Ivan Prisyazhnyy sitano

Warning - use at your own risk

Remove SentinelOne agent from Mac

Boot into Recovery Mode by holding Cmd+R during reboot
Open Terminal from top menubar
Run /Applications/Utilities/Disk\ Utility.app/Contents/MacOS/Disk\ Utility to open Disk Utility
If your startup disk is encrypted, use Disk Utility to mount it
In Terminal, run chroot /Volumes/Macintosh\ HD
Execute the deletion commands or script

О специальной олимпиаде Haskell vs Python (pypy) vs всё остальное

Первоначально задача возникла в https://t.me/haskellru и формулировалась примерно так: почему следующий код на Haskell

using rust with rr

rr is a great debugging tool. it records a trace of a program's execution, as well as the results of any syscalls it executes, so that you can "rewind" while you debug, and get deterministic forward and reverse instrumented playback. it works with rust, but by default if you try it out, it could be pretty ugly when you inspect variables. if this bothers you, configure gdb to use a rust pretty-printer

rr is probably in your system's package manager.

usage

using rust pretty printers with rr

rr is a great debugging tool. it records a trace of a program's execution, as well as the results of any syscalls it executes, so that you can "rewind" while you debug, and get deterministic forward and reverse instrumented playback. it works with rust, but by default if you try it out, it could be pretty ugly when you inspect variables.

install

steps:

get the rust pretty printer python script
configure gdb to automatically load it

Container security notes

Internet references

Kernel and architecture

namespaces - overview of Linux namespaces http://man7.org/linux/man-pages/man7/namespaces.7.html
mount_namespaces - overview of Linux mount namespaces

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

	knowledge dump on container runtimes

	KataContainers
	- image coupled with kernel
	- light vm layer
	- can run in nested virturalization environments if hardware supports and you can enable it in bios (ex. only bare metal EC2 instances, limits many cloud providers)
	- slower startup time
	- OCI compliant
	- previously known as ClearContainers by Intel

	=begin
	This script attempts to reproduce poor glibc allocator behavior within Ruby, leading
	to extreme memory fragmentation and process RSS bloat.

	glibc allocates memory using per-thread "arenas". These blocks can easily fragment when
	some objects are free'd and others are long-lived.

	Our script runs multiple threads, all allocating randomly sized "large" Strings between 4,000
	and 40,000 bytes in size. This simulates Rails views with ERB creating large chunks of HTML
	to output to the browser. Some of these strings are kept around and some are discarded.

	#!/usr/bin/python
	# to try this you'll need to edit in the name of your ruby binary and install bcc-tools
	# bcc installation instructions are at https://github.com/iovisor/bcc/blob/master/INSTALL.md

	from __future__ import print_function
	from bcc import BPF
	from time import sleep
	import os

	# load BPF program

	------------------------- MODULE GryadkaCasRegister -------------------------
	EXTENDS Integers, Sequences, FiniteSets
	-----------------------------------------------------------------------------
	\* Timestamps is the set of possible timestamps for operations to choose from.
	\* Each operation uses a unique timestamp.
	\* Values is the set of possible values to set the register to.
	\* Acceptors is the set of nodes which act as acceptors in the paxos sense.
	\* Quorums is the set of all possible quorums, typically simple majorities.
	CONSTANTS Timestamps, Values, Acceptors, Quorums