[RSS] A Deep Dive into JS Trusted Types Violations

https://bughunters.google.com/blog/5850786553528320/a-deep-dive-into-js-trusted-types-violations

Hyperlight is a library for creating micro virtual machines — or sandboxes — specifically optimized for securely running untrusted code with minimal impact.

https://github.com/hyperlight-dev/hyperlight

It supports both Windows and Linux, utilizing Windows Hypervisor Platform on Windows, and either Microsoft Hypervisor (mshv) or KVM on Linux.

#hypervisor #virtualization

“HKEY_CURRENT_USER. You will never find a more wretched hive of scum and villainy.”

@joxean As I see there are several ...Demangler classes under the Features directory along with wrapper scripts too that demonstrate their use. If you need help translating this Java->Python lmk!

Anybody knows how to demangle a string, not a symbol, in #Ghidra using Python?

@joxean This seems useful: https://hwreblog.com/9.1/api/ghidra/app/util/demangler/DemanglerUtil.html#demangle(java.lang.String) ?

[RSS] How Does #Linux Direct Mapping Work?

https://u1f383.github.io/linux/2025/02/27/how-does-linux-direct-mapping-work.html

been reminded of this several times this week and not in a nice way

@mttaggart My point is that since Mozilla is not in adtech (yet) their TOS will necessarily differ from ones (everyone else?) that are.

[RSS] Sidekick in Action: Finding Vulnerabilities in dnsmasq

https://binary.ninja/2025/02/26/sidekick-in-action-finding-vulnerabilities-in-dnsmasq.html

@mttaggart do other browser have similar business models? I mean if you are in adtech you will use different terms because you do want to collect and use data.

Mozilla has updated their press release with the following clarification:

UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of the basic functionality of Firefox possible. Without it, we couldn’t use information type into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice.

https://blog.mozilla.org/en/products/firefox/firefox-news/firefox-terms-of-use/

That is good to hear, but their reasoning makes no sense given that no other browser uses that language.

Firefox now has Terms of Use! This'll go over like a lead balloon.

You give Mozilla all rights necessary to operate Firefox, including processing data as we describe in the Firefox Privacy Notice, as well as acting on your behalf to help you navigate the internet. When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox.

https://www.mozilla.org/en-US/about/legal/terms/firefox/

RIP Michelle Trachtenberg, thanks for all the laughs :(

@mttaggart @Viss Sure, these are just my personal priorities that I try not to confuse with universal axioms :)

@mttaggart @Viss Yeah that too, although I don't find that feature as significant as search.

Majority are backfilled CVEs from 2021/2022, with someone randomly providing "affected since" commits of introductions of drivers for ones without Fixes tags.

524 new Linux kernel CVEs today, 7 newly-rejected

I got another #NameThatWare for you all. This time, lets try something new.
Its quite hard to make a challenge that is both accessible and challenging at the same time. So now, I will post multiple pictures. The first in this post is the 'hard' level. If you are not an expert, look at the 2nd picture that will be behind a CW. There is also a 3rd picture for easy-mode.

As always, try to write down you observations and deductions behind a CW to not spoil it for others.

@briansmith https://web.archive.org/web/20240114184648/https://www.openssl.org/~bodo/tls-cbc.txt ?