Old school hacker.

This profile is from a federated server and may be incomplete. View on remote instance

@ela@infosec.exchange avatar ela , to random German

"Age verification" laws are "we want to have all adults and their complete online profile in a database" laws, and that Persona, the company behind LinkedIn, Roblox, Discord ID and age verification is owned by Peter Thiel should be all you need to know.

@ela@infosec.exchange avatar ela , to random German

OMG. -froot bug resurfaced. https://seclists.org/oss-sec/2026/q1/89

I see the headlines, "10 years old bug".

My friends, this bug is older. Much older. Not this particular instance, but it is a classical mistake to make. It's a command line injection when calling the login executable.

Some people point to CVE-2007-0882. Solaris had that, almost 20 years ago.

But it's even older than that. It's so old it predates the CVE system. I don't remember exact dates, but we popped Linux and AIX boxes with that, mid 90s.

But it is even older than that. Have a look at System V R4, ©1990, getty calling login with unsanitized input:

https://github.com/calmsacibis995/svr4-src/blob/7dabeda6fc10bd1bbd1a84d502f05642b1bf0c9e/cmd/getty/getty.c#L526

But how deep does the rabbit hole go? When was this bug introduced?

Getty called login with user input since the dawn of time (UNIX V2, 1972):

https://www.tuhs.org/cgi-bin/utree.pl?file=V2/cmd/getty.s

But this predates command line arguments in login:

https://www.tuhs.org/cgi-bin/utree.pl?file=V2/cmd/login.s

So, when did this particular command line feature of login appear?

In the BSD universe, -f was introduced with POSIX compatibilitiy in 4.3BSD-Reno:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/login/login.c

But someone paid attention and filtered out user names starting with - in getty:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/libexec/getty/main.c

RCS timestamp says 6/29/1990, so same age as SysV R4.

The original 4.3BSD (1986) doesn't filter the user name:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD/usr/src/etc/getty/main.c

And it does have a -r option in login:

https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD/usr/src/bin/login.c

Exploitable? No idea, argv processing might be a problem. I'll find out another day.

In conclusion: bug existed since 1990, it's so easy to make when implementing POSIX that it keeps resurfacing, and at least one person in Berkeley knew since day 0.

@ela@infosec.exchange avatar ela , to random German

Stabil wie immer.

ALT
@w7voa@journa.host avatar w7voa , to random

In Japan, they’ve figured out how to get male sturgeon to switch their sex and make roe for caviar.
https://www.asahi.com/ajw/articles/16086487- https://www.asahi.com/sp/ajw/articles/16086487

ela ,
@ela@infosec.exchange avatar
ela ,
@ela@infosec.exchange avatar

@w7voa “We want to work on ways to turn males into females in a safe and secure manner.” I feel this.

@NanoRaptor@bitbang.social avatar NanoRaptor , to random

Studies have found the most logical and fastest keyboard layout is not between key orders like qwerty and dvorak, but one that prioritises the size of keys depending on the frequency of those letters in the language being typed, regardless of the ordering.

This Apple keyboard has an English layout. More frequently used letters in english are larger and slightly taller, less used letters are smaller and lower, which conveniently prevents tyops.,

ALT
ela ,
@ela@infosec.exchange avatar

@NanoRaptor Which, not by accident, is how phone onscreen keyboards work internally, even dynamically adjusting size depending on the context.

@ela@infosec.exchange avatar ela , to random German
@evacide@hachyderm.io avatar evacide , to random

This is your regular reminder that if you are the smartest person in the room, go find another room. You are not going to run out of people or rooms.

ela ,
@ela@infosec.exchange avatar

@evacide Sometimes though: start teaching.

@ela@infosec.exchange avatar ela , to random German

You might not like it, but this is what peak compiler performance looks like.

ALT