loadlibrary

tail because this vulnerability can't be fixed. It's conceptually fairly simple and <400 LoC and I'm sure you can find it on your own if you're determined. Righteo then writes program that generates all possible C programs <400 LoC long In all seriousness, you definitely have me interested now :) I guess what might be a relevant question is, how universally applicable is it? Would it run on my minimally-configured Slackware box, for example? And I am _very_ fascinated to hear that this "cannot be fixed". Are you describing a Linux-specific Spectre/Meltdown? If this is Chrome-specific - or, shall we say, could be deeply contextualized into domains very important to Chrome - well, I'm sure you've seen https://bugs.chromium.org/p/chromium/issues/detail?id=648971 and https://bugs.chromium.org/p/chromium/issues/detail?id=766253, and particularly the one tag with the numbers in it in the sidebar on the left... To be honest I'm not really sure what I'm interested in, you could sort of describe where I'm at as somewhat similar to your post 8 months ago about finding your passion. (In my case it's a resource thing.) I've started playing with X11 recently though, to the extent of just learning the wire protocol for fun. I was actually thinking of making a tiny Xlib-less keylogger the other day, haha. (As in, talking to X via write()/read() directly.) Not quite sure why; perhaps the theoretically-interesting scenario of "not linking to libX11 might be less suspicious?" could be one explanation. I don't seem to need to give myself a rationale to stay motivated on my current track (woohoo), so I'm just tinkering for now. Uh - getting root on Linux isn't exactly straightforward! Although there was that one time I found a very confused Docker installation (running Ubuntu on CentOS... I'd never used Docker before and could not figure out which way was up ("wat, I have yum AND ap--wait no now apt-get disappeared where did it go"), for about an hour lol) and this system may or may not have left /dev/vda1 in the Docker image... and it may have allowed me to mount it read-write from under the host system, with effective UID 0... ._. (IIRC, I think it was visudo that worked great.) I wonder if there's a password manager that stores data in the kernel and/or uses the kernel's crypto keyring - and whether such effort would be worth it? (At least this would thwart local attacks, and only remote attacks via the Wi-Fi stack would work. xD) I've fished forgotten passwords out of Login Data more times than I have fingers, I think. sqlite3 .dump + printf "$(sed 's/../\\x&/g')" FTW. Linux's non-umbrella model, where there's no cohesive oversight, will be its undoing, I think. I've wanted to do do packet inspection for a little while now, incidentally, and the introduction of TLS 1.3 has been most annoying. https://news.ycombinator.com/item?id=17540111 On the subject of AV my favorite thing is https://github.com/taviso/loadlibrary :P (if just for the very non-official "you totally know Google is using this every day.") One thing I was vaguely considering (last night, actually) was an idea I've had for a while - taking forensic memory-dump analysis tools to the next level and making them work in realtime with QEMU. End result being, you run a tool as root with the PID to a running QEMU instance, it attaches (possibly via process_vm_{read,write}v) and lets you watch VT streams, see keys+passwords being typed in SSH, perhaps take screenshots, see the process tree, etc. Thanks for the tips!

bility) nearly (or actually :/) goes out the window. It only takes a little bit of study to reverse-engineer the brain and almost immediately you'll get actionable insights on how to make people feel like they're getting what they really want when you're actually making them achieve your agenda instead. Fill people's heads/lives with movement they have to keep up with, make it so they can ride it like a fun wave if they do it right, and bam, you can control lots of people. Crowd dynamics is so fascinating. I'm not even touching on office politics, cults, etc. Sadly open source has its own toxicities. Linux is in many ways the PHP of operating systems; some really amazing bits hiding away in invisible corners, but no good oversight due to its bazaar-based design, and thus no cohesiveness. You will never get very far trying to push balanced views within Linux; the community has become too much of a reactive-yet-immobilized culture. The Lennart Poettering debacle is one recent example. Moving away from open source specifically, software design itself is also fundamentally broken because it tries to abstract out the people - what put the intelligence into "artificial intelligence"! - as perfect infallible beings that sometimes make mistakes. (For example, why on earth do programming languages describe errors as "exceptions"?!) Programming is full of leaky abstractions that have never been properly followed up on and properly ironed out of the woodwork. What we're currently stuck with is are systems that are intrinsically tied to individuals' mindset and skills, and as a result no two codebases are really the same. So, it's generally really impressive if you can take Random Component A and expect it to work properly with Random Component B. One example I can pull of the top of my head right now: https://github.com/taviso/loadlibrary Another way to describe this would be to say that "taking anything and making it work with anything else" is Very™ Very® ʎɹǝΛ NP-Hard™©®, if not categorically impossible. (This is what took me 15+ years to accept.) In terms of perfect governance, I definitely take a cyberpunk stance. https://news.ycombinator.com/item?id=17320295 https://news.ycombinator.com/item?id=17083221 I also just found this and am adding it in: https://news.ycombinator.com/item?id=17322457 Related thoughts/continuation: https://news.ycombinator.com/item?id=17299517 (if you're truly interested, you might follow all the continuation links) TL;DR study people, bureaucracy and sociopolitical crowd dynamics