Oof real. I love taking the 4Runner places off the beaten path (but still on a proper trail ofc). Get far enough out on a hard enough trail and it becomes zero to slight peopley

This is all I’ve run across on reverse engineering, so far but it is quite interesting.

https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b

I have a feeling there are a lot of busy people trying to answer that question, now. Yikes.

Yeah it sounds pretty wild already with some kind of, like, door knock mechanism using certificates? So you can’t scan for it. And some reverse engineering countermeasures.

Like everyone else, I have to wonder what libraries have been compromised in a way that nobody has noticed yet.

Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it’s “great new features”. We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor he had added). We had to race last night to fix the problem after an inadvertent break of the embargo.

He has been part of the xz project for 2 years, adding all sorts of binary test files, and to be honest with this level of sophistication I would be suspicious of even older versions of xz until proven otherwise.

Damn. I would love to see a full post mortem on this compromise.

Well maybe they aren’t experienced info security professionals :)

What the saying is trying to convey:

Sometimes people focus on a few small details of some problem to such a great degree that they completely fail to consider the larger context and purpose.

It isn’t trying to say details are unimportant. Only that the larger context matters and should be considered while investigating the details of a problem.

I am trying to think of a good example. The one I found online is something like, “the senator was so focused on the wording of one subsection of the bill he didn’t stop to consider the bill was too unpopular to ever pass regardless of the wording”.

Ok how about this. Let’s say a company is to unify access control across disparate systems. The overarching goal is to be able to set policy in one place not in each individual application.

A team is in the process of evaluating a candidate product. They want to complete the evaluation in a set time frame and focus on a particular scenario (web app, specific tech stack) for a proof of concept that isn’t representative of many of the typical scenarios in the company (web, database, API, etc).

The team spends their time focused on getting the evaluation done and discovers the product doesn’t integrate as well as originally expected with a key system. They focus on coming up with a solution so they can complete the proof of concept.

They consider their efforts a success when they finish up the eval on time.

But the evaluation wasn’t useful because it didn’t really consider the overarching project goals and in the end the solution didn’t even meet those goals!

Hope this helps.

I get where you’re coming from but is he managing his risk or not?

Does he understand the risk? If yes, good. No? Bad.

Is he ignoring the risk? If yes, bad. No? Good.

Is he weighing the risks against the benefits he receives of using these apps and taking appropriate steps to mitigate those risks? If yes, then good. No? Bad.

Cyber security isn’t “lock everything down at all costs”. Otherwise I would insist you throw your phone in an incinerator along with all your computers, live in a bunker reinforced against nuclear attack with a small army to guard you, never leave it, never talk to anyone… Etc.

It is enabling one to achieve their goals with a tolerable amount of risk. That level of tolerable risk is different for everyone.

Totally agree. Have been there and done that quite a few times too.

Very cool. Easily my favorite use for 3d printing.

Related, I think there are several sets of files for various RC cars I have run across. Would be kind of fun to download a whole (RC) car :)

Hopefully people with more of a clue than me will chime in… Meanwhile, my best swag is the filesystem had issues and had to do an fsck? If that’s the case it would boot quickly next time assuming a clean shutdown.

Were there any errors during boot?

Fastboot enabled in BIOS or no? (Not sure if this has anything to do with anything I’m just trying to look useful)

PS: the weird active time could maybe somehow be related to the filesystem being borked needing fsck? I’m not sure.

Definitely talk to your doc. (My GP prescribes my meds; the psychologist diagnosed and wrote a letter).

I don’t really have noticeable side effects. When I first tried the stuff I started at 30mg then at 40mg I started seeing lots of bright spots and went back to 30. Freaky experience.

I’ve been on 30mg for years now. My heart doesn’t usually race but some days I get a little jittery. I don’t recall it being elevated back when I was using an exercise monitor. It probably doesn’t help that I drink a double shot latte every morning with my meds. My BP did not seem to be affected by the lisdex last time I tested it on and off the ADHD meds. (I am on BP meds too).

Worth mentioning, I am also on Effexor (venlafaxine) for depression and anxiety, which was diagnosed a decade before adhd-c. Prior to Effexor I was on Lexapro for a few years.

When I was testing dosage, my PA said to increase 10mg every few days until I noticed it helping, then increase until I noticed side effects and then we would go with 10mg below that. Or something like that. Which is how I ended up at 30mg.

I recall that I couldn’t tell at first how much 30 helped vs 40 but now that I have more experience with the medicine and self evaluating my symptoms. The difference between 30mg and none is now very obvious.

Although… I have been thinking about trying 40 again so I can re-evaluate, in case I get a bit more out of it without side effects this time. Maybe I will do that next time I’m up for a refill.

Totally worth the watch. It’s so fascinating to see the differences, but more so the similarities, between then and now.

Even though that age had its share of war, sorrow, infirmity, and so on, I have to wonder if there wasn’t a sense of optimism from all of the rapid progress in science and technology. I doubt any of these people saw a world war coming in just two decades and a shakeup of the world order, the death of empires, and so forth.

One of my hobbies is collecting pocket watches and my favorite, a ladies Elgin in an ornate gold plated case, was manufactured about a decade before these films were made. It is wild to think this watch could have been worn by someone in these films and then surviving so many years and so much change yet still ticking away and keeping time to this day.

I imagine they’re not awful fond of Russian invasions, either.

Load average of 400???

You could install systat (or similar) and use output from sar to watch for thresholds and reboot if exceeded.

The upside of doing this is you may also be able to narrow down what is going on, exactly, when this happens, since sar records stats for CPU, memory, disk etc. So you can go back after the fact and you might be able to see if it is just a CPU thing or more than that. (Unless the problem happens instantly rather than gradually increasing).

PS: rather than using cron, you could run a script as a daemon that runs sar at 1 sec intervals.

Another thought is some kind of external watchdog. Curl webpage on server, if delay too long power cycle with smart home outlet? Idk. Just throwing crazy ideas out there.

You probably want to look for books on reverse engineering. And a book on assembly for your CPU.

I learned assembly language for VAX-11 (this was like 30+ years ago) in a CS class. We also learned 6502 assembly in a computer engineering class. Neither book would help you. You want a book specific to whatever CPU you’re using.

Now, I never took it, but friends in college took a CS Compilers course where they learned the basics of writing a compiler. But that’s not what you’re talking about though it might help.

Trying to understand what a program does is reverse engineering. And a tool like IDA Pro would help you understand subroutines, variables, flow, library calls, and so on.

A debugger will be invaluable for seeing a program execute one instruction at a time.

You would need to know the assembly language for your CPU. And it would help to become familiar with certain patterns. I haven’t done much assembly (but I have done assembly on a few different CPUs) nor much reverse engineering so I’m not sure I can lend a whole lot of insight there.

As you learn assembly instructions, you will start to understand how loops, subroutines, if/then/else, and other things are accomplished for your CPU.

For example, if/then/else and loops are often accomplished with conditional branching. The conditions are based on CPU flags (bits in the Status Register) that are set by a comparison instruction. You’ll start to recognize how if/then/else and loops and other things are commonly implemented in assembly (without necessarily having to study the compiler; it will be obvious without knowing anything but assembly).

Another example might be how C structs are implemented. Some CPUs provide convenient memory addressing modes for structs, some don’t. Nearly all I am familiar with provide a convenient way to reference arrays with a simple index.

Subroutines are jumps to a set location and at the end of that code is a return instruction. Usually registers have to be saved when jumping and restored when returning. Arguments to the subroutines are pushed on to the stack either by value or by reference. Return value is provided through some convention (machines with lots of registers might always use one particular one for return).

I guess bottom line, learn assembly for your particular CPU, then take a crack at using a debugger and disassembler / reverse engineering tool.

I’m not entirely sure I follow why that is needed to learn how to do branching in forth but I only vaguely remember that language. Maybe if I did it would be more clear.

Anyway I hope this helps at least a little.

Fucking fantastic. I gotta block more news before I lose it JFC.

As the other commenter said, you want to learn about programming principles. Like, low coupling or don’t repeat yourself.

How long is your longest program? What would you say is a typical length?

You say your code is “bad” – in what ways? For example:

• Readability (e.g. going back to it months later so you go “oh I remember” or “wtf does this do?!”
• Maintainability (go back to update and you have to totally rework a bunch of stuff for a change that seems like it should be simple)
• Reliability (mistakes, haphazard “testing”, can’t trust output)
• Maybe something else?

I guess if you are unlikely to go back and change it, or understand how it works, then sure. And yeah that happens.

I write scripts and utilities like that. Modularity is overkill although I do toss in a comment or two to give a hint to future me, just in case.

Although tbf, I took plenty of CS classes and some of the instructors beat best practices into our heads… So writing sloppy, arcane, spaghetti code causes me to flinch…

Exactly. Systemic issues. That’s my expert (fan of Air Disasters) opinion.