Collaborate Disseminate
From reproducible-builds.org:
Reproducible builds are a set of software development practices that create a verifiable path from human readable source code to the binary code used by computers.
In general, it means that… Continue reading What are the security trade-offs of using reproducible builds?
On a droplet, when Lynis reports that compilers have been found, I’ve been unable to determine which compilers it means exactly. I’d like to remove these. How can I?
There is another thread, but the “how to find which compil… Continue reading Lynis Indicates Compilers
We received a bug report (phrased as a security issue) for a program, which stated that when the program creates files on disk, it does not first verify if a symbolic link exists at the file path to be created. Because of tha… Continue reading Should programs check for symlinks before creating files?
I would like to ask, what does “secure” compiler/interpreter realy means, what is the formal definition that can describe “secure” compiler/interpreter, is there anything like that?
What are the consequences of allocating and then populating an extremely large buffer in C? Can a stack have a maximum size and if so what are the security mechanisms that enforce this.
We don’t use a GUI IDE, but if we did, it would most certainly be something along the lines of [Martin]’s embedded-IDE project. We’ve always felt that most IDEs are just fancy wrappers around all the tools that we use anyway: Makefiles, diff, git, ctags, and an editor. [Martin]’s project makes them less fancy, more transparent, and more customizable, while retaining the functionality. That’s the hacker’s way — putting together proven standard tools that already work.
The code editor he uses is QScintilla, which uses clang for code completion. The “template” system for new projects? He uses …read more
There seems to be a consensus, that
-D_FORTIFY_SOURCE=2 -O1
is a hardening measure that should be applied as compiler option. This was also a recommendation in the Dovecot Pentest Report.
What I’m confused about is, that… Continue reading Are Optimization Flags Harmful?
I want to make a little programming puzzle on my website. There’s going to be a task. The user will be asked to upload a C++ source file with their solution. The file should be compiled, run with some input and checked if it … Continue reading What security measure one should implement before executing user uploaded files?
I want to control the function pointer in the bss segment, I have a buffer for that purpose but can’t get to place it before the function pointer, is that a security mechanism alike the stack-protector that I have to disable … Continue reading bss buffer overflow
Somewhat hidden among athletes, actors, and musicians, three giants of technology have been aptly named as 2016 Presidential Medal of Freedom recipients. Grace Hopper, Margaret Hamilton, and Richard Garwin all made significant contributions to the technology that envelops our lives and embody the quest for knowledge and life-long self learning that we’d like to see in everyone.
Rear Admiral Grace Hopper’s legacy lies with the origins of computer science. She wrote the first compiler. In a time when computers were seen more as calculating machines than easily adaptable frameworks she looked to the future and made it happen. She continued …read more
Continue reading Grace Hopper, Margaret Hamilton, Richard Garwin Named for Medal of Freedom
