bkallus

AT&T was doing this in 2021. They called it "DNS Error Assist."

I imagine they're still doing it.

I went to a conference at GE Research where I spoke to some QNX reps from Blackberry for a while. Seemed like they were hinting that some embedded computers in some of GE'S aerospace and energy stuff relies on QNX.

I've only recently had to start using BSD, and FreeBSD is definitely easier to get started with.

Anecdote: I found a null pointer dereference in the OpenBSD httpd last week that allows an attacker to crash the server with a single crafted request. It's now patched.

I tried for a while to get a backtrace of the bug on OpenBSD, but their ancient gdb port doesn't support follow-fork-mode, and their clang port generates DWARF that their gdb port doesn't understand. Every time I reproduced the crash, the backtrace was just useless ASLR addresses. FreeBSD had none of these problems, and I was able to collect the backtrace in minutes.

I care very much about privacy. I use only free and open source software on my personal and work computers, as well as my phone and router. I do not use social media, except for this site. I do not connect anything to my network that I do not control. For this reason, I don't have a smart TV, smart speakers, or smart appliances. I drive a car from 2009 with no cellular connection or GPS unit. I agree that the "nothing to hide" argument is weak.

I am opposed to indiscriminate government surveillance. This is not that. I have seen what it looks like when this data is used as evidence in court. The EDR provides information about the driver's last inputs to the car, and it has a very small amount of storage. The data is only accessible through physical access to the unit.

In the event of a fatal accident, there are very few sources of information:

- Survivors (biased)

- Witnesses (not always present)

- Forensics (squishy)

- EDR data

The EDR is a crucial source of truth for determining the cause of an accident. When you drive on busy roads, you are taking others' lives into your hands. In the event of a serious accident, it's critical that the details of the seconds before the accident are available to inform legal decisions. If we remove the EDR, we are left only with less reliable sources of information.

I do not support making black boxes mandatory because it feels like it violates the 5th Amendment. I will also never purchase a car without one, because I think it is more likely to prevent harm than cause it.

Curious to hear your objections to the black box.

Black box data (speed, steering+pedal input logs) were invaluable in determining fault in an accident involving one of my family members recently. As long as the data doesn't leave the car under normal circumstances, what's the harm?

except (Error1, Error2) as e still works in python3.

C makes it too inconvenient to pull in 300 dependencies. I think the recipe for dependency hell is insufficient stdlib + decent included package manager.

In Alacritty, ctrl-l clears the screen but does not clear the scrollback buffer. Clear also clears the scrollback buffer. This is useful for running programs with lots of output containing escape codes that may get mangled by less; just run the program and press shift-home to scroll to the top of the buffer.

The biggest one is the Firefox ESR build from the pmOS repos with the custom userChrome.css that tries to fit everything onto the Pinephone's screen. I pretty consistently encountered pop-up prompts (for example, in the built-in password manager) that ran off the edge of the screen in both portrait and landscape. Zooming out sometimes helped, but then the text was unreadable and the buttons too small to press. There was also no forward button in either the overflow menu or the nav bar. The Phosh settings app had similar problems.

In the past year, I have used a pinephone+keyboard with Arch, a oneplus 6t with postmarketOS, and a pixel 7a with GrapheneOS. In my opinion, Graphene is significantly easier to daily drive because the applications are designed for a phone's form factor.

I had the privilege of reporting a few bugs in HAProxy in the last few months. Willy's a real treasure; he's friendly and knowledgeable, and he clearly cares a ton about HAProxy even after 22 years of development.

What stops you from desoldering the bad connector and soldering on a new one?

Definitely still a day job for some people. These DARPA and IARPA programs all have a decompilation component:

1. https://www.darpa.mil/program/assured-micropatching

2. https://www.iarpa.gov/newsroom/article/annotated-malicious-b...

3. https://www.darpa.mil/program/recovery-of-symbolic-mathemati...

Android updates often do not come with kernel updates. Major kernel updates are difficult because of the tangle of proprietary modules in most Android kernels.

To partially answer GP's question:

Unofficial major kernel updates have happened in the past. OnePlus 6T, for example, shipped with 4.9.x, but supports mainline on pmOS.

RFC 3986 provides a generic URI grammar that is not scheme-specific, though other standards that define URL schemes may choose to subset the subset that grammar as they see fit. If a URL parser does not recognize a scheme, I would expect it to parse the URL using the generic parsing procedure.

A student and I have been using coverage-guided grammar-aware differential fuzzing to discover bugs in URL parsers for a while now. There is extreme variation in this space; it's trivial to turn up meaningful bugs in widely-used URL parsers.

".://" is a particularly egregious example. (and, by the same principle, "evil.com://good.com")

- Python 3.6's urllib.parse sees the "." as the URL's scheme, and an empty authority.

- Python 3.11's urllib.parse sees the entire ".://" as the URL's path.

- urllib3.util.parse_urlsees the "." as the URL's hostname, the ":" as the separator for an empty port number, and the "//" as the path. (this is one of the most downloaded packages on PyPI)

- Boost::URL rejects the URL outright.

If you're going by RFC 3986, then only Boost::URL is exhibiting the correct behavior. If you're going by the WHATWG URL standard, then I don't know which one of these behaviors (if any) is correct.

If you're interested in collaborating on this project, please send me email. My address is in the footer at https://kallus.org

I do :)

Until recently, LiteSpeed parsed Content-Length values using strtoll in the base-0 mode. Thus, by sending Content-Length values prefixed with 0, you can get it to interpret the value in base-8. Most HTTP proxy servers strip leading 0s from Content-Lengths, rendering the bug in LiteSpeed not exploitable. Until recently, HAProxy didn't do this, which made HAProxy + LiteSpeed vulnerable to request smuggling.

I put together a PoC demonstrating how this can be used to bypass any HAProxy ACL with default configurations for HAProxy (except the added ACL) and LiteSpeed.

Clearly, LiteSpeed is more responsible for this problem than HAProxy, but the bug in LiteSpeed violates HAProxy's security model, not its own.

The CVE system is all kinds of messed up.

We need (at least)

- A clear policy from the CNAs that describes exactly which bugs should be assigned CVEs.

- A process by which bogus CVEs can be invalidated, and CVE spammers can be banned from further submissions.

- A way to register CVEs for vulnerabilities that span multiple programs.

  - e.g. an HTTP proxy has a low-risk bug, and an HTTP server has a low-risk bug, but when the proxy and the server are deployed together, the bugs become exploitable.

- An appeals process for CVE description updates.

  - e.g. You would not know from the description that CVE-2023-34188 is trivially exploitable and can reliably lock up vulnerable servers because MITRE refuses to update it.

This works only for programs that are publicly available.

I switched my 2012 thinkpad from dwm+st to sway+alacritty a couple years ago and noticed no difference in input latency.

I'm also in the New England area. In Boston, there's LibrePlanet, which is in March. I went for the first time this year; it was a lot of fun.

I'm still trying to figure out if I'll fly out to Columbus for OLF this year. I went last year and the year before. It's worth the travel to me, but I have a flexible schedule. The talks are good, but the people are the real reason to go. A lot of the people who go to these conferences work on really interesting stuff. There are of course also big names like maddog and Doug McIlroy.

Functional languages support this type of operation in a few different ways.

One is through constructs like Clojure's `take-while`. Instead of setting a vairable when you want to exit the loop, you define a predicate that is false when the loop should exit.

Another is through `any` and `all` (aka `some` and `every`), which work in a similar way to `take-while`, except they reduce OR or AND across the returned values from the predicate as they go.

EDIT: grammar and clarity

Dang; I found and reported this vulnerability on June 5 (after this report was made, but before it was made public or patched), and was told that they were already aware of the bug and working on a fix. I didn't realize I'd been beaten by only 10 days!

https://github.com/aio-libs/aiohttp/issues/7312 https://github.com/nodejs/premature-disclosures/issues/4

Taking a course in abstract algebra is a good first step. A first course in abstract algebra is supposed to introduce you to groups and rings, so you won't be out of place.

You might also consider taking a proof-based course in linear algebra.

This is good advice in general, but the Asus screenpad does work in Linux and it's extremely cool. Shows up just like a normal display!

Arch. I have hplip installed as well, and I'm not sure if that's necessary or not.

I use a LaserJet 1012 that was thrown out at a local law firm. It's almost 20 years old, and still prints great. I used it through high school, college, and now grad school, and haven't once changed the toner. It's plug and play on Linux, but is a pain to get working on Windows >7.

I don't know who still makes decent printers today -- I see a lot of people recommend Brother -- but why buy new when there are tons of cheap old laser printers from the days before they all became anti-consumer garbage?

It is. The cardinality of the power set of a set S is 2^|S|.

I don't know, but one could implement this without too much difficulty as a wrapper around afl-showmap.

My understanding is that that attacker wasn't using bath salts, and that the connection to bath salts was all speculation.

Also, I think bath salts is usually synthetic cathinones, i.e. functional analogues of khat, and not derivatives of meth, cocaine, ecstasy, or pcp.

Could be wrong, I'm just some guy on the internet.

See https://www.foxnews.com/us/medical-examiner-rules-out-bath-s... and https://en.m.wikipedia.org/wiki/Miami_cannibal_attack