Hacker News: vsgherzi

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Fri, 15 May 2026 05:07:11 +0000

Swift is definitely being used at apple. Most recently added as a CSS parser in safari and running embedded in some of the secure enclave parts. I know there was talk from as far back as strangeloop to get it in the kernel but I'm not sure how far that has gone. That being said they've been huge proponents of fbounds check in clang which can achieve a small portion (but important!) of what memory safe languages can do. I'd also like to see more swift or alternative adoptions I think they have potential and more competition in the safe language space is always welcome.

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Fri, 15 May 2026 04:38:58 +0000

Hm that leaves more questions for me. Why does this path not have bounds checking, is think perhaps a limit of the clang flag or is it more simply a mistake of omission on apples part. Either way it seems like a bad look. I wish we’d get a post mortem

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 23:25:18 +0000

Well it’s memory corruption so I think it’s pretty safe to assume it’s a bounds issue. I’m not sure if it’s possible to get this with something like type confusion tho I could be wrong here.

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 23:22:18 +0000

It’s unironically a good question :)

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 21:27:28 +0000

They don’t seem to state lpe as one of the bugs. Maybe 100k? There’s alot of factors that go into it so I’m really not able to say. I could see it going for lots more or lots less

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 21:07:16 +0000

You shouldn’t, MTE blocks a large chunk of vulnerabilities and makes things like rop and jop very difficult if not impossible now.

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 21:06:19 +0000

This is an lpe I believe what you’re describing is a zero click rce.

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 20:27:29 +0000

I can only imagine that

1. it’s to performance sensitive

2. The os is so darn large it’s hard to recompile everything

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 19:08:54 +0000

Upon further reading on data only attacks

(https://www.usenix.org/publications/loginonline/data-only-at...)

This makes more sense. You don't trigger MTE since you're not doing anything for force MTE to take action the program isn't actually changing.

My other question would be, why didn't apple use fbounds checking here? They've been doing it aggressively everywhere else.

MTE plus fbounds checking everywhere should lead to an extremly hardened OS

New comment by vsgherzi in "First public macOS kernel memory corruption exploit on Apple M5"

vsgherzi — Thu, 14 May 2026 18:32:26 +0000

unfortunately a little light on the details. I'm very curious how the bug survived through MTE

New comment by vsgherzi in "Postmortem: TanStack npm supply-chain compromise"

vsgherzi — Mon, 11 May 2026 21:59:42 +0000

Even linux was subjected to an attack in xz utils. Granted it is much harder and they have a much better auditing problem (something npm should learn from). There really isn't a silver bullet here unfortunately. The industry as a whole needs to get more serious about this.

New comment by vsgherzi in "Incident Report: CVE-2024-YIKES"

vsgherzi — Sun, 10 May 2026 20:54:31 +0000

As I said above

“Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.”

This is my solution. We get the quality of a std lib without forcing it in the std Lib and without extra maintaining cost for the team

New comment by vsgherzi in "Incident Report: CVE-2024-YIKES"

vsgherzi — Sun, 10 May 2026 20:53:34 +0000

The rust team is already stretched pretty thin. A larger library is going to put more pressure on them. These libraries are already maintained and used. The rust project should just directly, fund, Shepard and guarantee a level of quality for the packages. The foundation has started some of this with the maintainers fund. No need to force it all into the std lib. Go has experienced breaking issues with changes in the crypto library causing churn in the ecosystem.

New comment by vsgherzi in "Incident Report: CVE-2024-YIKES"

vsgherzi — Sun, 10 May 2026 18:50:06 +0000

This bloats the std library and forces lots more work and stress on the rust dev team. Not to mention it’ll add more churn to the std lib.

New comment by vsgherzi in "Incident Report: CVE-2024-YIKES"

vsgherzi — Sun, 10 May 2026 18:49:20 +0000

Yeah I’d agree that multiple crates under one project is basically the same as 1 large crate. The real problem is how many people you’re trusting and it’s all coming from the same person.

New comment by vsgherzi in "Incident Report: CVE-2024-YIKES"

vsgherzi — Sun, 10 May 2026 18:18:21 +0000

Crates has also been making efforts to include rust sec, but in addition to the above I would like the community to shy away from many small dependencies to a few larger ones just as tokio has

New comment by vsgherzi in "Incident Report: CVE-2024-YIKES"

vsgherzi — Sun, 10 May 2026 18:17:28 +0000

Supply chain incidents suck and we need to do better. Personally for rust I’m a proponent of the foundation supporting a few core crates that go under the same audit procedure as the main rust language and give funding to the project to limit supply chain vulns. I don’t think the right answer is to remove systems like crates or npm. Crate and npm are a boon for many developers.

New comment by vsgherzi in "GrapheneOS fixes Android VPN leak Google refused to patch"

vsgherzi — Sat, 09 May 2026 21:32:50 +0000

Seems like volunteers and donations? Is there something else I can read to be more informed on this?

New comment by vsgherzi in "You gave me a u32. I gave you root. (io_uring ZCRX freelist LPE)"

vsgherzi — Fri, 08 May 2026 21:27:45 +0000

super curious on this one as well, last I heard they've been enabling it slowly

New comment by vsgherzi in "Apple, Intel have reached preliminary chip-making deal"

vsgherzi — Fri, 08 May 2026 18:13:50 +0000

Boot camp is a windows problem. This can be done today on apple silicon but Microsoft dosent want to go through the effort to support it.