Veserv

50 ms·

601.
by Veserv 2y ago
Investment is actually about returns. Growth is a means of getting returns, but not the only way. A large, stable, profitable company with no growth prospects is not a poor investment if they pay out returns.
602.
by Veserv 2y ago
I took deliberate care to specify the terms and the concepts they correspond to, so I am confused by your statements that I was using ambiguous or loaded terminology. I was merely pointing out that the specific tactic proposed is untenable
603.
by Veserv 2y ago
As I explained, you are describing processes , in the Linux parlance, with a shared mapping. Threads with private mapping (shared root, different sub-tree) versus processes with shared mapping (different root, shared sub-tree) are equivale
604.
by Veserv 2y ago
That is not how MMUs work, so it would go very poorly. MMUs expect a tree. You can not give them “Tree A, except at Node N substitute a different sub-tree”. To have a different sub-tree, you must have a different root. However, you can shar
605.
by Veserv 2y ago
Yeah, if you instead dumped a dense binary log format into the log and then demangled/decoded on display, then you should be able to get much higher throughput. A separate decode step instead of straight to the console is not so bad be
606.
by Veserv 2y ago
In C land, function entry/exit traces (or reconstruction of one) is a prerequisite for time travel debugging which has been commercially available for over 20 years. If we are talking prologue/epilogue hooks, those have been comma
607.
by Veserv 2y ago
Well, if you assume “sane”, then you can do whole-function (or basic block) rewriting if the detour would overwrite other reachable instructions. More annoying for sure, but should be doable.
608.
by Veserv 2y ago
I literally presented a direct counterexample falsifying your claim that KVM + Rust results in highly secure virtualization. Even though you have rejected even attempting to define what would constitute highly secure, by no reasonable metri
609.
by Veserv 2y ago
And is the net result of those teams that they find, on average, fewer than 1 security vulnerability per year? That KVM has, on average, less than one security fix per year? To quote the KVM escape Google Project Zero published in 2021 [1]:
610.
by Veserv 2y ago
Would cost a few million dollars upfront with effectively zero marginal cost. Less than buying one tank or starting a McDonalds.
611.
by Veserv 2y ago
Yes. You have been unable to provide any objective or quantitative means of evaluating security and reject any attempt to do so. You even reject attempts to characterize what would constitute an objective minimum bar for adequacy. "I c
612.
by Veserv 2y ago
1. Commercially motivated attacks against mere mid-sized entities (100 M$-1 G$ in revenue) can empirically derive 10s of M$ from successful attacks. Adequate security must make such attacks unprofitable. This constitutes a absolute, rock-
613.
by Veserv 2y ago
I see, you are unfamiliar with actual high security development and certification. Common Criteria SKPP [1]. “AVA_VLA EXP.4.3E The NSA evaluator shall perform independent penetration testing. AVA_VLA _EXP.4.4E The NSA evaluator shall determ
614.
by Veserv 2y ago
You mean your argument that it is hard to find a vulnerability, despite the fact that commercial systems in Unix kernel lineage have historically been easy to hack and have never once demonstrated high robustness? You have not even establis
615.
by Veserv 2y ago
You presented arguments, but did not present any substantive, quantitative effects attributed to those changes. You have presented no quantitative means of evaluating security. Furthermore, you have presented no empirical evidence that thos
616.
by Veserv 2y ago
OpenBSD is not secure by any measure. That Theo happens to be right about the endless clown parade is independent of his ability to develop a secure operating system. I mean, jeez, even Joanna Rutkowska acknowledges the foundations are iffy
617.
by Veserv 2y ago
Are you claiming it has no security vulnerabilities? If yes, care to present a proof. If no, then please estimate how big of a bug bounty would result in a reported critical vulnerability. If I put up a 1 G$ bug bounty, do you think somebod
618.
by Veserv 2y ago
VT-x. You should get the name of the technology right before defending it. VT-d is the I/O virtualization technology. When did it become customary to defend people making claims of security instead of laughing in their face even though
619.
by Veserv 2y ago
The argument you are making here is that somebody else will figure it out. However, the argument you made before depends on that any arbitrary entity will figure it out with time and money. Those are categorically different. If, in the
620.
by Veserv 2y ago
That is not how any technology works, let alone literal bleeding edge technology, unless you mean Tesla will just scrap their technology and then just buy it from Waymo. Assuming SpaceX can make reusable rockets, it seems like a matter of t
621.
by Veserv 2y ago
You think humans are only 99% reliable on a per-mile basis?! That would mean your average person crashes every ~100 miles, or about once every two days. You can not just go around asserting comparative advantage when your baseline is so far
622.
by Veserv 2y ago
rr was introduced in 2014 [1]. gdb reverse debugging was introduced in 2009 [2]. You can see a fairly comprehensive history of time travel debugging here [3]. Not to say the built-in gdb reverse debugging was any good. It had (has?) like 1,
623.
by Veserv 2y ago
The latter. The neutral way of debugging is really debugging the raw machine code of a process. This requires OS integration for your low level manipulation primitives. To add language support, you then need to figure out how to define the
624.
by Veserv 2y ago
WinDbg uses a instruction-level emulation time travel implementation, so incurs the 10-20x slowdown associated with that technique. rr uses a replay-record time travel debugging implementation, which can incur far less overhead when done co
625.
by Veserv 2y ago
The GDB feature set has been largely unchanged since the 80s and even then mostly just parroted the design of other CLI debuggers from the 70s. Of course it is limited, you are talking about technology that was not even cutting edge nearly
626.
by Veserv 2y ago
Those tools exist. Time travel debugging has existed in product-ready forms since the early 2000s let alone the advancements since then. The problem is that game development companies are willing to invest money in buying quality tools to m
627.
by Veserv 2y ago
Here is the official Windows security certification page [1]. They certify against this standard [2]. The maximum security they certify is provided is: Page 53: “The evaluator will conduct penetration testing, based on the identified potent
628.
by Veserv 2y ago
That did not seem to bother Gilead when they cured Hepatitis C and stole business from their competitors, who were only making ongoing treatments, by ruthlessly undercutting them so that Gilead would get tens to hundreds of billions of doll
629.
by Veserv 2y ago
Maybe if it crashed in the ocean. If it crashed on land, then they would almost certainly find the device in the wreckage as in the Pan Am 103 bombing [1] where they found even scraps of disintegrated clothing in the suitcase carrying the b
630.
by Veserv 2y ago
The problem described in the paper is not what you think it is. The paper effectively says: "Assume we control the wire to the flight controls, then we have complete control over whatever is sent to the flight controls." Not to be

More ›