Hasnain says:

“And we are done!

[A screenshot from Cities: Skylines 2 at night ]

I tried not to make this into an in-depth graphics study, but I think I failed. Hope you learned something new”

Hasnain says:

This paragraph left me speechless (for hopefully obvious reasons)

““If this really goes bad, we want to be able to point to our past statements,” a senior U.S. official said. The official said the administration is particularly worried about a narrative taking hold that Biden supports all Israeli military actions and that U.S.-provided weapons have been used to kill Palestinian civilians, many of them women and children. The Defense Department has said the U.S. is not putting any limits or restrictions on the weapons it’s providing Israel. “

Hasnain says:

Let’s all agree to condemn the deaths of innocent civilians everywhere, please. Regardless of which side of the conflict they’re on.

“This is demoralizing work, to have to speak constantly in the vernacular of tragedies and atrocities, to say: Look, look. Remember? That other suffering that was eventually deemed unacceptable? Let me hold it up to this one. Let me show you proportion. Let me earn your outrage. Absent that, let me earn your memory. Please.

I don’t hesitate for a second to condemn the killing of any child, any massacre of civilians. It is the easiest ask in the world. And it is not in spite of that but because of that I say: Condemn the brutalization of bodies. By all means, do. Condemn murder. Condemn violence, imprisonment, all forms of oppression. But if your shock and distress comes only at the sight of certain brutalized bodies? If you speak out but not when Palestinian bodies are besieged and murdered, abducted and imprisoned? Then it is worth asking yourself which brutalization is acceptable to you, even quietly, even subconsciously, and which is not.

Name the discrepancy and own it. If you can’t be equitable, be honest.”

Hasnain says:

Felt myself nodding along the whole time - Elie always puts thoughts to paper way better than I can. Worth a read.

“I am neither Israeli or Palestinian, nor am I an expert on Middle Eastern geopolitics, terrorism, security, or colonization. I am an expert in American constitutional law, which, in this situation, is as useful as being an expert in sand-castle construction during a tsunami. As such, I have little to add to the current international conflagration and the foreign policy discourse around it. Instead, I have tried to read, listen, learn, and generally not say anything that could be used by the most morally bankrupt people to justify the murder of children.”

Hasnain says:

“So how far did we come? The original Python program was going to take 2.9 years to complete at k=5. Our final Rust program only takes 8 minutes on the same dataset. That is roughly a 180,000x speedup. A summary of the key optimizations:

Use Rust’s compiler optimizations.
Hash numbers instead of strings.
Use (indexed) vectors instead of hashmaps.
Use bit-sets for efficient membership tests.
Use SIMD for efficient bit-sets.
Use multi-threading to split the work over many cores.
Use batching to avoid a bottleneck at work distribution.”

Hasnain says:

Yikes.

“All jabber.ru and xmpp.ru communications between these dates should be assumed compromised. Given the nature of the interception, the attacker have been able to execute any action as if it is executed from the authorized account, without knowing the account password. This means that the attacker could download account's roster, lifetime unencrypted server-side message history, send new messages or alter them in real time.

End-to-end encrypted communications, such as OMEMO, OTR or PGP, are protected from the interception only if both parties have validated the encryption keys. The users are asked to check their accounts for new unauthorized OMEMO and PGP keys in their PEP storage, and change passwords.

We tend to assume this is lawful interception Hetzner and Linode were forced to setup based on German police request.
Another possible, although much more unlikely scenario is an intrusion on the internal networks of both Hetzner and Linode targeting specifically jabber.ru — much harder to believe but not entirely impossible.

As of 20 Oct 2023, we’re still waiting for the adequate reply from Hetzner and Linode to our inquiries.”

Hasnain says:

:(

Hasnain says:

“To find this – and similar vulnerability is OSS-Fuzz – would require a redesign of how OSS-Fuzz and especially Clusterfuzz work to allow for more diverse target instrumentation, fuzzer orchestration and correct corpus merging.

The lesson that can be learned from this is that some bugs can not be effectively found with CI based fuzzing, and instead need a long running fuzzing campaign, using different techniques to solve path constraints: CMPLOG, COMPCOV, libfuzzer's value profile and in small and medium projects maybe even one or two concolic execution frameworks.”

Hasnain says:

Love the visualizations here.

"We've covered a lot in this post, and if it has left you yearning for more you won't be disappointed. I've specifically avoided the topics of virtual memory, brk vs mmap, the role of CPU caches, and the endless tricks real malloc implementations pull out of their sleeves. There's no shortage of information about memory allocators on the Internet, and if you've read this far you should be well-placed to dive in to it."

Hasnain says:

Rampant Islamophobia and anti-semitism on the rise again globally. Let’s not do this please :(

“According to written text messages sent to the father of the boy by the mother from the hospital and shared with CAIR-Chicago, the landlord who had been angry with what he was seeing in the news knocked on their door, and when she opened, he tried to choke her and proceeded to attack her with a knife, yelling "you Muslims must die!"

When she ran into the bathroom to call 911, she came out to find that he had stabbed her six-year-old son to death.”