151–160 of 408 posts
Earlier quoted context omitted.
> And those apps, probably upwards of 99.999999% of them will be unsafe. Apps are sandboxed, so the damage should be limited to only the exploited app. Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.
Is there a way to rescind said permissions?
There are no laws in Israel preventing companies like NSO from building and selling zero-day and zero-click exploits? Without proper regulations the Israeli government is creating a sophisticated and dangerous platform for these kind of illegal attacks.
Anyone interested in learning more about how NSO group operates can check out digitalviolence: https://www.digitalviolence.org/#/
Earlier quoted context omitted.
This one is a good example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Really worth the read, it was quite eye-opening. > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exa…
You have to admire the ingenuity. Just wish it was being put to better use. I can't even fathom the amount of effort required to, basically, create an entire scripting language running in an environment like that.
Earlier quoted context omitted.
>People will still write apps. And those apps, probably upwards of 99.999999% of them will be unsafe. This can be avoided if you have a cross platform high level language like say C# with a big standard library like .Net , the field needs then to make sure the language and core library are safe, most programs use existing libraries and put some business logic on top, I remember that memory safety was a thing before R…
Respectfully, an enormous amount of work has gone into making sure things like Python, .NET, and Rust are secure. And the security researchers still regularly find bugs and sell 0-days. That's not even counting the work that's gone into the gold standard that is the JVM. Any serious minded security expert could tell you that guaranteeing security on any of these platforms is a sysiphean effort. Your platform is state…
Easier said than done…
Earlier quoted context omitted.
> And those apps, probably upwards of 99.999999% of them will be unsafe. Apps are sandboxed, so the damage should be limited to only the exploited app. Pegasus exploits exploited iMessage et al, which are Apple's own apps with special permissions.
Again, from the perspective of a cyber security expert, all that is great! Or rather would be great if Pegasus was the only 0-day out there. It'd be even better if Pegasus were the only 0-click out there. Here's the thing though, it's not. That's the world we live in. So the question is, given that fact, how do we get to a world where we can have some level of security? My belief is that everyone from the users to th…
Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
Quoted post unavailable.
Zero click hacks have been around for all of computing. Nothing connected to the internet, connected to a network, has ever, ever been safe. All you can do is reduce attack surface, and most of all, monitor. Another comment blames Apple, and financial incentives. Sure, there may be some of that. But the reality is that safe code is impossible. Now, you may say "But...", yet think about this. For all of computing hist…
Apparently, formal proof of algorithms being safe and sound has been repeatedly demonstrated, just not so toward Apple’s closed (proprietary) software specifically their large 14-format image decoders running outside a sandbox.
Rust won't be the miracle stopping this. Porting unveil/pledge to all OSes will.
Not to go all 'Rust Evangelism Strike Force' but almost universally, these exploits leverage memory unsafety somewhere in the stack, usually in a parser of some kind (image, text, etc). The fact that this is still tolerated in our core systems is a pox on our industry. You don't have to use Rust, and it won't eliminate every bug (far from it), but memory safety is not optional . We truly need to work more towards eli…
Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”. Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because H…
Earlier quoted context omitted.
I like Rust in a lot of ways, I write a fuckload of it and I get value from doing so. Not “praise the lord” value, but real value. But the attitude is an invitation to getting made fun of. It’s absurdly intellectually dishonest when Rust-as-Religion people actively hassle anyone writing C and then get a little precious when anyone mentions Haskell and then extremely precious when they step on the landmine of the guy…
It sounds like you’re saying, you spent a lot of time focused on learning rust, so now you like to discuss its shortcomings as abrasively as you can for sport.