It's the same chip, renamed (which is silly) after the Broadcom IoT division was bought by Cypress, which is bought by Infineon. So technically, it's the Infineon CYW43455 (formerly Broadcom BCM43455).
Several large bare-metal hosting companies. Not over the open Internet, but that doesn't matter if the management networks are shared and the price of admission a single server rental.
I would be concerned for e.g. Hetzner dedicated servers. They assumedly PXE-boot consumer grade UEFI hardware that is unlikely to have a dedicated management interface. Exploitability would depend on how well they filter ICMP within their network.
It's a pretty common setup on servers, even if it's not the majority. Probably more commonly it's part of the boot sequence on servers even if it's not used. I would say this is a relevant issue for most organizations' network security because of the risk it represents of being able to escalate from compromising a less privileged machine (e.g. a user's device) to a more privileged machine. It's not a 'oh god every server is going to be pwned' issue, but it doesn't need to be to be worth alerting people to.
It's always fearmongering when it comes to "vulnerabilities" that affect the model of locking down computing devices.
This shit used to confuse me so hard when I was learning security. It seemed that articles were talking about something really important, but I just couldn't connect it to anything I knew. Then I realized they weren't talking about security for users, but rather security from users - and for entities ultimately looking to restrict users (the same inversion-of-authority as TSA propaganda). Hence the syndrome of acronym hell, as that amount of overabstraction is required to motivate a system for its own purposes.
Now given that this is a network exploit, you've got to adapt my model a bit from above - my framing is most clear when talking about local "exploits" in locked down bootloaders etc. But from an individual security perspective here? If you've disabled the network stack in your BIOS (because why the hell is it there in the first place), OR put any management interfaces on their own network unreachable from anything that isn't trusted to be managing, this is an utter nothingburger.
IMHO this is one of the OSes with the weirdest decisions I've seen on here. I do agree with using PE instead of ELF, as the dynamic linking situation of the latter (and Unix-likes in general) is, to put it bluntly, a horrid mess.
The POSIX functions are split over ucrtbase, iphlpapi, and ws2_32, as on Windows, with anything that Windows doesn't implement put in mnposix.
LOL. POSIX in ucrtbase! Those are words that I never expected to see together.
I used AI to help with the mechanical parts of porting
I feel like it won't be long before someone comes up with a crazy chimera of an OS that can run DOS, Windows, Linux, BSD, and macOS binaries. It doesn't look like AI is replacing software developers, but rather boosting them quite significantly; there seems to be a lot of activity and new projects I've seen recently from many who aren't even using AI themselves, but must be somehow being inspired by others to do more.
As historical note, not all UNIXes use ELF, not only that came later in UNIX and related clones evolution, some of them like z/UNIX and Aix have gone for a PE like format, COFF.
So in those platforms you can also enjoy having private symbols by default, delayed loading on first call, and the joy of import files.
> it won't be long before someone comes up with a crazy chimera of an OS that can run DOS, Windows, Linux, BSD, and macOS binaries
TBF, the only missing part of this is that Darling isn't developed enough to run many Darwin programs; otherwise you can have that today by installing WINE+DOSBox+Darling on Linux or your pick of *BSD or illumos. (Well, running *BSD programs on other systems is a weak point, but otherwise.)
I once ported the runtime of my toy L98 compiler from Intel to AT&T syntax, it was enough as a learning exercise I don't plan ever to repeat, the reasoning was to only depend on GAS.
Alone the mental exercise to always convert into official documents and AT&T syntax isn't worth the trouble.
It's very common to use GDB with Asm, but only when combined with some plugins. Nowadays this is mostly done when reverse engineering software, or when testing low-level memory corruption exploits.
The screenshots of this popular gdb plugin are a good example: pwndbg.re/stable/features
I've been writing a lot of assembly over recent months (the runtime routines for a lisp compiler, and of course debugging the generated assembly my compiler emits itself).
Mostly all I do is run a backtrace from the segfaults, and otherwise single-step through the code to verify my assumptions.
Turbo Assembler!!! I think that was pretty much the standard in the demoscene, at least in my circles. I wrote most of our DOS demos with it. Anything that ran in real mode, doing all the wild things like modifying code loaded already in memory... Then for actual 32-bit code (using protected mode) watcom c+asm compilers became the go-to. I still hand rolled some assembly, but with the advent of Pentium processors, their pre-fetch and dual pipeline execution watcom C did a fairly good job to compile highly efficient/optimised code, so asm coding mostly went away. (did use it later professionally for microchip controller programming though) As for nostalgia, I'd rather pick up a virtual console nowadays. The limited resolution, colours, etc. gives enough mental exercise without going back to x86 asm. :)
Wrote a few small utilities in Win32 in the early 90s; still use them today unmodified, but most recently in WINE. I have some slightly older DOS utilities that are also quite usable.
I think another important point that AI is revealing is how diverse the population's preferences are. Legacy entertainment is nowhere as precisely tailored, because it tries to appeal to a wide audience.
Personally, all the Harry Potter AI shorts recently have been rather amusing, although they also vary significantly in detail and wit.
> Legacy entertainment is nowhere as precisely tailored
In some instances, it's even engineered to be broadly appealing. See Disney and Marvel.
On the other end of the spectrum, we have niche-specific creators who appeal to specific genre fans and can package their own tone and taste. That's actually really cool.
It's kind of like what happened to music. Electronic music, the DAW, and home recording opened the avenue for indie artists and all of the various genres.
I'm an experienced reverser, and have been doing it for decades, but I think it's great that LLMs have brought this power to everyone and the old gatekeepers are being made irrelevant. IMHO the ones who are complaining about it were always just seeking fame and fortune, not freedom and user empowerment. Like I said in another comment recently, I don't think Stallman ever anticipated this development, and that his focus on "open source" was always misguided.
Incidentally I've also been writing Z80 and x86 Asm for roughly as long, and saw the complaints about "compiler slop" (we didn't call it that) at the time. I could probably still beat one if I wanted to, but clearly "close enough is good enough" and there's so much useful software which would not have been created if compilers couldn't exist and everyone still had to write machine code using a hexpad.
Edit: got any counterarguments? It's not like I won't get a boost from using LLMs either.
You can outcode the compiler but ofc that's not a way to go with tens of thousands of instructions and so on. LLMs are just much faster in writing code, just like compilers are much faster at assembling all the functions.
And yes, in a roundabout way, this is Stallman's dream fulfilled to the tip with his printer driver ;)
Many of these people wanted a project to run and gatekeep the people "not worthy enough" to hack on it or to use it. That's changing now, everyone can prompt together a bunch of crap. Fun fact I think I've got like... probably more than ten people into C++ programming simply by helping them prompt AI on how to get started, then they've picked up actual skills along the way. Note, they weren't any kind of programmers before because code is scary, but with a much lower barrier of entry, many more people can do stuff. It's amazing to see.
The flip side is when you see someone who has never interacted with a community before come in and drop a big announcement written in Claudish about some new port they just released (with a ko-fi link already set up of course), you kinda feel like they're the ones chasing fame and fortune.
In the modding community I'm most active in, counter-strike, I have seen someone come in and literally ask if there was money in it and if not what game would be best to make mods for to make some money.
Many compression formats support static dictionaries, and for a good reason. Short messages don't compress well. If you know a bunch of common data for a context, you can make the first several kilobytes compress a lot better.
reply