bkallus

8 ms·

1.
by bkallus 3mo ago
I have seen it firsthand in the CS department here at Dartmouth. It is bad. We're currently designing a new intro systems curriculum, and we're thinking of it as an adversarial problem. That is, we're designing the course to
2.
Weird Design Choices in HPACK Strings(kallus.org)
2 points by bkallus 3mo ago|0 comments
3.
by bkallus 4mo ago
> the OpenBSD project has not been very receptive in the past for bug reports, my sense of “this is probably fine, in practice”, and that if OpenBSD wants to weed out UB from their code base, then that’s a major project that should be do
4.
How cross-thread double free detection could work in glibc malloc(kallus.org)
3 points by bkallus 6mo ago|0 comments
5.
by bkallus 10mo ago
I hope he ends up covering integer division by constants. The chapter on this in Hacker's Delight is really good but a little dense for casual readers.
6.
by bkallus 10mo ago
ABISan. Think of it like UBSan, but for assembly. It's a custom assembler built on top of the LLVM assembler (llvm-mc) that emits instrumentation code to catch ABI violations at runtime. Stuff like clobbering nonvolatile registers, mis
7.
Bash Username $PS1 Command Injection(kallus.org)
2 points by bkallus 1y ago|1 comments
8.
x86_64 Syscall Numbers Go Where?(kallus.org)
3 points by bkallus 1y ago|0 comments
9.
by bkallus 1y ago
Cache poisoning is also possible. See https://youtu.be/aKPAX00ft5s?feature=shared&t=8730 for a relevant demo. You can also (in principle) steal responses intended for other clients, and control responses that get delive
10.
by bkallus 1y ago
I have been working on this :) https://github.com/narfindustries/http-garden
11.
by bkallus 2y ago
We encourage students to use their own machines. We even loan out old ThinkPads and MacBooks for students to run Linux on. Very few (3-5 per term) take us up on this offer. Most of our students would rather we do the sysadmin stuff for them
12.
by bkallus 2y ago
Learning to use a real SSH client is part of the curriculum. If they graduate without this knowledge, we have failed as teachers.
13.
by bkallus 2y ago
I too have these fond memories, and I enjoy passing it on to the next generation :)
14.
by bkallus 2y ago
SSH is a fundamental protocol. If students can get through our program without learning what SSH is and how to use it, that's a problem.
15.
by bkallus 2y ago
I ran the servers for our networks, binary exploitation, and intro systems programming classes, and this thing is a major annoyance. It is because of this stupid RAT that students do not understand how to use the OpenSSH client. I've t
16.
by bkallus 2y ago
I went with SIGINT because it's more fun to press ctrl-c than to pgrep and kill. If you'd rather use SIGUSR1, just change SIGINT to SIGUSR1 line 654.
17.
Show HN: Heap Explorer(github.com)
73 points by bkallus 2y ago|5 comments
18.
by bkallus 2y ago
My experience participating in Google's program has been pretty good. The reward money is a nice supplement to my grad student stipend. I got a free trip to DEFCON out of it, too.
19.
by bkallus 2y ago
Search for local tech-oriented flea markets. If you're in the Boston area, this is a good one: https://w1mx.mit.edu/flea-at-mit/
20.
by bkallus 2y ago
This almost entirely skips the role of the dynamic linker, which is arguably the true entry point of the program. If you are interested in that argument, see https://gist.github.com/kenballus/c7eff5db56aa8e4810d39021b2.
21.
by bkallus 3y ago
Yuzu is free software, so its source code is already available: https://github.com/yuzu-emu/yuzu
22.
by bkallus 3y ago
I'm pretty sure that AVI just wraps Nginx, even though they claim otherwise. I think this because Nginx has a bunch of parsing quirks that are shared with AVI and nothing else.
23.
Freenginx: Core Nginx developer announces fork(mailman.nginx.org)
1131 points by bkallus 3y ago|475 comments
24.
by bkallus 3y ago
Yeah, I should really rewrite the README to bucket bugs by behavior instead of server; there's a decent amount of redundancy in the set of discovered bugs.
25.
Show HN: The HTTP Garden – A Parser Vulnerability Research Tool(github.com)
75 points by bkallus 3y ago|3 comments
26.
by bkallus 3y ago
This makes sense. Nginx is reliable and well-tested, and OLS is neither. See my recent Shmoocon talk (yes yes, self promotion) for an example of a vulnerability that would be caught immediately in Nginx, but persisted in the OLS codebase fo
27.
by bkallus 3y ago
I've spent the better part of the year messing around with every HTTP server I could get my hands on. I would not recommend OpenBSD httpd. It's supposed to be simple, and it is simple compared to Apache, but it also has way fewer
28.
by bkallus 3y ago
All I can say is that Signal uses more battery than any other app on my phone. Since my Pixel 7a's last complete charge 3 days ago, Signal has been in the foreground for only 2 hours, but it has been running in the background the entir
29.
by bkallus 3y ago
This isn't necessarily true. When you install the Signal app on an Android phone that doesn't have Google Play Services installed, it receives push notifications using its own notification daemon instead of using Google's. Th
30.
by bkallus 3y ago
Except the RFCs are not the only URL standards. Browsers all implement the WHATWG living standard, which is subtly incompatible with the RFCs.

More ›