Viewing profile — bkallus

I have seen it firsthand in the CS department here at Dartmouth. It is bad. We're currently designing a new intro systems curriculum, and we're thinking of it as an adversarial pro…

> the OpenBSD project has not been very receptive in the past for bug reports, my sense of “this is probably fine, in practice”, and that if OpenBSD wants to weed out UB from their…

I hope he ends up covering integer division by constants. The chapter on this in Hacker's Delight is really good but a little dense for casual readers.

ABISan. Think of it like UBSan, but for assembly. It's a custom assembler built on top of the LLVM assembler (llvm-mc) that emits instrumentation code to catch ABI violations at ru…

Cache poisoning is also possible. See https://youtu.be/aKPAX00ft5s?feature=shared&t=8730 for a relevant demo. You can also (in principle) steal responses intended for other clients…

I have been working on this :) https://github.com/narfindustries/http-garden

We encourage students to use their own machines. We even loan out old ThinkPads and MacBooks for students to run Linux on. Very few (3-5 per term) take us up on this offer. Most of…

Learning to use a real SSH client is part of the curriculum. If they graduate without this knowledge, we have failed as teachers.

I too have these fond memories, and I enjoy passing it on to the next generation :)

SSH is a fundamental protocol. If students can get through our program without learning what SSH is and how to use it, that's a problem.

I ran the servers for our networks, binary exploitation, and intro systems programming classes, and this thing is a major annoyance. It is because of this stupid RAT that students …

I went with SIGINT because it's more fun to press ctrl-c than to pgrep and kill. If you'd rather use SIGUSR1, just change SIGINT to SIGUSR1 line 654.

I wrote a little LD_PRELOAD library that makes it easy to inspect and interact with a running program's glibc heap. It's fun to pause processes, free a bunch of their allocations, …

My experience participating in Google's program has been pretty good. The reward money is a nice supplement to my grad student stipend. I got a free trip to DEFCON out of it, too.

Search for local tech-oriented flea markets. If you're in the Boston area, this is a good one: https://w1mx.mit.edu/flea-at-mit/

This almost entirely skips the role of the dynamic linker, which is arguably the true entry point of the program. If you are interested in that argument, see https://gist.github.co…

Yuzu is free software, so its source code is already available: https://github.com/yuzu-emu/yuzu

I'm pretty sure that AVI just wraps Nginx, even though they claim otherwise. I think this because Nginx has a bunch of parsing quirks that are shared with AVI and nothing else.