Mastodawn

Jann Horn

@jann@infosec.exchange

2.3K Followers

142 Following

1.1K Posts

human borrow checker (but logic bugs are best bugs).
works at Google Project Zero.

The density of logic bugs (compared to memory corruption bugs) goes down as the privilege differential between attacker context and target context goes up.

homepage

@tjw On the day Opteron was supposed to tape out, a colleague discovered a logic bug. After some analysis, we figured out we could fix it by disconnecting a wire from one gate and attaching it to another. But running through or design flow would take days, and the ripple effect of changing connectivity could cause more problems. So I loaded the chip mask into VIM and modified the polygons directly, then we taped it out.

Don’t remember for sure, but I don’t think we told management 🙂

Jann Horn 6d ago

Alexander Goeres 𒀯 Jul 6

ein etwas älterer text @Rico Grimms , der erläutert, wie gefährlich hitze für den menschen sein kann; und auf welche hitzeentwicklung wir uns mit dem fortschreitenden klimawandel einstellen müssen.

unsere aktuell handelnden politiker werden dabei total versagen, so viel kann man schon mal voraussehen.

hier noch ein schönes zitat, wie hitze die eiweiße im körper beeinflusst:
„Es ist wie bei einem gekochten Ei. Wenn das Eiweiß einmal hart ist, kriegen sie es nicht mehr weich.“
Claudia Traidl-Hoffmann, Uni Augsburg
#klimawandel #staastversagen #hitzewellen #klimakatastrophe #umwelt #politik #grenzwert-2-grad

#^Wie Hitze schon bei 32 Grad tödlich sein kann

Es sind keine Extrem-Temperaturen, trotzdem können sie jeden Menschen töten. Egal wie fit, egal wie alt. Laut Berechnungen sollte es sie noch nicht geben. Aber sie sind da.

Jann Horn Jul 7

Gabriele Svelto Jul 7

If you have an Intel Raptor Lake system and you're in the northern hemisphere, chances are that your machine is crashing more often because of the summer heat. I know because I can literally see which EU countries have been affected by heat waves by looking at the locales of Firefox crash reports coming from Raptor Lake systems.

Show thread

Jann Horn Jul 7

reminds me of the time I had two keyboards in front of me and hit ALT+SYSRQ+O on the wrong one

Jann Horn Jul 7

me: trying to use /proc/sysrq-trigger to hard-reboot a remote system with "REISUB"
me: types "R"
me: types "E"
ssh connection dies
me: ... ooh. oops. 😬
systemd: "oh hey I noticed your ssh server stopped, I'll go turn it back on"
me: ... shamefully continues with "SUB", leaving out the "I"

Show thread

Jann Horn Jul 7

(clang apparently does this better)

Show thread

Jann Horn Jul 7

So in bar2, all of these instructions are unnecessary:

        pushq   %rbp
        movq    %rsp, %rbp
        andq    $-16, %rsp
[...]
        leave
[...]

and a register (RBP) is wasted here

Jann Horn Jul 7

fun kernel/compiler interaction that causes some Linux kernel code to have some superfluous instructions on x86-64 and use a bit more stack space than necessary:

Linux instructs the compiler to prefer 8-byte aligned stack frames (instead of the standard 16 bytes), which then also means the compiler has to assume that at the start of each function, the stack is only aligned to 8 bytes; which means if something tries to do a 16-byte-aligned allocation, the compiler has to emit instructions to save the old stack pointer (even if frame pointers are disabled) and align the stack.

And apparently especially in GCC, any nontrivial stack allocation whose address escapes the compiler's analysis is aligned to 16 bytes even if the object actually requires less alignment:

int foo(void *);
struct s1 { unsigned long a; };
struct s2 { unsigned long a; unsigned long b; };
int bar1() {
    struct s1 s;
    return foo(&s);
}
int bar2() {
    struct s2 s;
    return foo(&s);
}

compiles to this with GCC trunk with flags -O3 -mpreferred-stack-boundary=3:

bar1:
        subq    $8, %rsp
        movq    %rsp, %rdi
        call    foo
        addq    $8, %rsp
        ret
bar2:
        pushq   %rbp
        movq    %rsp, %rbp
        andq    $-16, %rsp
        subq    $16, %rsp
        movq    %rsp, %rdi
        call    foo
        leave
        ret

Note that bar1 doesn't do alignment (probably because struct s1 is simple enough to hit some special case?) while bar2 adds instructions to align the object (even though s1 and s2 have the same alignment requirements).

Compiler Explorer - C (x86-64 gcc (trunk))

int foo(void *); struct s1 { unsigned long a; }; struct s2 { unsigned long a; unsigned long b; }; int bar1() { struct s1 s; return foo(&s); } int bar2() { struct s2 s; return foo(&s); }

Jann Horn Jul 7

Show thread

Asahi Lina (朝日リナ) // nullptr::live Jul 7

Also USB2.0 is super cursed. It's actually 480Mbps if you send enough "0" bits. If you send too many "1" bits, then it drops down to 411Mbps. Variable speed depending on the data?!

Of course it's also very inefficient for other reasons so you never get anywhere close to those speeds anyway...

Jann Horn Jul 4

abadidea Jul 4

a blog post by my friend eevee which is, y’know, preaching to the choir about exactly what you think, but. yeah. https://eev.ee/blog/2025/07/03/the-rise-of-whatever/

The rise of Whatever

This was originally titled “I miss when computers were fun”. But in the course of writing it, I discovered that there is a reason computers became less fun, a dark thread woven through a number of events in recent history. Let me back up a bit.

Thorsten Leemhuis (acct. 2/4)Jun 25

PNG is back!

https://www.programmax.net/articles/png-is-back/ (by Chris Blume)

A new PNG spec was just released! […]

[…] After 20 years of stagnation, PNG is back with renewed vigor!

What's new?

* Proper HDR support (future‐proof, too!)

* Finally recognizes APNGs (animations!)

* Officially supports Exif data

* General tidying up—fixing errata, clarifications, etc.

#png

Show thread

Alan Langford 🇨🇦🧤🧊摏 Jun 25

@knurd42 Great. Blinky PNGs, just what I always wanted.

>APNG support

I kinda thought we were over this considering animated WebPs and AVIF exist, was there really any interest in bringing back Animated PNGs?

@knurd42 that's super cool.. When can we expect universal integration? Some time after the climate collapse?

Exactly my thought!

@mina @naught101 @knurd42

"Universal" is a big ask :)
But it is already live in Chrome, Safari, Firefox, iOS/macOS, Photoshop, ...
A bunch of software.

Also in broadcast. So overlays in sports, news, etc.

Show thread

waso nytpu Jun 25

@knurd42 Unfortunately literally everyone (including libpng) only implements a fraction of the original PNG spec, so I'm not really hopeful for any of these that weren't already de facto supported like Exif. I doubt extended color spaces would be supported very well in anything but pro photo software where it's already supported, for instance

Show thread

ProgramMax Jun 25

@nytpu @knurd42

Some of it has already landed in libpng. Other parts are currently landing. :)

Show thread

sodiboo

Jun 25

@nytpu @knurd42 Even if capabilities are not universally implemented, it's still valuable for the way they are implemented to be standardized and not rely on de facto hacks. I think this is very exciting indeed.

Show thread

Luna D Dragon Jun 25

@knurd42 WOWW this is cool as hell thanks for posting about it would have missed it other wise <3

Show thread

Andy Jun 25

@knurd42 I think we hugged the site to death :(

Show thread

vandorb12 Jun 25

@knurd42 I thought all of these features and issue mitigations were addressed in the JPEGXL standard?

Show thread

Peter Fisher Jun 25

@knurd42 will i have to buy an app from the windows store just to look at these images? (like heic).

Show thread

LumiWorx Jun 25

@knurd42

For photographers, having to use JPG as the only output to retain embedded EXIF data was not the ideal. If this is to be the new default, the question is, how can older (outdated, defunct, dead, or abandoned) photo processing software make use of it.

Does this mean adding some other post-processing tool into workflows to implant the latest additions? I can't assume there's some magic 'injector' that will somehow push HDR or EXIF data into preexisting files without user intervention.

Show thread

Lunaphied Jun 25

@knurd42 finallyyyyyy been waiting for an HDR spec for so long

Show thread

John Ulrik Jun 25

@knurd42 Can’t wait for 2045 when all tools will finally have implemented the new version! 🤗

@knurd42 can we finally get proper arithmetic coding support?
I know it has been in the spec, but maybe this time.
Also 32 bit png anytime?

Show thread

Fish Id Wardrobe Jun 25

@knurd42 wait, it didn't support EXIF before?

Show thread

LumiWorx Jun 26

@fishidwardrobe @knurd42

Only JPEG and TIFF support EXIF...

The 1st and 2nd Edition specs don't mention either EXIF or HDR being included or even planned. The old specs use the term "IHDR" and some may assume that's High Dynamic Range, but it actually describes the file's "Header' data, that holds dimmensions (height, width) for the transparent black rectangle as the bounding box of the entire image... (and now, animation stages).

https://www.w3.org/TR/2003/REC-PNG-20031110/

https://www.w3.org/TR/png-3/

Portable Network Graphics (PNG) Specification (Second Edition)

Show thread

Basil Jun 25

@knurd42 APNG is pronounced Jiff.

Show thread

txt.file Jun 26

@knurd42 will it be as successful as YAML1.2?

Show thread

Rackuur

Jun 26

@knurd42 oh no, they changed something. stop changing existing standards

Show thread

CTHULHU KAWAII Jun 26

@knurd42 Ok but APNG with sound when 🤡

Show thread

Kirinn B.Jun 26

@knurd42 I'm very interested in seeing an upgraded #PNG format! Since the official PNG spec seemed stagnant, I was jotting down ideas on an upgraded PNG myself ( https://mooncore.eu/bunny/txt/pngx-eval.htm ), but I guess if the big guys like @ProgramMax are on it, I can wait and see what they come up with. :D

Although if they go with zstd for the new compression, I'll be sad.

Evaluation of PNGX ideas

Evaluation of easy improvements for the PNG image format

Show thread

HyperSoop

Jun 30

@mooncorebunny @knurd42 @ProgramMax fyi it's out of scope for them to come up with any breaking changes and that'd include any change to the compression algorithm in use, so zstd is out of the question for now

Show thread

Kirinn B.Jun 30

@soop @knurd42 @ProgramMax But the linked announcement does say at the end that they're working on better compression; I see proposals around "PNG2" in the git repo too...

Show thread