jstrieb

If you want to pull back the curtain, I highly recommend hand-writing your own small ELF binary. In particular, on Linux, the C ELF structures are available via:

    #include <elf.h>

Writing C code to generate an ELF makes it apparent that an ELF is just a couple of structs and some assembled code dumped to a file. (I've used Keystone with decent success for assembly.) It's actually pretty easy to build something that works if you follow along with the man page:

    man 5 elf

For debugging handmade ELF files, it's handy to explicitly run the system loader under strace:

    strace /lib/ld-linux.so.3 ./homemade_elf

You can find the path to the interpreter that will be used via something like:

    readelf -a "$(which ls)" | grep -i interpreter

For example, debugging with strace will make it apparent if any memory mappings are failing. The loader also sometimes has its own error messages that are more descriptive than a normal segfault.

My understanding is that building a .deb is not too hard. The hard part is finding a willing Debian project sponsor to add the package to the archive.

https://wiki.debian.org/DebianMentorsFaq#How_do_I_add_a_new_...

I share your wish. This project started out because Just is not apt installable. But at a certain point, it became a "just for fun" project (pun intended).

Thanks!

Yeah, Just is pretty awesome! Its biggest drawback over Make is that you can often assume Make is installed, whereas it's not always clear that Just needs to be installed if you've never heard of Justfiles before, let alone how to install it.

There are a few design decisions where I think Just missed an opportunity to improve on Make, but they're all pretty minor.

I have done similar work using the GitHub APIs before. I recommend using their GraphQL explorer to develop your queries interactively. You may need to fall back on the REST API instead of the GraphQL one for certain stats.

https://docs.github.com/en/graphql/overview/explorer

You can also refer to my code here, which may already collect some of the statistics you're interested in.

https://github.com/jstrieb/github-stats/blob/master/github_s...

I predict the most annoying part of this project will be dealing with authentication. There are a handful of ways to do it, and the permissions can be finicky depending on what data you are fetching.

Best of luck!

Maybe you are looking for something like this?

https://www.mattblaze.org/blog/faraday

It's a few years old, but seems pretty thorough.

Associated paper (and talk video): https://dl.acm.org/doi/10.1145/3025453.3025866

Associated code: https://github.com/uwdata/graphscape

This post and its findings are really interesting!

Back when the "I forced a bot to watch 1000 hours..." memes were popular (https://knowyourmeme.com/memes/i-forced-a-bot), ages ago in AI/ML time, I tried to do something similar by fine-tuning GPT-2 on messages from a group chat of my friends. Since there were years of chat data, it seemed like a really good opportunity to test whether the language model would capture everyone's personality and generate funny, uncanny-valley versions of our banter.

Turns out that the group chat was used nearly exclusively for sending funny pictures and videos (that the language model obviously couldn't see), and for making plans to meet up. The generated conversations almost exclusively consisted of a random group chat member starting with "there is a party tonight, who wants to go?" and others saying "I'm down" or "when?" or "where?" It was 0% banter, and 100% logistics.

It was pretty hilarious in its own way, but not for the reasons anyone expected! I didn't learn very much about language models with that experiment, but I did learn that my friends' group chat is actually pretty boring.

I guess the best banter happens in real life. Glad to see it worked out somewhat more interestingly for this person, even if they did allude to some similar results in their closing thoughts section.

This is valid criticism, and I agree. The regular expression example is not made easier by his use of non-standard regex syntax.

I have not read Dr. Harper's book cover to cover; I treat it as a reference. For that, it is quite useful.

The same criticism of his SML book could also be made of his Practical Foundations for Programming Languages book. It's a massive, dense tome that is probably great for other professors to use as the basis for a course, but (in my opinion) serves as a mediocre introduction if you have never seen the material before.

https://www.cs.cmu.edu/~rwh/pfpl.html

I loved 150 when I took it, and program in SML from time to time to this day.

Bob Harper (a CMU professor with a focus on PL theory) also has a really good SML reference that is closer to a textbook than lecture notes.

http://www.cs.cmu.edu/~rwh/isml/book.pdf

Haven't used this since college, but it was very helpful then!

I stumbled on this page after reading Matt Blaze's legendary paper about deducing master keys from physically strong, but cryptographically weak, physical systems.

The paper is really good, and worth a read, even though it is from 2003:

https://www.mattblaze.org/papers/mk.pdf

https://news.ycombinator.com/item?id=32306328

In the "Save as..." pop-up, you can set the file type to "Optimized SVG" (among other SVG output types, if I remember correctly). Picking optimized SVG pops up another dialog on save that can be used to configure the optimization passes.

I regularly use this to export small SVGs for the web.

A while ago, I came up with a way to use bookmarklets to make bookmarks that open to different pages depending on the order in which you click them.

https://jstrieb.github.io/projects/hidden-bookmarks/

Every clicked bookmarklet concatenates a character to a passphrase used for AES decryption. The encrypted text and current passphrase are stored as intermediate state in the URL hash. When it decrypts, it redirects. If it doesn't decrypt, it goes to a fallback page as if it was a regular bookmark.

It was mostly a fun proof-of-concept, but I am hopeful that the technique has actually been useful to someone.

Tangential to the article: I have had decent luck finding fossils at random spots in the US. When I'm traveling by car, I tend to map out spots based on this list of about 15,000 fossil spots in the US and Canada:

http://donaldkenney.x10.mx/FOSSITE_INFO.HTM (listings by state here: http://donaldkenney.x10.mx/FOSSINDX.HTM)

Not all of the listed spots are findable, since the list is based on index cards of unknown origin transcribed from years ago. But I have had success with some of them, and it's often a fun detour.

Next time I go, I'll have to try licking some rocks!

Actually, the LaTeX template took the least amount of work of anything! It's a very slightly modified version of the default Pandoc standalone LaTeX template. You can recover the original (or something like it, depending on your version of Pandoc) for comparison by doing the following:

    pandoc --print-default-template latex

QA testing on a few different computers to make sure it was portable was, by far, the most time-consuming part of the project.

I'm the author!

As some have guessed, I did, indeed, conceive of this for procrastinating and reading non-work materials at work.

I don't actually expect to use it, but it was one of those ideas that I couldn't get out of my head until I had it working. And after that, it wasn't too much effort to clean it up and lob it onto the Internet. Although, perhaps calling it "cleaned up" is a bit generous considering it's 1k lines of shell script.

Maybe there are some grad students or researchers out there for whom this will come in handy.

Given its mostly-unstated purpose, releasing it on Labor Day was a small joke for my own entertainment :)

So far, I've used two good strategies:

- Spray PC into as many registers as possible, try to add those registers together as many times as possible, and store the sum at zero (or wherever the score ends up)

- Load an assembled instruction from an old value of PC as an int into a register, then do some subtraction to make it non-negative (since it's usually negative in my experience), then store in the score location

I'm curious what other strategies people have tried?

Uses the Gamepad API. I found it very easy to work with, in large part thanks to the corresponding MDN docs.

The only weird part about the Gamepad API is that you have to poll it rather than handling events the way you normally would for other, similar stuff in JavaScript. In practice, this means that you have to do your own debouncing for handling things like key combos, but that doesn't really affect individual button presses too much.

R12 contains the address of your score. In this case, that is address 0 - the start of the data segment.

The score register is yellow, and the corresponding memory region it points to (the actual bytes of your score) are also yellow.

It also works with USB gamepads!

At DEF CON where we will have this set up in-person tomorrow, we will have people playing on a USB Dance Dance Revolution floor pad.

I like the idea of sandbox mode!

I'm definitely much quicker at reading ARM assembly after playing a few hours of this game over the course of making it.

Thanks for the kind words! This comment helped me realize that I had misunderstood the parent commenter's question.

I have just pushed an update so that the up/down arrow keys only show up in the instructions if the max gadget size is greater than one.

Oh, my bad, I misread your question.

See a reply to your original comment: it changes the order for gadgets larger than one instruction. The default is one, but originally it was three, so the instructions stuck.

I will make those confusing instructions only show up when the gadget size is greater than one! This feels like a good change to make based on this feedback.

Yeah, I may have sacrificed clarity for concision in this case.

To answer by way of example, if you are given "add R1, R2, R3" rotating to the right will result in "add R2, R3, R4". As another example, rotating "mov LR, R0" to the left will give "mov R12, SP".

In other words, rotating right changes every register RN in the instruction to be the register R(N + 1). Left changes RN to R(N - 1).

My hope was that if it was not clear from reading, it would be after testing things out. But hearing that this may not be the case is helpful feedback!

Hey, any specific questions? I'd be happy to explain anything that needs clarification.

More broadly, any thoughts on how to make the game clearer? I know that a manual describing the instructions would help. But other ideas are welcome as well!

An accompanying blog post that explains the origins of the supply chain explorer site:

https://eto.tech/blog/introducing-supply-chain-explorer-adva...

A similar type of timing attack can be used to port scan your local machine (and other devices on your local network) from your browser.

https://github.com/Flu1dTeam/PortScanner

A while ago, eBay got caught doing this.

https://blog.nem.ec/2020/05/24/ebay-port-scanning/

An accompanying blog post that explains the origins of the supply chain explorer site:

https://eto.tech/blog/introducing-supply-chain-explorer-adva...

It's small, but one of my favorite math professors in college, when he could tell the class was losing focus on the lecture, would begin proofs with a shouted "BEHOLD x!" instead of the more traditional "let x..." It always woke people up.

Even for the most diligent students (which I was not), there will always be some dry material. Often, when I was struggling with writing up a difficult proof, I imagined him saying "BEHOLD," and it would cheer me up. Little things can make learning much more fun.