• 0 Posts
  • 191 Comments
Joined 1 year ago
cake
Cake day: January 3rd, 2024

help-circle




  • It’s you can modify the settings file you sure as hell can put the malware anywhere you want

    True. (But in case it amuses you or others reading along:) But a code settings file still carries it’s own special risk, as an executable file, in a predictable place, that gets run regularly.

    An executable settings file is particularly nice for the attacker, as it’s a great place to ensure that any injected code gets executed without much effort.

    In particular, if an attacker can force a reboot, they know the settings file will get read reasonably early during the start-up process.

    So a settings file that’s written in code can be useful for an attacker who can write to the disk (like through a poorly secured upload prompt), but doesn’t have full shell access yet.

    They will typically upload a reverse shell, and use a line added to settings to ensure the reverse shell gets executed and starts listening for connections.

    Edit (because it may also amuse anyone reading along): The same attack can be accomplished with a JSON or YAML settings file, but it relies on the JSON or YAML interpreter having a known critical security flaw. Thankfully most of them don’t usually have one, most of the time, if they’re kept up to date.














  • Today I learned the term Vibe Coding. I love it.

    Edit: This article is a treasure.

    The concept of vibe coding elaborates on Karpathy’s claim from 2023 that “the hottest new programming language is English”,

    Claim from 2023?! Lol. I’ve heard (BASIC) that (COBOL) before (Ruby).

    A key part of the definition of vibe coding is that the user accepts code without full understanding.[1] AI researcher Simon Willison said: “If an LLM wrote every line of your code, but you’ve reviewed, tested, and understood it all, that’s not vibe coding in my book—that’s using an LLM as a typing assistant.”[1]

    Did we make it from AI hype to AI dunk in the space of a single Wikipedia article? Lol.


  • research papers that require a strong background in mathematics and cryptography to understand and implement.

    Lol. I guess that makes sense. Outside of school, we hope that all authentication will be implemented only cryptography experts anyway.

    Could you maybe suggest some resources on this topic?

    Not really, sorry. I’m not aware of anyone creating resources for your situation.

    Or should I choose a simpler project?

    For some context, cryptography isn’t even usually implemented “completely correctly” by experts. That’s part of why we have constant software security patches.

    If I were in your shoes, I guess it would depend on my instructor and advisors.

    If I felt like they have the skills to catch mistakes and no time to help correct mistakes, then I would just choose a simpler project. If they’re cool with awarding a good grade for a functional demo, I might just go for it.

    I guess I would take this one to an advisor and get some feedback on practicality.