thijsr

15 ms·

1.
The Last Question(thelastquestion.net)
3 points by thijsr 7d ago|0 comments
2.
iPhone Ultra accessories(dbrand.com)
2 points by thijsr 8d ago|0 comments
3.
Docker-Boot(github.com)
2 points by thijsr 9d ago|0 comments
4.
by thijsr 7mo ago
I may be biased, but I do think it is a very fun talk (disclosure: I am the speaker)
5.
by thijsr 7mo ago
A digital euro is intended to the the digital equivalent of cash. It is issued directly by the central bank. Currently, consumers cannot have an account at the central bank. They have a balance at a commercial bank, and the commercial bank
6.
by thijsr 9mo ago
We've only verified EC2 during our research, but you do make a good point here. Nitro wasn't vulnerable. Firecracker might have been, considering that it is also built on top of KVM. Firecracker was not specifically designed to al
7.
by thijsr 9mo ago
Hi, author here. Thanks for posting this! I gave a talk yesterday at the 39th Chaos Communication Congress in Hamburg that goes into detail about how the vulnerability works [1]. Short summary, on affected CPUs, all of host physical memory
8.
by thijsr 10mo ago
> I also don't love enums for errors because it means adding any new error type will be a breaking change You can annotate your error enum with #[non_exhaustive], then it will not be a breaking change if you add a new variant. Effec
9.
by thijsr 1y ago
Scientific papers have an abstract, which already serves as a short summary.
10.
by thijsr 1y ago
This is a project that we've been working in collaboration with Google and AWS. We present a vulnerability that allows a malicious virtual machine to leak all physical memory of its host, including the memory of other virtual machines
11.
L1TF Reloaded(bughunters.google.com)
4 points by thijsr 1y ago|1 comments
12.
by thijsr 1y ago
When you can modify the microcode of a CPU, you can modify the behaviour of the RDRAND/RDSEED instructions. For example, using EntrySign [1] on AMD, you can make RDRAND to always return 4 (chosen by a fair dice roll, guaranteed to be r
13.
by thijsr 1y ago
Rowhammer is an inherent problem to the way we design DRAM. It is a known problem to memory manufacturers that is very hard, if not impossible, to fix. In fact, Rowhammer only becomes worse as the memory density increases.
14.
by thijsr 1y ago
As far as I am aware, the course material is not public. Practical assignments are an integral part of the courses given by the VUSEC group, and unfortunately those are difficult to do remotely without the course infrastructure. The Binary
15.
by thijsr 2y ago
Disabling SMT alone isn’t enough to mitigate CPU vulnerabilities. For full protection against issues like L1TF or MDS, you must both enable the relevant mitigations and disable SMT. Mitigations defend against attacks where an attacker execu
16.
by thijsr 2y ago
It depends on your threat model. If you don't run any untrusted code on your hardware (including Javascript), you can safely disable the mitigations. If you do run untrusted code, keep them enabled.
17.
by thijsr 2y ago
From the FAQ: > While FLOP has an actionable mitigation, implementing it requires patches from software vendors and cannot be done by users. Apple has communicated to us that they plan to address these issues in an upcoming security upd
18.
Saving Voyager 1 [video](youtube.com)
88 points by thijsr 2y ago|13 comments
19.
Saving Voyager 1 [video](youtube.com)
2 points by thijsr 2y ago|0 comments
20.
by thijsr 3y ago
RowHammer is not a thing of the past. In fact, modern DRAM chips are significantly more susceptible to RowHammer due to their increased chip density [1]. [1] https://arxiv.org/abs/2005.13121
21.
Slam: Spectre Based on Linear Address Masking(vusec.net)
4 points by thijsr 3y ago|0 comments
22.
E-commerce app Pinduoduo used Android 0-days to turn 100M+ phones into a botnet [pdf](github.com)
2 points by thijsr 3y ago|1 comments
23.
by thijsr 4y ago
The paragraph right after says > Additionally, organizations may have their own billing information associated with the org itself. They can use this to sponsor the accounts of their members, allowing the billing for a tightly coupled gr
24.
Operational information regarding OpenSSL 3 vulnerability(github.com)
5 points by thijsr 4y ago|0 comments
25.
by thijsr 4y ago
They have a status page for the WhatsApp Business API at https://metastatus.com/whatsapp-business-api It currently shows major disruptions.
26.
by thijsr 4y ago
Yes, the CPU self-reported power usage is indeed fairly noisy. We've tried to mitigate this by executing certain tests multiple times in a row, and using the average power consumption across these executions. However, this is data is s
27.
by thijsr 4y ago
Hey, I wanted to share a project that we've been working on! Coppers is a custom test harness for Rust that allows you to measure the energy consumption of your test suite. A use case for this could be to identify regressions in energy
28.
Show HN: Rust test harness that measures energy consumption(github.com)
120 points by thijsr 4y ago|16 comments
29.
Buycloud – How natural phenomena are turned into (exploitable) resources(urcloud.buycloud.space)
1 points by thijsr 5y ago|0 comments
30.
IPCC Interactive Atlas – Visualization of climate change data(interactive-atlas.ipcc.ch)
3 points by thijsr 5y ago|1 comments

More ›