XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable." https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b
Bluesky Social
Filippo Valsorda (@filippo.abyssdomain.expert)
I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission.
The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().
It's…
The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().
It's…
An unusual 7400-series chip implemented with a gate array https://www.righto.com/2024/03/idt-gate-array.html
Righto
Inside an unusual 7400-series chip implemented with a gate array
When I look inside a chip from the popular 7400 series, I know what to expect: a fairly simple die, implemented in a straightforward, cost-e...
Timeline of the xz open source attack https://research.swtch.com/xz-timeline
CityGaussian: Real-time high-quality large-scale scene rendering with Gaussians https://dekuliutesla.github.io/citygs/
dekuliutesla.github.io
CityGaussian: Real-time High-quality Large-Scale Scene Rendering with Gaussians
CityGaussians realize high-quality and real-time rendering of large-scale scenes across vastly different scales.
Subroutine calls in the ancient world, before computers had stacks or heaps https://devblogs.microsoft.com/oldnewthing/20240401-00/?p=109599
Microsoft News
Subroutine calls in the ancient world, before computers had stacks or heaps
A lot of computing got done even before we had stacks and heaps.
Improvements to static analysis in GCC 14 https://developers.redhat.com/articles/2024/04/03/improvements-static-analysis-gcc-14-compiler
Red Hat Developer
Improvements to static analysis in the GCC 14 compiler | Red Hat Developer
I work at Red Hat on GCC, the GNU Compiler Collection. For the last five releases of GCC, I've been working on -fanalyzer, a static analysis pass that tries to identify various problems at
HTTP/2 Continuation Flood: Technical Details https://nowotarski.info/http2-continuation-flood-technical-details/
nowotarski.info
HTTP/2 `CONTINUATION` Flood: Technical Details
Preface In October 2023 I learned about HTTP/2 Rapid Reset attack, dubbed “the largest DDoS attack to date”. I didn’t have deep knowledge of HTTP/2 back then. I knew its basics like frames or HPACK but I was focusing more on HTTP/1.1 protocol and programming…
Former University of Iowa hospital employee used fake identity for 35 years https://www.thegazette.com/crime-courts/former-university-of-iowa-hospital-employee-used-fake-identity-for-35-years/
The Gazette
Former University of Iowa Hospital employee used fake identity for 35 years
A former University of Iowa Hospital employee pleaded guilty Monday to charges that he had been living under another man's identity since 1988, causing the other man to be falsely imprisoned for identity theft and sent to a mental hospital.
What I think about when I edit (2019) https://evaparish.com/blog/how-i-edit
Eva Parish
What I think about when I edit — Eva Parish
I’m often asked to edit friends’ or coworkers’ writing, anything from emails to short stories to documentation. Recently, someone asked me how I edit. What am I looking for? How do I know what changes to make? That made me stop and think about what I’ve…
Faces.js, a JavaScript library for generating vector-based cartoon faces https://zengm.com/facesjs/
WinBtrfs – an open-source btrfs driver for Windows https://github.com/maharmstone/btrfs
GitHub
GitHub - maharmstone/btrfs: WinBtrfs - an open-source btrfs driver for Windows
WinBtrfs - an open-source btrfs driver for Windows - maharmstone/btrfs
Did any processor implement an integer square root instruction? https://retrocomputing.stackexchange.com/questions/29787/did-any-processor-implement-an-integer-square-root-instruction
Retrocomputing Stack Exchange
Did any processor implement an integer square root instruction?
Has any processor ever implemented an integer square root instruction? Obviously, floating-point square root instructions are quite common, but I've never seen one specifically for integers.
One cl...
One cl...
Mixture-of-Depths: Dynamically allocating compute in transformers https://arxiv.org/abs/2404.02258
arXiv.org
Mixture-of-Depths: Dynamically allocating compute in...
Transformer-based language models spread FLOPs uniformly across input sequences. In this work we demonstrate that transformers can instead learn to dynamically allocate FLOPs (or compute) to...