https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns I read this blog post on the idea that we should use “dependency cooldowns” - the core concept is that by delaying when we install dependencies we’ll give more time to detect malicious dependencies. I think this is basically just not a very good idea. While it may be fine to say “don’t rush to install the latest…
I rolled my own crypto Disclaimer This code is not meaningfully tested or reviewed. It was about two hours of programming to get it done. I’m not releasing the code in-full because I really can’t hammer home enough how unusable this is. With that out of the way… blog post! So, I rolled my own crypto. I was feeling inspired and PSN is down and it’s cold out. I think the main thing I wanted to see…
Mitigations without Modeling Something that has been brought up for years is that mitigation techniques should not be built without a threat model. I agree with this premise, mostly at least, but I wanted to consider the alternative argument; if I truly believed that mitigations should be built without modeling, what would that look like? I believe that the argument would look like this; By…
Saving Firefox So once again the topic of Firefox’s decline has shown up on Hacker News. I want to give my opinion on the topic as a long-time Firefox user who switched to Chrome about a decade ago. I’m not an expert on browsers, and really I don’t think my opinion is that worthwhile - my relevant credentials are “someone who has thought a bit about browsers and one of billions who uses a…
The Cognitive Burden of Garbage Collection vs Move Semantics Many people feel that Rust’s borrow checker introduces too much cognitive overhead, and that it must therefore reduce productivity. This is something I strongly disagree with. In fact, I would argue that it reduces cognitive overhead by unifying memory and resource management. In Garbage Collected languages there is far more manual,…
I had some thoughts about capabilities. This is a very half assed post that I wrote up to get my thoughts out so that I could go back to work. OK so capabilities are cool. They’re essentially named tokens that, if you possess, give you some right. They can be delegated by telling someone about that name, which makes them very powerful. The “security” of a capability is enforced by the inability to…
Supply Chain Thoughts So there was a malicious crates.io package. No surprise there, malicious packages have been a thing for years and it was only a matter of time before one was discovered targeting rust. So what can be done about that? A number of things. (tl;dr at bottom, although tbh this is a short post) Reduce viable crate names. The vast majority of typosquatting falls under two…
Static Intersections With Pytype Python has had a static type system for quite some time as initially defined in PEP 484 (with additions in future PEPs). Types allow one to statically verify various aspects of a program - that a value conforms to some set of constraints (methods, property, assertions). The most popular and well known type checker for Python has been mypy, but an interesting…
I’ve been using Rust since just before it hit 1.0. Since that time the language has gotten considerably better; non-lexical lifetimes, impl Trait, async/await, compiler performance and error improvements, and more. In 2019 the big focus was async/await, or at least as an outsider that is how it has appeared. The end result looks like it will deliver what we’ve all been waiting for - efficient…
Detection and Response is all about data. Analysts collect many billions of logs every single day and store them, searching through the noise for some signal that might indicate malicious behavior. What has become obvious is that this collection of data is not slowing down at all - we’re instrumenting more services and systems all while companies are expanding their own asset inventories, or…
Grapl is a Graph based detection and response platform, but what does this workflow actually look like? What does Grapl do differently, and how does it all fit together? Grapl does a ton of work to get you the data you need in the best format for analysis, and provide the tools you need to understand your environment; it provides your logs with identity, it combines them together into a concise…
A detection and response (D&R) team’s attack signature queries are vital to their success, providing insight into suspicious behaviors occurring in their environment. Writing searches that can capture complex attacker behaviors, and ensuring that these searches are correct, are important responsibilities for a successful D&R team. Grapl takes a fairly different approach to building these queries…
I released the first Alpha version of Grapl in mid October, 2018. At that point Grapl was already over a year old, though development really started ramping up in the months leading up to that release. Months later, I spoke about Grapl at kernelcon, and transcribed the state of Grapl at the time here . When Grapl was first released it was already a powerful system, albeit with some rough edges.…
(This blog post is transcribed from a conference talk) (Original slides) Github: https://github.com/insanitybit/grapl Twitter: https://twitter.com/InsanityBit Grapl is an open source platform for Detection and Response (D&R). The position that Grapl takes is that Graphs provide a more natural experience than raw logs for many common D&R use cases. A graph is a data structure - like a linked list,…
Over the last few months I’ve been working on Grapl, a platform for DFIR built largely around graph structures. I wanted Grapl to be trivial to deploy, both because it would ease others’ work to get started with it, and because it’ll make my test cycle a lot faster. Grapl consists of around 7 Lambdas, some S3 buckets, SNS topics, SQS queues, and the connections and policies between them.…
Oftentimes when chasing down an alert I find myself asking the same questions: I know that a process is malicious, did it spawn any children? The process spawned children, what did they do? What spawned that first process? What created the binary file for the malicious process? Did these processes interact with the file system? Did they interact with the network? Answering these questions can be…
I’ve been continuing work on my rust actor library , which macro-magically turns synchronous structs into asynchronous actors. (Note that all examples are using branches of that project and not Master). For example, here’s a struct that stores a closure and, upon its ‘complete’ method being called, executes that closure. pub struct CompletionHandler < F > where F : Fn () + Send + Sync + 'static +…
Recently we had to solve a problem at work - we wanted to use AWS SNS topics to communicate in some of our services, but we also needed to selectively delay visibility/ processing of specific messages. In order to get delayed messages while still using SNS we developed a simple microservice that listens to an SQS Queue, grabs messages, and publishes the message to the appropriate topic. Because…
Recently I’ve been trying to extend my actor library, Aktors to deal with type safety. The current version relies heavily on the Any type, which has two serious problems: It means that your code is way slower than it needs to be - Any means dynamic dispatch all over the place You lose static type safety - you can send an actor a message that it can not handle What we want in an actor framework is…
(Don’t want to read? Jump to the end - there’s a tldr) Recently a post was written about Firefox’s local password database encryption. The post is appropriately titled Master password in Firefox or Thunderbird? Do not bother! , which I’ll certainly be getting back to soon. The tl;dr is that Firefox will SHA1 your master password and use that to encrypt your local database. This is purported to be…