rmast

8 ms·

91.
by rmast 3y ago
It seems like there should be a way to catch these types of “bugs” - some form of dynamic analysis tool that extracts the feature detection code snippets and tries to compile them; if they fail for something like a syntax error, flag it as
92.
by rmast 3y ago
The use of head/tail for deobfuscation also isn’t visible as plain text in the repository or release tarball, which makes searching for its use in other repositories more difficult (unless a less obfuscated version was tested elsewhere
93.
by rmast 3y ago
I suppose I think verbose-ness will help people see the other side of things. I think I was also trying to convince myself that you aren’t just into conspiracy theories, but given that you’re now accusing me of being suspicious… :shrug: it
94.
by rmast 3y ago
Maybe some analysis of odd patterns in entropy of binary files committed to repositories could pick out some to look at a bit deeper?
95.
by rmast 3y ago
As I understand it Jia was contributing things like tests, not making changes that involve “security”. They just turned the commit, and eventual ability to make releases on the xz GitHub after “earning” more trust (+ access to GitHub pages
96.
by rmast 3y ago
Well, good for you being one of the few exceptions who would make everyone submit themselves to a proper background check (presumably also covering the cost) before giving any write/commit access to the repo. That’s more than even most
97.
by rmast 3y ago
You might not be trying to start a rumor, but other people could when they try to answer the questions from a place of ignorance — if you take a look at the comments on a gist summarizing the backdoor, there are quite a few comments by z-no
98.
by rmast 3y ago
I don’t stalk all of your social media posts, so from my perspective I don’t see any of the solutions you’ve posted elsewhere — which brings up a good point to keep in mind: none of us see the complete picture (or can read minds to know wha
99.
by rmast 3y ago
Recall that the original maintainer had mental health issues and other things that likely led to the perceived need to bring on someone to help maintain xz. This brings up some integrity questions about you and other people bringing forth a
100.
by rmast 9y ago
If twitch offers an option for sound on embedded videos to be muted, that would be perfect -- at least on the home page where people who are checking out a site for the first time are most likely to land, getting blasted by unexpected sound
101.
by rmast 10y ago
Assembly is related to the process of reverse engineering a game - disassemblers translate compiled code back into assembly, so knowing how to read assembly would have been very useful. I think answering the questions about decryption and f