JOHN MENERICK OPEN SOURCE FAIRY DUST - DEF CON · 2014-08-23 · open source fairy dust john...
82
OPEN SOURCE FAIRY DUST JOHN MENERICK
Transcript of JOHN MENERICK OPEN SOURCE FAIRY DUST - DEF CON · 2014-08-23 · open source fairy dust john...
O P E N S O U R C E FA I R Y D U S TJOHN MENERICK
S E C U R I T Y D R A G O N @ N E T S U I T E
T H E V I E W S A N D O P I N I O N S E X P R E S S E D H E R E A R E M Y O W N O N LY A N D I N N O W AY R E P R E S E N T T H E V I E W S , P O S I T I O N S O R O P I N I O N S - E X P R E S S E D O R I M P L I E D - O F M Y E M P L O Y E R ( P R E S E N T A N D PA S T ) O R A N Y O N E E L S E .
M Y T H O U G H T S A N D O P I N I O N S C H A N G E F R O M T I M E T O T I M E ; T H I S I S A N AT U R A L O F F S H O O T O F H AV I N G A N O P E N A N D I N Q U I S I T I V E M I N D .
S E C U R I T Y D R A G O N @ N E T S U I T E
T H E V I E W S A N D O P I N I O N S E X P R E S S E D H E R E A R E M Y O W N O N LY A N D I N N O W AY R E P R E S E N T T H E V I E W S , P O S I T I O N S O R O P I N I O N S - E X P R E S S E D O R I M P L I E D - O F M Y E M P L O Y E R ( P R E S E N T A N D PA S T ) O R A N Y O N E E L S E .
M Y T H O U G H T S A N D O P I N I O N S C H A N G E F R O M T I M E T O T I M E ; T H I S I S A N AT U R A L O F F S H O O T O F H AV I N G A N O P E N A N D I N Q U I S I T I V E M I N D .
W H AT W E A R E N O T TA L K I N G A B O U T
W H AT W E A R E TA L K I N G A B O U T
THE INTERNET - C IRCA 2007
THE INTERNET - C IRCA 2007
N O O N E S A I D I T WA S S E C U R E
N O O N E S A I D I T WA S S E C U R E
N O O N E S A I D I T WA S S E C U R E
O O P S !
O O P S !
” O P E N S O U R C E I S M O R E S E C U R E . ”
O O P S !
” O P E N S O U R C E I S M O R E S E C U R E . ”
O O P S !
I N T E R N E T S O C I E T Y P R E S I D E N T
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
“This is a story about four people named
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
“This is a story about four people namedEverybody,
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
“This is a story about four people namedEverybody,Somebody,
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
“This is a story about four people namedEverybody,Somebody,
Anybody, and
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
“This is a story about four people namedEverybody,Somebody,
Anybody, andNobody.
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
“This is a story about four people namedEverybody,Somebody,
Anybody, andNobody.
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
There was an important job to be done and Everybody was asked to do it.
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Everybody was sure
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Somebody would do it.
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Anybody could have done it, but
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Nobody did it.
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Somebody got angry about that,
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
because it was
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Everybody's job.
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Everybody thought
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Anybody could do it but
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Nobody realized that
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
Everybody wouldn't do it.
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
It ended up that Everybody blamed Somebody when Nobody did what Anybody could have done.”
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
It ended up that Everybody blamed Somebody when Nobody did what Anybody could have done.”
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
It ended up that Everybody blamed Somebody when Nobody did what Anybody could have done.”
E V E RY B O D Y ’ S J O B I S N O B O D Y ’ S J O B
It ended up that Everybody blamed Somebody when Nobody did what Anybody could have done.”
Financial
Fun
Hobbyist
Activist
Financial
Fun
Hobbyist
Activist
“ O P E N S O U R C E P R O J E C T S P L AY A C R U C I A L R O L E I N T H E D I G I TA L A G E B U T A R E M A I N TA I N E D B Y A S M A L L ,
S T R A I N E D C A D R E O F V O L U N T E E R S . ”
Functionality
UsabilityPerformance Security
Stability Compliance
UsabilityPerformance Security
Stability Compliance
UsabilityPerformance Security
Stability
Performance Security
Stability
Performance
Stability
Performance
Stability
” T H E R E A R E L O T S O F C R I T I C A L L I B R A R I E S M A I N TA I N E D B Y V O L U N T E E R S T H AT A R E N O T G I V E N E N O U G H
AT T E N T I O N ”
C / C + +
C / C + +
” W H E N Y O U C A R RY P O I N T E R S A R O U N D A N D C A N N O T T R A C K W H E T H E R T H E Y A R E A L I V E A N D
H O W L O N G T H E Y A R E , I T ' S G O I N G T O H U R T. ”
J AVA
J AVA
“ I T I S N O T L I K E J AVA G O T I N S E C U R E A L L O F A S U D D E N . I T H A S B E E N I N S E C U R E F O R Y E A R S . ”
P H P
NO STRATEGY
N O S E C U R I T Y C O N TA C T O R R E P O R T I N G D E F I N E D
Inconsistent coding styles, usage, or complex code
”System administrators hate change when they have to bear the brunt of adverse effects of change.”
CHANGE IS HARD
”System administrators hate change when they have to bear the brunt of adverse effects of change.”
WHAT DO WE
DO NOW?
DEMOS
Hadoop HDFS 2.4.1
Free Radius 3.0.3
Exim
( A N D S O C A N Y O U ! )
WHAT IS YOUR INCENTIVE?
F U L L D I S C L O S U R ES T R E E T C R E D
L U L Z
TOOLING
TUNING AND CORRELATION
TUNING AND CORRELATION
TUNING AND CORRELATION
• hacktheplanet.ninja/index.html
O N E M O R E T H I N G …
2788: char name[PATH_MAX]; // 4,096 Bytes
2802: fscanf is 33,554,431 bytes
