Pelle Wessman voxpelli

Dependabot alert filter: resource-exhaustion and algorithmic-complexity CWEs

Filter

cwe:400 cwe:407 cwe:409 cwe:674 cwe:770 cwe:772 cwe:775 cwe:776 cwe:789 cwe:834 cwe:835 cwe:1333

What this filter is trying to capture

This Dependabot alert filter clusters CWEs that are primarily associated with availability risk, especially:

Reverse Engineered VAS Protocol Specification

Research by Grayson Martin
Last Updated 7/8/23

Introduction

Value Added Services (VAS) is the protocol used by NFC capable passes in Apple Wallet. Access to this protocol is heavily restricted on both the device end (a special certificate issued by Apple is required to create these passes) and the reader end (NDA enforced confidentiality). As such, a desire arose to better understand the protocol in order to explore additional use cases and examine its cryptographic integrity. There are gaps in understanding in certain parts of this protocol, however this document contains the minimum necessary understanding to automatically select, read data from, and decrypt a pass.

Importantly, this specification does not enable a malicious actor to read the data from a pass for which they do not have both the reader's private key, and the pass type identifier. Imp

Here are some results on the bench-v8 version 7 benchmark.

We did not run Splay as that uses more memory than c@e permits.

The programs were executed using Viceroy. They were run on a MacBook Pro 13inch, 2019, Core i7 @ 2.8GHz, 16 GB 2133 MHz LPDDR3.

Engine	QuickJS C@E	SpiderMonkey C@E
Executable size	3.9M	9.4M
Richards	112	36.8

Thanks to the work of @agraf, @KhaosT, @imbushuo, and others, we have Virtualization.framework working on M1 Macs. These [changes][1] have been merged with QEMU v5.2.0 RC3 (will rebase once the final release is out) and integrated with UTM, a brand new QEMU frontend designed in SwiftUI for iOS 14 and macOS 11.

Downloads

uce vs lit-element

A very simple comparison table between these two libraries.

	uce	lit-element
version	1.11.9	2.4.0
license	ISC (simplified MIT)	BSD-3-Clause License
language	JS w/ TS definition	TS w/ JS transpilation
size ^{_{( brotli )}}	9437b ES5 / 6811b ES2015+	8634b ES5 / 6708b ES2015+

Various Digirule 2U programs

d6.asm a six-sided dice roller
k2000.asm K2000-like flash-light.
k2000-loop.asm same as above, with 2 loops (This version is stored in fewer RAM slots, but it's slower because of an extra instruction).
fibonacci.asm a basic Fibonacci series computation, displayed on the Data LEDs. The maximum result will be 233, and then it "crashes", all Data LEDs will blink as if it was an error signal.
christmas.asm a XMas light using RANDA for the data LEDs + Speed for blinking delay.
christmas-advanced.asm Expanded version, still using a random SPEED + blinking both DATA & ADR LEDs.

How can I use this?

Fixing macOS 10.14, 10.15, 12

Dark main menu without the rest of dark mode

Set Light mode
defaults write -g NSRequiresAquaSystemAppearance -bool Yes
Log out and log back in
Set Dark mode

	/**
	* @template T
	* @param {T} value
	* @returns {T}
	*/
	const passthrough = value => value;

	/**
	* @param {object} [options]
	* @param {(value: string) => string} [options.staticCallback]

	// Used in real world eg. here: https://github.com/voxpelli/node-format-microformat/blob/5381268dbcdb1aef6a5757758710e4b9f75cbea3/index.js#L72-L78

	// Works

	/** @typedef {null\|undefined\|boolean\|string\|number\|Array} NonObject */

	/**
	* @template T
	* @typedef {T\|Promise<T>} MaybePromised

	//
	// Perlin noise text displacement.
	// Created using Processing 3.5.3.
	//
	// Code by @marcedwards from @bjango.
	//

	PGraphics textbuffer;

	void setup() {