Recent content on 0x21
At this year’s MRMCD , I had the pleasure of giving a workshop on self-restricting software . In particular, I started with a primer on software privileges, followed by software self-hardening methods without the need for extended permissions. Regular readers of this weblog (just me, I guess) might know what to expect. Since it was a workshop and not a presentation, there was an interactive…
There are a few quite interesting utilities in the Go Tools collection, golang.org/x/tools . One of these is the slide presentation software present . $ go install golang.org/x/tools/cmd/present@latest If you have watched any Go presentations in the past, there is quite a chance you have already seen present in action. For example, many of Rob Pike’s talks are using present , e.g., his talk…
After I started writing about techniques to let software drop privileges, I realized that there is way more to say than I first anticipated. To be able to finish the previous posts, I made many compromises and skipped some topics. This became especially clear to me after finishing my last post on Privilege Separation in Go , which became very Linux-leaning. While I introduced common POSIX APIs and…
Almost three weeks ago, I gave a talk on privilege separation in the Go programming language at FOSDEM 2025 . In my talk, I was foolish enough to announce two blog posts, one I had already written and this one. After a few evenings where I found the time to work on this post, it is finally done. The previous Dropping Privileges in Go post dealt with the privileges a computer program has. Usually,…
Computer programs may do lots of things, both intended and unintended. What they can do is limited by their privileges. Since most operating systems execute programs as a certain user, the program has all the user’s precious privileges. To take a concrete example, if a user has an SSH private key laying around and runs, e.g., a chat program, then this program is able to read the private key…
While the golden age of huge platforms offering RSS feeds may be over, lots of webpages still have feeds, especially niche blogs. Over the years, I have tried many RSS readers, but have always given up because they did not work for me. However, by switching to the more obsucre sfeed , I found a workflow that worked (and flowed) for me. Why RSS and what for? But before getting into it, I think I…
For quite some time I have been on the lookout for a cheap, small virtual server for one or two toy projects. My unspoken requirements were the ability to install OpenBSD, having IPv6, and that the hoster is not completely shady. While lowering the bar for “cheap”, picking all three seems to become quite difficult. Unfortunately, since most hosters use some Linux QEMU/KVM stack…