6,362 karma · joined May 7, 2008
geocar at sdf.org
if you used to email me at lonestar, that address no longer works.
#define $ [0]
qmail was at one point the second most widely deployed email server, handling the majority of online mail. It wasn't a research project; it's not obscure. Yahoo used to use it.
And what I mean by track record: After more than a decade after the last published version, a theoretical attack was found requiring special setup uncommon for a sysadmin, and impossible ten years prior.
When anyone thinks about how to build reliable secure software, I think they should be thinking of qmail because it really has no public source-available equal, except maybe djbdns.
seL4 on the other hand makes some specious claims about some ten year old version of itself, and so few people have even heard about it you thought it important to remind it is "technically" C -- qmail isn't like that at all: There is no prover, no test suite, and almost no metaprogramming of any kind. It's just C.
you able to find a reason to come visit? or am i going to have to come to blighty so we can hang out?
The software with the best security track record of all time is written in C.
Yes.
> Sure there are many edge cases, but surely the OS and FS can just be abstracted away and you can verify that "rm .//" actually ends up doing what is expected (Such as not deleting the current directory)?
I think people have been trying that since before I was born and haven't yet been successful, so I am much less sure than you are.
For example: How do you decide how many `/` characters to try?
For a better one: Can you imagine if "rm" could simply decide to refuse to delete files containing "important" as first 9 bytes? How would you think of a test for something like that without knowing the letters in that order? What if the magic word wasn't in a dictionary?
> This doesn't seem like sloppy coding, nor a critique of the language, it's just the same old "Oh, this is systems programming, we don't do tests"?
I've never heard anyone say that except as a straw man.
I've heard people say tests don't do what people think they do.
Also, hi how's things? :)
Yes. And I agree, but it also enables chroot(2) to work without being root, which was the syscall we are talking about, and which I still maintain is not as important as reading.
> arguably, it's the root that should be prohibited from calling chroot(2).
> IMHO there are a bit too many root-restricted operations that should not have been
It's a popular opinion. It's also cheap. So what?
> so we're stuck with setuid-enabled "confused deputies"
chroot(8) is not setuid-enabled. This has nothing to do with anything.
> That's the problem: the choice is implicit. If the author moved setuid/setgid calls way up in the call order, the implicit choice would've also been the safe one but it was literally impossible.
False. The setuid/setgid calls are in the right place. The lookup of the database mapping usernames to userids is in the wrong place.
If the rust programmer just read what they wrote they would see this.
If you just read what they wrote you would see this.
I did not choose the term to confuse you, that's from the definition document linked to the CVE:
https://cwe.mitre.org/data/definitions/426.html
The CVE itself uses the language "If the NEWROOT is writable by an attacker" which could refer to a shared library (as indicated in the report), or even a passwd file as would have been true since the origin of chroot()
> root technically controls everything in one sense of the word.
But not the sense we're talking about.
> Because you can't call chroot(2) unless you're root
Well you can[1], but this is /usr/sbin/chroot aka chroot(8) when used with a non-numeric --userspec, and the point is to drop root to a user that root controls with setuid(2). Something needs to map user names to the numeric userids that setuid(2) uses, and that something is typically the NSS database.
Now: Which database should be used to map a username to a userid?
- The one from before the chroot(2)?
- Or the one that you're chroot(2)ing into
If you're the author of the code in-question, you chose the latter, and that is totally obvious to anyone who can read because that's the order the code appears in, but it's also obvious that only the first one* is under control of root, and so only the first one could be correct.
[1]: if you're curious: unshare(CLONE_USERNS|CLONE_FS) can be used. this is part of how rootless containers work.
Seems and smells is weasel words. The root cause is not thinking: Why is root chrooting into a directory they do not control?
Whatever you chroot into is under control of whoever made that chroot, and if you cannot understand this you have no business using chroot()
> To me such a get_user_by_name function is like a booby trap
> I'd say, either split getting the user data and loading any shared libraries in two separate functions, or somehow make it clear in the function name what it is doing.
You'd probably still be in the trap: there's usually very little difference between writing to newroot/etc/passwd and newroot/usr/lib/x86_64-linux-gnu/libnss_compat.so or newroot/bin/sh or anything else.
So I think there's no reason for /usr/sbin/chroot look up the user id in the first place (toybox chroot doesn't!), so I think the bug was doing anything at all.
The idea that Copilot can do the same, and I can't sue Microsoft for it seems to me a similar kind of entertainment.
Unfortunately, my company isn't allowed to purchase entertainment for its employees because we've received advice it is considered payment-in-kind
You also didn't read the source from where that link was from.
> What matters is the order established in recent history.
> Colonization was normalized
Sounds pretty racist man.
That doesn't sound like struggling to me.
https://www.matec-conferences.org/articles/matecconf/pdf/201...
Compare with the growth in cases in the US:
https://www.uscourts.gov/data-news/judiciary-news/2020/02/13...
Why is it China increasing cases is evidence of struggling to you? Do you think the US is also struggling? What exactly are you talking about?
> You can't use 100-400 years ago as the counterexample to what happens today.
The US joined the Berne convention in 1988. I do not think we are talking about 400 years ago, but we're talking about the majority of the US history, having law that it was okay to ignore copyrights of the rest of the world.
> It's like justifying Russian invasion of Ukraine with colonists invading Native American territories
I don't agree: One can also mean that there is no justification for the invasion of the Ukraine just like there was no justification for invading American territories.
I didn't see anything in there about Chinese companies violating Chinese law.
Can you so easily look up how American companies struggle with effective enforcement of Chinese IP laws? I think it should be pretty easy to see how American companies struggle with effective enforcement of European IP laws, and I can tell you it is similar.
From here, it is not so clear that the US can even enforce its own laws at the moment.
> signaling unusual usage
Thank you!
> In this case, talking about countries like they're squabbling kids.
> > Started what?
> Fishy use of others' IP, packaging others' work without attribution.
I see. I guess if China is 3000 years old then maybe obviously, because the US is such a young country by comparison.
So you think it is "fair"[1] to violate Chinese Law because there were people in China who violated US law first?
If so, I think that is pretty childish.
[1]: I am trying it out!
I think they probably acquire it in accordance with Chinese law.
> but I don't think the US "started it" to be fair.
Who are you quoting with those marks? Started what? To be fair to whom?
I also know how to use SRV records so this is a non-issue for me and everyone I work with.
I also know of https://github.com/Crosse/sshsrv and other tricks
I agree more SRV records would have helped with a tremendous number of unnecessary proxies and wasted heat energy from unnecessary computing, but in this day and age, I think ECH/ESNI-type functions should be considered for _every_ new protocol.
That's one implementation. Another implementation is the proxy looks at the SNI information in the ClientHello and can choose the correct backend using that information _without_ decrypting anything.
Encrypted SNI and ECH requires some coordination, but still doesn't require decryption/trust by the proxy/jumpbox which might be really important if you have a large number of otherwise independent services behind the single address.
Talk about perverse.
What the fuck are you talking about?
Github only has authority because people put their shit there; if people want to point that back at the "right" website, Github should be helping facilitate that, instead of trying to help Google make their dogshit search index any better.
I mean, seriously, doesn't Bing own Github anyway?
But there was a need for you to characterise me so?
> So what problem is this solving?
What makes you ask me that instead of reading the website and papers for yourself? Do you think I could possibly know enough about the kinds of other problems you have from the example one that makes you call me names?
I mean, did you read even the first page of the paper I suggested? Were you confused by anything in the first paragraph? Do you know what System-F means in that context? Did you do an Internet search? Anything? Anything at all you could say you got stuck on that you didn't understand? Or did you somehow get the impression I should spoon-feed you?
Why do you waste anyones time with this?
The aesthetic of mathematics as it appears in journals is I think questionable, but undeniably convenient for communication, so it is every language making the case that you (dear reader) can say something very complicated and useful in the ideal amount of space.
"Hello world" isn't that: That's the one program everyone should be able to write correctly, 100% of the time. That's how we can talk about brainfuck as exercise, but APL is serious.
Or put another way, even if seeing a new kind of "hello world" excites dear reader, it's probably not going to excite me, unless it's objectively disgusting.
What Om does here is exactly right for me: It tells me what it is, and makes it easy for me to drill down to each of those things to figure out what the author means by that, and decide if I am convinced.
I mean, that's the point right? I'm here trying to learn something new and that requires I allow myself to be convinced, and since "hello world" is table-stakes, seeing it can only slow my ability to be convinced.
We can enumerate all programs up to a given length, so up to that limit all sets of functions are functions.
f(x)=O(g(x)) still makes sense in exactly this way: if g(x) is 1, then f(x) is a function that is O(1) right? How do we know g(x) is 1? Because all programs of some length that compute f(x) have that property. Of course there are longer programs that do it, and shorter programs that don't, and other programs still, but we're talking about these ones.
f(x)<O(g(x)) then says that the f(x) must be shorter than that; it isn't a member of the set.
What do you think I am missing?
I have no idea what you think you just said, but I did not say anything like that.
> Most of the internet is noise, and if you're showcasing something it's good form to immediately show your readers what actually is
So you say, but without responding to either of my suggestions for not doing this, and after saying something that doesn't sound relevant at all.
Of what exactly are you trying to convince me to do? I'm not the author of this page, I'm not confused by what TAL is, and I'm not going to agree that you don't deserve to have your time wasted when you're here wasting mine, so what is it?
So you say, but I think _I'm_ an expert too, and I wasn't frustrated in the slightest. Maybe you're just not an expert in this space. Did you consider that?
Of course it would be nice if everyone communicated to us in our preferred way, but I think making the reader work a little bit before they have a conversation is a good way to figure out if you're dealing with an expert or not, because an expert actually worth talking to about your ideas will not find it to be too much work to understand them
Students can especially benefit from this advice, because they are still too new to be able to recognise experts from the substance of their words
Your "feelings" may help you make snap judgements that can keep you alive, but they cannot help you code and they will conspire against you when you effort to learn new things. Nobody wants to feel wrong, and you will feel wrong many times when you learn something new, but it is the only way to actually learn the thing. Remember this the next time you have "feelings" about knowledge
Did you consider the possibility that this sort of thing was done to avoid wasting time with non-experts who think an "example" of a language they don't know is enough to make comments about?
> I still have not seen a line of TAL
My suggestion: Start with the "Papers" and then look at the paper that introduces TAL. It has an example program with analysis