lvh's blog
My takeaways from the GraalVM 19.3.0 release notes : JDK code inlining support Optional JDK11 support Better Windows support These may not seem like much, but JDK code inlining fixes my one major niggle with native-image: it was too hard to get top-notch single-binary TLS, and now it just works. (There are lots of other great things that happened in this release! They're just not in parts of Graal…
Regex Crossword is a puzzle game to help you practice regular expressions. I wrote a program to solve them. You can find it on GitHub as lvh/regex-crossword . If you're on amd64 Linux, you can try the demo binary too . This blog post walks you through how I wrote it using logic programming. To me this game feels more like Sudoku than a crossword. When you solve a crossword, you start by filling…
Last year we did a blog post on interservice auth. This post is mostly about authenticating consumers to an API. That’s a related but subtly different problem: you can probably impose more requirements on your internal users than your customers. The idea is the same though: you’re trying to differentiate between a legitimate user and an attacker, usually by getting the legitimate user to prove…
Cryptography engineers have been tearing their hair out over PGP’s deficiencies for (literally) decades. When other kinds of engineers get wind of this, they’re shocked. PGP is bad? Why do people keep telling me to use PGP? The answer is that they shouldn’t be telling you that, because PGP is bad and needs to go away. There are, as you’re about to see, lots of problems with PGP. Fortunately, if…
(This is an introductory level analysis of a scheme involving RSA. If you're already comfortable with Bleichenbacher oracles you should skip it.) Someone pointed me at the following suggestion on the Internet for encrypting secrets to people based on their GitHub SSH keys. I like the idea of making it easier for people to leverage key material and tools they already have. The encryption…
The eslint-scope npm package got compromised recently, stealing npm credentials from your home directory. We started running tabletop exercises: what else would you smash-and-grab, and how can we mitigate that risk? Most people have an RSA SSH key laying around. That SSH key has all sorts of privileges: typically logging into prod and GitHub access. Unlike an npm credential, an SSH key is…
The Noise protocol is one of the best things to happen to encrypted protocol design. WireGuard inherits its elegance from Noise. Noise is a cryptography engineer's darling spec. It's important not to get blindsided while fawning over it and to pay attention to where implementers run into trouble. Someone raised a concern I had run into before: Noise has a matrix. N(rs): ← s ... → e, es NN: → e ←…
I’ve been working on some pickle security stuff. This is a teaser. Python pickles are extremely flexible: they can run essentially whatever code they want. That means you can create a pickle that contains a compressed pickle. The consumer doesn’t know if an incoming pickle will be compressed or not: the Pickle VM takes care of the details. To do this, we define a useful little helper class: class…
Default shells usually end in $. Unless you're root and it's #. That tradition has been around forever: people recognized the need to highlight you're not just some random shmoe. These days we have lots of snazzy shell magic. You might still su, but you're more likely to sudo. We still temporarily assume extra privileges. If you have access to more than one set of systems, like production and…
Modern applications tend to be composed from relationships between smaller applications. Secure modern applications thus need a way to express and enforce security policies that span multiple services. This is the “server-to-server” (S2S) authentication and authorization problem (for simplicity, I’ll mash both concepts into the term “auth” for most of this post). Designers today have a lot of…