Hacker News Reader

Comment by CrispEditor | Hacker News Reader

Please see

ftp://86.0.252.89/pub/release/website/tools/trace-20140126-x86_64-b95.tar.gz

This is a tool called ptrace - which does everything that strace does and a lot more. You have working binaries in there, and most of the source - I havent extricated the full build dependencies so it all builds, but this includes extra facilities like reporting summaries of process trees, showing only connections or files, and shlib injection into a target process.

If people are interested more on this, contact me at CrispEditor-a.t-gmail.c-o-m

View on HN

I am a bit paranoid about downloading a binary from a site without a domain name.

ftp://crisp.dyndns-server.com/pub/release/website/tools/trace-20140126-x86_64-b95.tar.gz works too if it makes you feel any better.

dyndns ain't much better.

Indeed. Dyndns tends to be the source of much Internet clap...

I can understand being twitchy but it is so easy to get a domain name that it would literally be no barrier at all to an attacker. Not wanting a binary (especially one that will run with root privs) to come from a domain you don't recognise and trust is understandable. Even then it should be by https with AND/OR a signed package are the first steps to security.

Since IP address ranges are allocated in blocks to ISPs, you can do an IP lookup and discover that this fellow is in the UK using a Virgin Cable connection.

So now we know his ISP too. Useful, eh?

Why do you link directly to the download file? A link to the tool's man page[1] would be sufficient.

[1] http://linux.die.net/man/2/ptrace

I might be wrong, but I'm reasonably sure that you link to the system call's man page. Which is probably what the tool in question uses, but .. not the same thing.

Elsewhere in this discussion: There's a difference between man page section 1 and 2 - and read was quoted as an example for a potential ambiguous result if you invoke "man read" (opens man 1 read here, when man 2 read was the syscall I might want to look at after running strace).

Yes, you are probably right, but the direct link to .tar.gz was not reasonable.

His blog is here: http://crtags.blogspot.com/2013/12/ptrace-now-available.html

Reply on news.ycombinator.com