com/?query=How%20SQLite%20Is%20Tested&sort=byPo… for previous submissions. An amazing thing about the fuzz tester American Fuzzy Lop is that even with all of the SQLite tests, it managed to find bugs. See http://lcamtuf.blogspot.se/2015/04/finding-bugs-in-sqlite-easy-way.htm… , and HN comments at https://news.ycombinator.com/item?id=9376391 .

For any that were not aware, this is the same Zalewski that did a lot of great work around the Shellshock bug. He found 2 additional issues with the parsing function after the initially reported bug. CVE-2014-6277 and CVE-2014-6278 http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.ht… I don't know where he finds time to sleep.

As a followup, someone finally did find a full-blown 'execute whatever you like' exploit for the patched version of bash. http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.ht…

This is something Zalewski has written about: http://lcamtuf.blogspot.com/2010/10/http-cookies-or-how-not-to-design.… --- if this kind of thing is interesting to you, his latest book, _The Tangled Web_, is excellent.

Some blogs I like (most are not updated very frequently, though): Billy Rios (discovered GIFAR) http://xs-sniper.com/blog/ Michal Zalewski (one of the top security researchers in the world, wrote "The Tangled Web", a must-read) http://lcamtuf.blogspot.com Neal Poole: https://nealpoole.com/blog/ Nir Goldshlager: http://www.nirgoldshlager.com/ Michael Brooks: https://sitewatch.me/en/Blog Nils Jünemann: http://www.nilsjuenemann.de/ Stefano di Paola (Minded Security): http://blog.mindedsecurity.com/ Root Labs: http://rdist.root.org/

You've already lost me by step two; I have no clue what "force is the negative gradient of potential" means or what a "conservation force field" is. When my non-expert perception is that potential energy already seems a bit like a hack to cause conservation to work, citing some technical fact based on the assumption that there's something called "potential" with a negative gradient that I should take for granted as equivalent to force doesn't really do much to dispel that. It seems like your response is assuming I understand a lot more than I do, and I suspect that if I understood enough to do anything other than just trust it at face value, I probably wouldn't need any explanation about why my intuition is wrong in the first place! Circling back to the blog post here, it seems like the author is specifically trying to discuss things in a way that non-experts can still follow along with I took a lot at a couple of other posts on the blog after finishing this one, and the one about a "proof" that pi equals 4 had a section that felt pretty similar to me, where it cites an explanation of why it's wrong conveyed in as way that probably doesn't do much to help the people who are most likely to need it in understanding why the proof is wrong: https://lcamtuf.substack.com/p/4

The problem they’re worried about is untrustworthy browser extensions that have broad permissions to do harm. There are over 100,000 extensions and from a security standpoint, not having good-enough sandboxing is a vulnerability. More: https://lcamtuf.substack.com/p/the-asymmetry-of-nudges > In reality, Manifest V3 was meant to solve a real problem — and to do so for the right reasons. I know this because about eight years ago, we set out to conduct a survey of the privacy practices of popular browsers extensions. We were appalled by what we uncovered. From antivirus to “privacy” tools, a considerable number of extensions hoovered up data for no discernible reason. Some went as far as sending all the URLs visited by the user — including encrypted traffic — to endpoints served over plain text. Even for well-behaved extensions, their popularity, coupled with excessive permissions, opened the doors for abuse. The compromise of a single consumer account could have given the bad guys access to the digital lives of untold millions of users — exposing their banking, email, and more. Maybe they could have avoided controversy by grandfathering in a few popular extensions and watching them closely?

The classic article is by George Monbiot at The Guardian 24 Oct 2011 https://www.theguardian.com/commentisfree/2011/oct/24/advertising-pois… Advertising is a poison that demeans even love – and we're hooked on it With AI everywhere, the trust level gets even lower https://lcamtuf.substack.com/p/psa-ebay-lets-chatgpt-make-up-item PSA: eBay lets ChatGPT make up item descriptions And Chrome is playing its chrome games. That is to say, sites can ask Chrome directly what kinds of topics you're interested in – topics automatically selected by Chrome from your browsing history – so that ads personalized to your activities can be served. This is supposed to be better than being tracked via third-party cookies, support for which is being phased out. There are other aspects to the sandbox that we'll get to. https://www.theregister.com/2023/09/07/google_privacy_sandbox/ Discussion: https://news.ycombinator.com/item?id=37427227

The article focuses exclusively on the technical side. No, certifications are not required. Sure, they will get your resume higher on the list. Security is much more than simply breaking stuff. You need to understand the fundamentals, CIA triad, risk, misunderstandings that arise from the fundamentals, issues that generally arise with security due to the context etc. Debunk also some common myths around security. Fundamentals can land you in tables that technical skills won't. It is one thing to land bugs and another to be able to sit in a meeting with a guy from engineering and reason with his team and reach an agreement. Generally, working with non-security folks is hard and knowing the fundamentals helps. This also requires soft skills. Know your limits and be honest about them. Also, it is good to listen to people and their concerns. Generally, soft skills are super important in security because in most cases your opening statement is going to be one of the following: - I found some bugs that I want to discuss with you. - You did X which violated that policy and it rang an alarm in SOC. - We have this issue and I came up with this plan to build this to address it. Being able to calm the other side is crucial or you risk derailing the conversation. Also, being able to write code helps a lot. As a matter of fact, I forced team-members to work for other teams for two months. Not only they brought skills back, my team now had an understanding of their work and potential…

"CVE counting" is not necessarily a good proxy for "security". The practice of drawing conclusions from various CVE statistics has been variously debunked over the years. I strongly recommend reading this 6-year old(!) resource from @lcamtuf: https://lcamtuf.blogspot.com/2010/05/vulnerability-databases-and-pie-c… My own personal favorite anecdotes of why CVE counting is fail: 1) Adobe used to tour around presenting a chart of how their CVEs were decreasing over time. But then @taviso did a bit of simple fuzzing and found almost 100 issues. So it turns out the Adobe CVE count was low simply because no-one was looking hard. In fact, Adobe assigned a single CVE to all the issues, in this waffling blog post: http://blogs.adobe.com/security/2011/08/how-did-you-get-to-that-number… 2) Google Chrome has lots of CVEs because of the monetary incentives to go and find and report them. A quick comparison of CVEs for Chrome vs. some browser without a decent rewards program might lead you to incorrect conclusions. 3) Historically, Microsoft did not publicly disclosure or assign CVEs for issues found internally by employees. This contrasts with Chrome and Firefox, which have a greater culture of openness, where internal security discoveries are documented publicly. Quasi-arbitrary decisions like this bend the numbers all over the place, from vendor to vendor and product to product.

If you followed some common-sense advice [1], you only needed two patches: the original one as a stop-gap measure for the original RCE on September 24, and Florian's prefix-adding patch that came out shortly thereafter (but has taken some time to appear upstream). Now, I'm a bit stumped how any obvious variant of the CVE-2014-6271 or CVE-2014-6278 RCE payloads could lead to accidental code execution somewhere else, since they generally produce a parser-breaking syntax error when executed outside an env-encoded function definition. Also, because of an unusual fixed-string prefix required to carry out the attack, there is not a lot you can really do to avoid any half-baked IDS/IPS. Anyway, for the sake of my idle curiosity, I secretly hope that Alex shares the buggy line of code, even though that's unlikely =) [1] http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-no…

Better link: https://ricioly.substack.com/p/you-can-judge-a-book-by-its-cover Separate blogger covering AI children’s books: https://lcamtuf.substack.com/p/ai-childrens-books-body-horror-edition

For images, there are some clear styles AI leans heavily on if not actively steered away[0]. It can definitely be prompted pretty successfully though, a bird spotting app was up her on HN recently with some really nice looking woodblock prints that were AI generated (I always feel disappointed/tricked when art turns out to be made by AI, I'm not sure why, it seems to pull the joy out of it for me) [0] https://lcamtuf.substack.com/p/the-100000-whys-of-ai

Modern fuzzers try to modify the input so that code travels through as many different paths as possible. One of the better known "new gen fuzzers" is AFL. Wikipedia has a high-level overview of its fuzzing algorithm https://en.wikipedia.org/wiki/American_Fuzzy_Lop_(software)#Fuzzing_al… With AFL you can use a JPEG decoder and come up with a "valid" JPEG picture, i.e. one acceptable by the decoder: https://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.htm…

Competent fuzzers don't just use random bytes, they systematically explore the state-space of the target program. If there's a crash state to be found by feeding in a file full of null bytes, it's probably going to be found quickly. A fun example is that if you point AFL at a JPEG parser, it will eventually "learn" to produce valid JPEG files as test cases, without ever having been told what JPEG file is supposed to look like. https://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.htm…

this is profoundly moving too bad chemistry has been criminalized except for 'professionals' https://lcamtuf.substack.com/p/a-requiem-for-amateur-chemistry what kind of people will persist at getting into programming once you can be arrested for possessing a debugger or compiler without an exploit developer's license? kids who were never allowed to program anything until they got into college? that's how we're losing potential chemists today a lot more lives could have been saved with better drugs i'm not convinced that dementia can be solved with a drug, but chemistry is how we understand the processes that cause dementia

Needs to be fixed to go to https://lcamtuf.substack.com/p/afternoon-project-jpeg-dct-text-lossifi…

> For a nonsensical but amusing demo that lets you watch what happens if you apply JPEG-style lossy compression to text, check out this post. The link seems broken, since it points back to the same article at https://lcamtuf.substack.com/p/not-so-fast-mr-fourier

This is another interesting link about the issue: https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor It mentions something not being reported, the issue is with a Linux specific patch to OpenSSH. If the patch did not exist there would be no issue. This is not an OpenSSH issue but a Linux issue.