Hacker News Reader

zwpon Inside the Massive 711M Record Onliner Spambot Dump

I know an email address that appears in this leak but not in any other leak that hibp knows about. That might invalidate that hypothesis (or alternatively hibp's dataset might not be as complete as it could be).

zwpon Pop-up bike lanes show that demand exists

    > i milanesi hanno percorso in media 18,6 miglia
    > in bici per andare al lavoro...
    > velocità media a Milano 14,8 miglia all’ora

"The Milanese cyclist averages 18.7 miles per day to go to work... at an average speed of 14.8 mph". Is my translation okay? That seems improbable [time & distance, not speed]: the _average_ Milanese cyclo-commuter takes over an hour each way? Currently 36C/97F in Milan.

Or is this per week? Is it current to talk in "miglia" in modern Italian? (though even km would be high IMHO).

zwpon How Torch broke ls and made me vulnerable

> Sounds like a bug in GNU's ld.so more than anything.

It's neither unique to glibc (AIX, Solaris) nor to LD_LIBRARY_PATH (PATH), nor trailing colons (leading colons, adjacent colons).

This de facto standard becomes a little more obvious when one considers a likely implementation (iterating over "strchr(arg, ':')" or whatever). Any of these sequences then will give up an empty string:

    PATH=:/foo
    PATH=/foo:
    PATH=/foo::/bar

And an empty string is equivalent to dot for chdir(2).

    zwp:/tmp$ cd ''
    zwp:/tmp$ pwd
    /tmp
    zwp:/tmp$

(This is not the same as plain "cd" (ie with no args), which is a special case that takes you $HOME, of course).

I agree it's surprising and potentially dangerous.

FWIW, the execp() functions hide a similar wtf. From the Linux man page:

    The file is sought in the colon-separated list of
    directory pathnames specified in the PATH envi‐
    ronment  variable. If this variable isn't defined,
    the path list defaults to the current directory
    followed by the list  of  directories returned by 
    confstr(_CS_PATH).

Security conscious programs that clear the environment and then call eg execlp() end up searching dot before the system path. Yay.

zwpon Diaspora-common: does 'rm -rf /' on purge

> should have "set -eu" at its second line

Do you have a strong reason to prefer "set" over shebang flags? I have a slight preference for shebang flags so I can deliberately override them from the command line (but it's not a hill I'd die on):

    $ cat foo 
    #!/bin/bash -eu
    cd /nowhere
    echo 'still here'
    $ ./foo 
    ./foo: line 2: cd: nowhere: No such file or directory
    $ bash -c ./foo # thinking about system(3)
    ./foo: line 2: cd: nowhere: No such file or directory
    $ bash +e ./foo # override
    ./foo: line 2: cd: nowhere: No such file or directory
    still here
    $

EDIT: Google's shell style guide has "Executables must start with #!/bin/bash and a minimum number of flags. Use set to set shell options so that calling your script as bash <script_name> does not break its functionality."

https://google.github.io/styleguide/shell.xml?showone=Which_...

zwpon /usr/bin/time: not the command you think you know

I too don't see how it is useful but it's certainly a thing. The Solaris implementation looks like this:

    #!/bin/ksh -p
    # ...
    cmd=`basename $0`
    $cmd "$@"

I just noticed that the what(1)-string (I haven't seen on of those for a long time) references "alias.sh", perhaps this is a clue?

    #ident  "@(#)alias.sh   1.2     00/02/15 SMI"

Were builtins actually aliases in an early shell? I still don't understand how this works though.

zwpon Anagram Scoring

My intermediate steps were: "word equivalence classes" and "[flawed] fundamental theorem of arithmetic^Wspelling", and then you have it.

zwpon GitLab Database Incident – Live Report

> regret not recording the source of it

The googlable nugget is actually "organizational scar tissue" (it caught my attention too). It's from Jason Fried. On twitter:

https://twitter.com/jasonfried/status/2758624714

and also apparently in "Rework", quoted with more context here:

https://www.goodreads.com/quotes/1012423-policies-are-organi...

zwpon An Explainer on Unix’s Most Notorious Code Comment

Link to the comment in V6 at Diomidis Spinellis' unix-history-repo:

https://github.com/dspinellis/unix-history-repo/blob/Researc...

zwpon Cylance Discloses Voting Machine Vulnerability

The seals aren't signed by election officials?

I'm not familiar with seals used on voting machines but that's common in other "tamperproof container" scenarios.

zwpon Show HN: A fork of sudo with Touch ID support

https://www.schneier.com/crypto-gram/archives/2002/0515.html...

"He used $10 of ingredients you could buy, and whipped up his gummy fingers in the equivalent of a home kitchen. And he defeated eleven different commercial fingerprint readers, with both optical and capacitive sensors, and some with "live finger detection" features."

That article's a little old now and the tech may well have improved since but I wouldn't put too much faith in fingerprint readers. (Also: other attack vectors exist).

zwpon A bite of Python

CVE-2008-5983 (https://bugs.python.org/issue5753) "Untrusted search path vuln... prepends an empty string to sys.path when the argv[0] argument does not contain a path separator"

Check out the "yes"es in the "fixed" column in comment at https://bugs.python.org/msg85966

zwpon Firejail – security sandbox

That'll certainly help keep the wolves at bay (though I still will not install firejail 4755...).

~1000 commits since I last looked at firejail, keep up the good work!

zwpon Firejail – security sandbox

> this approach could lead to new vulnerabilities?

Yes. The first line of the article ("a SUID program that reduces the risk of security breaches") should be enough to raise a quizical eyebrow from security-minded users but overwhelming positive commentary I've seen elsewhere (lwn?) has not mentioned this.

Some of the obvious holes (eg "mount a tmpdir on any mount point") have now apparently been closed but I haven't been back to it for a while. Early releases did everything euid==0... It certainly needs more pairs of eyes.

OTOH the largest attack surface presented by a typical single-user Linux box is probably the browser and not an unprivileged local user looking for escalations (assuming: firejail drops privs perfectly and an attacker cannot trigger a vulnerability in SUID firejail from the application that it invoked). So could be that's a reasonable trade off for some folks.

> like the idea though

I agree, the feature set is nice but it needs some more basic TLC. "Security products do not necessarily make systems more secure" </rant>

zwpon Vulners – Vulnerability Data Base

Great initiative, thanks. Your aim to keep the db open forever is commendable. I'd like to know how you might address two of the problems that [AIUI, paging @attritionorg] osvdb struggled with:

1. BigCo pillages (resells) your data and/or puts compute (search) pressure on your db.

2. Data entry, triage. Is the plan (for plex) to source data solely from origins with an API?

Good luck, gute Reise :)

zwpon Hacker Releases a How-To Video Targeting Police

We also see TZ "CLT" aka "Chilean Standard Time" (4 hours left of UTC, 6 hours left of Spain) which fits neatly with previous speculation (here and elsewhere) of Chilean origin (language characteristics).

Assuming it's not all carefully orchestrated or multiple correspondents or...

zwpon RubyGems.org gem replacement security vulnerability and mitigation

The commit to fix this appears to be "validate Version full_name":

https://github.com/rubygems/rubygems.org/commit/1067ab7e0871...

Cause: a "full name" is a dash-seperated join of its components, yet those components may themselves contain dashes :(

zwpon HTTP/HTTPS not working inside your VM? Wait for it

Funky! This feels like the connect(2) is returning before it has actually done its work, async-style.

Rachel, could you write a small sneaky program (using eg libpcap) to see if the TCP handshake has completed by the time connect(2) returns control to your program, before your first write(2)?

zwpon Update on 1/28 service outage

Is there an easy config for that? Suppose I want to push to eg github and bitbucket (without sharing my creds with ifttt or similar)? Is a post-receive hook on a local pseudo-master the way to go?

zwpon Survey of popular Node.js packages reveals credential leaks

> `egrep 'PATTERN|PATTERN'` instead of `grep PATTERN | grep PATTERN`

Oops? Ironically (assuming two distinct values of PATTERN) I think you just answered your own question. (They are different: first is disjunction of patterns, second is conjunction).

Your point has merit for scripts (performance) but for data exploration at the prompt it's almost always irrelevant: the simplicity of pipe composition outweighs anything else.

zwpon The impact of syntax colouring on program comprehension [pdf]

> dick measuring contest

A more experienced colleague: "Pah, that's just a crutch". Well, yes. And?

My personal tipping point was watching a sysadmin edit resolv.conf and type "namesrever": vim picked it out in reverse red. This mistake could otherwise have gone unnoticed for a while. Good crutch.

zwpon OS X 10.11 buffer overflow with deep filesystem hierarchy

Since this doesn't cause a system panic... multiple userland utilities have MAXPATHLEN problems? Is this reproducible with longer filenames and less depth? (If not: what cares about depth?)

zwpon The Dynamic Def – abusing Ruby's def statement

Zork-alikes aside... I'm looking for practical applications :)

I recently re-watched Yaron Minsky's "Effective ML" talk where (towards the end) he talks about making read-only and read-write types. That's where I thought Jamis was going with the state machine example: one could tell an object "yo, make yourself immutable!" (ie redefine your methods so that you can't change yourself). But in an OO world that seems more neatly achieved with subclassing. [To the extent of faking anything "immutable" in ruby"].

There's #freeze I suppose... and no #unfreeze. Which is perhaps sensible :) And #freeze only guards against new assignment to instance variables; it doesn't guard against an instance method mutating the content of an instance variable (def esquirify! ; @name << ' Esq.' ; end). So there's that. But I'm far from convinced...

Python has this "inner-methods" capability (with saner scoping) which is a great antidote for python's limited lambdas. But that's not a problem with ruby.

It's a neat trick (and nice to read something from Jamis again). Are there any sensible use cases?

zwpon Hackers Prove They Can ‘Pwn’ the Lives of Those Not Hyperconnected

I want a small hardware, non-connected tablet that acts exclusively as a password manager. It connects to the computer I'm using as a USB keyboard device and only "types" a password when I physically tell it to ("yubikey on steroids"). Backups and system updates via flash card with encrypted filesystem. No wifi, no bluetooth, no phone, no ethernet, no other purpose.

Edit: heh, that's funny, you edited your comment as I was replying? Now we just need someone to build it for us :)

zwpon KeepassC – Curses based keepass written in Rust

Is this such a thing:

https://github.com/raymontag/rust-keepass/blob/2b7b701b69541...

    unsafe { ptr::write_bytes(self.encrypted_string.as_ptr() as *mut c_void, 0u8, self.encrypted_string.len()) };

?

zwpon Linus on compiler warnings and code reviews

"I tried - and failed - to come up with a reasonable grep pattern"

Is there a nice, light, better-than-betterthangrep[1] static analysis tool that would help with this sort of question? (I suspect the decay to pointer would, for example, elide this detail from llvm's IR?).

[1] http://beyondgrep.com/

zwpon On the Security of Password Manager Database Formats (2012) [pdf]

This is correct. For v3, with P' the key derived from stretching the password:

"2.6 B1 and B2 are two 128-bit blocks encrypted with Twofish [TWOFISH] using P' as the key, in ECB mode. These blocks contain the 256 bit random key K that is used to encrypt the actual records. (This has the property that there is no known or guessable information on the plaintext encrypted with the passphrase-derived key that allows an attacker to mount an attack that bypasses the key stretching algorithm.)"

zwpon OpenSSL Security Advisory

And servers that are authenticating client certs?

(clearly there are far fewer of those around but they do exist)

zwpon Downloading PuTTY Safely Is Nearly Impossible (2014)

> As of two days ago, there is a hostile version of PuTTY

A small correction -- from the symantec blog post:

"this file has been in the wild since late 2013 and it was first seen in Virus Total around the same time. However, we have only seen this sample broadly distributed recently. Distribution in 2013 was minimal, and we saw a gap of a year and a half before it reappeared again."