razighter777

5 ms·

1.
Build a crappy ring-0 toy antivirus in eBPF with the IMA LSM(blog.prizrak.me)
3 points by razighter777 1mo ago|0 comments
2.
by razighter777 2mo ago
It's so telling and offputting. Please write like a normal human and put the effort in to type what you want to say. Using AI to make your writing is not only lazy, it's bland, tiresome, and disrespectful of the reader's time
3.
by razighter777 3mo ago
Excellent choice, the "Merge tag 'net-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net".
4.
by razighter777 3mo ago
I hope this doesn't become the new norm where government becomes the bottleneck for innovation in the AI space. It's worrying that with no formal and transparent policy framework that the government will be picking winners and los
5.
by razighter777 3mo ago
yep and and it forces every application to deal with the C FFI. It's beautiful in linux that I can access the full kernel API from an int 0x80/syscall instruction + a few register loads without having to link against crap. I can w
6.
by razighter777 3mo ago
Direct system calls are an amazing idea. The NtDll and bsd models are worse. The whole libc becomes a security boundary without the protection of kernel space. So much windows malware and process tampering happens because now you have a lib
7.
by razighter777 3mo ago
Very cool! would be interesting to see about combining this with other bpf program types like xdp progs, or socket map attached programs to integrate L7 http features downward.
8.
by razighter777 3mo ago
Same I had to do a double take. Would be pretty humourous if they somehow took advantage of crypto offloading to accelerate ai inference
9.
by razighter777 3mo ago
In practice, mostly scaling sessions and ephemeral data (caching) across multiple intances of a microservice on multiple machines. Seperating the kv store and the application allows upgrading each application while retaining availability an
10.
by razighter777 4mo ago
Remember, a lot of the memory safety benefits from go and rust and eBPF don't apply to the kernel eBPF! Kernel eBPF enforces semantics that verify array and loop bounds, memory accesses, and correctness of programs via the verifier. I
11.
by razighter777 5mo ago
Agreed. Software patents were a mistake in general. It is impossible to implement a modern video codec without using work in patents because of how overbroad and poorly written they tend to be.
12.
by razighter777 5mo ago
10gbe is a sweet spot at least for my homelab stuff. It's easy to find old enterprise gear for, cheap, and fast enough for everything I want to do.
13.
by razighter777 5mo ago
https://lore.kernel.org/linux-security-module/adjwZAevNaDgui... Patch for linux kernel adding support for enforcing Landlock rulesets from eBPF. In RFC stage now.
14.
by razighter777 6mo ago
I would love to use openbsd. I really wanna give it a try but the filesystem choices seem kinda meh. Are there any modern filesystems with good nvme and FDE support for openbsd.
15.
United States vs. $124,700 in U.S. Currency(en.wikipedia.org)
6 points by razighter777 6mo ago|0 comments
16.
by razighter777 7mo ago
This post goes over some of my trials and tribulations in making a clean user experience for TPM2-backed PIN authentication on Linux.
17.
Greasing Linux Auth: Hardware-Backed Authentication with PAM+TPM2(blog.prizrak.me)
1 points by razighter777 7mo ago|1 comments
18.
by razighter777 7mo ago
I frequently see freeBSD jails as a highlighted feature, lauding their simplicity and ease of use. While I do admire them, there are benefits to the container approach used commonly on linux. (and maybe soon freebsd will better support OCI)
19.
by razighter777 7mo ago
> It did something in the real world with real consequences. It didn't. It made words on the internet.
20.
by razighter777 7mo ago
Hmm I think he's being a little harsh on the operator. He was just messing around with $current_thing, whatever. People here are so serious, but there's worse stuff AI is already being used for as we speak from propaganda to mass
21.
by razighter777 7mo ago
Quick tip: If you type .patch after the PR url it gives you a git patch. Do curl <github patch> | git am and you can apply and review it locally.
22.
by razighter777 7mo ago
I was prepared to see something like a trimmed down / smaller weight model but I was pleasantly suprised. I was excited to hear about the wafer scale chip being used! I bet nvidia notices this, it's good to see competition in some
23.
by razighter777 7mo ago
Linux /home is far from a free for all. flatpak, landlock, selinux, podman, firejail, apparmor, and systemd sandboxing all exist and can and do apply additional restrictions under /home
24.
by razighter777 7mo ago
This is pure dramaposting- "post-mortem" is so misleading and mischaracterizes the situation. I don't use bazzite, I don't know Kyle or anybody here, but I am tired of the drama. All of the things listed in the blog are
25.
by razighter777 8mo ago
What practical problems do you run into with systemd? All the compliants I see tend to be philisophical criticism of systemd being "not unixy" or "monolithic". But there's a reason it's being adopted: it does i
26.
by razighter777 8mo ago
Yes, but you need cap_bpf now to load ebpf programs.
27.
by razighter777 8mo ago
https://blog.prizrak.me
28.
by razighter777 8mo ago
How about just allowing key enrollment with a physical button?
29.
by razighter777 9mo ago
The workarounds we need to enable P2P communication on the internet are a shame... we need turn, stun, webrtc, all this stuff so two computers can talk without a dedicated port forward or public ipv4. ipv6 is a beautiful protocol, (not perf
30.
by razighter777 9mo ago
That's more of a job for an encapsulating protocol. (shadowsocks or similar) Wireguard isn't designed to be obfuscating alone. It's just a simple l3 udp tunnel with a minimal attack surface.

More ›