Interesting articles

Blog: Hacking myself to prove a point

Binary OS security (process with full user permissions OR root) is becoming a big problem. If you get execution on desktop OS as the user running it, it is all over.

Developers run lots of untrusted code during their work. While browsers sandbox untrusted code (with many security issues), developers run untrusted code directly.

OS design from 70' is not helping here.

If only we had Plan9 today, each application has it's own namespace (like docker on Linux), that can be arbitrarily nested without root privileges.  Plan9 does not need root at all since there is no global namespace state to manage (all is per process); on Linux/UNIX you need root to manage namespaces (file systems/VFS, networks, processes etc.).

Another nice aspect of Plan9 in this context would be its ability to transparently run computation on separate computers over network. You can trivially run compilation on compilation farm, separated from your PC. This could be used to mitigate such vulnerability.

Project: z-tokens -- Random tokens generation and related tools

Cool project to generate random tokens and asses their binary brute force cracking resistance.

Blog: Alan Kay on “Should web browsers have stuck to being document viewers?” and a discussion of Smalltalk, NeWS and HyperCard

Funny how computer graphics, documents, web pages etc. come from printing standards and all have PostScript in common in one way or another.

Also the idea that if you can't describe something with data flexibly enough then instead of data describe it with a DSL that gets executed at the target device.

We have been moving from data to programs on the web for many years now. In printing this has happened early on and persisted to this day. Does that mean that JavaScript (or WASM) will eventually replace HTML and CSS entirely one day?

Also it explains why PostScript (and also font) processing is such a security nightmare (try finding secure PDF reader). Should we use JS/WASM sandboxes for PostScript the same way we use them in the web browsers?

OS: MenuetOS is an operating system for PC, written fully in assembly language

Like MS-DOS and many before it. I should explore this a bit on a VM.

Serverless Speed: Rust vs. Go, Java, and Python in AWS Lambda Functions

Serverless Speed: Rust vs. Go, Java, and Python in AWS Lambda Functions

Takeaways

Rust Lambda setup

// main.rs
use lambda_runtime::{run, service_fn, Error, LambdaEvent};
use rusoto_core::Region;
use rusoto_s3::{S3Client, S3};
use serde::{Deserialize, Serialize};
use tokio::io::{AsyncReadExt, AsyncBufReadExt};

#[derive(Deserialize)]
struct Request {
    bucket: String,
    key: String,
}

#[derive(Serialize)]
struct Response {
    req_id: String,
    msg: String,
}

async fn handle_request(event: LambdaEvent<Request>) -> Result<Response, Error> {
    let started_at = std::time::Instant::now();
    let client = S3Client::new(Region::UsWest2);

    let output = client
        .get_object(rusoto_s3::GetObjectRequest {
            bucket: bucket.to_string(),
            key: key.to_string(),
            ..Default::default()
        })
        .await?;

    let Some(body) = output.body else {
        return Err(anyhow::anyhow!("No body found in S3 response").into());
    };

    let body = body.into_async_read();
    let body = tokio::io::BufReader::new(body);
    let decoder = async_compression::tokio::bufread::ZstdDecoder::new(body);
    let reader = tokio::io::BufReader::new(decoder);

    let mut lines = reader.lines();
    let mut num_log_events = 0;
    while let Ok(Some(mut line)) = lines.next_line().await {
        let _value = unsafe {
            simd_json::to_borrowed_value(line.as_mut_str().as_bytes_mut())?
        };
        num_log_events += 1;
        if num_log_events % 1000 == 0 {
            println!("num_log_events={}", num_log_events);
        }
    }

    let msg = format!(
        "elapsed={:?} num_log_events={}",
        started_at.elapsed(),
        num_log_events
    );
    Ok(Response {
        req_id: event.context.request_id,
        msg,
    })
}

#[tokio::main]
async fn main() -> Result<(), Error> {
    tracing_subscriber::fmt()
        .with_max_level(tracing::Level::INFO)
        .init();

    run(service_fn(handle_request)).await
}

Build:

# build.sh
cargo lambda build --release --arm64
(cd ./target/lambda/lambda_langs_test_rust/ && zip ./bootstrap.zip ./bootstrap)

Deploy:

aws lambda create-function \
--function-name lambda_langs_test_rust \
--runtime provided.al2 \
--memory-size 640  \
--architectures arm64 \
--zip-file ./bootstrap.zip \
--handler unused \
--timeout 900 \
--role ${LAMBDA_IAM_ROLE}

Run:

aws lambda invoke \
  --function-name lambda_langs_test_python \
  --log-type Tail \
  --cli-binary-format raw-in-base64-out \
  --payload '{"bucket": "<s3_bucket>", "key": "<s3_key>"}' \
  ./response.json \
| jq -r .LogResult | base64 --decode

execline - script language to rely entirely on chain loading

Idenity management: Kanidm

Written in Rust. Suse sponsored. OCID, Yubikey etc. 

Rust in Perspective

The ambition of Rust is, as I perceieve it, and whether the people driving it even knows it or not, to finish what the ALGOL committe as primus motor started in 1958, and what the Garmisch NATO conference concluded was necessary in 1968: to develop a language for systems programming that rely on formal logic proof, and to fulfil what ALGOL never could, what Pascal never could, and what the whole maybe-not-700 functional programming languages never could: a language that joins the disciplines of computer science and software Engineering into ONE discipline, where the scholars of each can solve problems together.

The Rise of Worse is Better

Early Unix and C are examples of the use of this school of design.

Unix and C are the ultimate computer viruses.

Seizing the means of computation

Companies will treat you how they can get away with treating you. And if they can find a way to make money by treating you like the product, they will. And if you think giving them money will make them stop, you're a sucker.

Comprehensive Python Cheatsheet

Small Operating Systems

gemini://ew.srht.site/en/2023/20231109-re-small-operating-systems.gmi

A Brief History & Ethos of the Digital Garden

A newly revived philosophy for publishing personal knowledge on the web