robertgraham

7 ms·

1.
by robertgraham 1y ago
The "Washington Game" is described the Society of Professional Journalists. https://www.spj.org/spj-ethics-committee-position-papers-ano... Citing anonymous sources is not established ETHICAL practice, it's c
2.
Reading the Code Around Make_u32_from_two_u16()(cybersect.substack.com)
2 points by robertgraham 1y ago|1 comments
3.
by robertgraham 1y ago
This blogpost comments on Linus's latest tirade by reading the code. For example, it explains the specific problem of technical debt on failing to mask of high order bits by casting the low part to (u16). Years from now, when this lead
4.
by robertgraham 2y ago
My guess is that your original SYN did not go to the target, but was redirected somewhere close by. I'd look at the TTL value in the IP header of your first SYN-ACK, and play with such things as traceroute. Such redirection is often do
5.
by robertgraham 3y ago
The first two answers are 8 and 0. They are technically `undefined` according to the C standard, but are the behavior of every mainstream compiler. So much of the world's open-source code depends upon these that it's unlikely to c
6.
by robertgraham 3y ago
Nobody (yet) has mentioned Microsoft PWB - Microsoft's Programmers Workbench for their C compiler, around 1990. It's what all the Microsoft engineers themselves used when writing code for Windows, WinNT, OS/2, etc. It was ess
7.
by robertgraham 3y ago
Ethernet doesn't use TCP/IP. Ethernet is it's own network. It has nothing to do with TCP/IP. Other things use Ethernet. Routers, when connected to each other, often use a local Ethernet network to communicate. Think of t
8.
by robertgraham 3y ago
Well, you sort of demonstrate my point. The writers the OSI Model wrote a specific blueprint, not an "observation of natural laws". When they said "session", they didn't mean the same things you conceive of. Instead
9.
by robertgraham 3y ago
I use RFC 791, the original Internet model. RFC 1122 is a retconned version of the Internet model that tried to change terminology to fit OSI.
10.
by robertgraham 3y ago
Yea, it's not about engineers constructing systems. I mean, engineers do frequently pretend their creations fit the OSI model, but they work backwards to make it appear to conform to orthodoxy. The issue is about education. People teac
11.
by robertgraham 3y ago
It's wrong to think of them as different functions of the same network. Instead, they are differnet networks. Ethernet and the Internet both provide the function of forwarding packets through a network to the target destination address
12.
by robertgraham 3y ago
You can't. Nobody knows what the session layer does. Most falsely believe that layer handles sessions.
13.
by robertgraham 3y ago
I discuss this point several times. I claim the model is not useful, specifically because the layering abstraction for hte lower layers is a misconception rather than the truth. For example, I describe how the OSI Model claims that layer #2
14.
by robertgraham 3y ago
The book has an extensive section on history. I claim that by 1981, the OSI Model was already obsolete and that it didn't fit well, that was not a good teaching tool, that it has done more to beffudle than enlighten students. The probl
15.
by robertgraham 3y ago
Elsewhere in the text I describe how OSI chose a word at random, that they never meant by it what we now call "sessions". It could've been 'dialog layer' or 'interaction layer". I recommend they should&#x2
16.
by robertgraham 3y ago
Contrast with my descriptions of the layers, especially in chapters 3, 7 and 8.
17.
by robertgraham 3y ago
Well, as my footnote in the abstract says, it's swatting a fly with an anvil. It's not about people who already deal with this, like Nanog or systems programmers. Whatever model they've started with, they've developed a
18.
by robertgraham 7y ago
> I have no clue what point the author's trying to make here You mean, you don't know the agenda. The "point" was data, namely: - the Washington game that leads to unreliable journalism - the fact that all Huawei&#x27
19.
by robertgraham 10y ago
It's an absurd point. ZCash was built upon the Bitcoin codebase. This inherits a lot of bad decisions. Moral purity, demanding they start over again from scratch, just isn't practical. The bug in question could have been solved ha
20.
by robertgraham 11y ago
Yea, your startup failed long ago. You are just throwing good money after bad. Here's how a business model works: you try a business model. If it works, great. If it doesn't, move on and try the next business model. You are either
21.
by robertgraham 12y ago
'cause I'm a Windows user who don't know the advanced flags of Unix command-line tools
22.
by robertgraham 12y ago
I build stacks that are highly customized for the target solution and are impractical for general purpose use. A good general purpose stack is the 6windgate stack. I know nothing about it personally, but I know that a lot of people do use i
23.
by robertgraham 12y ago
The Linux TCP stack is NOT fast. My DNS server can respond to DNS queries faster than the simplest of in-kernel echo servers (like ICMP ping or UDP port 7 echo). That's with the entire DNS overhead of parsing the DNS protocol, looking
24.
by robertgraham 12y ago
ah, so you agree that the content of the article is good -- you just don't like the writer
25.
by robertgraham 12y ago
I've long had experience with: exploits working for the wrong reason, and also the reverse, failing for the wrong reason. For example, way back in the day before ISS bought my company, somebody claimed their IDS was vulnerable to an IM
26.
by robertgraham 12y ago
This has been there for nearly the entire history of Bash, like 2 decades.
27.
by robertgraham 12y ago
People are good at convincing themselves there is no problem. Vendors are good at convincing people there is no problem. The demonstration has to hit them over the head with the obviousness of the exploit. If the private-key pops up automat
28.
by robertgraham 12y ago
Because Snort's signatures can't detect 'heartleech'. But most other IDSs can, such as Bro. Unless there is a tool that demonstrates this, people won't believe that there is a difference between Snort and Bro, becau
29.
by robertgraham 12y ago
You still have to be in a spot to snoop. If you are a random hacker wanting to snoop on a Russian bank, once you get their private key, you have to now tap into the network. This is unlikely to be within your ability. You might fly to Russi
30.
by robertgraham 12y ago
Nobody is writing articles at Neel Mehta, the guy who discovered the bug. They should, he's a god.

More ›