NateLawson

38 ms·

1.
by NateLawson 4y ago
There's another reason why USB-to-parallel adaptors can't replace a PC with a printer port: the latency for round-trip applications is significantly higher over USB. It takes a few microseconds to read/write a byte from a PC
2.
by NateLawson 4y ago
Yeah, the ISP I founded in 1995 (elite.net) was a PM2ER for both dialup and routing with a Pentium 90 as the shell & web server. We quickly hit the 30 line limit and went up to the PRI-based Portmaster models. Fun and exciting times, ju
3.
by NateLawson 4y ago
These typically work by changing the media bit encoding to be easier to process with 6502 instructions instead of a lookup table. Others simplify the table and use more RAM so that fewer lookups are needed. I haven’t looked at how Transwarp
4.
by NateLawson 4y ago
A semi-legit app can later drop malicious code and run it. Think of a repackaged OSS project or pirated software that has an auto-updater built in.
5.
by NateLawson 4y ago
Xprotect is part of GateKeeper, which arrived in Mountain Lion (and late versions of Lion).
6.
by NateLawson 4y ago
Here's a good summary of the flaw: https://guidovranken.com/2022/06/27/notes-on-openssl-remote-... Note that the bug is only in 3.0.4, which was released June 21, 2022. So if you didn't update to th
7.
by NateLawson 4y ago
My company, Root Labs, has consulted on various lawsuits. We aren't trial witnesses but we've done supporting work, such as reverse engineering and writing a detailed technical analysis of how a product works. This report was then
8.
by NateLawson 4y ago
If you did a pure analog copy (dual tape deck), you had generation loss. Eventually copies of copies would have too much noise and thus persistent load errors. Additionally, in-band signals were included in the gaps between blocks that woul
9.
by NateLawson 4y ago
Same year, and every engineering and CS student I knew had one in their dorm room. The lowest spec I saw was 386SX-16 with 2 MB and the highest was 486DX-50 with 16 MB RAM. Most used DOS/Windows but the CS students dual booted to Linux
10.
by NateLawson 4y ago
As late as the mid-90s in California, some kids showed up at university without a computer. There were PC and Mac labs on campus that were open pretty late, as well as VT100 terminal labs open 24/7 (though these were only used by most
11.
by NateLawson 4y ago
This article is a good list of implementation flaws with RSA, both in parameter selection and protocols. However, I disagree with the recommendation to use ECIES. It has a separate MAC and encryption algorithm approach which is better serve
12.
by NateLawson 4y ago
You need to get access to the raw entropy stream in order to characterize it and test it under a number of different situations. At Cryptography Research, we did a number of reviews of hardware entropy sources. You have to look into behavio
13.
by NateLawson 5y ago
QKD relies on many underlying assumptions, which researchers conveniently sweep under the rug while continuing to build castles ever higher on the theoretically "perfect" but insecure foundation. It is unclear how the underlying i
14.
by NateLawson 5y ago
This is kind of a ridiculous announcement, but I appreciate what they're trying to do. I find it ironic that they're trying to improve security & privacy for app users, but then the first apps they certify are almost exclusive
15.
by NateLawson 6y ago
Kirk McKusick took this kind of scale into consideration when designing softupdates for UFS. One of his criticisms of the competing log structured filesystems at the time was that the replay process would require RAM in excess of any server
16.
by NateLawson 6y ago
Hacking became "cool" for the corporate world in the late 90's. Movies like The Matrix and the fact that nothing too valuable was online yet meant that getting hacked was likely just web site defacement. Meanwhile, there was
17.
by NateLawson 6y ago
There was some ongoing consternation at ISS around 96-97 about an employee being a Phrack editor. Management talked to them but it didn't threaten their career.
18.
by NateLawson 6y ago
My university had terminal labs in the early 90s, tables full of Wyse terminals hooked up to the central UNIX cluster. PCs and Macs were common in other labs, but a terminal lab was still a convenient place to check email or get on IRC betw
19.
by NateLawson 6y ago
Butler Lampson (Xerox PARC researcher who created the Alto) recently revised this classic paper from 1983, updating it for more modern systems and principles (e.g., eventual consistency).
20.
Hints and Principles for Computer System Design (2020 Version)(arxiv.org)
3 points by NateLawson 6y ago|1 comments
21.
SourceDNA seeks lead UI engineer to visualize the code in millions of apps
1 points by NateLawson 11y ago
22.
by NateLawson 11y ago
Yes, parsing of untrusted data, race conditions, etc. are still a problem in general. My complaint was with the uninformed article, not your analysis.
23.
by NateLawson 11y ago
Sure, how about linking against the platform OpenSSL implicitly by grabbing a lib.so from an actual Android phone, linking against it with the NDK, and hoping that the ABI will never change? https://sourcedna.com/blog/2
24.
by NateLawson 11y ago
I've spent a lot of time both reversing and creating these kinds of schemes. Anyone else here? I gave a talk a few years back, comparing both retro and modern copy protection schemes. Also designed hardware for dumping floppies at the
25.
A Pirate’s Life for Me, Part 3: Case Studies in Copy Protection(filfre.net)
63 points by NateLawson 11y ago|17 comments
26.
by NateLawson 11y ago
There is no IOMMU in USB. You've got it backwards: the IOMMU in PC's is on the host side of the USB controller, not the device side. There's an easy way to tell. Does the bus carry memory addresses? Then it supports DMA. Does
27.
by NateLawson 11y ago
This is correct. The problem in this example is not the pendrive, but the automatic selection of device drivers based on the PC OS 100% trusting physical access. An easy way to see this is recompile the USB keyboard driver to ignore keyboar
28.
by NateLawson 11y ago
For one example, see the Android kernel for Qualcomm HSIC baseband interface (baseband-qct-mdm-hsic.c) https://git.sphere.ly/Lloir/android_kernel_htc_evitareul/tre... The way manufacturers "mitigate" bas
29.
by NateLawson 11y ago
The original post talks about DMA being a method the baseband can use to compromise the AP, which is false for any mainstream design. Trust doesn't have anything to do with it; the protocol literally does not support DMA.
30.
by NateLawson 11y ago
The premise of the article is flat out wrong. Mainstream smartphones do not provide DMA access from the baseband to the application processor's memory. The connection is usually HSIC, which is a chip-to-chip USB derivative. https:&#x2

More ›