I much prefer using Jenkins Job Builder for managing jenkins jobs. I find Groovy and Jenkins Job DSL basically impossible to debug and a semantic nightmare. JJB is just a YAML file that creates jobs from it. You can generate the YAML however you want, but it’s pretty clear how that YAML turns into a job.

“Pwning coworkers thanks to having them run a program written in a Turing-complete language” just doesn’t have the same ring, eh?

I guess there could be a disconnect between a user’s expected security and the reality, but…

The original page had a tag stating it was Connect() related. Connect() is a developer conference intended for later this week.

It’s probably being announced then.

https://connectevent.microsoft.com/

For everything but my laptops, wmii. The rest of the time is on OSX, where I use Spectacle to (basically) tile my apps via the keyboard.

Correct me if I’m wrong, because I’m sure there are people here who know more about this topic, but couldn’t the problem of unnecessary branching be fixed with conditional move instructions?

For example, absolute value in pseudo-assembly:

compare X 0
move Y 1
conditional-move-LT Y -1
multiply X Y

It seems like most of the mathematically unnecessary branches (i.e. where you’re just pulling different data, but not using different control flows) can be cleared out using conditional move instructions, which (IIRC) aren’t generated by most compilers for backward compatibility reasons.

It would be awesome if posts went to the original content, not to another link aggregation site.

The link with actual content: http://www.grenadille.net/post/2016/06/17/ART-single-thread-performances

Wow. An ncurses mp3 player? It feels like 1998 all over again.

I use this idea where capabilities are not applicable to good end. For single shot applications, such as 12 factor apps, or fork-on-accept read-only network servers such as anoncvs, non-cgi http, or anonftp, I highly recommend something like this.

Let’s take Apache, a forking TCP server. Assume an attacker can compromise the process handling their connection, but doesn’t have kernel or filesystem privileges. Even if the attacker can’t touch the filesystem due to properly implemented chroots, they can still impact other user’s HTTP processes via ptrace or signals.

My issues with raru are that it might randomly land on an in-use UID/GID, and uses only 16 bits of entropy, which is too little separation for a highly used network service. I prefer my I implementation of this idea I used for the inetd replacement used in CGC:

• https://github.com/CyberGrandChallenge/service-launcher/blob/master/privileges.c#L46 - get_unused_uid
• https://github.com/CyberGrandChallenge/service-launcher/blob/master/privileges.c#L63 - get_unused_gid
• https://github.com/CyberGrandChallenge/service-launcher/blob/master/privileges.c#L80 - drop_privilages

“I know everything there is to know”, Geohot 2015.

I am reminded of the Socratic paradox, which is roughly mirrored in the bible and on many fortune cookies. The wise man knows he knows nothing, the fool thinks he knows all.

For those that can’t stand video for reading code, the code in question is:

class A(object):
    def __getitem__(self, item):
        print item
        return item

a = A()
if "A" in a:
    print "YEP"

A few things to remember:

__getitem__(...)
    x.__getitem__(y) <==> x[y]

With that in mind, remember that "a" in x is roughly equivalent to:

i = 0
try:
    while True:
        if x[i] == "a":
            return True
        else:
            i += 1
except IndexError:
    return False

The original A implementation never bothers to validate the position of getitem

Work: Visiting Edinburgh for our semi-annual internal hackdays! Aiming to build a new internal service to replace a google document using Lotus which should be quite interesting.

Outside of work I’ve been playing with celluloid with the aim of writing a stats collection script to shove stats into influxdb for graphs on various things at home. Also thinking I should spend some time teasing private config out of my puppet modules for the home server & start publishing the modules.

Broke a spoke on the rear wheel of my bike for the second time late last week, which is just a bit irritating. At £16 for a replacement spoke & true at the local bike shop, I’m half minded to buy a decent pack of spokes & a truing jig and just rebuild the wheel myself with stronger spokes. It is a cheap stock Mavic wheel after all, they’re not rated as super strong out the box. Hub & Rim are strong enough, just needs some better quality spokes on it.

Using pickle for data marshaling in an intrusion detection project? No thanks, Lockmart.

https://github.com/lmco/laikaboss/blob/master/laikad.py#L499

I conjecture that the recent hacking of the Office of Personnel Management was enabled by similarly bad project management leading to sub-optimal, if not outright dangerously insecure software.

How does one solve this? Open audit of software? Better contracting standards?

I’ve also found using ‘trap’ to help make bash less painful.

http://redsymbol.net/articles/bash-exit-traps/