I did a “lecture”/“workshop” about this at work today. 16-bit DOS, real mode. 💾 Pretty cool and the audience (devs and sysadmins) seemed quite interested. 🥳
- People used the Intel docs to figure out the instruction encodings.
- Then they wrote a little DOS program that exits with a return code and they used uhex in DOSBox to do that. Yes, we wrote a COM file manually, no Assembler involved. (Many of them had never used DOS before.)
- DEBUG from FreeDOS was used to single-step through the program, showing what it does.
- This gets tedious rather quickly, so we switched to SVED from SvarDOS for writing the rest of the program in Assembly language. nasm worked great for us.
- At the end, we switched to BIOS calls instead of DOS syscalls to demonstrate that the same binary COM file works on another OS. Also a good opportunity to talk about bootloaders a little bit.
- (I think they even understood the basics of segmentation in the end.)
The 8086 / 16-bit real-mode DOS is a great platform to explain a lot of the fundamentals without having to deal with OS semantics or executable file formats.
Now that was a lot of fun. 🥳 It’s very rare that we do something like this, sadly. I love doing this kind of low-level stuff.
Saw this on Mastodon:
https://racingbunny.com/@mookie/114718466149264471
18 rules of Software Engineering
- You will regret complexity when on-call
- Stop falling in love with your own code
- Everything is a trade-off. There’s no “best” 3. Every line of code you write is a liability 4. Document your decisions and designs
- Everyone hates code they didn’t write
- Don’t use unnecessary dependencies
- Coding standards prevent arguments
- Write meaningful commit messages
- Don’t ever stop learning new things
- Code reviews spread knowledge
- Always build for maintainability
- Ask for help when you’re stuck
- Fix root causes, not symptoms
- Software is never completed
- Estimates are not promises
- Ship early, iterate often
- Keep. It. Simple.
Solid list, even though 14 is up for debate in my opinion: Software can be completed. You have a use case / problem, you solve that problem, done. Your software is completed now. There might still be bugs and they should be fixed – but this doesn’t “add” to the program. Don’t use “software is never done” as an excuse to keep adding and adding stuff to your code.
Okay, here’s a thing I like about Rust: Returning things as Option and error handling. (Or the more complex Result, but it’s easier to explain with Option.)
fn mydiv(num: f64, denom: f64) -> Option<f64> {
// (Let’s ignore precision issues for a second.)
if denom == 0.0 {
return None;
} else {
return Some(num / denom);
}
}
fn main() {
// Explicit, verbose version:
let num: f64 = 123.0;
let denom: f64 = 456.0;
let wrapped_res = mydiv(num, denom);
if wrapped_res.is_some() {
println!("Unwrapped result: {}", wrapped_res.unwrap());
}
// Shorter version using "if let":
if let Some(res) = mydiv(123.0, 456.0) {
println!("Here’s a result: {}", res);
}
if let Some(res) = mydiv(123.0, 0.0) {
println!("Huh, we divided by zero? This never happens. {}", res);
}
}
You can’t divide by zero, so the function returns an “error” in that case. (Option isn’t really used for errors, IIUC, but the basic idea is the same for Result.)
Option is an enum. It can have the value Some or None. In the case of Some, you can attach additional data to the enum. In this case, we are attaching a floating point value.
The caller then has to decide: Is the value None or Some? Did the function succeed or not? If it is Some, the caller can do .unwrap() on this enum to get the inner value (the floating point value). If you do .unwrap() on a None value, the program will panic and die.
The if let version using destructuring is much shorter and, once you got used to it, actually quite nice.
Now the trick is that you must somehow handle these two cases. You must either call something like .unwrap() or do destructuring or something, otherwise you can’t access the attached value at all. As I understand it, it is impossible to just completely ignore error cases. And the compiler enforces it.
(In case of Result, the compiler would warn you if you ignore the return value entirely. So something like doing write() and then ignoring the return value would be caught as well.)
@movq@www.uninformativ.de I think it’s here on MIT’s website: Your Brain on ChatGPT: Accumulation of Cognitive Debt when Using an AI Assistant for Essay Writing Task 🤔
@prologic@twtxt.net I am finding writing my Notes very therapeutic. Just create a markdown file and commit, push, and it’s live. Whatever comes to mind, whatever I want to keep as relevant. Silly things, more like a dump.
If I feel like it, I do. If not, I don’t. Not social, not intended for anyone to see them. I am enjoying it!
@movq@www.uninformativ.de why Gopher to babble, and not just HTTP? I mean, may as well just write plain text files on your machine, and leave them there, right?
Gopher and Mastodon are two completely different things. That’s where my confusion comes from.
GraphQL Gatecrash: When an Introspection Query Opened the Whole Backend ️
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/graphql-gatecrash-when-an-intro … ⌘ Read more
Could XSS Be the Hidden Key to Account Takeover
What if I told you that a simple Cross-Site Scripting (XSS) vulnerability could be the golden ticket to a full Account Takeover (ATO)? No…
[Continue reading on InfoSec Write-ups »](https://infosecwriteups … ⌘ Read more
Crafting Standalone Python Proof of Concept Exploits
Creating standalone proof of concept exploits implementing a zero-to-hero method, requiring a single action to run.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/craf … ⌘ Read more
$560 Bounty: How Twitter’s Android App Leaked User Location
A Silent Broadcast That Let Any App Spy on You Without Asking
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/560-bounty-how-twitters-android-app-leaked- … ⌘ Read more
50 Command Line Tools You Wish You Knew Sooner
Master the terminal with these essential commands that will transform your Linux experience from novice to power user.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/50-command-line-tools-you-wis … ⌘ Read more
When you play the Game of RBAC, You either validate, or the world denies your existence — like a King behind the wall.
OIDC: The Digitally signed Pinky Swear “It’s Me” (Part I)
Whenever an Elbow-Shake Protocol is being established, there’s always Users try to communicate safely during Corona pandemic!
[Continue reading on InfoSec Write-ups »](https://infosecwrit … ⌘ Read more
WebSocket Wizardry: How a Forgotten Channel Let Me Sniff Private Chats in Real-Time ️♂️
Hey there!😁
[Continue reading on InfoSec Write-ups »]( … ⌘ Read more
Business logic allows any user to be blocked from creating an account
FREE READ
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/business-logic-allows-any-user-to-be-blocked-from-creating- … ⌘ Read more
**Abuse-ception: How I Turned the Abuse Report Feature Into a Mass Email Spammer **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/abuse-ception-how-i-turned-the- … ⌘ Read more
$1,000 Bug: Firefox Account Deletion Without 2FA or Authorization
How a Missing Backend Check Let Attackers Nuke Accounts With Just a Password
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/1-000-bu … ⌘ Read more
The 5 Cybersecurity Roles That Will Disappear First
Think your job is safe from AI? Think again. These are the first cybersecurity roles AI will eat.”
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/the-5-cybersecurity-role … ⌘ Read more
How can one write blazing fast yet useful compilers (for lazy pure functional languages)?
I’ve decided enough is enough and I want to write my own compiler (seems I caught a bug and lobste.rs is definitely not discouraging it). The language I have in mind is a basic (lazy?) statically-typed pure functional programming language with do notation and records (i.e. mostly Haskell-lite).
I have other ideas I’d like to explore as well, but mainly, I want the compiler to be so fast (w/ optimisations) that … ⌘ Read more
21 Secret Linux Commands Hackers and Sysadmins Don’t Want You to Know About
Not your usual ‘ls’ and ‘pwd’ — these are the real tools used by professionals.
[Continue reading on InfoSec Write-ups »](https://info … ⌘ Read more
How I Captured a Password with One Command
Many beginner-friendly sites or older web applications still use HTTP, which transmits data without encryption.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/why-htt … ⌘ Read more
$7,500 Bug: Exposing Any HackerOne User’s Email via Private Program Invite
How One GraphQL Query Turned Private Invites into Public Data Leaks
[Continue reading on InfoSec Write-ups »](https://infosecwrite … ⌘ Read more
Create own Hacking SERVER Instead of Portswigger exploit server
This article describes about to create your own server that helps to exploit CORS vulnerability or more.
[Continue reading on InfoSec Write-ups »](https://i … ⌘ Read more
OIDC: The Fellowship of the Token (Part III)
One token to rule them all, one token to find them, One token to bring them all, and in the cluster spawn them (I meant the pods.).
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/oidc-the-fellowsh … ⌘ Read more
How I Hacked 100+ Accounts Using Just XSS
One Small Flaw, 100+ Accounts Stolen — Here’s How It Happened
This might be the end
How a Welcome Email Can Be Used for Malicious Redirection
Free Article Link: Click for free!
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/how-a-welcome-email-can-be-used-for-malicious-redirection-fd833ec71550? … ⌘ Read more
A Step-by-Step Plan to Secure Web Backends with XAMPP (Part 1/3)
Installing and Configuring XAMPP
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/a-step-by-step-plan-to-secure-web-backends-with-xampp-p … ⌘ Read more
** Broken Object Fiesta: How I Used IDOR, No Auth, and a Little Luck to Pull User Data **
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/broken-object-fiest … ⌘ Read more
A critical look at NetBSD’s installer
NetBSD is an OS that I installed only a couple of times over the years, so I’m not very familiar with its installer, sysinst. This fact was actually what led to this article (or the whole series rather): Talking to a NetBSD developer at EuroBSDcon 2023, I mentioned my impression that NetBSD was harder to install than it needed to be. He was interested in my perspective as a relative newcomer, and so I promised to take a closer look and write about it. While … ⌘ Read more
{CyberDefenders Write-up} Yellow RAT ⌘ Read more
**☠️ CORS of Destruction: How Misconfigured Origins Let Me Read Everything **
Free Link 🎈
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/%EF%B8%8F-cors-of-destruction-how-m … ⌘ Read more
** Cookie Attributes — More Than Just Name & Value**
Understanding the Security & Scope Behind Every Cookie
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/cookie-attributes-more-than-just-name-value-a95591be6fba?source=rss—-7b722bfd1b8d—4 … ⌘ Read more
DOM XSS Exploit: Using postMessage and JSON.parse in iframe Attacks
[Write-up] DOM XSS Using Web Messages and JSON.parse.
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/dom-xss-exploit-using … ⌘ Read more
Bypassing HackerOne Report Ban Using API Key
How a Banned Researcher Could Still Submit Reports Using the REST API
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/bypassing-hackerone-report-ban-using-api-key-061711e873c6?source=rss—-7b … ⌘ Read more
Top File Read Bug POCs that made $20000
Learning & Methodology to find File Read from top 5 POCs by Elite hackers
JWT the Hell?! How Weak Tokens Let Me Become Admin with Just a Text Editor ️
Hey there!😁
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/jwt-the-hell-how-weak-to … ⌘ Read more
404 to $4,000: Exposed .git, .env, and Hidden Dev Files via Predictable Paths”
How Bug Bounty Hunters Can Turn Common 404s Into Critical Information Disclosure Bounties
[Continue reading on InfoSec Write-u … ⌘ Read more
**2. Setting Up the Ultimate Hacker’s Lab (Free Tools Only) **
“You don’t need a fortune to break into bug bounty. You just need the right mindset — and the right setup.”
[Continue reading on InfoSec Write-ups »](https://infosecwriteups.com/2-se … ⌘ Read more