Shit happened. Mistakes were made.

> As you might expect, the BBC test card with the girl and clown has both a backstory and a cult following.

source: K

> A long and vivid debate for and against different vulnerability disclosure models is still taking place. Sources that collect all these valuable arguments are scarce. This document acts as a place-holder for related contributions that we are aware of. Paper, articles and more informal documents are grouped based on the type of publication. We hope that these links are useful to anyone familiarising themselves with the scene or planning further contributions.

source: grugq

Meta note: new domain, new code base, everything should be about the same, but not quite done converting all features.

RSS now at /rss.

> I’ve started the long process of porting old articles and it has been fun revisiting topics I haven’t thought about much for years.

> Anyways, as I port articles over I’ll post links to them here, with a few reflections.

> Excellent NASEM study (also has refs for futher reading): https://www.nap.edu/catalog/25120/securing-the-vote-protecting-american-democracy

> On Software Independence: https://people.csail.mit.edu/rivest/RivestWack-OnTheNotionOfSoftwareIndependenceInVotingSystems.pdf

> Gentle intro to Risk Limiting Audits: https://www.stat.berkeley.edu/~stark/Preprints/gentle12.pdf

> My own thoughts: https://www.mattblaze.org/papers/blaze-govtreform-20171129.pdf

> You know something you can’t get through the internet’s wires, at least not on its own? Food. We’ve been working on it for years, but no, we’re not at the point where we can deliver nourishment directly via the series of tubes. But food has always been something of a means to an end—a way of driving the internet forward, making it something people would actually like to use.

Plus tons of links.

> Okay, so you’re a CS graduate and you did a hardware course as part of your degree, but perhaps that was a few years ago now and you haven’t really kept up with the details of processor designs since then. In particular, you might not be aware of some key topics that developed rapidly in recent times...

> pipelining (superscalar, OOO, VLIW, branch prediction, predication)
> multi-core and simultaneous multi-threading (SMT, hyper-threading)
> SIMD vector instructions (MMX/SSE/AVX, AltiVec, NEON)
> caches and the memory hierarchy

> Fear not! This article will get you up to speed fast. In no time, you’ll be discussing the finer points of in-order vs out-of-order, hyper-threading, multi-core and cache organization like a pro. But be prepared – this article is brief and to-the-point.

I would say all of that is accurate except the brief part. It’s quite long, but very dense. Excellent resource.

> Queueing theory is the scientific study of waiting in line. It can apply to familiar lines like those at the grocery store or bank but also to things like web servers, highway traffic, and telecommunications…basically any situation where you have things entering a system, being processed by a system for a certain period of time, and leaving the system.

Assorted stories and links.

source: K

> My goal in this post is to skim my observations on the state of software design and development over the past year, and to try to find a meaningful way forward for myself for 2019. My perspective is limited by the fact that I have worked exclusively in client-side software security for the past 7.5 years. Still, I think there are broad trends visible even to me, and some clear signs about where we need to go as an industry.

source: L

> This year I had a great pleasure to be involved in a research project, which required me to get familiar with a substantial number of publications from the domain of deep learning for computer vision. It allowed me to take a deep dive into the field and I was amazed by the progress done in the last 2-3 years. It is truly exciting and motivating how all different subfields such as image inpainting, adversarial examples, super-resolution or 3D reconstruction have greatly benefited from the recent advances. However, there is one type of neural networks, which has earned truly massive amounts of hype (in my humble opinion definitely for a reason)- Generative Adversarial Networks (GANs). I can agree that those models are fascinating and I am always on a lookout for some new GAN ideas.

source: HN

> Running through this year’s list of video games that made the most impact on the Ars staff, I’m struck by the sheer variety. Sure, there’s the usual selection of open world adventures and slick action games. But there are also a handful of fresh takes on the puzzle game genre, a few promising virtual reality games, a relatively wide variety of 2D platformers, racing games that run the gamut from realistic to campy, a couple of fighting games, and even a rhythm game!

20 more ways to spend time and money.

> In last year’s Stratechery Year in Review I noted that the predominant theme was the impact of tech on society; perhaps unsurprisingly, the dominant theme in 2018 was tech and regulation.

> While evidence has shown that “a container with a well-crafted seccomp (secure computing mode) profile (which blocks unexpected system calls) provides roughly equivalent security to a hypervisor” (https://blog.hansenpartnership.com/measuring-the-horizontal-attack-profile-of-nabla-containers/), methods are still needed for securely running those processes that require the entire syscall interface. Solving this problem has led to some interesting research.

> Let’s take a look at some of the research being done in these areas.

> Let’s raise a glass to dataviz that pushes boundaries, illuminates truth, and celebrates beauty. Thank you to everyone who joined us on the Information is Beautiful Awards journey this year - now see which entries took home trophies at tonight’s spectacular ceremony.

Another collection: https://www.wsj.com/graphics/year-in-graphics-2018/

source: K

> For the past couple of years, I have invested significantly in all things emojis. This post rounds up everything I’ve done during that period.

> Denis Kolegov, Oleg Broslavsky, “WebGoat.SDWAN.Net in Depth”
> En He, Jiashui Wang “Hacking Android VoIP for Fun and Profit!”
> Gmliu, “Windows Kernel Fuzzing”
> Jaanus Kääp, “Document parsers “research” as passive income”
> Jiafeng Li, Zuotong Feng, “How to Exploit Blockchain Public Chain and Smart Contract Vulnerability”
> Jin Liu & Chong Xu, “Pwning Microsoft Edge Browser: From Memory Safety Vulnerability to Remote Code Execution”
> Kang Li, “Practical evading attacks on commercial AI image recognition services”
> Liang Chen, “Era of iOS 12 with A12: End of iOS War?”
> Lidong LI & Naijie XU, “802.11 Smart Fuzzing”
> Ned Williamson, “Exploiting Chrome IPC”
> Nikita Tarakanov, “Automating Windows Kernel Pool Overflow/Corruption Exploits Development”
> Samuel Groß, “IPC MitM: Exploiting a Fun Logic Bug for Kernel-Mode Code Execution on MacOS”
> Tielei Wang, Hao Xu, “IOService Becomes a Grandpa”
> WYP, “Vulnerability analysis of Z-wave products used in Korea”
> Yannay Livneh, “Baby I can drive your car: remotely hacking Telematics CAN-connected devices”
> Yongtao Wang, Sai Cheng, Jie Fu, “SSRF To RCE In Java ”
> Yunhai Zhang, “Diving into Windows Defender Application Guard”

source: solar

No answer, but a virtual conference worth of links.

> Starting last year, I began a list of all the talks that I thought would be useful to C programmers. Some are entirely relevant to C, others just have significant portions that are relevant to C. When someone asks about where they can find a C conference, I send them my list.

source: L

> This issue of Increment explores technical, tactical, and empathetic ways to make the systems we build more secure.

C, swift, rust, unicode, etc. link collection.

source: L