Viewing profile — jdamato

Thanks for commenting this! I've seen this website before and it's really unfortunate how much attention it gets. APT's use of plain text HTTP (even with GPG) is vulnerable to seve…

APT will not reject it on replay if the 'Valid-Until' date has not been met yet. Imagine a version of, say, libEXAMPLE has a vulnerability allowing remote code execution. The `Vali…

Yes, plain text APT repositories (signed with GPG or not) are vulnerable to freeze attacks.

We never suggest that you turn security off -- several versions of APT come with various settings defaulted to off, as described in the article. All of the attacks presented (repla…

Hi! I'm the author of the article. We never suggest turning off GPG and checksum verification. The bugs may be in APT, but they allow several attack vectors against APT, as explain…

The website you linked to has several factual errors, as explained in the article.

Yep, and the information is still relevant! The article explains how it applies to recent versions of APT in the current Ubuntu LTS releases.

We don't really know what EC2 does or precisely the type of hardware your VM will be spun up on. I've erred on the side of being cautious due to the vast amount of work being inves…

Not quite. The vDSO provides a general syscall-wrapper mechanism for certain types of system call interfaces. It also provides implementations of gettimeofday clock_gettime and 2 o…

This is precisely what the vDSO does. The clocksources mentioned explicitly list themselves as not supporting this action, hence the fallback to a regular system call.

Author here, greetings. Anyone who finds this interesting may also enjoy our writeup describing every Linux system call method in detail [1]. [1]: https://blog.packagecloud.io/eng/…

Thanks for reading and I'm glad to hear you loved my post!

Hi, both are answered in the article: First: > What’s going on here is that the first call to localtime in glibc opens and reads the contents of /etc/localtime. All subsequent call…

Author of the post here: greetings. If you enjoyed this post, you may also enjoy our deep dive explaining exactly how system calls work on Linux[1]. [1]: https://blog.packagecloud.…

Check out the post linked from the article: https://blog.packagecloud.io/eng/2016/04/05/the-definitive-g... to learn more about how system calls work on x86 Linux.

If you enjoy this post, you may also enjoy the companion post which dives into the same level of detail, but for the receive side[1]. I set out to write all this up because so much…

Thanks for this! I recently wrote a deep dive in to both strace [1] and Linux system calls [2] which may be interesting to folks reading this great article. [1]: https://blog.packa…

Great introductory article, thanks for writing and sharing this! I wrote an article explaining the inner workings of strace [1], and a detailed article about Linux system calls [2]…

I wrote an article explaining how ptrace works, which may interest you: https://blog.packagecloud.io/eng/2016/02/29/how-does-strace-...