While reading "No way to prevent this" say users of only language where this regularly happens, yet another complaining about C code, I was thinking... During the past 20 years, many solutions have been created, but only a few C developers are using them. More recently, the fil-c was created to make C memory safe, hopefully it will be used in the future. The compilers are way better than 20 years ago, and for example, it is now possible to easily export the AST of any C project with clang/llvm. Even more, many compilers are now offering their own tools like static analyser to check the code. In fact, I was currently using few them to test my own pet project sandbox, and it's amazingly pleasant to code with all the flags and all those tools. So, why should we rewrite everything in rust, go or any other "modern" language if the AST is available, and we have ways to convert existing C/C++ code into a safer binary version?
Let's go back to the article, the CVE-2026-92392 is an use after free bug, a classical mistake anyone do at least one time in its developer life. fil-c fixes that, but let's go a bit deeper. C is known to be an interface to low-level language (assembly) and will let you do whatever you want, it means the memory management must be done manually, like any other resources. It's a complex task, and can become a nightmare when dealing with concurrency. Why not using a pattern above that, always in charge to deal with those resources... Oh, wait, it's a kind of garbage collector, right? Or perhaps a kind of state machine, where the state is a resource that can be opened, used or closed. Anyway, adding another layer will increase the complexity of the existing code, but using something like fil-c could really help a lot.
A part of my free-time was dedicated to find design inspiration with Flutter. Thanks to Flutter Awesome, a long list of open-source Flutter projects can be checked! Here a quick list with the ones I liked the most
flutter_social_chat: A simple chat compatible with iOS and Android. The design is really cool.OstrichGram: a desktop (linux/windows) Nostr client.dash_chat_2.1: an interesting library with many reusable widgets.Flutter-Music-Player-App-With-BLoc: I like the clean MVC organization of this application and the fact there is no route defined, only a navigator pushing screen between context.bloc_flutter_app: another example application using the Bloc pattern.
I was playing with the Erlang ssh key interface with Elixir (I wrote an article on that in a French magazine on this topic, but with Erlang). Let generate a public/private key.
$ ssh-keygen -f t.key -t ed25519
...
Your identification has been saved in t.key
Your public key has been saved in t.key.pub
...
$ file t.key.pub
t.key.pub: OpenSSH ED25519 public key
Then, we can use parse and validate it. We are using the :ssh_messagehttps://github.com/erlang/otp/blob/master/lib/ssh/src/ssh_message.erl Erlang module (undocumented) and the :public_key Erlang module to convert it from one format to another one.
# open the file, it can also from any kind of String.()
# element
File.read!("/t.key.pub")
# Split the key with null char, it should returns a list
# of 4 elements
# ["ssh-ed25519", pubkey, comment, ""]
|> then(&Regex.split(~r"\s+", &1))
# Returns only the pubkey
|> Enum.at(1)
# SSH public key is base64 encoded, decode it.
|> Base.decode64!()
# parse the result with ssh2_pubkey_decode/1 function.
# it returns something like that:
# {{:ECPoint, ecpoint}, {:namedCurve, {1, 3, 101, 112}}}
|> :ssh_message.ssh2_pubkey_decode()
# this part is to convert it in PEM format (TLS)
# the firs step is to create an entry with the correct
# ASN1 type (e.g :SubjectPublicKeyInfo)
# {:SubjectPublicKeyInfo, pubkey, :not_encrypted}
|> then(&:public_key.pem_entry_encode(:SubjectPublicKeyInfo, &1))
# the final step is to finalize the PEM encoding
# "-----BEGIN PUBLIC KEY-----\nbase64\n-----END PUBLIC KEY-----\n\n"
|> then(&:public_key.pem_encode([&1]))
Coding
📝 Introduction to Compilers and Language Design, Second Edition: what a great book! It covers all compiling steps, from scanning, parsing, code generation and optimization.
📖 Write You a Haskell: yet another book in Haskell.
📝 Arena Allocators in C: implementing memory allocators in C can be challenging, here a nice article on how to write one using region-based memory management technique or arena allocator
🏗️ eyelang: An experimental symbolic logic programming language using a practical subset of Prolog syntax and .pl files, with query explanations and executable checks.
📝 Concentrated Liability: a security audit report on Ash framework using LLMs.
📝 Generic Dynamic Arrays in C: Another great article by Eliase Ebner.
📝 Why C Strings Suck And How I Fixed Them: A good way to fix C strings. I like it.
📝 Some Advice for Software Developers in the Age of Large Language Models: This post has many good points regarding LLM, especially the quote below. Indeed, I already saw that in a previous position, someone losing many weeks of developing, switching and switching between LLMs to solve a problem.
what are you going to do when the LLM reaches its limit [...] and you are left having to solve the issue on your own? Ask a different LLM? And if that fails? Who are you going to turn to?
📝 C Socket Programming in Linux: Build a TCP Client & Server (Complete Guide): this blog has really nice article! A must read for the one who wants to learn more about C programming!
🌐 Competitive Programming Hall Of Fame: a project created to preserve the history of international championships in competitive programming. This website collects the results of final stages for both worldwide and regional contests. By international championship we mean a contest consisting of several stages available for competitors from more than one country.
System
📝 FreeBSD Cope with Signal Fuckup: installing signal on FreeBSD using chrooted environment. It would have been better to use a jail there, but it looks okay.
📝 We can harden C: why talking about rust or IA, again? If you want to increase the security of you C application, the first step is to enable all warnings and errors, but also all security features offered by your favorite compiler. It will less fun - because the compiler will blame you for every weird stuff you are doing - be the result will be way better. The next step is to ALWAYS code in C with the help of a small test suite framework like munit or minunit. Easy to install and easy to use, it will easier to create your tests and design your application. Finally, don't forget to use the modern tools available on gcc or llvm, like static analyzers. Not everything will be fixed though, and if you need a really strong application, you should check the security features offered by FreeBSD (capsicum), OpenBSD (pledge, unveil) or Linux. Anyway, C hardening can be challenging, not because of the complexity, but more because of our ignorance about all the tools available.
📝 Building OCI Images Without a Daemon or a Dockerfile: how to build OCI image from scratch, here the repository on github.
📝 Understanding the Linux Kernel: Namespaces: yet another article on the namespaces.
📝 Your Computer Memory Is A Lie: a post doing a summary of the problems involving memory (in general).
Database
📑 Distributed Datalog at Scale with Worst-Case Optimal Joins
🏗️ pglifecycle: keeps your database schema in a version-controlled project of YAML files — one file per database object, validated against a JSON-Schema contract — and moves schema between the repository and live databases.
security
📝 Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD: an interesting report about one of the security issues recently published on OpenBSD. This is a nasty issue, present there for more than 3 decades.
🌐 zr.ax: classifies executables and raw firmware, with interactive Hilbert entropy maps, a hex inspector, and batch analysis. via Kenan Sulayman
📝 Azure's Weakest Link - Five Full Cross-Tenant Compromises: oof. a violent and nasty security issue on azure cloud that can extract user secret via a craft URL encoded path.
📑 Hardware-Assisted Rootkits: Abusing Performance Counters on the ARM and x86 Architectures
📝 Fingerprints are the new cookies
📝 Confessions of a Professional Hacker: Can the CIA or other Intelligence Agencies Track My Every Move?: yes. Any state agencies with enough resources can track anybody without any problem. It's becoming very hard to be protected against that, even without any digital devices, you are becoming a target.
📝 A story of wifi secrets, UART lockdowns and a damaged flash memory chip
🏗️ openwrt-one-sdr: Turns an OpenWrt One router into a wideband, receive-only software-defined receiver. The board's MediaTek MT7981B Wi-Fi SoC (with an MT7976 radio front end) captures raw 14-bit IQ from the 2.4 and 5 GHz bands at 40 Msps, the dual Cortex-A53 streams it over the 2.5 GbE port as VITA 49, and a Linux host shows it as a live spectrum and waterfall in the browser.
Security/Cryptography
Security/Red-Team
🏗️ exploit-watch-archive: durable, private aggregation of the exploit/PoC source repos tracked by the exploit-watch monitoring task.
Embedded
📝 The FPGA Chronicles: Ready To Probe
📝 Another Wireless Chip Has A Hidden SDR Revealed: some ESP32 chips are embedding SDR feature. It looks provising.
Update/Upgrade
🔄 OpnSense: 7 remote exploits. Some of them looks really dangerous, please update.
- opnsense-firmware-mirror-sed
- opnsense-tunables-loader
- opnsense-uidfield-system-uid0
- opnsense-ntp-gps-fudge
- opnsense-wlan-wpa-line
- opnsense-captive-lastseen-roam
- opnsense-tunables-loader
🔄 pfSense: pfSense seems to have been impacted as well.
- pfsense-qinq-parent-if
- pfsense-openvpn-wizard-crlf
- pfsense-limiter-number
- pfsense-carp-vhid
- pfsense-ipsec-login-banner
🔄 Erlang/OTP 29.1.2: bugs and security fixes.
Leaks of the week
📝 Meta: 1500 people impacted after github repositories hacked.
📝 MaQuestionMedicale: 96000 people impacted, 369k private messages, with name, phone number, and more.
📝 Solution30: more than 10millions identifiers impacted, 11 millions phone number, 2 millions e-mail address.
🐦 Canva: 200 millions database rows including enterprise license, and orders.
🐦 Sourcenext Corporation: 22.5 millions customer records including name, phone numbers, e-mail addresses, passwords, postal address...
Misc
📝 I don't understand this whole idiotic concept of "don't use AI for X".: The problem is not the LLM/AI per se, but where the computation is made. A compiler and most of the software a developer is using are hosted on their own laptop or on a server they are owning. The result is their own binaries, on their own infrastructure. Today, most - if not all - LLMs are being used through big companies (e.g. Google, Microsoft, Apple, Meta, Anthropic and so on), where the definition of "freedom of usage" is globally incompatible with open-source software. Yes this is a tool, but a tool one is using remotely, on servers no one controls. That's crazy someone like Torvalds does not understand that. When local-LLMs will be working correctly, I think it will be huge win for the open-source world, but for now, this is a future trap.
Cover Image by freestocks on Unsplash
Top comments (0)