"MuPDF versions before 1.28.5 use an implementation of the drand48 family" yeah, ok, so they're basically not doing real encryption. The number of bits in the key space isn't the real story; the keys simply aren't cryptographically random.
You could do what openbsd did and tie all the traditional weak psudorandom interfaces into a cryptographically secure one. it will still match the drand48() interface. I still don't think I would use them for secure things but now rand() is actually random. http://man.openbsd.org/drand48
Another pet peeve is when people use the rand() when they want hash() but I will leave that rant for another day.
What is wrong with software engineers that we keep making really stupid basic mistakes like this? Sometimes I think programming should require licensing and regular testing.
We direly need to split things into a licensed engineering field which is necessary for working on security- and reliability-critical systems, and a generic unlicensed software developer field where people can screw around with their 1000 dependency JS frontends to their hearts' content. The two should not be conflated and yet so easily are.
Certification do exist for engineers, and various industries and governments impose their own certification programs on platforms and software before they’re authorised for use.
Each with varying degrees of trust. The outcome is never perfect, but that’s not their purpose.
University degrees are not the difference between an engineer and a developer, universities have churned out millions of people who don't care about programming and have no idea what they're doing, who are just following the script with as little effort as possible because they were told it was the easiest way to make a lot of money.
Be careful to use the cryptographic one, not rand(3)
And if you're a sysadmin, be extremely careful when generating keys in VMs or embedded devices. They tend to overestimate their entropy sources - it's possible that every clone of a VM generates the same keys. In some cases (cough ECDSA) generating the same key and nonce to sign two different messages is catastrophic - it immediately leaks the private key.
btw, the idea that the system rng isnt good enough, or "runs out" or whatever, is no longer true on pretty much every modern, widely used os.
btw... im sure there's some legacy rng in windows or some shit that isnt good. read the docs but if it's the blessed system rng, you're probably fine!
although... i suppose if this is news to you (the person reading this), then you probably shouldn't be implementing whatever you are that really requires prng. ask a friend for help. im not trying to be a jerk, i just want to make sure you dont hurt yourself!
File formats are the buffer issue honeypot. You may be aware of how often video and audio codecs have vulnerabilities - it's nearly never the hand-tuned frame decode assembly (where you would think all the mistakes would be). It's nearly always the thing that reads the metadata and encoded frames to memory. Binary formats have things like offsets in them, and those can be trivially used to overrun.
Same thing applies here. Even Rust has a crate for dealing with binary data, despite its memory promises: https://crates.io/crates/untrusted
It's a fucking minefield, and this is one area where the Rust zealots are undeniably correct. It doesn't have to be Rust, any memory safe language will do, but Rust also happens to be performance competitive and that's usually also desirable.
I think the claim is hyperbolic, since most people memory-unsafe PDF implementations, but PDF is a monster format, a metaformat that brings in virtually every conceivable display format, and their renderer implementations with them, often poorly-maintained, never-touched reference implementations from the before times. PDF is pretty scary.
PDFs are usually untrusted input and C provides no assurance there isn't a bug in the code that allows corrupted input to turn into arbitrary remote code execution.
"MuPDF versions before 1.28.5 use an implementation of the drand48 family" yeah, ok, so they're basically not doing real encryption. The number of bits in the key space isn't the real story; the keys simply aren't cryptographically random.
You could do what openbsd did and tie all the traditional weak psudorandom interfaces into a cryptographically secure one. it will still match the drand48() interface. I still don't think I would use them for secure things but now rand() is actually random. http://man.openbsd.org/drand48
Another pet peeve is when people use the rand() when they want hash() but I will leave that rant for another day.
Per the manpage you linked, openbsd's behavior does not match the drand48() interface, since the drand48() interface requires determinism.
I'm interested in that rant (at $WORK we adopted hash() for almost everything, and I'm curious to hear other perspectives).
What is wrong with software engineers that we keep making really stupid basic mistakes like this? Sometimes I think programming should require licensing and regular testing.
We direly need to split things into a licensed engineering field which is necessary for working on security- and reliability-critical systems, and a generic unlicensed software developer field where people can screw around with their 1000 dependency JS frontends to their hearts' content. The two should not be conflated and yet so easily are.
Certification do exist for engineers, and various industries and governments impose their own certification programs on platforms and software before they’re authorised for use.
Each with varying degrees of trust. The outcome is never perfect, but that’s not their purpose.
This is partly why I'm not too worried about AI slopcode.
The human bar is not that high.
I would much rather have rigorous testing than a filter based on the origin of the code.
What's your method for implementing rigorous testing while using AI?
I think it's safe to assume anything associated with PDFs is radioactive.
Those are not the "software engineers" but coders, those who like to say that the university degree doesn't add anything in programming.
University degrees are not the difference between an engineer and a developer, universities have churned out millions of people who don't care about programming and have no idea what they're doing, who are just following the script with as little effort as possible because they were told it was the easiest way to make a lot of money.
You can get through a Computer Science degree with just a few thousand lines of code if you focus on theory courses.
a small wonder the wunderkinds of computer science were at all capable given their lack of computer science degrees
one and the same
Does the DMCA still make it illegal to access encrypted content no matter how easy it is to discover the key? https://www.law.cornell.edu/uscode/text/17/1201
Would the new LLM model owners like to strike this down, or use it to demonstrate how dangerous unrestricted models can be?
there is a case to be made that weak encryption is equivalent to no encryption at all
Rule #1 of rolling your own RNG: don’t.
Rule #2? Please don’t.
That's why we use the system RNG !
Be careful to use the cryptographic one, not rand(3)
And if you're a sysadmin, be extremely careful when generating keys in VMs or embedded devices. They tend to overestimate their entropy sources - it's possible that every clone of a VM generates the same keys. In some cases (cough ECDSA) generating the same key and nonce to sign two different messages is catastrophic - it immediately leaks the private key.
3 replies →
btw, the idea that the system rng isnt good enough, or "runs out" or whatever, is no longer true on pretty much every modern, widely used os.
btw... im sure there's some legacy rng in windows or some shit that isnt good. read the docs but if it's the blessed system rng, you're probably fine!
although... i suppose if this is news to you (the person reading this), then you probably shouldn't be implementing whatever you are that really requires prng. ask a friend for help. im not trying to be a jerk, i just want to make sure you dont hurt yourself!
Rule 3: Use as many bits of randomness as the key size.
Rule 3b: Failing rule 3, disclose motivations and full list of employers and / or customers
Rule 3c: At least as many bits. Bits tend to not be as random as you think they are
That's way too many PDF implementations affected by this category of stupidity.
It makes me wonder: Coincidence, really? There's enough there to think that there might be some invisible hand behind it.
Wonderful.
it's like the weak hardware wallet entropy bug
Obligatory xkcd https://m.xkcd.com/221/
I assume this is the fruit of AI-driven decompilation? Nice work.
You'd have to be completely off your rocker to use a PDF tool written in C anyway.
very VERY few people judge tools like this by the language used to develop them.
How many people judge their tools based on the AES key entropy?
1 reply →
just down vote it.
You can downvote anything not interesting.
If he have list some alternative or give example, it might be interesting.
What are the alternatives?
PDF.js, for example. It's what Firefox uses, and most websites with integrated on-page PDF viewing functionality.
Genuine question, since I'm not very knowledgeable about this: why is using C for a PDF tool such a bad idea?
File formats are the buffer issue honeypot. You may be aware of how often video and audio codecs have vulnerabilities - it's nearly never the hand-tuned frame decode assembly (where you would think all the mistakes would be). It's nearly always the thing that reads the metadata and encoded frames to memory. Binary formats have things like offsets in them, and those can be trivially used to overrun.
Same thing applies here. Even Rust has a crate for dealing with binary data, despite its memory promises: https://crates.io/crates/untrusted
It's a fucking minefield, and this is one area where the Rust zealots are undeniably correct. It doesn't have to be Rust, any memory safe language will do, but Rust also happens to be performance competitive and that's usually also desirable.
4 replies →
I think the claim is hyperbolic, since most people memory-unsafe PDF implementations, but PDF is a monster format, a metaformat that brings in virtually every conceivable display format, and their renderer implementations with them, often poorly-maintained, never-touched reference implementations from the before times. PDF is pretty scary.
PDFs are usually untrusted input and C provides no assurance there isn't a bug in the code that allows corrupted input to turn into arbitrary remote code execution.
3 replies →
buffer overflow vulnerability in code dealing with user generated data and a complex file format.