In 2015 I performed an offensive security analysis of Redis, focusing on its Lua scripting capabilities and related execution environment. This post contains a brief summary of my findings, which at the time have been reported and discussed with project maintainers.
Recent days have been full of news and emotions, with many sad events and a few happy ones. On the last days of February 2022 I got shocked by the beginning of a new deadly war in Ukraine, but also got an unexpected FLOSS-related email from the Google Open Source Peer program .
This page contains a blameless retrospective analysis on CVE-2020-10781 , from the point of view of the reporter ( me ). This analysis has NOT been externally reviewed and may be biased/incomplete; private feedback and corrections are welcome!
This post explains some low-level details related to nRF52 Debug Access Port (DAP) protection.
This post briefly describes a useful trick to execute binaries across different mount-namespaces. It consists of a neat technique involving setns(2) and fexecve(3) .
This post contains a quick summary describing how this website is actually made, and how it evolved over time.