Readit News logoReadit News
eyalitki commented on Project Zero – Policy and Disclosure: 2025 Edition   googleprojectzero.blogspo... · Posted by u/esnard
eyalitki · a month ago
Not sure what is the measurable metric here, and what will be considered a success in this trial period.

Propagating the fix downstream depends on the release cycles of all downward vendors. Giving them a heads up will help planning, but I doubt it will significantly impact the patching timeline.

It is highly more likely that companies will get stressed that the public knows they have a vulnerability, while they are still working to fix it. The pressure from these companies will probably shut this policy change down.

Also, will this policy apply also to Google's own products?

eyalitki commented on The .a file is a relic: Why static archives were a bad idea all along   medium.com/@eyal.itkin/th... · Posted by u/eyalitki
benreesman · a month ago
`pkg-config` works great in just about any standard scenario: it puts flags on a compile and link line that have been understood by every C compiler and linker since the 1970s.

Here's Bazel consuming it with zero problems, and if you have a nastier problem than a low-latency network system calling `liburing` on specific versions of the kernel built with Bazel? Stop playing.

The last thing we need is another failed standard further balkanizing an ecosystem that has worked fine if used correctly for 40+ years. I don't know what industry expert means, but I've done polyglot distributed builds at FAANG scale for a living, so my appeal to authority is as good as anyone's and I say `pkg-config` as a base for the vast majority of use cases with some special path for like, compiling `nginx` with it's zany extension mechanism is just fine.

https://gist.github.com/b7r6/316d18949ad508e15243ed4aa98c80d...

eyalitki · a month ago
If someone needs a wrapper for a technology, that modifies the output it provides (like meson and bazel do), maybe there is an issue with said technology.

If pkg-config was never meant to be consumed directly, and was always meant to be post processed, then we are missing this post processing tool. Reinventing it in every compilation technology again and again is suboptimal, and at least Make and CMake do not have this post processing support.

eyalitki commented on The .a file is a relic: Why static archives were a bad idea all along   medium.com/@eyal.itkin/th... · Posted by u/eyalitki
flohofwoe · a month ago
Library files are not the problem, deploying an SDK as precompiled binary blobs is ;)

(I bet that .a/.lib files were originally never really meant for software distribution, but only as intermediate file format between a compiler and linker, both running as part of the same build process)

eyalitki · a month ago
Yeah, but when the product is an SDK, and customers develop on top of it (using their own toolchains) there isn't a lot left for me to play with.
eyalitki commented on The .a file is a relic: Why static archives were a bad idea all along   medium.com/@eyal.itkin/th... · Posted by u/eyalitki
jhallenworld · a month ago
On the private symbol issue... there is probably a solution to this already. You can partially link a bunch of object files into a single object file (see ld -r). After this is done, 'strip' the file except for those symbols marked with non-hidden visibility- I've not tried to do this, maybe 'strip -x' does the right thing? Not sure.
eyalitki · a month ago
1. "Advanced" compilation environments (meson) probably limit this ability to some extent. 2. Package managers (rpmbuild for instance) mandate build with debug symbols and they do the strip on their own so to create the debug packages. This limits our control of these steps.
eyalitki commented on The .a file is a relic: Why static archives were a bad idea all along   medium.com/@eyal.itkin/th... · Posted by u/eyalitki
lokar · a month ago
Also, don’t use automatic module init, make the user call an init function at startup.

And prefix everything in your library with a unique string.

eyalitki · a month ago
Agree, there should be a prefix. But if 2 of my dependencies didn't use a prefix, why is it my fault when I fail to link against them?

Also, some managers object to a prefix within non-api functions, and frankly I can understand them.

eyalitki commented on Adding 16 kb page size to Android   android-developers.google... · Posted by u/mikece
eyalitki · a year ago
RHEL tried that in that past with 64KB on AARCH64, it led to MANY bugs all across the software stack, and they eventually reverted it - https://news.ycombinator.com/item?id=27513209.

I'm impressed by the effort on Google's side, yet I'll be surprised if this effort will pay off.

eyalitki commented on CrowdStrike admits faulty content update wasn't tested on a real machine   theverge.com/2024/7/24/24... · Posted by u/eyalitki
eyalitki · a year ago
Rapid Content Update file (detection signatures) are tested on the cloud side "Content Validator" which had a bug and didn't detect the issue with the faulty file. No where in the post mortem to CrowdStrike mention that these files are actually being tested on a real machine where the issue would have been detected. On top of that, they blame they software bug in the Content Validator.
eyalitki commented on Lessons from Securing FreeRDP   eyalitkin.wordpress.com/2... · Posted by u/eyalitki
eyalitki · 2 years ago
FreeRDP's recent version (3.0.0) contains a new security mechanism aimed at blocking information-leak vulnerabilities. Said fix would have blocked more than 50% of the info-leak vulnerabilities discovered in the project since 2018, which are 28% of all vulnerabilities in FreeRDP

The article describes the technical background about the "Reverse RDP" attack vector, the software design flaw in FreeRDP and the security patch that was integrated into the project (and that took 2 years to get officially released to the public).

u/eyalitki

KarmaCake day155February 15, 2019
About
Former vulnerability researcher (@EyalItkin). https://eyalitkin.wordpress.com/
View Original