@mjg59@nondeterministic.computer
@mjg59@nondeterministic.computer avatar

mjg59

@mjg59@nondeterministic.computer

Former biologist. Actual PhD in genetics. Security at https://aurora.tech, OS security teaching at https://www.ischool.berkeley.edu. Blog: https://mjg59.dreamwidth.org. He/him.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

mjg59, to random
@mjg59@nondeterministic.computer avatar

Extremely strong competition this year and very happy with the result

mjg59,
@mjg59@nondeterministic.computer avatar

Kind of feel that coming second to a team with @deviantollam and @Tarah is not a bad outcome

mjg59, to random
@mjg59@nondeterministic.computer avatar

Dystopian thriller novel concept: antagonist puts phone in airplane mode and turns off GPS but ends up having their movements tracked by extracting their Pixel's history of identified background music and cross-referencing against their victim's phone

mjg59, to random
@mjg59@nondeterministic.computer avatar

Flights to @emf booked, so time for the "Don't get arrested in England" challenge 2024 edition (flawless record so far)

mjg59, to random
@mjg59@nondeterministic.computer avatar

My annual plea for a thing: I want a type 1 hypervisor that just has a small isolated VM and then passes through the rest of the hardware to the main VM which runs Linux. The small VM is intended to be used to run small pieces of code that the main OS should not be able to interfere with. Does such a thing exist? (Think Xen, but with a Dom0 that can't see into DomUs)

mjg59,
@mjg59@nondeterministic.computer avatar

@hyc No, once you're in SEV-land you're not really in a good place to do hardware passthrough

mjg59,
@mjg59@nondeterministic.computer avatar

@hyc I'm fine with the hypervisor being able to see what's happening in arbitrary guests, but there needs to be isolation between the primary VM and the security VM (Hyper-V manages this fine in Windows land)

mjg59,
@mjg59@nondeterministic.computer avatar

@agraf My recollection is that Jailhouse does static partitioning and no scheduling, ie you need to give it a CPU? It also starts from Linux which makes it harder to sequester secrets that Linux can't get at.

mjg59,
@mjg59@nondeterministic.computer avatar

@bluca @l0kod Not quite the same - you still have Linux with the ability to see everything, I think?

mjg59,
@mjg59@nondeterministic.computer avatar

@baloo @hyc Potentially the TPM, but otherwise nothing - just CPU, RAM, and some sort of simple intra-VM communication channel.

mjg59,
@mjg59@nondeterministic.computer avatar

@agraf I'm pretty sure the lack of scheduling is a design choice that would need to be retrofitted. Launching from Linux is more about how it's managed, so that's probably an easier thing to fix.

mjg59,
@mjg59@nondeterministic.computer avatar

@jornfranke No, firecracker VMs are visible to the Linux host

mjg59,
@mjg59@nondeterministic.computer avatar

@baloo @hyc Right, you can do it the other way around with SEV, but that then leaves you with very restricted hardware support at the moment

mjg59,
@mjg59@nondeterministic.computer avatar

@noodles @hyc Some form of secret manager, at least

mjg59,
@mjg59@nondeterministic.computer avatar

@rzeta0 A hypervisor doesn't have to let a privileged VM see into other VMs - Xen allowing that for Dom0 is an artifact of their design rather than anything inherent. The primary Windows VM can't see into the Credential Guard VM, since the hypervisor has drawn a hardware-enforced barrier in between them.

mjg59,
@mjg59@nondeterministic.computer avatar

@rzeta0 Cryptography doesn't remove side channels - if you keep the secrets in a TPM but it doesn't use constant time operations, or if I'm able to monitor the power rails, that's not an absolute barrier. Very little is absolute - the level of security appropriate for a given problem will vary depending on what your threat model is, and I'm broadly ok with having my WebAuthn secrets in a separate VM running on the same CPU

mjg59,
@mjg59@nondeterministic.computer avatar

@noodles @hyc SEV is pretty much exclusive to server parts, and I have a laptop

pippin, to random

For a minute the last line made me doubt myself. But a quick test and no, I did remember right: at least on ext*, permissions are stored in the inode.
♲ nondeterministic.computer/

mjg59,
@mjg59@nondeterministic.computer avatar

@pippin apparmor MAC decisions are based on path, not inode

mjg59, to random
@mjg59@nondeterministic.computer avatar

I love it when I can just dump some RE notes on reddit and then someone writes an actually working library https://github.com/GoneUp/mask-go

mjg59, to random
@mjg59@nondeterministic.computer avatar

I'll be at Bsides SF this weekend, if anyone wants to say hi

mjg59, (edited ) to random
@mjg59@nondeterministic.computer avatar

STOP DOING HARDLINKS

INODES WERE NOT MEANT TO EXIST IN MULTIPLE DIRECTORIES

YEARS OF FILES yet NO REAL-WORLD USE FOUND for being in more than one directory

Wanted to reference files from more than one directory anyway? We had a tool for that: it was called "SYMLINKS"

"Yes please give me FIFTEEN paths that this file resolves to" - Statements dreamed up by the utterly Deranged

"Hello I would like different permissions on this file based on path" They have played us for absolute fools

mjg59,
@mjg59@nondeterministic.computer avatar

@cate Maybe our tooling should be better

mjg59,
@mjg59@nondeterministic.computer avatar

@wjt Oh no

mjg59, to random
@mjg59@nondeterministic.computer avatar

The idea that an inode has no idea which directory it's associated with was a mistake and I will take no questions

mjg59,
@mjg59@nondeterministic.computer avatar

@kithrup @rfc6919 opened-but-unlinked don't cause problems here, the two main issues are that you can't apply security policy based on path (one file may exist in multiple paths) and you can't look for notifications based on parent directory (if files have no canonical parent, how do you know to notify on modification?)

mjg59, to random
@mjg59@nondeterministic.computer avatar

I am, once again, attempting to figure out how the fuck Okta's API actually works

mjg59,
@mjg59@nondeterministic.computer avatar

@plambrechtsen Direct experience is that a lot of it doesn't work with normally scoped OIDC tokens, it's more aimed at different flows

mjg59,
@mjg59@nondeterministic.computer avatar

@plambrechtsen I literally can't open an external browser because of how Apple handles hardware backed key ownership

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • Leos
  • Durango
  • magazineikmin
  • InstantRegret
  • hgfsjryuu7
  • vwfavf
  • Youngstown
  • slotface
  • thenastyranch
  • ngwrru68w68
  • rosin
  • kavyap
  • PowerRangers
  • DreamBathrooms
  • anitta
  • khanakhh
  • mdbf
  • tacticalgear
  • cubers
  • ethstaker
  • osvaldo12
  • everett
  • cisconetworking
  • GTA5RPClips
  • modclub
  • tester
  • normalnudes
  • provamag3
  • All magazines
    •