ShikChen

How to set up stress-free SSL on an OS X development machine

One of the best ways to reduce complexity (read: stress) in web development is to minimize the differences between your development and production environments. After being frustrated by attempts to unify the approach to SSL on my local machine and in production, I searched for a workflow that would make the protocol invisible to me between all environments.

Most workflows make the following compromises:

Use HTTPS in production but HTTP locally. This is annoying because it makes the environments inconsistent, and the protocol choices leak up into the stack. For example, your web application needs to understand the underlying protocol when using the secure flag for cookies. If you don't get this right, your HTTP development server won't be able to read the cookies it writes, or worse, your HTTPS production server could pass sensitive cookies over an insecure connection.
Use production SSL certificates locally. This is annoying

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed

THIS GIST WAS MOVED TO TERMSTANDARD/COLORS REPOSITORY.

PLEASE ASK YOUR QUESTIONS OR ADD ANY SUGGESTIONS AS A REPOSITORY ISSUES OR PULL REQUESTS INSTEAD!

	#! /usr/bin/env python
	# -- coding: utf-8 --

	'''
	tcget.py

	Kosei Moriyama <[email protected]>
	'''

	import BeautifulSoup

	Latency Comparison Numbers (~2012)
	----------------------------------
	L1 cache reference 0.5 ns
	Branch mispredict 5 ns
	L2 cache reference 7 ns 14x L1 cache
	Mutex lock/unlock 25 ns
	Main memory reference 100 ns 20x L2 cache, 200x L1 cache
	Compress 1K bytes with Zippy 3,000 ns 3 us
	Send 1K bytes over 1 Gbps network 10,000 ns 10 us
	Read 4K randomly from SSD* 150,000 ns 150 us ~1GB/sec SSD

	#!/bin/sh

	###
	# SOME COMMANDS WILL NOT WORK ON macOS (Sierra or newer)
	# For Sierra or newer, see https://github.com/mathiasbynens/dotfiles/blob/master/.macos
	###

	# Alot of these configs have been taken from the various places
	# on the web, most from here
	# https://github.com/mathiasbynens/dotfiles/blob/5b3c8418ed42d93af2e647dc9d122f25cc034871/.osx

	//LICENSE: CC0 (Public Domain)
	#include <vector>
	#include <algorithm>

	class SuffixArray {
	public:
	typedef int Index;

	//Verified: SPOJ SARRAY (0.49 / 2.8M)
	template<typename AlphaT>

	#-- coding:utf-8 --

	import random
	from z3 import *

	s = Solver()

	htest = random.randint(0, 1<<32-1)
	print hex(htest)

	#!/usr/bin/ruby
	# Create display override file to force Mac OS X to use RGB mode for Display
	# see http://embdev.net/topic/284710

	require 'base64'

	data=`ioreg -l -d0 -w 0 -r -c AppleDisplay`

	edids=data.scan(/IODisplayEDID.*?<([a-z0-9]+)>/i).flatten
	vendorids=data.scan(/DisplayVendorID.*?([0-9]+)/i).flatten

	I wasn't first to get the key. Nor was I second, third, or even fourth. I'm probably not even the
	10th to get it (ok, looks like I was the 8th.) But I'm happy that I was able to prove to myself
	that I too could do it.

	First, I have to admit I was a skeptic. Like the handful of other dissenters, I had initially
	believed that it would be highly improbable under normal conditions to obtain the private key
	through exploiting Heartbleed. So this was my motivation for participating in Cloudflare's
	challenge. I had extracted a lot of other things with Heartbleed, but I hadn't actually set out to
	extract private keys. So I wanted to see first-hand if it was possible or not.