Tim Pinoy

Random thoughts and ramblings

[Ivan Velichko @iximiuz]

Finally made an explainer diagram for ShellGym, an interactive Linux command-line trainer I've been hacking on for the past month and a half.

The idea is pretty simple, actually:

- ShellGym is a background daemon with a built-in web UI
- A learning path (markdown + YAML) is loaded into the daemon on start
- The user performs the actions requested by the path in a non-instrumented bash session
- The daemon observes the state of the Linux system and updates the UI (shows a hint, moves to the next task, etc.)

All is meant to run in a split-screen view.

The project repo if you want to give it a try: https://t.co/kxoT6lbzhg

[Tim Pinoy @timpinoy]

Signed up for Iximiuz Labs and while I've only scratched the surface of it the content that I've gone through has been excellent.

[Ivan Velichko @iximiuz]

Extended the offer through September. August ended up at around $12k, which is still far from the sustainability target.

Support iximiuz Labs and upgrade your membership at an (un)fair price 👇

[Ivan Velichko @iximiuz]

Extended the offer through September. August ended up at around $12k, which is still far from the sustainability target.

Support iximiuz Labs and upgrade your membership at an (un)fair price 👇

[Tim Pinoy @timpinoy]

@NyarchLinux Best logo though

[Ivan Velichko @iximiuz]

How Container Filesystem Works 🧐

Building a Docker-like container from scratch using only standard Linux commands (unshare, mount, pivot_root, etc.) is a great way to understand exactly what a container runtime like runc does under the hood to turn a container image into a fully-fledged rootfs.

Deep dive: https://t.co/PC7c9Zy1SJ

[GrapheneOS @GrapheneOS]

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has ~40% higher single threaded CPU performance, ~80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

Pixel 9a and earlier (including Nexus devices) were the Android Open Source Project reference devices. Pixel support was removed from AOSP with Android 16. It's now harder to support Pixels than many other devices and massive progress towards open source firmware and driver libraries was discarded.

Compared to the stock Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we rely on them for firmware and most driver updates. We also want to move to new kernel branches earlier. These things can be improved with our Motorola partnership.

We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

We haven't determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead. Pixel 10a was really a 9th gen Pixel, so hopefully the Pixel 11a does the same with 10th gen and includes MTE.

[Ivan Velichko @iximiuz]

How to Build Slim Container Images 🔽

A detailed write-up on what usually causes bloat in production images and how to avoid it by using multi-stage builds and carefully choosing base images.

With practical examples for Node.js, Go, Rust, Java, and PHP: https://t.co/U4qN8SamFs

[NyarchLinux @NyarchLinux]

With great power comes great elecricity bill

[Ivan Velichko @iximiuz]

Good news, everyone! It is now possible to sign in/up on iximiuz Labs via GitLab and Google. GitHub lock-in is no more! 🥳

Of course, you can also link an existing account to a new or alternative login method.

GitHub's recurring unavailability has been a great motivator.

[Mischa van den Burg @mischavdburg]

Exciting news:

Next Tuesday, I'm hosting a free, live workshop on the 10 highest-paying career paths that all start with Linux.

I'll break down exactly how much each one pays, which ones are growing the fastest, and which path is right for YOU.

(And I'm giving away a special bonus to everyone who attends live!)

Get your free ticket here:
https://t.co/0nyjqhP91X

[Kyle Q (the DockerSlim guy) @kcqon]

The Minimal Containers project hit a big milestone! A 100 minimal container images, and all free! Awesome!

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Nature is Amazing ☘️ @AMAZlNGNATURE]

These are Nachi(dancing) goats from Pakistan and this is how they walk.

[RYO Knosis @ryokinoshita___]

ギターを持っているのに弾かない男

[Tim Pinoy @timpinoy]

@chfsrh Yes to both.