So, the problem with USB tokens that we basically have two choices: - Unauditable black boxes built on *supposedly* more secure ICs that require NDAs to develop for - Open and auditable, but definitely pwnable off the shelf microcontrollers. Which poison do you prefer?
-
Show this thread
-
Open IC, because of you master assembly language and code everything with it, you can code things that can resist usual pwn techniques.
1 reply 0 retweets 0 likes -
No. Coding in assembler has nothing to do with writing secure software (in fact it's a lot worse most of the time), and certainly has nothing to do with the physical attacks I'm talking about, which cannot be mitigated in any programming language.
3 replies 0 retweets 1 like -
For example, in assembly language, there are technics from assembly language jedi knights like me to mitigate stack & buffer overflow, but also ROP and maybe JOP (I'd have to review JOP's white paper to ensure my tricks can work). It's all a matter of being an advanced highly
1 reply 0 retweets 0 likes -
Or you could just code in Rust and never have to worry about buffer overflows. Sorry, I would never hire you. You don't know what you're talking about if that's your mindset. If you think coding in assembler means you write more secure code, I am certain your code is not secure.
5 replies 0 retweets 0 likes -
Do I won't argue with you. Code in Rust, it's an option, but coding in Rust makes you dependant of an OS, of a kernel, of libraries, full of security breaches. When I code in assembly language, usually for embedded systems, 100% of the code is my own code. I use no library.
1 reply 0 retweets 0 likes -
If you had actually looked into Rust, you'd know it works standalone without an OS, a kernel, or anything but a tiny subset of the standard library, which is itself written in Rust and thus largely free of security flaws by design. Rust works fine on embedded systems.
3 replies 0 retweets 1 like -
Great for those who don't have my skills in assembly language.
1 reply 0 retweets 0 likes -
Great for those who want to write maintainable and safe code efficiently. You do you, but I still won't hire you. You're not superhuman, your assembly has exploitable bugs. The only way to write safe code is to use tools that reduce the chances of mistakes.
3 replies 0 retweets 0 likes -
I am working more that you think with other crypto-anarchist friends on secure coding tools, and I strongly believe it's the future, but just don't say secure code can't be done manually in assembly language with specific coding constraints and rules.
1 reply 0 retweets 0 likes
Of course secure code *can* be done in asm (e.g. just take the output of a Rust compiler, it's asm), but the point is that it's a lot *harder* and you're a lot more *likely* to have bugs in asm and thus it's almost impossible for a huge pile of asm written by a human to be secure
-
-
My longest ASM program is about 700000 lines of code. I coded it 20 years ago, and could jump right now into the code as if it was yesterday. There are a reasons for that. And it is not a matter of having a good memory.
1 reply 0 retweets 0 likes -
If it were written in Rust it probably would be about 20000 lines of code if not less, and anyone familiar with the language would be able to jump right into the code, and it would probably have about a couple dozen fewer exploitable bugs that you don't know about :-)
2 replies 0 retweets 0 likes - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.