• 2 Posts
  • 20 Comments
Joined 1 year ago
cake
Cake day: June 14th, 2023

help-circle


  • Not quite. Their “malicious” extension only got a few hundred installs. Using the data gathered by that extension and via other means they were able to locate other actually malicious extensions. Those total in the millions of installations.

    Through this process, they have found the following:

    1,283 with known malicious code (229 million installs).
    8,161 communicating with hardcoded IP addresses.
    1,452 running unknown executables.
    2,304 that are using another publisher's Github repo, indicating they are a copycat.
    




  • Most closely matches the behavior of actual SNES consoles.

    This requires very careful emulation of the timings of the various buses and co-processors, as well as on-cart chips which may or may not be present. For instance, a Speedy Gonzales game has a button in the final stage which crashes almost every emulator because enters an infinite loop reading from an open bus and waiting for the value to attain a specific pattern. However reading from an open bus is generally specified to be the last value loaded into the bus, which in this case is the load instruction itself, $18. So the value is read to be $1818 by most emulators, which doesn’t match the pattern expected.

    However, this is only if you’re emulating with instruction level accuracy. It is possible for the value of the bus to change in between the instruction being loaded and the value of the bus being loaded due to an HDMA load being triggered, but this requires a cycle accurate emulator.


  • “Early in the Reticulum – thousands of years ago – it became almost useless because it was cluttered with faulty, obsolete, or downright misleading information,” Sammann said.

    “Crap, you once called it,” I reminded him.

    “Yes – a technical term. So crap filtering became important. Businesses were built around it. Some of those businesses came up with a clever plan to make more money: they poisoned the well. They began to put crap on the Reticulum deliberately, forcing people to use their products to filter that crap back out. They created syndevs whose sole purpose was to spew crap into the Reticulum. But it had to be good crap.”

    “What is good crap?” Arsibalt asked in a politely incredulous tone.

    “Well, bad crap would be an unformatted document consisting of random letters. Good crap would be a beautifully typeset, well-written document that contained a hundred correct, verifiable sentences and one that was subtly false. It’s a lot harder to generate good crap. At first they had to hire humans to churn it out. They mostly did it by taking legitimate documents and inserting errors – swapping one name for another, say. But it didn’t really take off until the military got interested.”

    “As a tactic for planting misinformation in the enemy’s reticules, you mean,” Osa said. “This I know about. You are referring to the Artificial Inanity programs of the mid-First Millenium A.R.”

    “Exactly!” Sammann said. “Artificial Inanity systems of enormous sophistication and power were built for exactly the purpose Fraa Osa has mentioned. In no time at all, the praxis leaked to the commercial sector and spread to the Rampant Orphan Botnet Ecologies. Never mind. The point is that there was sort of a Dark Age on the Reticulum that lasted until my Ita forerunners were able to bring matters in hand.”

    “So, are Artificial Inanity systems still active in the Rampant Orphan Botnet Ecologies?” asked Arsibalt, utterly fascinated.

    “The ROBE evolved into something totally different early in the Second Millennium,” Sammann said dismissively.

    “What did it evolve into?” Jesry asked.

    “No one is sure,” Sammann said. “We only get hints when it finds ways to physically instantiate itself, which, fortunately, does not happen that often. But we digress. The functionality of Artificial Inanity still exists. You might say that those Ita who brought the Ret out of the Dark Age could only defeat it by co-opting it. So, to make a long story short, for every legitimate document floating around on the Reticulum, there are hundreds or thousands of bogus version – bogons, as we call them.”

    Excerpt from Anathem by Neal Stephenson

    Welcome to the brave new bogon world.


  • Well, the problem is you don’t know what you don’t know. One of the first example tasks in the paper was regarding implementing a symmetric cipher. Using a weak cipher was recommended by AI tools sometimes, these developers didn’t know that some ciphers were weak. Additionally, even when the AI tool recommended a strong cipher, such as AES, it generated code that screwed up an implementation detail (failing to return the authentication tag), making the result insecure. And the user didn’t know it was wrong because they didn’t know it was incomplete.

    There’s no substitution for domain specific knowledge. Users who were forced to use traditional tools got the answer correct significantly more often because they had to read, process, and understand the documentation for the libraries, which meant they understood why the symmetric cipher was the way it is, and what additional information needed to be reported and why.









  • Or sometimes even just an array. The first time I thought I wanted to do this was 2003 and I was writing a perl script, and I was trying to loop through some sort of array, and write the outputs of some calculations to $val0 $val1 and so on, and I was neck deep into some horrible dark constructs like ${"val" . $i} before I actually realized that I really just wanted an array, you know, like the one I was already using.

    It took me forever to understand map (the metafunction).