6 ms·

I wish I was smart enough for the article. 8 years of web dev doesn't make the cut unfortunately.

dyjakan 9y ago
You are smart enough but you have different priorities. This isn't magic but it does require time and time is usually spent on things people like. Therefore you just don't _like it_ enough.
vvggff 9y ago
Why the comment of dyjakan was marked as dead?
tyingq 9y ago
It's just domain knowledge and terminology. "Packet sockets" is shorthand for the AF_PACKET type sockets in Linux that let you construct network packets from the ground up, including the ethernet header, if you so wish. That's as opposed to a regular socket, which is higher level and restricts you to a much smaller subset of things you can change/set. The article just shows how they uncovered an exploit by "fuzzing" input to packet sockets. Where "fuzzing" just means using a tool that creates random inputs/values.
- Achshar 9y ago
  The concept I think I can still get my head around. It's all the stuff that surrounds it that eludes me. I have done some work in C but that C is unlike any of the C I wrote in college (duh, it's the kernel code)
  - tyingq 9y ago
    I don't see what you mean. It's a long line, so it breaks across 3 lines, but otherwise, it's just: if (a >= b && (int)(c - MACRO(d)) <= 0) goto out; Or the stuff further down? Just confusing because tpacket_req and friends are defined as structs elsewhere, so you don't have that context. And it's not really C, it's syzkaller (fuzzing tool) descriptions, kind of a pseudo code syntax.
_jordan 9y ago
yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though
- yeukhon 9y ago
  (and I can't do any frontend work). Every job has its own difficulties and its own obstacles. off-topic, btw, I read tpacket == tptacek. He can easily hide in Linux kernel. No one noticed, until now.
  - schoen 9y ago
    Hey, it's an anagram! I believe that the serial device /dev/ttyS0 was named in honor of Theodore Ts'o. So maybe tpacket could be at least retroactively declared to honor tptacek.
- BenjiWiebe 9y ago
  I personally find embedded programming easier than web development...
  - _jordan 9y ago
    But isn't embedded programming more complex? as in, it requires a well founded understanding of CS concepts, as well as requires advanced ability in programming and math.
    - tyingq 9y ago
      I imagine to an embedded developer, the web just looks like madness because there's no consistency. Parachute into a web app you've never seen before, one that might not have been developed well. Your task is to make a button that's currently green and make it blue instead. What's the right file(s) to edit? How many layers of caching do you need to disable to see that your change actually worked? Do you need to restart anything after the change for it to be seen? The current green color could be: - in a css file, but one that has to go through SAAS/LESS first, or maybe not. Or maybe there's more than one entry, depending on @media screen resolution? Or maybe it's not a file at all...the css "file" is generated on the fly by some server-side framework. - in an html file, but in <style> tags. Or maybe dynamically generated style tags via client side javascript. Or maybe server-side dynamically generated style tags? Or maybe not style tags at all? Perhaps a style attribute on the button. - Or hey, that looks like a button, but it's not a button at all. It's an <a> tag with button styling. And it's green, but only because of a background image. Which is loaded how (static css? dynamic js style manipulation? inline <img> tag in the <a>? something else?)

You are smart enough but you have different priorities. This isn't magic but it does require time and time is usually spent on things people like. Therefore you just don't _like it_ enough.

vvggff 9y ago

Why the comment of dyjakan was marked as dead?

tyingq 9y ago

It's just domain knowledge and terminology. "Packet sockets" is shorthand for the AF_PACKET type sockets in Linux that let you construct network packets from the ground up, including the ethernet header, if you so wish. That's as opposed to a regular socket, which is higher level and restricts you to a much smaller subset of things you can change/set. The article just shows how they uncovered an exploit by "fuzzing" input to packet sockets. Where "fuzzing" just means using a tool that creates random inputs/values.

Achshar 9y ago
The concept I think I can still get my head around. It's all the stuff that surrounds it that eludes me. I have done some work in C but that C is unlike any of the C I wrote in college (duh, it's the kernel code)
- tyingq 9y ago
  I don't see what you mean. It's a long line, so it breaks across 3 lines, but otherwise, it's just: if (a >= b && (int)(c - MACRO(d)) <= 0) goto out; Or the stuff further down? Just confusing because tpacket_req and friends are defined as structs elsewhere, so you don't have that context. And it's not really C, it's syzkaller (fuzzing tool) descriptions, kind of a pseudo code syntax.

_jordan 9y ago

yeah webapps in general are the most simple aspect of programming that you can get paid to do. Not knocking it though

yeukhon 9y ago
(and I can't do any frontend work). Every job has its own difficulties and its own obstacles. off-topic, btw, I read tpacket == tptacek. He can easily hide in Linux kernel. No one noticed, until now.
- schoen 9y ago
  Hey, it's an anagram! I believe that the serial device /dev/ttyS0 was named in honor of Theodore Ts'o. So maybe tpacket could be at least retroactively declared to honor tptacek.
BenjiWiebe 9y ago
I personally find embedded programming easier than web development...
- _jordan 9y ago
  But isn't embedded programming more complex? as in, it requires a well founded understanding of CS concepts, as well as requires advanced ability in programming and math.
  - tyingq 9y ago
    I imagine to an embedded developer, the web just looks like madness because there's no consistency. Parachute into a web app you've never seen before, one that might not have been developed well. Your task is to make a button that's currently green and make it blue instead. What's the right file(s) to edit? How many layers of caching do you need to disable to see that your change actually worked? Do you need to restart anything after the change for it to be seen? The current green color could be: - in a css file, but one that has to go through SAAS/LESS first, or maybe not. Or maybe there's more than one entry, depending on @media screen resolution? Or maybe it's not a file at all...the css "file" is generated on the fly by some server-side framework. - in an html file, but in <style> tags. Or maybe dynamically generated style tags via client side javascript. Or maybe server-side dynamically generated style tags? Or maybe not style tags at all? Perhaps a style attribute on the button. - Or hey, that looks like a button, but it's not a button at all. It's an <a> tag with button styling. And it's green, but only because of a background image. Which is loaded how (static css? dynamic js style manipulation? inline <img> tag in the <a>? something else?)