https://security.apple.com/blog/pcc-security-research/
侍
Why didn’t they?
Do you have any evidence this is actually happening to good faith security researchers? There are many examples of Microsoft and other large corporations treating security researchers well. Microsoft hosts BlueHat,…
Can’t find the pdf, but it’s all related to the zentool stuff: https://github.com/google/security-research/blob/master/pocs... Tavis spells it out there pretty quickly: “ The simplest instructions (add, sub, mov, etc)…
I saw the paper from Google last year and thought something in it aligned with not everything running through the microcode engine, though I could be wrong.
I believe only some parts of Jazelle are handled in hardware, though I don’t know if anybody has got their hands on any of the bits of the software side. I do know there’s documentation on handling unimplemented…
Most of the time. But sometimes, no. See ATL thunk emulation (last I checked, still alive in the windows kernel) and ntvdm handling of the BOP pseudoinstruction. See also: Jazelle DBX. Hell, on modern x86 processors,…
I agree there’s a big divide. I think I’m also team “let people do things they enjoy.” I like using computers to solve problems. I’m more interested in the problem being solved than the journey most of the time, though…
Can you look at code today and predict what assembly a compiler will output to some high degree of accuracy? Do you avoid certain classes of compiler optimization so you can more accurately predict compiler output? I…
I agree with this, but I’m also curious: what would have to change before that advice is as sound as “write a little bit of assembly by hand” or the even more ridiculous “just write the raw bytes for the program in a…
Yea, but Galen’s a beast so it might actually happen.
If I asked a human assistant to do this and it came back with that level of research, I’d be pretty disappointed.
This doesn’t seem true. Doesn’t LSASS cache credentials for 30 days?
Did you try making small changes to your phd proposal to see if it opened up new paths? </fuzzingjoke>
I was quite impressed as well.
https://chatgpt.com/share/66fd5ca8-1810-8005-a9b5-70ee11bdb8...
Trail of Bits if you want it done right.
Explain why it’s a huge mistake, please.
Did you learn to write or draw without studying the samples of artists and authors before you?
gnunits*
That’s DARPA’s bread and butter. They’re a research org, not a productization org.
Yes. Most of the work is not done in the DARPA building. Generally federal contractor sites. The daily work in the building is phone calls, reviewing papers, email, building powerpoint slides, and trying to come up with…
Program Managers are fixed term - up to 3 2 year terms (though Director Tompkins generally doesn’t like PMs to be around longer than 4 years - see section 1101 of the Strom Thurmond NDAA for more details about the…
Yes. https://developer.apple.com/documentation/virtualization/run...
https://security.apple.com/blog/pcc-security-research/
侍
Why didn’t they?
Do you have any evidence this is actually happening to good faith security researchers? There are many examples of Microsoft and other large corporations treating security researchers well. Microsoft hosts BlueHat,…
Can’t find the pdf, but it’s all related to the zentool stuff: https://github.com/google/security-research/blob/master/pocs... Tavis spells it out there pretty quickly: “ The simplest instructions (add, sub, mov, etc)…
I saw the paper from Google last year and thought something in it aligned with not everything running through the microcode engine, though I could be wrong.
I believe only some parts of Jazelle are handled in hardware, though I don’t know if anybody has got their hands on any of the bits of the software side. I do know there’s documentation on handling unimplemented…
Most of the time. But sometimes, no. See ATL thunk emulation (last I checked, still alive in the windows kernel) and ntvdm handling of the BOP pseudoinstruction. See also: Jazelle DBX. Hell, on modern x86 processors,…
I agree there’s a big divide. I think I’m also team “let people do things they enjoy.” I like using computers to solve problems. I’m more interested in the problem being solved than the journey most of the time, though…
Can you look at code today and predict what assembly a compiler will output to some high degree of accuracy? Do you avoid certain classes of compiler optimization so you can more accurately predict compiler output? I…
I agree with this, but I’m also curious: what would have to change before that advice is as sound as “write a little bit of assembly by hand” or the even more ridiculous “just write the raw bytes for the program in a…
Yea, but Galen’s a beast so it might actually happen.
If I asked a human assistant to do this and it came back with that level of research, I’d be pretty disappointed.
This doesn’t seem true. Doesn’t LSASS cache credentials for 30 days?
Did you try making small changes to your phd proposal to see if it opened up new paths? </fuzzingjoke>
I was quite impressed as well.
https://chatgpt.com/share/66fd5ca8-1810-8005-a9b5-70ee11bdb8...
Trail of Bits if you want it done right.
Explain why it’s a huge mistake, please.
Did you learn to write or draw without studying the samples of artists and authors before you?
gnunits*
That’s DARPA’s bread and butter. They’re a research org, not a productization org.
Yes. Most of the work is not done in the DARPA building. Generally federal contractor sites. The daily work in the building is phone calls, reviewing papers, email, building powerpoint slides, and trying to come up with…
Program Managers are fixed term - up to 3 2 year terms (though Director Tompkins generally doesn’t like PMs to be around longer than 4 years - see section 1101 of the Strom Thurmond NDAA for more details about the…
Yes. https://developer.apple.com/documentation/virtualization/run...