server_bot

While this seems like a convincing case, at what point is it morally acceptable to produce new art derived from existing work?

Would it have been fine if Capcom had re-created near identical patterns without use of the book's original digital files? It's a reference book after all.

Not saying Capcom should profit without crediting the original artist. But visual art remixing textures feels more grey area to me than copy/pasting code or someone's writing.

We should encourage PL experimentation and welcome new languages!

But keep in mind that cost of entry for production usage these days is a full suite of tooling (package manager, code formatter, language server for IDEs, etc).

I didn't see a standout feature in this article on Grain that made me think the manpower investment in developing the language and tooling is worth it, but I could be wrong!

Firmware isn't necessarily more difficult than other areas, every domain has serious challenges. But firmware programming has the kind of challenges that require a very deep technical background, something almost impossible to build in an X-week boot camp:

- Insane debugging: you have to debug extremely low-level failures with very limited visibility (e.g. no operating system to catch your segfaults) and proprietary or complex tools.

- A hard language made harder: C is difficult to get right, but embedded C (no dynamic memory, lots of bitwise operations for MMIO register writes, targeting exotic architectures, etc) is even more difficult.

- Extreme constraints: The products you work can have constraints like safety certification, minimal power utilization, or ultra low latency response. Meeting those constrains often means having to deeply understand hardware.

Nope. But you should check out Embedded Artistry[1], its the single best resource I've seen on a field that's mysterious even to most professional programmers.

Have you spent any time doing Arduino projects? While not representative of real-world firmware work, Arduino is very accessible/cheap and will teach your transferable skills (e.g. C programming for interfacing with HW). I'd encourage you to really put some time in before you commit to anything embedded - because the amount of jobs and the range of companies you can work at is much, much lower than "mainstream" development (say, building web applications).

[1] https://embeddedartistry.com/beginners/

Hmm...I think a lot of this discussion is missing two important points:

1. Regardless of whether or not C++ is going away, your team needs help now. You have an opportunity to get up to speed and add value in the present. That could pay off in social capital, promotion, or just plain old appreciation of your efforts.

2. Say you don't care about your team's needs at all (for the sake of argument, I'm sure you do!). Learning C++ will teach you concepts and patterns that can help you be a better engineer, even if you move on to Rust later (which IMO will be C++'s replacement for new projects eventually). Growth happens outside your comfort zone, this could be a good growth opportunity.

Thanks! You're right about the PC, misread the table.

Thanks for the suggestion! Unlike uxn, there's a C compiler for ZPU: https://github.com/zylin/zpugcc

Love the idea of a minimal retro VM, had a chuckle at the single-byte program counter. Hope this catches on and there's a software ecosystem.

Does anyone know of a list of quirky VMs like this one?

The Pico-8 comes to mind since it's also a fantasy console, but wondering if there are other esoteric emulators - maybe even ones that had real-world use at some point.

Given Ghidra's [1] decompilation support, emulation (CPU via PCODE IR, not whole-system) support, headless analysis scripting API, and the active open-source contribution/issue community - I find it hard to justify other static RE tooling.

Any thoughts on why I would choose Rizin over Ghidra?

[1] https://ghidra-sre.org/

A mature take, I applaud the author for overcoming "commitment bias" and being willing to make a change. The lack of a cloud SDK for thier provider seems crippling in hindsight.

Wish them well with whatever the replacement language becomes!

Nice high-level breakdown without pushing one moral stance or another, just focusing on the business-side facts.

I always wonder about the employee-side of the equation - since the pool of job candidates that can hold a government security clearance is small realative to the pool of skilled engineers, what are the implications for hiring/retention/culture for teams that do defense work?

Did you read the same post I read? One of the harassers asserted that she must have traded sexual favors for a CS degree. Do you seriously believe that a male engineer would be sexualized and discredited that aggressively?

Please take some time to reflect. Look up statistics on sexual assault and violence against women. This is not an attempt to bait clicks, its an attempt to stand up against systemic attack.

Sad day, she was a champion of the people - a fighter for both women's rights and civil rights. Her iconic status was earned. Would recommend the 2018 documentary "RBG" for anyone interested in her life and career.

I feel like choosing between the two for a new project comes down to one factor: do you truly need to maximize performance? Be honest.

If yes, Rust: no GC, consider the rayon crate for concurrency. Higher learning curve, ecosystem may not be as mature for certain areas yet (outside of web assembly).

If no, Go: lower learning curve, runtime-managed concurrency, more ecosystem maturity for most enterprise software tasks.

Fun article! I'd add that malware packers are a good example of an obscurity layer that's typically effective in practice.

But food for thought: in the general case you can't reliability predict the efficacy of an obscurity mechanism, so you never know if it's an actual layer of defense or a placebo.

Looking at the certificates homepage [1], this seems like a great entry point into the tech industry for people that might otherwise be excluded - practical skills to perform a job, not a replacement for the theory and rigour of an expensive 4 year Computer Science or Computer Engineering education (but how many entry level tech jobs REALLY require that background anyway?).

My name-brand-school Master's degree makes me want to resist this sort of thing to justify my own ego. But I've worked with great people who were self-taught, so if this credential helps motivated self-starters get thier foot in the door and launch a fulfilling career, I'm all for it!

[1] https://grow.google/certificates/

I love how whimsical this is, made me smile! It's refreshing to see a silly hack that isn't also performative self-promotion.

These are valid questions a lot of people new to Rust have, so:

1. Rust is "backward compatible" in the sense that Rust code can use C libraries and C code can use Rust libraries - both ways via CFFI [1]. Security gaurentees only apply to the Rust code.

2. We've tired static and dynamic analysis of C to find security bugs for decades, there has been a plethora of research and commercial tools in the space. None fix the problem like Rust does [2].

[1] https://michael-f-bryan.github.io/rust-ffi-guide/ [2] https://msrc-blog.microsoft.com/2019/07/18/we-need-a-safer-s...

I have the older Stab Lab model (Mk III) and have never owned a MacBook Air, but Googling the newest versions of both:

Star LabTop Mk IV [1]:

Thickness: 0.58 inches (1.48 cm)

Weight: 2.2 pounds (1 kg)

MacBook Air [2]:

Thickness: 0.63 inch (1.61 cm)

Weight: 2.8 pounds (1.29 kg)

[1] https://starlabs.systems/pages/labtop-mk-iv-specification

[2] https://www.apple.com/macbook-air/specs/

I replaced my older XPS with an Ubuntu 20.04 laptop from Star Lab systems. Mostly because I wanted firmware updates via apt-get. They have a new model coming out: better CPU, more RAM, more disk for the same price point as the XPS.

https://starlabs.systems/pages/labtop-mk-iv

The top-end XPS will be a more powerful system, but if you're gonna budget - worth considering. Build quality is excellent, have had no issues.

Would highly recommend the "Advent of Computing" podcast episode on this topic: http://adventofcomputing.com/?guid=3a1d7af237bb48bb985e795c2...

Thanks for pointing that out and linking through to a great resource!

Good intro to the benefits of Rust for a broad audience, but one important omission: the Use-After-Free and Double-Free protection he mentioned is provided by compile-time static analysis, but Rust also does runtime bounds checks to prevent classic stack smashing (with minimal performance overhead).

That may not seem like a big deal for the x86_64 world where modern mitigations largely make shellcode a thing of the past (hence heap exploitation, ROP/JOP, etc) but it is a BIG DEAL for embedded microcontrollers that lack OS/HW memory protection - an area where #![no_std] Rust shines.

As a security researcher and not a developer, let me be very frank: you should STRONGLY consider Rust in place of C or C++. But know that release profile builds don't do integer overflow checking, so don't get cocky :P

I don't know of any discussion forums, but would recommend the following resources for learning:

Accessible (at least compared to more formal texts) lecture notes: http://www.cs.cmu.edu/~aldrich/courses/17-355-18sp/

Free book that's more readable than "Principles of Program Analysis" by Nielson et al: https://cs.au.dk/~amoeller/spa/

Some practical resources for binary PA: https://reversing.io/resources/

For C/C++:

This should help you get started with AFL and more traditional security research workflows:

https://www.ixiacom.com/company/blog/how-use-fuzzing-securit...

Consider DeepState for a more development-focused workflow, akin to writing unit tests:

https://github.com/trailofbits/deepstate

Good list, but missing CONFIG_CPU_SW_DOMAIN_PAN (https://cateee.net/lkddb/web-lkddb/CPU_SW_DOMAIN_PAN.html).

Are you sure that you should be focusing on your lecture style/content?

I recently graduated from a top tier CS school that emphasizes systems programming (C/C++, OS concepts, embedded systems, etc) and found that the overwhelming majority of learning happens when working through implementations and actually writing code (10+ hrs/week). Lectures (2-3 hrs/week) are really just a supplemental overview of concepts, the quality of a course is largely a function of the quality/rigor of the projects – the exception may be courses for students new to CS, who need lectures to understand fundamentals.

Well designed projects with detailed writeups, built-in tests, and live scoreboards created an effective curriculum. As did factoring program performance (runtime, memory utilization, cycle count, etc) into the grade (in addition to correctness).

Really appreciate your willingness to take feedback and your desire to improve, especially given that you already have a wealth of experience. Your students are lucky to have you! Best of luck.

Obviously it's biased, but the Radare site has a comparison table with "IDAPro demo" (i.e. the older IDA Free, v5.0), maybe it will be updated soon: http://rada.re/r/cmp.html

I can't really complain, this is definitely an improvement, but there's still no IDAPython support for scripting - just the archaic IDC :(

Indeed! It's my favorite technical book, several of the chapters have information I've yet to find laid out in comparable detail anywhere online.

The book was written for a CS course (15-213) at Carnegie Mellon University, course materials here (supplement, but no replacement for the book): https://www.cs.cmu.edu/~213/