zwp

The spec (RFC 7250, "Using Raw Public Keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)") suggests DANE/DNSSEC as a mechanism to bind identities to public keys (section 6).

https://datatracker.ietf.org/doc/html/rfc7250

Will this really be simpler?

Comment · 1 year ago

We already have Macaroons

https://en.wikipedia.org/wiki/Macaroons_(computer_science)

https://en.wikipedia.org/wiki/Macaroon

Comment · 2 years ago

And Layer Cake

Comment · 2 years ago

There was a sense of "wasting a port". A modern Linux /etc/services has only 200 or so reserved TCP ports (out of a possible ~50k) so that fear might have been overblown.

I suspect the bureaucratic overhead of needing to go to IANA to reserve a new port might have had a chilling effect. See:

  https://www.iana.org/protocols/apply

  https://www.iana.org/form/ports-services

Comment · 2 years ago

> you are supposed to still continue if you strictly follow the standard

Which standard? RFC 3207 (for STARTTLS over SMTP), 2002, says: "If the client receives the 454 response [TLS not available], the client must decide whether or not to continue the SMTP session".

Comment · 2 years ago

    def execute(f)
      f.call "test response"
    end

    perform = TOPLEVEL_BINDING.method(:execute)

    perform.call Kernel.method(:puts)

Comment · 2 years ago

You still need to pull out the paths?

A sprinkling of grep/perl (awk/sed/ruby/...) is mostly good enough eg:

strace -e trace=%file cat /etc/passwd 2>&1 >/dev/null | grep ^open | grep -Po '(?<=").*(?=")'

Comment · 2 years ago

You can use "-e trace=open" to trace only open(2) calls

Alternatively "-e trace=%file" to get all file-related system calls (will catch eg failing pre-emptive checks using access(3) -> stat(2)).

Comment · 3 years ago

> whatever "SSH-2.0-SSHD" is (the authors don't know either)

I think this is from the j2ssh/maverick SSH server, used in a bunch of enterprisey Java products.

https://jadaptive.com/en/products/java-ssh-server

https://github.com/sshtools/j2ssh-maverick/blob/ce11ceaf0aa0...

Comment · 3 years ago

Tangential question: there is one reason to use NODELETE in the dlopen(3) man page: https://man7.org/linux/man-pages/man3/dlopen.3.html

  RTLD_NODELETE (since glibc 2.2)
    Do not unload the shared object during dlclose().
    Consequently, the object's static and global variables
    are not reinitialized if the object is reloaded with
    dlopen() at a later time.

Are there any other times when it's beneficial to use NODELETE?

Comment · 3 years ago

The PDF ("sec23summer...") has metadata creation/modification timestamp of 20221004165319Z (October 2022). So presumably the paper was written last October and released for Usenix 2023.

(Reference [12] is from Usenix July 2022. See "Prior work" in the introduction).

Comment · 4 years ago

Slightly silly sketch (bash):

    sqlite-utils create-table ~/commands.db commands id integer text text --pk id
    PROMPT_COMMAND="( fc -n -l -1 | perl -p -e 's/^\s+//; chomp if eof' | sqlite-utils insert --text ~/commands.db commands - & )"

It's slow, has perl & python external deps, needs a timestamp column, call subshell to avoid job control messages, ...

A nicer single "prompt command" wrapper is certainly possible though.