flak rss random

Deconstruct 2019 day 2

The conference continues from day 1.

more...

Posted 13 Jul 2019 01:12 by tedu Updated: 13 Jul 2019 02:59
Tagged: event review software

Deconstruct 2019 day 1

Some notes from the first day of Deconstruct Conf 2019 which is an annual conference in Seattle organized and hosted by the eternally optimistic Gary Bernhardt.

more...

Posted 12 Jul 2019 00:14 by tedu Updated: 13 Jul 2019 01:13
Tagged: event review software

fixing telnet fixes

There’s a FreeBSD commit to telnet. fix a couple of snprintf() buffer overflows. It’s received a bit of attention for various reasons, telnet in 2019?, etc. I thought I’d take a look. Here’s a few random observations.

Here are three new lines, after the patch.

                unsigned int buflen = strlen(hbuf) + strlen(cp2) + 1;
		cp = (char *)malloc(sizeof(char)*buflen);
		snprintf((char *)cp, buflen, "%s%s", hbuf, cp2);

1. The first line is indented with spaces while the others use tabs.

2. The correct type for string length is size_t not unsigned int.

3. sizeof(char) is always one. There’s no need to multiply by it.

4. If you do need to multiply by a size, this is an unsafe pattern. Use calloc or something similar. (OpenBSD provides reallocarray to avoid zeroing cost of calloc.)

5. Return value of malloc doesn’t need to be cast. In fact, should not be, lest you disguise a warning.

6. Return value of malloc is not checked for NULL.

7. No reason to cast cp to char * when passing to snprintf. It already is that type. And if it weren’t, what are you doing?

8. The whole operation could be simplified by using asprintf.

9. Although unlikely (probably impossible here, but more generally), adding the two source lengths together can overflow, resulting in truncation with an unchecked snprintf call. asprintf avoids this failure case.

Posted 11 Jul 2019 04:13 by tedu Updated: 11 Jul 2019 04:13
Tagged: c programming

the activity person examined

One of the basic objects in ActivityPub is the actor. Also known as a Person, although there’s no promise it’s a human. If you are building ActivityPub software, or curious how the network works, it’s a good place to start. The ActivityPub spec (and underlying ActivityStreams vocabulary) explain what could or should be here, but not necessarily what you’ll see in the wild.

more...

Posted 08 Jul 2019 18:44 by tedu Updated: 06 Aug 2019 15:24
Tagged: activitypub web

404 Found

When a web page (or other resource) cannot be found, a web server is supposed to return code 404, Not Found. Additionally, it can return some other content for a human viewer. And so, if you visit https://mastodon.social/honktime with a browser, you can watch a tooter tantrum, but requesting the same URL with curl displays < HTTP/2 404.

more...

Posted 04 Jul 2019 18:55 by tedu Updated: 04 Jul 2019 23:21
Tagged: web

what happens when you activity post

You’re out there posting on your federated status federator, and people are reading your posts, and you’re reading their posts, but how exactly does it happen? What’s talking to what? (Equally applicable to tooting, but we don’t use that word in my house.)

more...

Posted 02 Jul 2019 21:24 by tedu Updated: 02 Jul 2019 21:24
Tagged: activitypub web

random ip id comments

There’s a new paper, From IP ID to Device ID and KASLR Bypass, which I liked. It’s at the intersection of networking, old but not obsolete standards, random, security, and implementation defined behavior. By all means, read the paper, but the really short version is they accomplished two things. They reverse engineered a per host random seed from network traffic on Windows and Linux, allowing fingerprinting, and more surprising, turned this into a KASLR break on Linux. Pretty wild.

more...

Posted 01 Jul 2019 01:23 by tedu Updated: 01 Jul 2019 01:23
Tagged: networking openbsd security

extension injection detection

One of the unexpected but very interesting side effects of the brutalist html quine is that anything added to the page suddenly becomes visible as well. In the common case, this might be browser extensions adding custom stylesheets, but it might also be stylesheet or script injection by a network interloper.

What if every web page had a little something like this embedded in it?

That’s an actual style. It should be the only one visible on this page. If there’s anything else visible, it’s not coming from me.

Posted 05 Jun 2019 10:12 by tedu Updated: 05 Jun 2019 10:12
Tagged: web

honking for fun and profit

It’s been a little while, so a few more notes about ActivityPub implementation, federation, and other odds and ends. There’s no real order to these notes, just things that have come up in the past two months.

more...

Posted 03 Jun 2019 09:03 by tedu Updated: 06 Aug 2019 15:52
Tagged: activitypub project web

hello android

I’ve had an iPhone for many years, and an iPad for not quite as long. People would tell me I should switch to Android. I thought they were crazy. I recently got some Android devices. Now I know they are crazy. Some notes on recent experiences with a Moto G6 and Samsung Tab S5e.

more...

Posted 01 Jun 2019 18:21 by tedu Updated: 05 Sep 2019 11:28
Tagged: gadget review