varx/tech

Boston-area meat construct ␥ I just do what the plants tell me ␥ I'd rather be undermining the client-server paradigm

This is the more tech-y alt of https://cybersecurity.theater/@varx

Public Key

npub13cavz8sul0get8lllzwszm7j5mq4n3ygpn60uqn54su99csl9wyqeu3sx0

NIP-05 Address

varx_at_infosec.exchange@mostr.pub

Profile Code

nprofile1qqsguwkprcw0h5v4nlll38gpdlf2ds2ecjyqea87qf62cwzjug0jhzq2u8eyd

Author Public Key

npub13cavz8sul0get8lllzwszm7j5mq4n3ygpn60uqn54su99csl9wyqeu3sx0

Show more details

Last Notes

2024-09-18 13:30:43

Bless the CS rep who just listened to me rattle off something like "eVfFmNeLPuVvHbbcrPaz" as the answer to a security question ("what's your favorite horse breed" or whatever). And then made me say it again, but indicating which letters were uppercase!
That's a lot more commitment than the reps where you can say "it's a string of garbage" and they say "sounds good".
...but for both our sakes I've changed it to something pronounceable, because apparently this is a thing you have to say over the phone sometimes, not just paste into a web page. -.-

2024-08-29 03:04:05

- reply

@npub10mw…awkn I love this and hate this in equal measure.

2024-08-02 22:28:26

I'm having trouble understanding the concept of "Key Compromise Impersonation". I think the idea is that if Alice's keys are compromised, not only can Mallory impersonate Alice to Bob, but also impersonate Bob *to Alice*. Is that right?

2024-07-19 14:40:19

I guess there are still some people running Windows on their servers.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/813/665/846/642/095/original/ee68d35f9f23123d.png

2024-07-19 14:32:53

And a happy Windows Server Awareness Day to you as well.

2024-07-14 02:57:46

In the past few years I donated $1000 to Mozilla. Firefox has been important to me.
But with all the adtech bullshit they're doing now, I definitely cannot see myself giving them more. I don't feel like they've spent my money wisely, or in my interests.
Maybe Servo is the right thing to support going forward...

2024-06-20 11:43:35

- reply

@npub1wa4…9nmn And it works really, really well. Each person gets to create their own *social space*, like a host sets the tone in their own living room.

2024-05-24 22:14:00

- reply

@npub1836…8jp6 Yeah. I still run a Jabber server, but... there are an awful lot of offline buddies in Pidgin. :-(

2024-05-18 22:11:24

Bisection is one of the most powerful tools I have at my disposal while debugging. (Right after print(), heh.)
Today's adventure: Something in my IDE's config is breaking my workflow. I can't find it by poking around, so I'm deleting alternating halves of its config directory to see which files affect the issue. Just 4 iterations in and I think I know which *file* to start biseecting.
This is something that should be taught in school.

2024-03-29 13:03:05

- reply

@npub1836…8jp6 Cool, thank you for the code samples! That will really help.

2024-03-14 03:22:05

Today's Rust learning:
I've been doing this thing where I have a param `foo: &Bar` and then I pass it to some function as `&foo` because I've superstitiously stuck & onto everything to make the compiler happy. Turns out this creates a double reference; that only works because the compiler is automatically dereferencing the first layer to make things match up. My `foo` is already a reference, so I can pass that reference.
This clears some things up. :-) I'm still missing something about borrowing, but I'll get there.
(Thanks to cargo-clippy for illuminating this!)

2024-02-25 00:04:49

- reply

@npub1836…8jp6 Mine have been freezing up as well, but it starts with slowness and then gets worse. Haven't yet hooked up a monitor because the only monitor we have with a matching port is an ancient projector with misaligned colors. 🙃

2024-01-25 23:39:24

- reply

@npub1836…8jp6 I was bemused to discover this month that my employer has one as well.
I'm sure there are good reasons for having that position—I don't really have a good understanding of corporate division of labor, etc.—but to be honest one of the first thoughts to enter my head was the phrase "Chief Enshittification Officer". 😆

2024-01-21 16:18:53

- reply

@npub1836…8jp6 Something in academia (or adjacent) is actually something I've had an interest in for a while. I've never been clear on how exactly that would work -- find someone who has a grant and needs a programmer, I guess?

2024-01-21 00:17:46

Anyone looking to hire a senior software engineer, or perhaps a pentester?
I just lost half my team in another round of layoffs, and it's feeling grim around here—looking for a new employer. Hoping to find one that does something good for the world.
My main experience is in backend dev, APIs and such, but I had my start in web dev and wouldn't at all mind going back to full-stack work.
Security has been a huge part of my life, and it would also be fun to pivot to doing offensive security in my day job, not just as a hobby. :-)
#GetFediHired

2024-01-15 00:38:07

- reply

@npub1yck…ujmw Nope, just stuck into the README next to the "This project is licensed under the GPL". (Editing the GPL would be a different kettle of fish, yeah...)

2024-01-14 23:59:50

Software licensing question, semi-hypothetical:
I encountered a repo available under the GPL, *but* there's also a note about "you can't sell this". This... isn't actually compatible with the GPL, and reveals the author's poor understanding of the license they chose. It doesn't matter for me, because I'm not planning on selling it, but it does raise an interesting question: What is the most likely *effect* of this statement?
- License grant is invalid?
- GPL prevails entirely?
- No-sale applies to original work, but not to derivatives?
I'm leaning towards the first one, myself. Curious to hear what others think.

2023-12-14 23:07:20

- reply

@npub1836…8jp6 @npub189n…7mgz You can have two modules import each other at the top level, no problem. Here's a demo: https://pastebin.com/dmQLktwn

2023-12-14 21:27:35

- reply

@npub1836…8jp6 @npub189n…7mgz Python has late binding (if that's the right term) so there should be no difficulty in two classes in different modules referring to each other.
It sounds like maybe the problem you're encountering is a cross-module reference *at the top level* in one of the modules. That doesn't permit circularity.

2023-11-23 17:00:52

- reply

@npub1836…8jp6 I spent 2-3 hours this week trying to diagnose a bug in my data upgrader. I had some SQL statements that would create a new table, copy the data from the old one, delete the old one, and rename the new one -- basically just changing some columns in an awkward way, for reasons.
It was saying that it couldn't find one of the existing columns in the old table when doing the copy. But every time I put in a breakpoint and inspected the DB directly... the column was there! And when I added logging statements, the column was missing!
Are you ready for this?
I had written this code a while back, and I had forgotten that this large method had a dry-run parameter. It would get run *twice*, first as a dry-run with transactions rolled back, then for real. But I had forgotten to add the rollback for this transaction, so on the second run it would be working with the actually-changed data, and of course nothing made sense.
The breakpoint would always activate on the *first* run, so I never saw the bug when debugging. And I only saw the logging statements from the second run because they were so voluminous. 😩
Yes, I was very clever to write my code this way. -.-

2023-10-27 21:40:54

- reply

@npub1836…8jp6 Oooh, that's kind of annoying. I guess it's Kotlin favoring explicitness? Is this new behavior in Kotlin, or an existing annoyance?

2023-10-27 21:39:27

- reply

@npub1836…8jp6 As long as the semantics are equivalent for all implementations, I'm not too concerned about binary equality—that's a level of canonicalization that I think would generally be a functionality concern rather than a security concern.
I don't have a specific attack in mind. I'm just aware that Alice and Bob disagreeing on the semantics of a message is bad. :-P And structured messages are known to be trouble.
I had another thought about how to prevent these issues: Test data. If you offer a selection of "test vectors" you can include known canonicalization issues and specify that they should cause parse failures. Free unit tests is a very attractive thing for implementers. :-)

2023-10-24 22:30:03

- reply

@npub1836…8jp6 I feel like with binary protocols, there's a marginally higher chance that protocol implementers will follow the spec carefully—a bit of an incidental gatekeeping effect.
There's a JSON canonicalization spec, but what you really need is a spec for *parsing* JSON safely. One approach would be to parse it, then recanonicalize it according to https://www.rfc-editor.org/rfc/rfc8785 and finally check if it is byte-for-byte identical with the input. But that spec doesn't actually say to do so, as far as I can tell!

2023-10-24 00:32:41

In general, what's the best way to have signatures over dictionaries without canonicalization attacks or parser mismatch?
Dictionaries seem to be *really* susceptible to this—with a repeated key, two implementations might disagree on whether the first or the second key "wins" (or simply on whether the data is even parseable).
Approaches I can imagine:
- Specify that implementations *really ought to* reject anything with repeated keys, weird Unicode sequences in keys, etc.
- Avoid maps entirely, and instead have lists of pairs (which implementers *definitely won't* just feed into a dictionary)
- Use data formats that are really strict in their spec about how to handle repeated keys, and ensure that all the major libraries for that format follow the spec
- Something protocol-level, like asking the implementers to pretty-please re-serialize the data and ensure it hasn't changed
Am I missing some option?

2023-10-22 23:42:39

- reply

@npub1836…8jp6 I think I'll have to wait until I can look at an example. (I'm also not up to date on recent changes in Kotlin.)

2023-10-22 00:41:55

- reply

@npub1836…8jp6 What's an example of code that no longer works?

2023-09-27 00:24:07

- reply

@npub1836…8jp6 Not inside info, although it looks like my information may be a bit old at this point—they seem to have reached a resolution and ended the strike after several months: https://meta.stackoverflow.com/questions/425000/moderation-strike-stack-overflow-inc-cannot-consistently-ignore-mistreat-an

2023-09-24 02:02:11

- reply

@npub1836…8jp6 Sorry to break it to you, but this is not the place to find sanity.
For while this is what Stack Overflow says publicly, they say a very different thing internally so that their unpaid moderators effectively cannot enforce this rule. This has even been the nucleus of a whole new moderation strike (as Stack Exchange has a history of treating their mods quite poorly).

2023-08-14 14:44:23

- reply

@npub1836…8jp6 This was an important lesson for me as an employee, as well. I now strive to avoid caring about how well projects will work out, with two exceptions:
- If it's going to hurt people outside the company (loss of privacy, etc.)
- If it's going to hurt me (getting repeatedly paged for shitty software)
I still try to uphold high standards, but I won't fight for them. (And I'll just leave if it gets unpleasant enough.)

2023-08-05 12:56:36

Anyone know of a library for upgrading an app's data storage in a safe way from one version to the next?
My desktop app has various databases and flat files, and sometimes I need to change the schema or layout or file formats. But I want to do it safely—if the upgrade fails partway through, I want to be able to reset to a known-good state, and not leave the user's data in an unusable halfway-upgraded state.

2023-07-03 23:40:25

- reply

@npub1836…8jp6 Cavern has a problem that's very similar; my solution is for the friends to have to brute-force the list until they find something they can decrypt, but not have to do this *often*.
Not sure if this is appropriate in your use-case, but consider whether there's a way to "stabilize" the numbers you're sending your friends; if they can act optimistically on the presumption of the number not having changed since last time (if that's even a meaningful concept) then they get to skip the expensive step whenever they're right.
Barring that, it feels like this might require some fancy math involving combining multiple people's public keys. :-/

2023-06-22 16:40:03

- reply

@npub1yck…ujmw Yeah, but the templating language also doesn't give you a way to interpolate into a JSON string. :-/

2023-06-22 00:26:32

Today I have experienced the horror that is #Helm.
Helm chart templates make #Kubernetes manifests by string-templating #YAML.
YAML has one of the most unfriendly syntaxes of any textual data structure language I've ever seen. There's a whole website just dedicated to the nine different ways you can write a multiline string.
And Helm just... string-interpolates values into it. The most fragile syntax in the world, and you're just going to inject raw bytes straight into it. The only tool provided to alleviate this is the `quote` function, which... doesn't actually do what you want.
Currently at work I'm trying to figure out how to insert an arbitrary string value into another string, which is a pretty normal thing to do. And four attempts later, nothing works. The most common "solution" on the web appears to be to use `{{ ... | indent 12 }}` where 12 has to match the template's current indentation level. Good luck if you ever want to reindent anything!

2023-06-16 01:02:50

- reply

@npub1836…8jp6 I feel like I've encountered a few pieces of software that zero out any copies they have of passwords, keys, etc. as soon as that information is no longer needed -- with the threat model involving malware that can exploit your standard buffer overflows and such in order to read bits of memory.

2023-05-29 17:34:27

- reply

@npub1n0m…z5ld I'm not a customer, but I'm curious—if you charged extra for port forwarding, what price point do you think you would have to set in order to reduce abuse and make the feature worth your while?

2023-05-12 18:00:58

Good news! .zip and .mov are now TLDs, not just file extensions! So mentioning archive.zip in chat may now link to a phishing site or something.
Wait no, that's *bad* news...