happyPersonR

Shout out to the author, it seems coherent.

I like flamegraphs

I know folks use perf to help generate them

But in the future, now that Llm is here, get and agent to check assembly, PMUs and also see what you’re doing in assembly.

My 2c and happy coding to everyone :)

The entire issue with this is the dmca and not being able to share what is RE’d from the US.

So much more would be possible were this the case.

That being said… I’m not sure it should be illegal to share this re’d code.

And at the very least … just take it and rewrite what it does in rust lol.

Might not be clean room but hell, if it works.

I’ve gotten good mileage out of binary patching in trampolines lol

And adding in kernel shims.

The only part that’s missing that would probably help is tossing in more storage and moving logs off of root lol.

This is cool stuff !!

Would love to see what other things could benefit from this beyond storage. Maybe like BT or similar wireless.

I’m hoping with RE everything, for at least consumer IOT products we’ll get to a point where we can just get rid of a lot of the need for ipv4 for home.

What’s left are just apps and devices that people don’t wanna change out but are probably pwnd and I don’t think are gonna get updates because the teams that wrote the software moved on and the companies don’t wanna keep spending on sustaining.

lol “we don’t feel like following the law so we just picked some fresh dog poop and yelled about bad things that were unrelated and then did whatever we want and invented these funny little games with paper thin jokes everyone is going to pretend is valid so we could do whatever we wanted to anyway lol”.

Yeah those exist… the trouble being we need something that doesn’t exist

There needs to be a service that does reproducible builds of opensource projects as they sit and publishes results for people to scrape freely.

To be robust itself against attacks, likely 3-4 services.

But then that needs funding to be sustainable … and companies are incredibly cheap. Especially right now. As such… shrug :(

Maybe something as a skill for LLMs to run that actually checks build reproduction from source for a project and all of its dependencies? But then that’s gonna burn some tokens ….

I do this for personal projects … but at work they’ve started rationing tokens… as such… idk?

This software should be rewritten until it has no dependencies other than the compiler. Like it should use no libraries at all other than crypto.

Also put it in rust ….

My advice for everyone…. If you have to buy a new one …

just never connect it to the internet.

Wait 6 months or 6 days

And then root it till you own it for real.

Just used slopbro and did all 3 in my place. Kept on Ethernet point to point connected to my laptop until I had verified I had everything and every packet explained.

(Shout out slopbro and everyone else!!)

Getting Llm + ghidra to check every and document every binary, etc and make sure startup to a running system is understood, logs are rotated properly.

After this … all 3 will probably run one giant rust binary from startup lol

For anyone that can read this, if you have one connected to your network, change your WiFi password and don’t update your devices or bring them on the internet until you pwn/root them yourself.

From here out … everything only via tailscale and nothing should be able to connect inbound. Setup some firewalls.

Do you know if they found a “safe” bmi? Like is it 25-30 ? Or

We need something external that actually checks to see if source code matches built artifacts, and also possibly something Llm based that checks to see if you’re making checked in code vulnerable or directly adding something malicious.

I’d imagine there were probably fixes for critical CVEs that were included …. A lot of companies are on a 24 hour timeline to get them out.

Yeah those devices also need to be “opened up” as it were. Some of them already have been. Just think about it like fermented whiskey. Leave them alone for a month or two until they run an opensource firmware you control.

If you just take them offline you can do this without having to rush.

Just change your WiFi password, don’t give them the new one and don’t update them lol.

Yeah, api useage

But I figure they would just say “no” when you exhaust the tokens you have

A lot of people in opensource projects put their heads in the sand, and didn’t want to deal with all of the stuff coming out of LLM assisted code. This is a much better idea. We were always short of hands to help build things … and shorter still of hands to review things, or to even decide what a competent gate was for a feature.

This is much more useful.

Projects and developers and maintainers using LLM to review all of the code and the original specs for the architecture to make sure it makes sense and to find things that are just flawed or half baked or “now that we have Llm is this really all you can do?”

I’m actually kind of excited to see more Llm structure in a project as a given for things like Linux, Postgres etc, things that make it possible to find problems early … further left. Actually higher standards for what constitutes code that’s pushed for a project.

We need this bad in the open source world.