lolsowrong

侍

Why didn’t they?

Do you have any evidence this is actually happening to good faith security researchers?

There are many examples of Microsoft and other large corporations treating security researchers well. Microsoft hosts BlueHat, where they invite external parties to talk about their findings. They thank researchers monthly who do contribute reports to MSRC. As I recall, they treated bunnie well, and I think they also treated “hoodie” (the original Xbox 360 hacker) well as well.

Can’t find the pdf, but it’s all related to the zentool stuff:

https://github.com/google/security-research/blob/master/pocs...

Tavis spells it out there pretty quickly:

“ The simplest instructions (add, sub, mov, etc) are all implemented in hardware. The more complicated instructions like rdrand, fpatan and cmpxchg are microcoded. You can think of them as a bit like calling into a library of functions written in that RISC-like code.”

I saw the paper from Google last year and thought something in it aligned with not everything running through the microcode engine, though I could be wrong.

I believe only some parts of Jazelle are handled in hardware, though I don’t know if anybody has got their hands on any of the bits of the software side. I do know there’s documentation on handling unimplemented instructions.

I don’t know how I feel about micro-ops being executed in hardware - I mostly agree, but also, microcode updates exist…

Most of the time. But sometimes, no. See ATL thunk emulation (last I checked, still alive in the windows kernel) and ntvdm handling of the BOP pseudoinstruction.

See also: Jazelle DBX.

Hell, on modern x86 processors, many “native” instructions are actually a series of micro-ops for a mostly undocumented and mostly poorly understood microcode architecture that differs from the natively documented instruction set.

It’s turtles all the way down.

I agree there’s a big divide. I think I’m also team “let people do things they enjoy.”

I like using computers to solve problems. I’m more interested in the problem being solved than the journey most of the time, though I’ve also been on some lovely journeys. Sometimes that means I write a tool all by myself. Sometimes it means I download an existing open source tool. And sometimes it means I delegate the creation to an AI model.

Can you look at code today and predict what assembly a compiler will output to some high degree of accuracy? Do you avoid certain classes of compiler optimization so you can more accurately predict compiler output? I recall a time where many compilers would remove a bzero() operation in situations where you’re trying to zero out a buffer that had sensitive data in it - it’s why we have APIs like https://github.com/MicrosoftDocs/win32/blob/docs/desktop-src.... I ran into a huge performance regression because I didn’t have all the edges of named return value optimization in mind when I refactored some code.

There’s ambiguity in the x86 specification, such that you can execute a single instruction and get different results in intel vs amd. See the rcpss instruction, for example.

I get that LLMs are categorically different, and they’re absolutely not as reliable as compilers are, but compilers are also not as reliable as compilers seem. And even less predictable IMO.

I agree with this, but I’m also curious: what would have to change before that advice is as sound as “write a little bit of assembly by hand” or the even more ridiculous “just write the raw bytes for the program in a hex editor?”

Yea, but Galen’s a beast so it might actually happen.

If I asked a human assistant to do this and it came back with that level of research, I’d be pretty disappointed.

This doesn’t seem true. Doesn’t LSASS cache credentials for 30 days?

Did you try making small changes to your phd proposal to see if it opened up new paths?

</fuzzingjoke>

I was quite impressed as well.

Trail of Bits if you want it done right.

Explain why it’s a huge mistake, please.

Did you learn to write or draw without studying the samples of artists and authors before you?

gnunits*

That’s DARPA’s bread and butter. They’re a research org, not a productization org.

Yes. Most of the work is not done in the DARPA building. Generally federal contractor sites. The daily work in the building is phone calls, reviewing papers, email, building powerpoint slides, and trying to come up with the next program. In my time, most PMs managed between 3 and 5 programs, some of their own creation, and some inherited from outgoing PMs (term limit + federal contracting timelines means generally the originating PM is not around to see a program through to its conclusion)

Program Managers are fixed term - up to 3 2 year terms (though Director Tompkins generally doesn’t like PMs to be around longer than 4 years - see section 1101 of the Strom Thurmond NDAA for more details about the hiring authority).

I don’t know about the admin vs director types split you’re talking about (at least in the PM ranks). Office directors generally provided top cover and some very sweeping research directions, but as a PM it was your job to come up with research programs that were roughly compatible, convince the office director it was, and then manage the technical execution with the performers and doing dog and pony shows when the pentagon called.

Yes.

https://developer.apple.com/documentation/virtualization/run...

Google’s implementation allows multiple passkeys. I have a passkey for my iPhone, one from Windows Hello, and 3 from different yubikeys I’ve picked up over the years. The yubikey implementation requires setting a PIN, so I’m not even really worried about one of them being lost of stolen.

That mix up must be the human touch you’ve spoken so highly of.

“In this theoretical world, shorter people have bigger feet. Given the information provided, we can deduce the following height order:

Ben (tallest) Paul Andrew Steve (shortest) Since shorter people have bigger feet in this world, we can also deduce the following order for foot size:

Steve (biggest feet) Andrew Paul Ben (smallest feet) Assuming that everyone walks the same number of steps each day and all other things being equal, the person with the biggest feet would be more likely to step on the most bugs simply because their larger foot size would cover a greater surface area, increasing the likelihood of coming into contact with bugs on the ground.

Therefore, Steve, who is the shortest and has the biggest feet, would step on the most bugs.”

GPT4 solved it correctly. You didn’t.

Are both useful in some context?

Go type .1*.2 into any JavaScript console.

Edit: slapping a few more in here:

https://learn.microsoft.com/en-us/office/troubleshoot/excel/...

https://daviddeley.com/pentbug/index.htm