Yet another random hacker
I recently added a b2 remote to one of my nixos systems. I found some docs recommending a systemd service but this felt like the wrong abstraction. So I opted to turn that into a systemd mount. In the spirit of “let’s write a blog post so that I don’t forget”, here’s how to do it. Here’s the nix module. Replace the contents of let with your configuration. I’m mounting a b2 bucket, but this should…
I made a tree-sitter plugin for dune files. It is available on GitHub . Tree-sitter is a parsing system that can be used in text editors. Dune is a build system for OCaml projects. Its configuration language lives in dune files which use a s-expression syntax. This makes highlighting challenging: the lexing part of the language is very simple (atoms, strings, parentheses), but it is not enough to…
This article has been first published on the Tarides blog . AFL (and fuzzing in general) is often used to find bugs in low-level code like parsers, but it also works very well to find bugs in high level code, provided the right ingredients. We applied this technique to feed random programs to OCamlFormat and found many formatting bugs. OCamlFormat is a tool to format source code. To do so, it…
Hello! It’s 2016, it’s November, and apparently it rhymes with #NaBoMaMo 2016, the National Bot Making Month. I made a bot! . Full disclosure: it’s actually 2017, but I started writing this in 2016 so it’s OK. Also I’m not actually from the US, but I’ll relax the definition a bit and let’s pretend it means International Bot Making Year. Close enough! Bots are all the rage - Twitter bots, IRC bots,…
This is a minimal example reproducing a bug I found in html2text . Suppose we have configuration module, a library that uses the configuration, and a main function. # config.py default = False # lib.py import config def f(x = config.default): print x # main.py import config import lib config.default = True lib.f() The main function sets the configuration, then calls f . One would expect that the…
Every year, as part of the SSTIC conference , there is a forensics/reverse engineering challenge. I participated in the 2015 edition. Though I did not manage to complete it, I made an emulator for the exotic ST20 architecture, which is probably worth describing here. Some programs will loop. It’s OK. Note that this emulator is not really optimized for pure speed. In the actual challenge I actually…
Abstract: I released Secret Santa Creator , a free website to organize events where every participant makes a gift to a random other one. To do that I learnt Ruby on Rails in a week and it was awesome. As usual I put the source on Github . Every year I take part in Secret Santa: within a group of friends, everyone has a “target” to whom he has to make a gift. There are several techniques to…
Like many, I noticed a common pattern in the past few years: software authors publishing instructions to download and install their program from their website, directly in the terminal, through a variant of curl URL | sh . Since I think that it should be considered bad practice, I created a tumblr called “ curl | sh ” which lists occurrences of this pattern. I would like to address some of the…
Abstract: I transform a Playstation/parallel port converter to USB. This includes finding the pinout of the previous circuit, making an AVR toolchain work, and writing the firmware. Some bugs are found, and fixed. The result is open source. Do you pine for the days when people were people and wrote their own device drivers? Some days are still like that, you just have to take the opportunity.…
Right now, Debian Jessie is frozen, and in a fairly good shape. The amount of RC bugs is low, which means that the release should be “quite” near (“when it is ready”). It is a good time to make a summary of my contributions during this release cycle. New packages in Debian For Jessie I have added no less than 6 new packages to the archive. subliminal is a tool to automatically download subtitles…
TeX is a very primitive language. Everything is dynamic, even parsing. This explains in part why it’s so long to compile. It also means that it’s very flexible : it’s possible to define your own control structures. Here is a small explanation of an implementation of a “switch” macro I made last year. It is released as part of my discotex library (a collection of macros, really). We want to define…
Hindley-Milner type systems are in a sweet spot in that they are both expressive and easy to infer. For example, type inference can turn this program: let rec length = function | [] -> 0 | x::xs -> 1 + length xs into this one (the top-level type 'a list -> int is usually what is interesting but the compiler has to infer the type of every subexpression): let rec length : 'a list -> int = function |…
I like to have /home on a separate partition. But sometimes it can backfire. If the root partition is full, you don’t have a lot of solutions. In particular, I found that debian-installer’s “automatic partitioning” sometimes creates very small root partitions. If you want to install big packages (ghc, eclipse, libreoffice, …), a 16GiB root partition is not enough. In the past, filesystems were…
Of monads and comonads This post is written in Literate Haskell . This means that you can copy it into a .lhs file 1 and run it through a Haskell compiler or interpreter. Today we’ll talk about… import Control.Comonad import Control.Monad Comonads ! They are the categoric dual of monads, which means that the type signatures of comonadic functions look like monadic functions, but with the arrow…
The Stripe CTF 2.0 is over ! Massive props to Stripe for this great edition. I was stuck on level 5 but here is a humble writeup. Level 0 : the Secret Safe The first level is a web application written in node.js that holds a password in a SQLite database. The error is in following line : var query = 'SELECT * FROM secrets WHERE key LIKE ? || ".%"' ; “LIKE” interprets its argument as a regular…
I recently changed my login shell to use zsh instead of the venerable bash . I am still wondering why I didn’t make the change earlier. Zsh’s infamous slowness almost not perceptible, at least with the default configuration. One cool feature present in zsh is the notion of suffix alias (described in zshbuiltins(1) ). Quick example : $ alias -s pdf=evince $ filename.pdf … will open filename.pdf…
Introduction Algebraic Data Types, or ADTs for short, are a core feature of functional languages such as OCaml or Haskell. They are a handy model of closed disjoint unions and unfortunately, outside of the functional realm, they are only seldom used. In this article, I will explain what ADTs are, how they are used in OCaml and what trimmed-down versions of them exist in other languages. I will use…
EBCDIC, ASCII & the power of legacy … and no, that’s not a movie title. As you know, all your computer knows about is numbers, yet when you type on a keyboard, a character appears on your screen. This is thanks to character encodings. There are several norms that defines how characters (ie, glyphs) are encoded into numbers. Besides dinosaurs such as EBCDIC , the “classic” way of encoding is ASCII…
So, the recent trend seems to be static blogging. Indeed, as a web application, a blog is mostly read-only. By generating static .html files, one can eliminate : CPU load : static content is what’s easiest to serve, especially with modern servers using sendfile(2) . security issues : without dynamic page generation, the attack surface is also vastly reduced. Authentication is moved from a PHP or…
blog :: IO () blog = putStrLn "Hello, world !" This is my first attempt at blogging, I still don’t know what to expect. I will probably write about the following topics : Programming, especially using functional languages . Development of the Debian operating system. Static analysis of software. Computer security. Like some of my friends , I decided to use a static blog generator. The first series…