4 ms·

Been playing with tools like angr lately and learning more about binary analysis. It seems to me that "automatic exploit generation" is improving quite a bit w

Been playing with tools like angr lately and learning more about binary analysis. It seems to me that "automatic exploit generation" is improving quite a bit where the infrastructure for analysis is a little tricky to set up, but then you can direct that infrastructure to analyze the code for you. The bad guys and good guys are in a race to find new exploits faster (they always have been) but I've been pretty amazed by the direction I see things going with automation. I might just go back to pen and paper at this point.

ancarda 6y ago
>I might just go back to pen and paper at this point. Maybe you kid, but... I've been using a physical calendar on the wall this year. I also replaced my Apple Watch with a Casio F-91W some time ago. You know what's really great? My calendar or watch never gets hacked and it's never unavailable because some overnight software update broke it! Sure, the F-91W technically runs software, but it has no connectivity. That's the important part. Now if I could just figure out what to do with my phone... I don't think dumb phones are particularly secure, so maybe it makes sense to keep using Android? Or eventually switch to Linux on my phone?
- sausage_dog 6y ago
  I suppose this year is different but what about when you're outside and you want to check your calendar? Do you copy everything to a pocket calendar and risk them going out of sync?
  - ancarda 6y ago
    So far that hasn't really come up. How often do you need to check your calendar outside? Maybe I don't need to very much because I work from home. Here's some possible scenarios though: * If I need to remember when something is going to happen, such as "I'm leaving my house to meet a friend at 4 PM", I can just commit to memory what time it was suppose to be. * If there's a lot of stuff happening, then I'd make a note on my phone. If the times of events change while I'm out, it doesn't really matter if my calendar at home is out of sync. I'm just going to cross the day off when I get back. * If I find out a later date will change ("the user group has been moved to Thursdays"), then I'll leave myself a reminder on my phone. Most of the things on my calendar are actually little post-it notes, so I can move things around. I only write things in ink when they will never change, like national holidays that are already scheduled/set in stone. So far, I haven't really run into any pain points. The drawbacks of paper calendars just aren't enough to overcome the drawbacks of electronic calendars.
- cyberpunk 6y ago
  If only the F-91w had a countdown/timer function instead of a stopwatch... :)
- LinuxBender 6y ago
  I have a $12 flip phone, pay as you go, not in my name. It can't browse the web and if someone sends me binary data in a text message its shows up the same as if I read binary data in my terminal. The phone has no idea what to do with it. Battery life would be great if the did not remove the cell sites near me. I think this model was replaced by one that is $29 but its basically the same thing. Check Walmart or an equivalent store.
  - generalizations 6y ago
    I would do that also, if I could replace the live traffic of google maps. Did you find a solution to that, or do you just not need it?
    - xet7 6y ago
      a) Some do like paper maps. b) Google Maps could advice direction to some smaller not so well maintained roads, that could increase travel time a lot, or lead to some road where it's hard to turn back. So maybe planning ahead and writing driving instructions at home before driving would be better. Or just trying to follow main street signs for major roads. c) There are some DIY projects like Raspberry Pi navigator: https://www.raspberrypi.org/forums/viewtopic.php?t=70517 https://www.raspberrypi.org/forums/viewtopic.php?t=70517
      - generalizations 6y ago
        Oh, I was thinking specifically about avoiding traffic jams as they happen, which requires some kind of online connection. The raspberry pi project looks interesting, though.
    - LinuxBender 6y ago
      I do not need it.
- 0xdeadbeefbabe 6y ago
  It's a tedious game though: but, but, you your Casio is still vulnerable to EMP and you have to be awake to read it.
saagarjha 6y ago
angr is cool and all (disclaimer: I know many of the people who work on it) but we’re not really at a point where you can just point automated tooling at software and get results. That isn’t to say that code analysis tools are not heavily used by people finding exploits, but their effectiveness is limited by the difficulties of analyzing code and the fact that the “good guys” have access to pretty much the same tooling. (In fact, their tooling is better in a sense because it often runs in better conditions like with full source code and lack of a need to find a full exploit for every bug.)
- dave_sullivan 6y ago
  > we’re not really at a point where you can just point automated tooling at software and get results I hear you, but I see where they're going with it and what is possible with automation will improve each year. It's certainly not a dead end.

ancarda 6y ago

>I might just go back to pen and paper at this point. Maybe you kid, but... I've been using a physical calendar on the wall this year. I also replaced my Apple Watch with a Casio F-91W some time ago. You know what's really great? My calendar or watch never gets hacked and it's never unavailable because some overnight software update broke it! Sure, the F-91W technically runs software, but it has no connectivity. That's the important part. Now if I could just figure out what to do with my phone... I don't think dumb phones are particularly secure, so maybe it makes sense to keep using Android? Or eventually switch to Linux on my phone?

sausage_dog 6y ago
I suppose this year is different but what about when you're outside and you want to check your calendar? Do you copy everything to a pocket calendar and risk them going out of sync?
- ancarda 6y ago
  So far that hasn't really come up. How often do you need to check your calendar outside? Maybe I don't need to very much because I work from home. Here's some possible scenarios though: * If I need to remember when something is going to happen, such as "I'm leaving my house to meet a friend at 4 PM", I can just commit to memory what time it was suppose to be. * If there's a lot of stuff happening, then I'd make a note on my phone. If the times of events change while I'm out, it doesn't really matter if my calendar at home is out of sync. I'm just going to cross the day off when I get back. * If I find out a later date will change ("the user group has been moved to Thursdays"), then I'll leave myself a reminder on my phone. Most of the things on my calendar are actually little post-it notes, so I can move things around. I only write things in ink when they will never change, like national holidays that are already scheduled/set in stone. So far, I haven't really run into any pain points. The drawbacks of paper calendars just aren't enough to overcome the drawbacks of electronic calendars.
cyberpunk 6y ago
If only the F-91w had a countdown/timer function instead of a stopwatch... :)
LinuxBender 6y ago
I have a $12 flip phone, pay as you go, not in my name. It can't browse the web and if someone sends me binary data in a text message its shows up the same as if I read binary data in my terminal. The phone has no idea what to do with it. Battery life would be great if the did not remove the cell sites near me. I think this model was replaced by one that is $29 but its basically the same thing. Check Walmart or an equivalent store.
- generalizations 6y ago
  I would do that also, if I could replace the live traffic of google maps. Did you find a solution to that, or do you just not need it?
  - xet7 6y ago
    a) Some do like paper maps. b) Google Maps could advice direction to some smaller not so well maintained roads, that could increase travel time a lot, or lead to some road where it's hard to turn back. So maybe planning ahead and writing driving instructions at home before driving would be better. Or just trying to follow main street signs for major roads. c) There are some DIY projects like Raspberry Pi navigator: https://www.raspberrypi.org/forums/viewtopic.php?t=70517 https://www.raspberrypi.org/forums/viewtopic.php?t=70517
    - generalizations 6y ago
      Oh, I was thinking specifically about avoiding traffic jams as they happen, which requires some kind of online connection. The raspberry pi project looks interesting, though.
  - LinuxBender 6y ago
    I do not need it.
0xdeadbeefbabe 6y ago
It's a tedious game though: but, but, you your Casio is still vulnerable to EMP and you have to be awake to read it.

saagarjha 6y ago

angr is cool and all (disclaimer: I know many of the people who work on it) but we’re not really at a point where you can just point automated tooling at software and get results. That isn’t to say that code analysis tools are not heavily used by people finding exploits, but their effectiveness is limited by the difficulties of analyzing code and the fact that the “good guys” have access to pretty much the same tooling. (In fact, their tooling is better in a sense because it often runs in better conditions like with full source code and lack of a need to find a full exploit for every bug.)

dave_sullivan 6y ago
> we’re not really at a point where you can just point automated tooling at software and get results I hear you, but I see where they're going with it and what is possible with automation will improve each year. It's certainly not a dead end.