CanaryLayout

6 ms·

1.
For Go programmers, a cheap CGo pattern to give Jia Tan a headache(gist.github.com)
44 points by CanaryLayout 2y ago|2 comments
2.
by CanaryLayout 2y ago
TL;DR: force them to learn not just systemd, ld, but also all of pthreads and the go runtime itself
3.
by CanaryLayout 2y ago
IBM could sell the future of the on premises z/xxx boxes as "datacenter in one rack" Running x86 in z/VM has been a discussion for 25 years. Just fucking do it. Let people run whatever they want. Just as people are ex
4.
by CanaryLayout 2y ago
And no, the paywalled IBM Cloud LPARs are a joke. The mainframe is not a special thing anymore, hasn't been since the late 90s. It's just a server box. I work at a shop with a z/14. I would love it if we finished the last C
5.
by CanaryLayout 2y ago
If IBM weren't hostile to the Hercules project and allowed local licensing to run z/OS, CICS, IMS and DB2 on it, perhaps more hobbyists would want to careerpath themselves on to the s390 architecture. I do love the s390 arch and t
6.
by CanaryLayout 2y ago
Oh God why.
7.
by CanaryLayout 2y ago
even easier is to STOP HOSTING SSHD ON IPV4 ON CLEARNET at minimum, ipv6 only if you absolutely must do it (it absolutely cuts the scans way down) better is to only host it on vpn even better is to only activate it with a portknocker, over
8.
by CanaryLayout 2y ago
This does not matter either. The attack came in by loading into systemd via liblzma. It put on a hook and then sits around waiting for sshd to load in so it can learn the symbols then proceeds to swap in the jumps. sshd is a sitting duck
9.
by CanaryLayout 2y ago
any one of us if we sat on the OSSH team would flip the middle finger. What code is the project supposed to write when nothing on main dyn loaded liblzma. It was brought in from a patch they don't have realistic control over. This i
10.
by CanaryLayout 2y ago
Exactly. The attack came in by hitching a ride on to systemd. sshd is not the problem. the ldd/monolith architecture surrounding systemd is. What if I duplicated this attack but instead targeted dbus or any other thing that systemd i
11.
by CanaryLayout 2y ago
Yeah Goroutines are great. Then add something like WebRTC to your project that realistically tops out at 10000 listeners, and people wonder why Twitter Spaces is so buggy...
12.
by CanaryLayout 2y ago
Yeah... RISCV routine was put in, then some binary test files were added later that are probably now suspect. don't miss out on the quality code, like the line that has: i += 4 - 2; https://git.tukaani.org/?p=xz.git;a=
13.
by CanaryLayout 2y ago
From what I read on masto, the original maint had personal life breakdown, etc. Their interest in staying as primary maint is gone. This is a very strong argument for FOSS to pick up the good habit of ditching/un-mainlining projects w
14.
by CanaryLayout 2y ago
Well isn't this an interesting commit. He finished his inject macro to compose the payload at build, so now he can start clearing up the repo so none of that shit gets seen when cruising through it. https://git.tukaani.org
15.
by CanaryLayout 3y ago
Some links (and more alt keyboard layout propaganda) *Discord Servers* Alt Keyboard Layouts- < https://discord.gg/2qq8qmDtFf > Same but on matrix - < https://matrix.to/#/!iZdsjIZXWPXnohYGdD:matrix
16.
Holiday Reminder to Change Your Keyboard Layout and Self-Improve [video](youtube.com)
4 points by CanaryLayout 3y ago|3 comments
17.
by CanaryLayout 3y ago
Oldie but a goodie. More people should check out Ben Vallack, who takes working ergonomics hacking to an extreme degree. He inspires lots of modifications that I make to my own work+keyboarding habits. The extended vacation periods that p
18.
Y Combinator Bailing, Web Summit Gonna Be Lonely(twitter.com)
5 points by CanaryLayout 3y ago|1 comments
19.
by CanaryLayout 3y ago
Guess by the time it starts it will just be the jihadi VCs... https://twitter.com/garrytan/status/1713937044798603313
20.
by CanaryLayout 3y ago
Mostly to pretty it back up into the original shape (so it matches what was already in git)
21.
I Had a VPS on Cloudzy, the Iranian Hosting Outfit. What Now?(securityweek.com)
3 points by CanaryLayout 3y ago|1 comments
22.
by CanaryLayout 3y ago
Over a week ago news got out that cheap cloud hoster Cloudzy is really a front for an Iranian company abrNOC. The full rundown of the research is here: https://20688644.fs1.hubspotusercontent-na1.net/hubfs/206886... I
23.
by CanaryLayout 3y ago
I think you're asking this question because you're wondering if a container that uses environment variables for its configs would show up in this and I think the answer would be no because it's an operating system service tha
24.
by CanaryLayout 3y ago
This is terrifying. You could hijack a user that has SAPGUI open, then push code updates to SE38 that spread everywhere.
25.
by CanaryLayout 3y ago
Yes. And Linode. And Quadra. And OVH. A lot of people on YC are enterprisey-brained and only think there are 3 possible clouds, and then there is the rest of the planet who can't afford to park their cash at AWS and set it on fire.
26.
by CanaryLayout 3y ago
If you throw in the same vulnerability that AMD has with the list from Intel I think it pretty much covers every server available for rent at Quadra.
27.
by CanaryLayout 3y ago
This concern I also share and it's probably worth converting into layman's terms so that all computer users understand what it is. Basically the job scheduler Behavior in the OS needs to surface to the user with understandable lan
28.
by CanaryLayout 3y ago
Think of all the cloud resellers that are out there who really aren't segregating their tenants out or it's just a web shop with proxmox who recombined their own customers onto a core even though the cloud provider specifically se
29.
by CanaryLayout 3y ago
They have workarounds. If you prevent multi-tenant from sharing their threads on the same core, that eliminates the most desirable goal of an attacker. However it does not eliminate the vulnerability within a single tenants own threads. You
30.
by CanaryLayout 3y ago
The OS job scheduler informs the CPU when it's ideal to swap jobs. But the OS is not doing the work of moving the register and stack pointers, the microcode is. These timing attacks take advantage of shared information in the cache (

More ›