Saagar Jha / is on Nostr

Website: https://saagarjha.com
Email: saagar@saagarjha.com
Hotel: Trivago

Last Notes

2024-09-20 20:24:19

- reply

Maybe you should do a better job of tracking what is actually being used

2024-08-09 02:55:11

- reply

I have this sentiment about a lot of projects and it’s very difficult to express it without being yelled at as not being thankful for free labor

2024-06-08 21:40:25

Don’t want to jinx it but with WWDC right around the corner I have to say this is the first year that a network Time Machine Backup has actually lasted all the way to June without corrupting itself and forcing me to wipe it at least once

2024-05-28 08:49:40

- reply

2-3K for a stack frame sounds kind of insane, what could possibly be taking all that space?

2024-04-19 22:48:30

- reply

[@osy86](https://mastodon.social/@osy86)

2024-03-31 13:31:01

- reply

The problem is that nobody can read all this code. That’s it. You can make the code 50% clearer or reduce the number of libraries loaded or increase auditing but there is so many orders of magnitude more code being written than is properly reviewed that this can’t be fixed

2024-03-31 13:28:33

- reply

The “lol I wouldn’t have done that” analysis is, IMO, like fixating on a “goto fail” level of bug–isolated, clearly wrong, obvious to fix–while there are also a thousand other memory corruptions in the language that are prohibitively expensive to fix. But for supply chains here

2024-03-31 13:23:37

- reply

Unlike how the stars aligned to catch this backdoor*, there was almost nothing special at all about where it was placed. There are hundreds of other places it could have been done! *That* is the systemic problem. It’s also a lot harder to identify and fix.

2024-03-31 13:19:03

- reply

It’s easy to disregard the people who think [ld.so](http://ld.so) should be sandboxed because they clearly have no idea what is going on. But the others are a little harder, because they actually do bring up reasonable problems that are likely in urgent need of being looked at

2024-03-31 13:17:01

- reply

This means that any conversation from people who have discovered what ifuncs and resolvers are recently and pontificate on them are completely missing the point. As are comments about how autoconf needs to die or that Debian shouldn’t patch software or that systemd sucks!

2024-03-31 13:12:51

- reply

The sequence of events that uncovered this specific attack when it did are nothing short of a miracle*. With the benefit of hindsight it is easy to think you can prevent “xz” from happening again. However, we have no comprehensive protections against the general form of this!

2024-03-31 13:10:05

The security community is going through the five stages of grief right now with the xz thing and I think a lot of people are coping with “there are technical measures that could have prevented this”. To move on, it is important to understand that this is not true in the slightest