Top all-time · #3044
Push the Red Button
Personal blog · moyix.blogspot.comsecuritysystems
Push the Red Button is a personal blog at moyix.blogspot.com about security and systems. Since 2013, 24 different Hacker News readers have linked it 41 times, most often “Someone's been messing with Python's floating point subnormals”. The last post was in 2022, but the archive is still widely read.
Malware, encryption, reverse engineering, networking, and other arcana.
Most-linked posts?
- Someone's been messing with Python's floating point subnormals8 people · 13 mentions · first linked 2022-12-08
- Breaking Spotify DRM using Statistics and Dyanamic Analysis3 people · 3 mentions · first linked 2014-07-03
- /2022/09/someones-been-messing-with-my-subnormals.html?m=12 people · 3 mentions · first linked 2023-04-27
- PANDA: a Platform for Architecture-Neutral Dynamic Analysis2 people · 2 mentions · first linked 2013-09-30
- Reproducible Malware Analyses for All2 people · 2 mentions · first linked 2014-12-11
- On building 30k Debian packages2 people · 2 mentions · first linked 2022-02-06
What Hacker News says?
> I also recall a blog post where someone was scanning PyPI for malicious Python packages, only to realize that `pip download` also executed code. I think you're thinking of this post[1]. The code being searched for wasn't malicious, just buggy :-) [1]: https://moyix.blogspot.com/2022/09/someones-been-messing-wit...
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html
on “Uv: Python packaging in Rust”Submitted Someone’s Been Messing with My Subnormals as a story · 442 points
HN discussionhttps://moyix.blogspot.com/2022/09/someones-been-messing-wit... TLDR: Python gevent compiled with -Ofast messes up x87 floating point unit state. Bad for PyTorch.
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html?m=1
on “A bug that taught me more about PyTorch than years of using it”Submitted Breaking Spotify DRM with PANDA as a story · 278 points
HN discussionHaha, I don't know how folks found this, but I actually did make it for a real-world use case. While doing large-scale builds of debian packages [1], occasionally I'd have parts of the build process hang (usually some test that I didn't care about). I didn't want the whole build to fail, so I needed some way to kill the process but have it return 0 so that make and friends wouldn't think anything was amiss. Also, cr…
Comment linking /2022/02/on-building-30k-debian-packages.html
on “Killbutmakeitlooklikeanaccident.sh”Submitted Someone's been messing with Python's floating point subnormals as a story · 209 points
HN discussionI'm not going to try to debate the merits of Twitter threads vs blog posts, but I will note that I, like many others, have an abandoned blog [1] but manage to post plenty of Twitter threads. The activation energy needed is just way lower on Twitter, and (as an academic) if I need to write something much more serious it'll usually be a paper. If you want people to blog more and tweet less, you probably have to find a…
Comment linking /
on “Forget Twitter Threads; Write a Blog Post Instead”Submitted On building 30k Debian packages as a story · 139 points
HN discussionHis other post explains it: http://moyix.blogspot.com/2013/09/announcing-panda-platform-...
Comment linking /2013/09/announcing-panda-platform-for.html
on “Breaking Spotify DRM with PANDA”Submitted Fuzzing with AFL is an Art as a story · 109 points
HN discussion-ffast-math and -Ofast are inadvisable on principle: Tl;dr: python gevent messes up your x87 float registers (yes.) https://moyix.blogspot.com/2022/09/someones-been-messing-wit...
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html?m=1
on “Compiler Options Hardening Guide for C and C++”Submitted How to add a million bugs to a program, and why you might want to as a story · 40 points
HN discussionHere's an example of fairly extensive use of construct: http://amnesia.gtisc.gatech.edu/~moyix/minidump.py Explanation: http://moyix.blogspot.com/2008/05/parsing-windows-minidumps....
Comment linking /2008/05/parsing-windows-minidumps.html?m=1
on “Working with Binary Data in Python”Submitted Breaking Spotify DRM using Statistics and Dyanamic Analysis as a story · 7 points
HN discussionThe only work I've seen on breaking Spotify DRM encryption was this[1], back in 2014 and discussed on HN here[2]. [1]: http://moyix.blogspot.com/2014/07/breaking-spotify-drm-with-... [2]:
Comment linking /2014/07/breaking-spotify-drm-with-panda.html
on “Reverse Engineering the GoPro Cineform Codec”Submitted On building 30k Debian packages as a story · 3 points
HN discussionThat's not really true. If you link a shared library that was compiled with -ffast-math, that will affect the entire program. https://moyix.blogspot.com/2022/09/someones-been-messing-wit...
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html
on “Own Constant Folder in C/C++”Submitted The Mechanics of Bug Injection with LAVA as a story · 3 points
HN discussionWell, this isn't exactly how I expected my PDB parsing library to end up on HN ;) The bytes/string changeover is probably the biggest pain point for RE tools written in Python2. Indeed, despite lucasg's excellent work porting things over, there was still at least one byte/string issue that needed to be fixed: https://github.com/moyix/pdbparse/issues/39 Edit: Also, I have one small correction – pdbparse is actually 1…
Comment linking /2007/08/pdb-stream-decomposition.html
on “Porting a historic Python2 module to Python3”Submitted Breaking Spotify DRM with PANDA as a story · 3 points
HN discussionSomeone else beat me to it. Will answer anyway. Had a very similar experience to yours with one important exception. The visitor pattern is relevant for traversing ASTs in single dispatch languages. Most notably, this includes Java and C++. The alternative concept is multiple dispatch and it is way more anti-fragile. This is where the next step in college literally was to learn the concept of cargo-culting. The conc…
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html
on “Design Patterns Are Temporary, Language Features Are Forever”Submitted How to add a million bugs to a program, and why you might want to as a story · 2 points
HN discussion> lpClass most likely is a class name in COM/OLE sense. I don't think that is true. In the original Windows 3.1 registry, lpClass did not exist. You only had the RegCreateKey() function which had no lpClass parameter, that parameter was added in RegCreateKeyEx() which was only in NT (and later Windows 95 too). COM/OLE never used lpClass. Out-of-the-box, very few Windows registry keys have lpClass set, and those that…
Comment linking /2008/02/syskey-and-sam.html
on “Why is a registry file called a “hive”? (2003)”Submitted 100 Days of Malware as a story · 2 points
HN discussionIn principle, yes. In practice, there are a lot of issues with that workflow. For example, `pip install --ignore-installed --dry-run --quiet --report` will build sdists (and run arbitrary code from `setup.py` or other places specified by a build backend) - just so that it can confirm that the downloaded sdist would produce a wheel with the right name and version. Even `pip download` will do the same. I'm not kidding…
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html
on “Problems with Python dependency management”Submitted Breaking Spotify DRM with PANDA as a story · 2 points
HN discussion> even package managers like pip This reminds me of a blog post [1] I read before. Pertinent quote: > Unbeknownst to me, even with --dry-run pip will execute arbitrary code found in the package's setup.py. In fact, merely asking pip to download a package can execute arbitrary code (see pip issues 7325 [2] and 1884 [3] for more details)! Also seen on Twitter [4]. [1] https://moyix.blogspot.com/2022/09/someones-been-m…
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html
on “TabFS – a browser extension that mounts the browser tabs as a filesystem”Submitted A couple ideas that went nowhere as a story · 1 points
HN discussionFor one, because Docker is not a sandbox, and containers are not a strong security boundary[1]. What you really need here is a strongly isolated VM, at which point you're playing cat-and-mouse games with your target: their new incentive is to detect your (extremely detectable) VM, and your job is to make the VM look as "normal" as possible without actually making it behave normally (because this would mean getting e…
Comment linking /2022/09/someones-been-messing-with-my-subnormals.html
on “Aggressive Attack on PyPI Attempting to Deliver Rust Executable”Submitted The Mechanics of Bug Injection with LAVA as a story · 1 points
HN discussion
