The unreasonable effectiveness of component taxonomies in Vuln Mgmt
Flaws exist in things
Jon’s blog
Just a tourist in a dream.
Latest posts
An LLM blog post
Large language models are all the rage these days. Everyone’s working on them (or else 😰) and they’re showing up in everything. I have not been a fan though I do see the appeal of natural language programming, boiler plate free development, and of capturing the expertises of transient humans. That said, I get the sense that the hype is coming less from the theory, design, or scale behind…
How and why we index vulnerabilities
Preliminaries
Parsing semver values from CVE records
Preliminaries
A minimal samba share with SELinux
Time off and new toys I recently got myself a raspberry pi in trade for a sauce pan and had to come up with a use for it. In struggling to come up with a use a basic samba share came to mind. Now, I used to be a sysadmin and do this sort of thing for a living and thought this would be a simple exercise in memory recall. It was not quite so stright forward.
Stop DOSing yourself
Deep in the woods Some time ago a colleague of mine was working on a problem with a license server we run and had asked me for help. He was trying to determine why some license checkouts to the server would be connect and checkout without incident and others would timeout. Some background; we dealt with a good amount of third party, close source code in order to run our customer workflows and…
The one line that allocated 5 megabytes of memory
Preamble Recently at work our primary piece of web code was hit with a memory leak. We all panicked of course, but then we all took a hard look at what was going on. This blog post doesn’t cover that memory leak, but covers another memory hog I found while digging into things.
Exploring x509 by creating a toy PKI
PKI and x509 I’ve had a good opportunity this week to play with PKIs at work and after reading a number of poorly sourced and downright incorrect posts I felt that I should make a post to summarize my experiences. First off what is a Public Key Infrastructure (PKI)? Broadly speaking a PKI is system that allows for the creation and distribution of public keys. In a PKI you tend to have certificates…
Porting test vectors with sed and awk
Intro Lately I’ve been working on a port of some C reference crypto code to rust for the gimli lightweight cipher and I wanted to make a quick post on some sed and awk which made helped me make part of the test suite.
So you need a logging pipeline
You have chosen or have been chosen to implement a logging pipeline So, some event has occurred within your organisation and now you need a logging pipeline. What do you do? Where do you begin? Most people come to holistic logging from some shock event like a hack event, a catastrophic failure, or some external requirement. Whether you’re reading this as a result of something tragic or simply…