chrisrohlf
Joined 14 years ago
Karma
75
Submissions
35
Member since
Mar 29
Recent submissions
Comment · 2 years ago
The Murray Hill campus may have been where the bulk of the innovation happened but the former Holmdel site is the architectural gem of the two. Thankfully it was preserved and is now functional and used as ‘Bell Works’.
Comment · 3 years ago
Sure. I'm just not sure why their existence depends on cheating the remaining tax payers out of tens of millions of dollars every year.
Comment · 3 years ago
> These are landowners who farm as a tax dodge
This is exactly what it is here in NJ. They’re called ‘fake farmers’ here, and a quick google search will show you they cost the state tens of millions in lost tax revenue per year. Its all the usual suspects too, you know, the kind of celebrities that lecture you on giving and their politics. Those quaint farm stands are just a ruse to keep their tax bills to a minimum on >5 acres if expensive land in wealthy counties.
Comment · 3 years ago
Most people have no idea this exists or any of the historic events and scientific achievements that happened at these locations or in the near by area such as the Horn Antenna or Radio Astronomy at the old Bell Labs site in Holmdel.
Comment · 3 years ago
I used to work at this location when it was an active military base. The Army Signal corps made movies there long before Netflix. As a local resident its nice to see some reinvestment in the base a full 12~ years since BRAC was finalized and the gates closed for good. It’s a beautiful campus with proximity to the ocean and NYC. I do wonder what lies beneath that soil though…
https://tworivertimes.com/move-over-netflix-the-army-signal-...
Comment · 3 years ago
Reducing the likelihood of side channels through transparency is a worthy endeavor. But for RISC-V, adoption of Control Flow Integrity (CFI) and memory tagging capabilities will have far greater security impact for the vast majority of users.
Comment · 4 years ago
I asked this same question not long ago and the CEO of a well known company in this same research area reached out and recommended Veritas Genomics https://veritasgenetics.com/mygenome/
I’ve yet to finish the order process but I share this here because in my research of companies providing full sequencing services I never came across them and yet they seem far more reputable than others. Current SEO for these services turns up a lot of sketchy companies.
Comment · 5 years ago
Thank you Tom.
It’s a really exciting area of research.
Comment · 5 years ago
No it will still catch it if you access the 42nd byte with a read, but not if you write to any other byte first. Thats just a limitation of page faults and the information provided by userfaultfd.
Comment · 5 years ago
Correct, this technique works on a page by page basis. It's the only way to do it with userfaultfd as the technique relies entirely on the first page fault being a read and not a write. Im working on a feature that returns an allocation that straddles 2 pages to catch reads of structure paddings but it will come at the cost of an additional 4k of memory and/or possibly returning unaligned memory.
Comment · 5 years ago
I've gotten this feedback before. It's probably time to change it from #414141
Comment · 6 years ago
IsoAlloc author here. Thanks for reading the post and linking to the security properties. I plan to expand on those in an additional post and how I implemented them.
You're right that Electric Fence takes a different approach and is more geared towards finding bugs and isn't really suitable as a general purpose allocator. The easiest way to describe it is taking some allocations and placing them on their own page of memory, surrounding them with guard pages, and then setting the page PROT_NONE upon free so that any access results in a segfault. For a more modern attempt at this check out GWP ASAN which is doing something very similar but in Chrome across millions of installs https://chromium.googlesource.com/chromium/src.git/+/master/...
As for the allocator in glibc, a lot of its internal data structures either live on the same pages as user chunks or write meta data to free chunks. So using aggressive strategies like page permissions to protect that data is often not an option.
Comment · 8 years ago
When in doubt just assume Mark Dowd found it first http://taossa.com/index.php/2007/01/03/attacking-delete-and-... (dead link) but see here too http://www.blackhat.com/presentations/bh-usa-07/Dowd_McDonal...
Comment · 8 years ago
I used to teach a training on the subject (all the course material is now free at https://github.com/struct/mms). I had a section on ‘where to look’ for vulnerabilities. I started this section off with a scenario: “You’ve checked out the Chrome tree. Where do you start? OK you want to find Javascript interpreter bugs. Whats the first piece of code in Chrome that sees untrusted Javascript?”. Its a trick question. The answer of course is the networking code or the TLS decryption code. But you’ve never go looking there for Javascript interpreter vulnerabilities. The pt of the thought exercise is to introduce the concept of manual taint analysis. Basically understanding how to analyze what code paths and data structures your untrusted inputs could influence or control and then go from there.
Comment · 9 years ago
Sure. First name dot last name at gmail
https://struct.github.io https://secure.dev