[email protected]

software toolsmith — appsec, program analysis, automated bug finding

[email protected]

[[email protected] @bradlarsen]

Been on Twitter for nearly 14 years. Met a bunch of people here and even got jobs through Twitter. Moving on now though. Find me on Mastodon at [email protected].

[[email protected] @bradlarsen]

@_saagarjha @pcwalton Might be a proximal cause (i.e., a symptom of a deeper memory corruption problem)

[[email protected] @bradlarsen]

@geofflangdale Yes, for this application we want longest matches, not all matches. There is code in Nosey Parker's second stage to deduplicate all matches to the longest.

[[email protected] @bradlarsen]

Part of my work from the past year is now open sourced!

Nosey Parker finds hardcoded secrets in Git history and textual data with few false positives. It runs quickly, able to scan 100GB of Linux kernel source history in 5 minutes on a laptop.

https://t.co/HacUmSRsgG

[[email protected] @bradlarsen]

@geofflangdale I will have to measure and see if it helps or hurts!

[[email protected] @bradlarsen]

@geofflangdale I'm going to explore using SOM_LEFTMOST for the rules that we can, to get start locations from Hyperscan when possible. Should help Nosey Parker performance if I can get it working.

[[email protected] @bradlarsen]

@geofflangdale Also, several patterns we have fail to compile with SOM_LEFTMOST, so at present we don't bother trying to get start locations from Hyperscan. Being able to get that reliably would help us.

[[email protected] @bradlarsen]

@geofflangdale Nosey Parker also currently lacks any rule-level profiling at this point. I'm planning to add that eventually, which will give a much better picture of which rules are slower than others.

[[email protected] @bradlarsen]

This is a reimplementation of the regex scanner part of the internal version used at @praetorianlabs in offensive security engagements. That internal version has additional ML capabilities to suppress false positives and identify secrets without needing explicit rules.

[[email protected] @bradlarsen]

@pedrib1337 Static binaries make distribution much simpler

[[email protected] @bradlarsen]

every time someone suggests using pgp for comms i think of this

[[email protected] @bradlarsen]

@ESultanik @jfischoff Amazing!

Yes, node collision seems different than a hashquine.

I've recently been working with Git history; lots of graph traversal. I suspect that no one explicitly checks for cycles—that property is taken for granted. Everyone's graph traversals would break given a cycle.

[[email protected] @bradlarsen]

If you could do this, I bet you could craft a commit that would DoS github, gitlab, and every other piece of infrastructure that deals with Git

[[email protected] @bradlarsen]

I wonder how feasible it would be to make a Git tree object that included itself as an entry.

(This would involve creating an object whose SHA-1 digest is included within itself)

[[email protected] @bradlarsen]

@jfischoff @ESultanik Yes, that seems quite likely!

[[email protected] @bradlarsen]

I wonder how feasible it would be to make a Git tree object that included itself as an entry.

(This would involve creating an object whose SHA-1 digest is included within itself)