@Magnum@infosec.pub
Magnum, P.I.
Thomas Sullivan Magnum IV is a private investigator. He lives in the guesthouse of a 200-acre (81 ha) beachfront estate called Robin’s Nest, in Hawaii, at the invitation of its owner, Robin Masters. Ostensibly this is quid pro quo for Magnum’s services based upon his expertise
member since 31 Dec 2025 09:48
comments
- on Google’s AI Is Destroying Search, the Internet, and Your Brain in c/technology@lemmy.world · 11h ago
-
on Denuvo sues anonymous game cracker ‘voices38’ over alleged DRM circumvention — seeks damages after Anti-Tamper protections bypassed in 26 games in c/games@lemmy.world · 6d ago
Well then they are all up for learning a lesson or two in the future. Don’t get me wrong, its great, I am a fan of education.
-
on Denuvo sues anonymous game cracker ‘voices38’ over alleged DRM circumvention — seeks damages after Anti-Tamper protections bypassed in 26 games in c/games@lemmy.world · 6d ago
You are cracking a game and use Discord? Haha there’s always a new lesson to be learned kiddo
-
on I love fun quizzes like this. Let’s all share! in c/programmer_humor@programming.dev · 17 Sep 2026
It is very good - I will steal it.
-
on A Head-to-Head Comparison of Windows vs Consoles vs Linux in c/linuxmemes@lemmy.world · 16 Sep 2026
Well, I’m Magnum P.I. what did you expect.
-
on A Head-to-Head Comparison of Windows vs Consoles vs Linux in c/linuxmemes@lemmy.world · 16 Sep 2026
Calm down, its just a VM nothing really mad about that tbh.
-
on Active Matter developers put up an incredibly distasteful AI notice on Steam in c/games@lemmy.world · 12 Sep 2026
-
on It's all about those little file mode bits in c/linuxmemes@lemmy.world · 11 Sep 2026
The CH from channel and then mod
-
on After a year of struggling and losing my job to AI, my game finally made it to 4000 wishlists! This is how it feels: in c/games@lemmy.world · 5 Sep 2026
What did you do that your work can be replaced by AI?
-
on After a year of struggling and losing my job to AI, my game finally made it to 4000 wishlists! This is how it feels: in c/games@lemmy.world · 5 Sep 2026
You lost your job to AI?
-
on I rented a car, and within hours, my driver's license was for sale in c/technology@lemmy.world · 4 Sep 2026
Where can I find this nexus?
-
on Google Has Removed Manifest V2 Extensions From the Chrome Web Store, Including uBlock Origin in c/technology@lemmy.world · 2 Sep 2026
What does it fake about the tracking? The tracking is very real and the tool is clicking every tracking link available on the site like its life depends on it
-
on Google Has Removed Manifest V2 Extensions From the Chrome Web Store, Including uBlock Origin in c/technology@lemmy.world · 1 Sep 2026
Doesn’t this just track the shit out of you? Does it also click malicious ad banners?
-
on New Twitter launches, says Musk's X gave up the name in c/technology@lemmy.world · 27 Aug 2026
en.wikipedia.org/wiki/Operation_Blue_Bird
en.wikipedia.org/wiki/Operation_Bluebird
www.cia.gov/…/CIA-RDP83-01042R000800010003-1.pdf
www.amnesty.org/en/documents/asa20/017/1990/en/
They didn’t do any research before?
-
on Android users can't remove nude-scanning app as Google opens the feature to app developers in c/technology@lemmy.world · 26 Aug 2026
Or you could use an open camera app
-
on Ken Thompson Hack 2.0 in c/linuxmemes@lemmy.world · 23 Aug 2026
Doesn’t Ken’s virus depend on the fact that the compiler (a pre-existing binary version thereof) was used to bootstrap itself? Had a different compiler been used to compile the compiler, the virus would have been killed. No. Ken notes “I could have picked on any program-handling program such as an assembler, a loader, or even hardware microcode.” Put it in the linker, say, and all your compilers are affected. You could use a debugger to inspect the compiler’s operation. Perhaps a debugger toggled in via the patch panel on the front of a PDP-10 … otherwise s/login/debugger/ in what Ken said and paste in another trojan or two. How about modification of the compiler sources for another reason? Might have fooled the “am I compiling myself” algorithm, or might have caused the Trojan to have been inserted incorrectly. There are no C compilers out there that don’t use yacc and lex. But again, the really frightening thing is via linkers and below this hack can propagate transparently across languages and language generations. In the case of cross compilers it can leap across whole architectures. It may be that the paranoiac rapacity of the hack is the reason KT didn’t put any finer point on such implications in his speech … These examples are not given to rebut Thompson’s point (which is a valid one), but instead to remind of good practices to prevent this sort of thing. What practices? I can’t think of any way to do it without the resources of a major TLA. KTH demonstrates that we are not able to fully trust any binary even when we have compiled it ourselves from trustworthy sources on a system we have compiled ourselves. The OpenSourceMovement might have an off switch … but your cell phone probably does not.
It’s been more than twenty years since I read Thompson’s marvelous paper, but I believe I correctly recall his fundamental point: UNIX, and every system like it, can NEVER be “secure”. It doesn’t matter how many layers of anti-virus software, “internet worm protection”, “firewall” or any other buzzword – systems like UNIX (including all versions of Linux, Macintosh OSX, and all versions of WinXP) will NEVER be secure. Thompson published his paper and revealed his hack in order to demonstrate this point. Whereas what systems are secure? Ones that are not compiled from source code, presumably. And certainly not, say, Windows which you left of your list by sheer coincidence.
In August 2009 a virus utilizing the Ken Thompson hack was seen in the wild. It infected Delphi 4 through 7 and applications genereated with it. www.h-online.com/security/…/114031
Although non-trivial, an effective counter has been identified: www.schneier.com/blog/…/countering_trus.html. That’s only (and trivially) effective if you already have a trusted compiler executable. The problem is generating one of those in the first place. Living in the era of PRISM, we can guarantee you can’t get one online - KTH in the network will see to that. You sure didn’t get one shipped with your OS - all the commercial OS mfrs are compromised and the open source ones all went through PRISM’s internet. The only way you’re going to get a clean compiler executable now is to build your computer yourself out of TTL logic you salvage from some museum somewhere, then code up a set of basic binary tools sufficient to assemble assembler. Then bootstrap from the source of all the modern tools. This actually sounds like a worthy project until you realize that the only person who could possibly trust your clean compiler executable is you. No one else will know for sure that you’re not secretly working for PRISM. Or that you’re not just too careless, or that black hats didn’t hack their way into your garage and add the KTH while you weren’t looking. And even if you got far enough to prove something, the great conspiracy would dose you with mind-altering chemicals or blackmail you into silence or discredit you or similar. Face it, little dude, against TheKenThompsonHack there simply is no defense. Little dude? Why the put down? Who are you putting down, all of us? Please see GoodStyle. {I don’t think it was intended to be a put-down so much as a colloquial generic diminutive used as a rhetorical invective to imply weak superiority. It suggests the writer was not confident in his/her claim that “against TheKenThompsonHack there simply is no defense”, and subconsciously sought to blunt the full force of the assertion by diminishing the reader.}
- [Dude. Print out the hexdump of the disassembler, disassemble it manually, see that it works, then use it as the first step in analyzing the compiler. Oh, and TheKenThompsonHack is trivially visible in the .s file if you’re looking for it.]
- {You’re assuming the disassembler, hexdump tool, editor you use to read the .s file aren’t all compromised.}
- Yep. The weakness in TheKenThompsonHack isn’t there. It’s in the fact that it will have to make mistakes in identifying the disassemblers, hexdump tools, editors, compilers, etc. Somewhere, there’s a program whose output it will change but it shouldn’t have, or a program whose output it should have changed but didn’t. See TuringIncompletenessTheorem.
‘’‘I’ve never been able to understand why simply doing some programmatic transformation of your compiler first isn’t considered a good defense. Basically just obfuscating the code. For such a backdoor to work the injection point needs to be recognized by the injector. So if one … Started with a corrupted compiler and then obfuscated it’s source. Then compiled the obfuscated but “clean” source with the corrupted compiler. One should end up with a clean and uncorrupted compiler. Then compile the unobfuscated source with the “washed” compiler (if the obfuscation significantly degraded the performance of the compiler). If in my paranoia I needed to bootstrap an entire toolchain this way. I’d start with an FPGA. Use it to emulate an FPGA (at horrendous loss of efficiency). Then use the emulated FPGA to run a custom simple soft-CPU. Preferably hand written. Ad then bootstrap a build toolchain using some expensive obfuscations for the first pass after which the tools are considered clean. One would probably always need to be careful of the CPU the toolchain runs on though, but similar obfuscation arguments should apply…’’ How do you know that the compromised compiler won’t recognize the obfuscation you used? If it does, your “clean” compiler is no longer clean. (The FPGA and CPU solution has the same problem.)
Wouldn’t it be extremely hard (in any sense I can think of) to actually be able to recognize every program that does a particular operation? Say you wrote a program that runs a JVM implementation of a MIPS emulator that can make host system calls that runs a program that implements login by reading whatever files contain the passwords in backwards and converting them to EBCDIC before doing processing on them. I find it hard to believe that the KTH-implementing compiler would actually recognize anything that program is doing. Yes, it will have to make mistakes somewhere. This is because any implementation that was always correct could be used to solve the HaltingProblem. But this doesn’t make any particular trick undetectable. What they detect is mostly a matter of whether or not they thought of it and whether or not they considered checking for it worth the effort.
-
on but seriously, what symbols go best with which genders? in c/transmemes@lemmy.blahaj.zone · 17 Aug 2026
Moon is my favourite planet. Not like Pluto that fucking poser.
-
on 'Locking a gameplay trailer behind a Netflix subscription is a new level of greed' — GTA 6 callout Rockstar for 'paywalling' the game's extended look in c/games@lemmy.world · 9 Aug 2026
It never did?
-
on 2027 RAM Capacity Has Reportedly Been Sold out in c/technology@lemmy.world · 8 Aug 2026
nvidia is actually the only one that made profit
I use SearXNG it works pretty well for me.