sibomots

Keybase proof

I hereby claim:

• I am sibomots on github.
• I am sibomots (https://keybase.io/sibomots) on keybase.
• I have a public key ASDGY8oKxx4rNBb3x2gmKElZh1P34AABqnUYr-z0x9PC5go

To claim this, I am signing this object:

sibomots

The code used in Arduino is very C-like.
What trips people up is exactly how the underlying system invokes your code.
You're essentially writing two functions. setup and loop.

The platform of Arduino, will come out of reset and then invoke the setup function ONCE.
then the Platform of Ardruino will call the loop function repeatedly over and over as fast as it can.

What people do (by mistake) is put a while(1) { ... } loop inside the loop function.
They think they need to run an infinite loop themselves. T hey do not need to do that. Let Ardruino call loop for you as fast as it can repeatedly.

sibomots

Log4J CVE Advisory

The Problem

Log4J has a feature called Java Naming and Directory Interface (shortened to JNDI in this document), which allows a Java program to reach out to an external source to gather data.
If you put a section of text containing ${jndi:query} into the log, the Log4J library will try to resolve the query.
This can be combined with the Lightweight Directory Access Protocol (LDAP) to connect to a remote server.

However, because JNDI is built for retrieving data, and JNDI is a Java program, if you put a JNDI query using LDAP into a log, it will connect to the given site, download a file, and then execute it.
This is called Remote Code Execution.

sibomots

#!/bin/bash

tmux new-session -d bash
tmux split-window -h bash
tmux send -t 0:0.0 "vmstat 2 2000" Enter
tmux send -t 0:0.1 "top" Enter
tmux -2 attach-session -d