rkeene2

7 ms·

1.
by rkeene2 1mo ago
Keeta developer here. I think the way we handle execution of code will be significantly different from Sui, both for stateful and stateless executions.
2.
by rkeene2 3mo ago
I'm not sure it can be malware if it's not some kind of -ware; like an SQL injection attack isn't malware even though it's attacking a weakness in the system
3.
by rkeene2 4mo ago
I have an implementation I use that has multiple drivers (PostgreSQL, Firestore, SQLite3, just a file, Redis, or an in-memory store) written in TypeScript and it's been working well for my low-scale needs. The interfaces could support
4.
by rkeene2 4mo ago
Make sure you use URL-safe base64 or the portions that looks like a path can get mangled MII//epi Is converted to MII/epi
5.
by rkeene2 5mo ago
Fair enough -- a simpler change might be to poison /etc/passwd and call `su` to a user that has uid 0, since that requires no shell code nor a readable binary, and this seems to have worked in a slightly modified POC: f=g.open
6.
by rkeene2 5mo ago
My `sudo` is also not readable. Files/directories don't need to be readable to be executed. I can still use `su` and `sudo`.
7.
by rkeene2 5mo ago
I couldn't get the POC to work with my version of Python so I had ChatGPT convert it to C [0] and was able to verify my Slackware system does not appear to be affected, but my NixOS system would be if I had any world-readable suid bina
8.
by rkeene2 5mo ago
A workaround might be to make all setuid/setgid files non-world-readable because then they cannot be opened at all, and thus there is no setuid file to replace the contents of.
9.
by rkeene2 5mo ago
Interestingly it fails for me because my `su` isn't world-readable: $ stat /bin/su File: /bin/su Size: 59552 Blocks: 118 IO Block: 59904 regular file Device: 0,52 Inode: 796854
10.
by rkeene2 5mo ago
We created Keeta Agent [0] to do this on macOS more easily (also works with GPG, which is important for things that don't yet support SSH Signatures, like XCode). Since it just uses PKCS#11, it also works with tpm_pkcs11. Source for t
11.
by rkeene2 6mo ago
I don't know what you mean regarding pivot_root affecting file descriptors because they are not modified, they point to new names because the enclosing directory has been moved/renamed. There is a small race between moving items
12.
by rkeene2 6mo ago
I usually just move all the files to a new directory (/oldroot) and pivot_root -- any open files reference the new paths. Then install into the newly empty root directory of the filesystem, reboot and delete the /oldroot.
13.
by rkeene2 6mo ago
To me, the biggest issue is that it seems to think of computers as something you use while being near and having only one user at a time accessing, where computers you use might be far away and have thousands of people accessing them per da
14.
by rkeene2 7mo ago
Well, not really because that part doesn't grant the US President arbitrary powers to perform any action that would result in regulation (for example, he is not given the power to go around killing random people even if doing so would
15.
by rkeene2 7mo ago
Good news ! It is against the law (i.e., illegal) for a US President to impose tariffs (on a whim or otherwise) -- a US President doing so is doing so illegally and without constitutional authority! When the US President commits crimes as
16.
by rkeene2 7mo ago
This misses the point that tax exemptions are the way politicians campaign for voter blocks. Having different kinds of taxes makes it easier to target a voter blocks more precisely.
17.
by rkeene2 7mo ago
Neat !
18.
by rkeene2 7mo ago
Also why num/num32 for Integer types, and no floating point type
19.
by rkeene2 7mo ago
It really just requires a network that doesn't use some kind of NAC since you can trivially do ARP poisoning of your target.
20.
by rkeene2 8mo ago
If you open a file with LibreOffice will read the whole thing regardless of whether or not the file is on NFS or not. The parent comment was stating that if you use the open(2) system call on a WebDAV mounted filesystem, which doesn't
21.
by rkeene2 8mo ago
I've had some additional time to reflect on this thread and I think I can spot the core disconnect. Do you believe that the Vienna Convention requires that countries treat their diplomatic representatives in some special legal way ? F
22.
by rkeene2 8mo ago
So it sounds to me like you are stating that you are okay with the original premise that it would be okay for China to come to the US Whitehouse and forcibly remove Trump to China to stand trial for the crimes he may have committed against
23.
by rkeene2 8mo ago
I still do not understand your point because as you state there is no conflict between the two agreements, and further there are no pair countries involved that mutually agreed to the ICC: - Diplomatic Immunity (through various treaties): C
24.
by rkeene2 9mo ago
I do not understand the point you are making. You cite a treaty that countries explicitly agree to protect diplomats while they are guests in another country -- I'm not sure what relationship this has with one sovereign nation using f
25.
by rkeene2 9mo ago
You are talking about a after a country has decided that they want to participate in the this process by ratifying their participation intentionally. How does this relate to a unilateral invasion ?
26.
by rkeene2 9mo ago
It seems like we should not invade another sovereign country unless we are at war -- a weighty process we should undergo because it's how the will of the people manifest in power. The US isn't a participant to the ICC, so I'm
27.
by rkeene2 9mo ago
So a thought experiment: If China were to put out a warrant for Trump's (the most unpopular president in US History, someone the majority of Americans disapprove of, a convicted criminal, and a pedophile who raped young people and has
28.
by rkeene2 9mo ago
I did something similar with TCL, the basis was using an extension I wrote to handle the UNIX stuff [0]. It operated an On-Premises cloud environment appliance, and `init` was just a TCL script (at one point it was a statically linked bina
29.
by rkeene2 9mo ago
Fast is cheap, and cheap is good.
30.
by rkeene2 10mo ago
See my comment above regarding Keeta Agent, which supports GPG and SSH with the same key.

More ›