Damien Miller / is on Nostr

debugging, v: the process of inserting printf statements into code until one's errors reveal themselves

Last Notes

2024-07-15 06:10:57

- reply

@npub1zdp…vqv8 how does the black hole keep pace with the accelerating craft? If they are relatively moving away from each other, then I'd have thought that the harvestable energy would be quickly limited by diffraction?

2024-07-01 13:15:09

I'm extremely grateful that there are excellent security researchers like the Qualys person/team and Google Project Zero who are putting their work into the public domain.
An unfortunately large chunk of vulnerability research has "gone dark" and sells their findings to buyers that include intelligence agencies in repressive regimes and organised crime groups.
OSS attracting top-tier adversarial research is IMO necessary for its survival. IDK what would happen if it dried up...

2024-07-01 10:43:56

- reply

Lots more details on exploitation of the critical vulnerability in Qualys' report: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt

2024-07-01 10:11:12

OpenSSH 9.8 has just been released. This release includes a fix for a critical race condition in sshd that could be exploited for remote code execution so you should definitely patch or upgrade. It also contains a fix for a minor issue in ssh that saw the recently-added ObscureKeystrokeTiming feature work the opposite way as intended.
There are some new features too. Please see the release notes at https://openssh.com/releasenotes.html for more details

2024-06-06 19:45:27

I'm pretty excited by this change coming in the next version of OpenSSH sshd: https://marc.info/?l=openbsd-cvs&m=171769392207688&w=2
sshd will now be able to automatically penalise clients that repeatedly fail authentication (e.g. password guessing) or cause sshd to crash (e.g. exploit attempts).

2024-05-09 12:00:54

- reply

@npub1eqg…fncn DISPLAY is the type bound used for the display member of DisplayAt. It seems fairly common for these to be all-caps, e.g. https://github.com/stm32-rs/stm32f4xx-hal/blob/master/src/i2s.rs#L471

2024-05-09 11:27:58

- reply

@npub1eqg…fncn maybe not, this is all still very much in-progress and probably could be simplified

2024-05-09 03:26:22

Still trying to learn #RustLang and had my first real fail with the borrow checker last night. How can you return a temporary reference to `self` from a method?
https://gist.github.com/djmdjm/9c717fc294e68b4da563077d9469ec99
any clues appreciated

2024-04-05 12:02:12

Piñata proposal for a model of trusted open-source without placing more onus/load on maintainers.
1. Maintainers keep doing what they do with no new mandates, but with encouragement and support to adopt good practices like commit and release signing, repository hygiene, CI/CD, fuzzing, etc.
1/n

2024-04-01 00:46:57

Here's my 2c on the xz incident.
This is the nearest of near-misses. Anyone who suggests this was any kind of success is a fool. No system caught this, it was luck and individual heroics. That's not acceptable when unauthorised access to ~every server on the internet is on the table. We need to find a way to do better.
1/n

2024-03-28 02:43:05

Bless the Maker and His water. Bless the coming and going of Him. May His passage cleanse the world
https://assets.cybervillains.com/media_attachments/files/112/170/772/235/363/260/original/dc72337e43a95326.jpeg

2023-12-18 16:46:36

OpenSSH 9.6 has just been released: https://openssh.com/releasenotes.html#9.6
Among other things, this release contains a fix for the so-called Terrapin Attack (https://terrapin-attack.com/)

2023-10-04 03:29:32

- reply

@npub1zdp…vqv8 @npub1jaq…lf6k what?!? why ban calculus?!?

2023-08-10 07:41:46

I'm happy to announce that #OpenSSH 9.4 has been released.
This release fixes a few bugs and adds a few small features. Full release notes at https://www.openssh.com/releasenotes.html#9.4p1