steakejjs

Lcamtuf notably found several ELF Parsing bugs in file, that appeared may have been exploitable.

The work he has been doing with AFL and googles big fuzz farm, focusing on utilities that are used daily without thought is insanely important, imho

The first way I did it was just read the file, parse the json, check for nulls, and print. Then I piped this to a file. That is too boring though.

The next way I did it was with Vim replaces. There might be sexier ways of doing this?

1) A big replace to get rid of all the junk.

    %s/\%Vemail.*creditcard/creditcard/g

2) A big replace to fix nulls in the credit card

    %s/\%V.*creditcard.*null.*//g

Then I could either change my code to not check for nulls or keep cleaning up this data until I have a CSV.

This Vim flow is the exact thing I do every week or two at work when building the Chrome HSTS preload list into our product. Anyone know the sexier ways to make this really really fun?

I should note to those not super familiar with vim that may try this, my vim commands are over a visual block (the json string), since this was in the same file as my code.

It might be extremely valuable for Google to prompt you, while riding in your driverless Tesla, to make a stop at a Krispie Kreme on your way home.

What if you are an experienced engineer talking to another experienced engineer ?

Seems to me if someone writes bad code when they SHOULD be writing good code, code-shaming might be in order.

I'm all for being nice and understanding. Everyone programs at a different level and I may not write code that is as good as I think, but some code is just obviously bad...and constructive criticism (if willing to be accepted) might help

Nginx and net/http has worked wonderfully for me. Nothing fancy is necessary.

They are technical.

Brushing up on:

K&R - The C Programming Language

K&P - The Unix Programming Environment

K&P - The Practice of Programming

Kerrisk - The Linux Programming Interface (Not light reading)

Even though it is mostly review, reading code and seeing commands that K&R&P run has actually helped my workflow, code quality, etc.

Highly recommend re-reading if it has been a while. Even things like variable names have noticeably improved since beginning re-reading.

And, the Linux Programming Interface....is huge. There's always more to learn in there.

Google has a big fuzz-farm and Project Zero looking for this type of thing and even they did not find Heartbleed years ago. They are nabbing tons of bugs but there are many that are simply buried.

This seems to me a bit like when you do a maze starting from the finish and it is, for whatever reason, trivial to go from one end to the other.

It is neat that it is 2015 and fuzzers are cool again, though.

The new stuff happening in the PHP space is really really awesome.

HHVM + HACK + XHP is an entirely different experience compared to writing PHP. Code can actually be very clean and lots of bugs can be found that may have previously gone unnoticed + performance benefits.

Just wanted to say FB is doing an exceptional job with these projects.

Sounds like we were always on the same page...

I never said an attacker can't do this. I'm saying an attacker can't do a s/https/http and have a user end up at an HTTP login page, where the attacker can sniff credentials.

Relay what credentials from the HTTP connection ? There are none...

It sounds like you are talking about creating a phishing page and injecting it, hoping the user enters their credentials, and stealing them. I already said this was possible.