thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

alvinhochun

Control Flow Guard (CFG/CFGuard) for mingw-w64

Control Flow Guard is a security mitigation that verifies the target address of indirect calls. It works by having the compiler insert a check at indirect call sites to verify the validity of the call target, and also the linker write the necessary data and flags into the PE/COFF image to enable the feature on Windows' end.

johanthoren

FROM clojure:lein AS build

# TODO: Make sure to replace "foo" with actual value before running this!
ENV BIN_NAME="foo"

# The current versions to build against:
ENV MUSL_VERSION="1.2.2"
ENV ZLIB_VERSION="1.2.11"
ENV GRAALVM_VERSION="21.2.0"

Morendil

Note: this content is reposted from my old Google Plus blog, which disappeared when Google took Plus down. It was originally published on 2016-05-18. My views and the way I express them may have evolved in the meantime. If you like this gist, though, take a look at Leprechauns of Software Engineering. (I have edited minor parts of this post for accuracy after having a few mistakes pointed out in the comments.)

Degrees of intellectual dishonesty

In the previous post, I said something along the lines of wanting to crawl into a hole when I encounter bullshit masquerading as empirical support for a claim, such as "defects cost more to fix the later you fix them".

It's a fair question to wonder why I should feel shame for my profession. It's a fair question who I feel ashamed for. So let's drill a little deeper, and dig into cases.

Before we do that, a disclaimer: I am not in the habit of judging people. In what follows, I only mean to condemn behaviours. Also, I gath

mmozeiko

//

struct TerminalCell
{
    // cell index into GlyphTexture, should be two 16-bit (x,y) values packed: "x | (y << 16)"
    uint GlyphIndex;

    // 0xAABBGGRR encoded colors, nonzero alpha for Foreground indicates to render colored-glyph
    // which means use RGB values from GlyphTexture directly as output, not as  ClearType blending weights
    uint Foreground;

rrika

// clang++
//   -x hip
//   test.cpp
//   -O3
//   --cuda-gpu-arch=gfx1010
//   --hip-device-lib=dummy.bc
//   --hip-device-lib-path=path_to_dummy_bc
//   -nogpuinc
//   -fuse-ld=lld
//   -fgpu-rdc

Mefistophell

Question: I want to compile my Rust source code for the Windows platform but I use macOS.

Solution:

1. Install target mingw-w64: brew install mingw-w64
2. Add target to rustup: rustup target add x86_64-pc-windows-gnu
3. Create .cargo/config
4. Add the instructions below to .cargo/config

[target.x86_64-pc-windows-gnu]

pervognsen

A quadratic space is a real vector space V with a quadratic form Q(x), e.g. V = R^n with Q as the squared length. The Clifford algebra Cl(V) of a quadratic space is the associative algebra that contains V and satisfies x^2 = Q(x) for all x in V. We're imposing by fiat that the square of a vector should be the quadratic form's value and seeing where it takes us. Treat x^2 = Q(x) as a symbolic rewriting rule that lets you replace x^2 or x x with Q(x) and vice versa whenever x is a vector. Beyond that Cl(V) satisfies the standard axioms of an algebra: it lets you multiply by scalars, it's associative and distributive, but not necessarily commutative.

Remarkably, this is all you need to derive everything about Clifford algebras.

Let me show you how easy it is to bootstrap the theory from nothing.

We know Cl(V) contains a copy of V. Since x^2 = Q(x) for all x, it must also contain a copy of some nonnegative reals.

pervognsen

import numpy as np

def plu_inplace(A):
    P = np.arange(len(A))
    for i in range(len(A)):
        j = i + np.argmax(np.abs(A[i:, i]))
        P[[i, j]], A[[i, j]] = P[[j, i]], A[[j, i]]
        A[i+1:, i] /= A[i, i]
        A[i+1:, i+1:] -= np.outer(A[i+1:, i], A[i, i+1:])
    return P, A, A

pervognsen

# Tensor product contractions with Einstein's summation notation. Examples:
# Matrix-matrix multiply is tensor(A, 'ij', B, 'jk')
# Matrix-vector multiply is tensor(A, 'ij', v, 'j')
# Matrix trace is tensor(A, 'ii')
# Matrix transpose is tensor(A, 'ji')
# Matrix diagonal is tensor('i', A, 'ii')
# Inner product is tensor(v, 'i', w, 'i')
# Outer product is tensor(v, 'i', w, 'j')
def tensor(*args, **kwargs):
    result = ''