~?~

~?~

~?~

~?~

~?~

~?~

~?~

Christine Dodrill - Blog - Contact - Gallery - Resume - Talks - Signal Boost - Feeds | GraphViz - When Then Zen Twitter Facebook Description On November 22, I sent a tweet that contained the following text: #467662 #207768 #7A7A6C #6B2061 #6F6C20 #6D7079 #7A6120 #616C7A #612E20 #5A6C6C #206F61 #61773A #2F2F6A #6C6168 #6A6C68 #752E6A #736269 #2F6462 #796675 #612E6E #747020 #6D7679 #207476 #796C20 #70756D #767974 #686170 #76752E This was actually the first part of a scavenger hunt/mini CTF that I had set up in order to see who went down the rabbit hole to solve it. I've had nearly a dozen people report back to me telling that they solved all of the puzzles and nearly all of them said they had a lot of fun. Here's how to solve each of the layers of the solution and how I created them. The first layer was that encoded tweet. If you notice, everything in it is formatte...

Christine Dodrill - Blog - Contact - Gallery - Resume - Talks - Signal Boost - Feeds | GraphViz - When Then Zen Twitter Facebook Description When setting up services on your home network, sometimes you have questions along the lines of "how do I know that things are working?". In this blogpost we will go over a few tools that you can use to monitor and visualize your machine state so you can answer that. Specifically we are going to use the following tools to do this: Grafana for creating pretty graphs and managing alerts Prometheus for storing metrics and as a common metrics format Prometheus node_exporter for deriving metrics from system state Loki as a central log storage point promtail to push logs to Loki Let's get going! Mara Something to note: in here you might see domains using the .pele top-level domain. This domain will likely not be available o...

Christine Dodrill - Blog - Contact - Gallery - Resume - Talks - Signal Boost - Feeds | GraphViz - When Then Zen Twitter Facebook Description Recently I introduced Mara to this blog and I didn't explain much of the theory and implementation behind them in order to proceed with the rest of the post. There was actually a significant amount of engineering that went into implementing Mara and I'd like to go into detail about this as well as explain how I implemented them into this blog. Mara is an anthropomorphic shark. They are nonbinary and go by they/she pronouns. Mara enjoys hacking, swimming and is a Chaotic Good Rogue in the tabletop games I've played her in. Mara was originally made to help test my upcoming tabletop game The Source, and I have used them in a few solitaire tabletop sessions (click here to read the results of one of these). Mara I use a h...

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen Multiple vulnerabilities in the mysqljs API and code. Security Warning Level: yikes/10 There are multiple issues exploitable by local and remote actors in mysqljs . These can cause application data leaks, database leaks, SQL injections, arbitrary code execution, and credential leaks among other things. Mysqljs is unversioned, so it is very difficult to impossible to tell how many users are affected by this and what users can do in order to ensure they are patched against these critical vulnerabilities. Mysqljs is a library intended to facilitate prototyping web applications and mobile applications using technologies such as PhoneGap or Cordova . These technologies allow developers to create a web application that gets packaged and presented to users as if it was a native application. This lib...

~?~

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen 2018-09-05 - Olin: 2: The Future 2018-09-01 - Olin: 1: Why 2018-06-18 - Land 1: Syscalls & File I/O Copyright 2019 Christine Dodrill. Any and all opinions listed here are my own and not representative of my employers; future, past and present. ...

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen Waking up, you feel a rather large warm, fuzzy blob on top of you. You feel it stretch out and start to wake up too, then it changes its mind and starts to viciously cuddle you to death. A peaceful night’s sleep is being breached by a batpony. “Morning~” she says to you. You reply “morning” back and she rolls to lay next to you so you can sit upright. Giving the poni pets, you slowly start to wake up and check on the notifications you missed overnight. She purrs gently. That is basically what it feels like when I wake up nowadays. I’m not entirely alone mentally anymore. I live alone, work remotely, and yet I almost always pair program. When I write, I get advice on how to word things. When I speak to people, I get shut up if I am saying too much. When I design software, I get told how theoretical t...

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen This is an experiment in blogging. I am going to be putting my tweets and select replies one after another without commentary. shitty synthetic benchmark idea: how long it takes for a compiler to handle a main function with 1.2 million instances of printf("hello, world!\n") or similar — Cadey Ratio 🌐 (@theprincessxena) October 2, 2019 fun fact, you need an AWS x1.16xlarge instance to compile 1.2 million lines of rust source code — Cadey Ratio 🌐 (@theprincessxena) October 2, 2019 oh god that might not be enough — Cadey Ratio 🌐 (@theprincessxena) October 2, 2019 oh god, is that what X1 is for??? My wallet just cringed. — snake enchantress (@AstraLuma) October 2, 2019 They have been now https://t.co/o5vMKx583C — Cadey Ratio 🌐 (@theprincessxena) October 2,...

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen or: How I got my blog onto it with autodeployment via GitHub Actions. The world was once a simple place. Things used to make sense, or at least there weren’t so many layers that it became difficult to tell what the hell is going on. Then complexity happened. This is a tale of how I literally recreated this meme: Deployed my blog on Kubernetes pic.twitter.com/XHXWLrmYO4 — DevOps Thought Liker (@dexhorthy) April 24, 2017 This is how I deployed my blog (the one you are reading right now) to Kubernetes. Before I deployed my blog to Kubernetes, I used Dokku , as I had been for years. Dokku is great. It emulates most of the Heroku “git push; don’t care” workflow, but on your own server that you can self-manage. This is a blessing and a curse. The real advantage of managed services like Herok...

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen h is a project of mine that I have released recently. It is a single-paradigm, multi-tenant friendly, turing-incomplete programming language that does nothing but print one of two things: the letter h a single quote (the Lojbanic “h”) It does this via WebAssembly . This may sound like a pointless complication, but actually this ends up making things a lot simpler . WebAssembly is a virtual machine (fake computer that only exists in code) intended for browsers, but I’ve been using it for server-side tasks. I have written more about/with WebAssembly in the past in these posts: https://christine.website/talks/webassembly-on-the-server-system-calls-2019-05-31 https://christine.website/blog/olin-1-why-09-1-2018 https://christine.website/blog/olin-2-the-future-09-5-2018 https://christine.website/blog/l...

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen Root-level Remote Command Injection in the V playground (OVE-20190623-0001) The real CVEs are the friends we made along the way awilfox While playing with the V playground , a root-level command injection vulnerability was discovered. This allows for an unauthenticated attacker to execute arbitrary root-level commands on the playground server. This vulnerability is instantly exploitable by a remote, unauthenticated attacker in the default configuration. To remotely exploit this vulnerability, an attacker must send specially created HTTP requests to the playground server containing a malformed function call. This playground server is not open sourced or versioned yet, but this vulnerability has lead to the compromising of the box as reported by the lead developer of V. V allows for calling ...

~?~

Christine Dodrill - Blog - Contact - Resume - Talks | GraphViz - When Then Zen Author’s note: I’ve been going through a lot lately. This Monday I was in the emergency room after having a panic attack. I have a folder of writing in my notes that I use to help work off steam. I don’t know why, but writing this article really helped me feel better. I can only hope it helps make your day feel better too. The year is 2019. Politicians have fallen asleep at the wheel. Capitalism controls large segments of the hearts and minds of the populace. Social class is increasingly only a construct. Popularity is becoming irrelevant. Money has no value. The ultimate expendability of entire groups of people is as obvious as the sunrise and sunset. Nothing feels real. There’s no real reason for people to get up and continue, yet life goes on. Somehow, even after a decade of aid and memes, childr...

Christine Dodrill - Blog - Contact - Resume | GraphViz - When Then Zen TempleOS is a public domain, open source (requires source code to boot) multitasking OS for amd64 processors without EFI support. It’s fully cooperatively multitasked and all code runs in Ring 0 . This means that system calls that normally require a context switch are just normal function calls. All ram is identity-mapped too, so sharing memory between tasks is as easy as passing a pointer. There’s a locking intrinsyc too. It has full documentation (with graphical diagrams) embedded directly in source code. This is outsider art. The artist of this art, Terry A. Davis (1969-2018, RIP), had very poor mental health before he was struck by a train and died. I hope he is at peace. However, in direct spite of this, I believe that TempleOS has immediately applicable lessons to teach about OS and compiler design....

Christine Dodrill - Blog - Contact - Resume – import "vanbi" Package vanbi defines the Vanbi type, which carries temcis, sisti signals, and other request-scoped meknaus across API boundaries and between processes. Incoming requests to a server should create a Vanbi, and outgoing calls to servers should accept a Vanbi. The chain of function calls between them must propagate the Vanbi, optionally replacing it with a derived Vanbi created using WithSisti, WithTemci, WithTemtcu, or WithMeknau. When a Vanbi is sistied, all Vanbis derived from it are also sistied. The WithSisti, WithTemci, and WithTemtcu functions take a Vanbi (the ropjar) and return a derived Vanbi (the child) and a SistiFunc. Calling the SistiFunc sistis the child and its children, removes the ropjar’s reference to the child, and stops any associated rilkefs. Failing to call the SistiFunc leaks the child and it...

Christine Dodrill - Blog - Contact - Resume pemci zo'e la xades ni'o pano ki'o nu cmila .i cmila cei broda .i ke broda jo'u broda jo'u broda jo'u broda jo'u broda jo'u broda jo'u broda jo'u broda jo'u broda jo'u broda ke'e cei brode .i ke brode jo'u brode jo'u brode jo'u brode jo'u brode jo'u brode jo'u brode jo'u brode jo'u brode jo'u brode ke'e cei brodi .i ke brodi jo'u brodi jo'u brodi jo'u brodi jo'u brodi jo'u brodi jo'u brodi jo'u brodi jo'u brodi jo'u brodi ke'e cei brodo .i ke brodo jo'u brodo jo'u brodo jo'u brodo jo'u brodo jo'u brodo jo'u brodo jo'u brodo jo'u brodo jo'u brodo ke'e cei brodu .i mi brodu This is a synthesis of the broda family of gismu in Lojban. In order to properly understand this lojban text, you must conceive laughter ten thousand times. This is a reference to the Billion laughs attack that XML parsers can suffer from. Transla...

Christine Dodrill - Blog - Contact - Resume A group of blind men heard that a strange animal had been brought to the town function, but none of them were aware of its type. package blindmen type Animal interface{} func Town(strangeAnimal Animal) { Out of curiosity, they said: “We must inspect and know it by type switches and touch, of which we are capable”. type Toucher interface { Touch() interface{} } So, they sought it out, and when they found it they groped about it. for man := range make([]struct{}, 6) { go grope(man, strangeAnimal.(Toucher).Touch()) } In the case of the first person, whose hand landed on the trunk, said “This being is like a thick snake”. type Snaker interface { Snake() } func grope(id int, thing interface{}) { switch thing.(type) { case Snaker: log.Printf("man %d: this thing is like a thick snake", id) For another one whose hand ...

Christine Dodrill - Blog - Contact - Resume Contact Me Skills Go, Lua, Nim, Haskell, C, Python (3.x) and other languages Docker (deployment, development & more) Mashups of data Package maintainer for Alpine Linux Highlighted Projects PonyAPI - My Little Pony: Friendship is Magic Episode information API Aura - PonyvilleFM live DJ recording bot Elemental-IRCd - IRC Server Software This website - The backend and templates for this website Copyright 2017 Christine Dodrill. Any and all opinions listed here are my own and not representative of my employer. ...