#morello — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #morello, aggregated by home.social.
-
Sixth (and final) part of this series on the #NewOrleans connections of #NYC #Mafia boss Giuseppe #Morello is now available.
-
Kicking off a series on early NY #Mafia boss Giuseppe #Morello and his possible involvement in a #NewOrleans tragedy.
Latest free article from the MobHistory Substack.
-
Bruce #Springsteen and Tom #Morello Rouse Anti-Fascist Fervor at First Ave
Fists were pumped, tears were cried, and 'fuck' was shouted at the #Minneapolis anti-ICE rally we all needed.
https://racketmn.com/bruce-springsteen-and-tom-morello-rouse-anti-fascist-fervor-at-first-ave
-
#Minnesota #Springsteen #Morello
"Bruce Springsteen and Tom Morello Rouse Anti-Fascist Fervor at First Ave
Fists were pumped, tears were cried, and 'fuck' was shouted at the Minneapolis anti-ICE rally we all needed.
Admit it—you feel a little goofy when you cheer in response to a musician shouting out Minneapolis or St. Paul or Minnesota from the stage. It’s a good kind of goofy, no doubt, all part of the fun of going to a gig. But we’re aware and so are they that everyone’s participating in a ritual. No matter how special they say we are, we know they say that to all the cities.
But every shout out to Minneapolis and Minnesota at the 'Defend Minnesota' concert at First Avenue Friday afternoon felt like genuine recognition, and was received as such. Minnesota had earned it, through the disciplined and dogged resistance of our community to a violent federal occupation."
https://racketmn.com/bruce-springsteen-and-tom-morello-rouse-anti-fascist-fervor-at-first-ave
-
#OTD (Dec 22) in 1903, Ignazio #Lupo marries Salvatrice #Terranova in #Manhattan, with Giuseppe #Morello and Nicolina Salemi serving as witnesses.
-
#OTD (Nov 27) in 1909, Sam #Lucchino (shown) of #PittstonPA agrees to testify in court against #NewYork #Mafia leader Giuseppe #Morello and his #counterfeiting gang.
-
#OTD (Nov 16) in 1909, Giuseppe #Morello, Antonio #Cecala, Giuseppe #Boscarino, Nicholas #Terranova (shown) and ten other codefendants are arraigned before a federal commissioner on #counterfeiting charges.
-
#OTD (Nov 15) in 1909, Giuseppe #Morello (shown), Ignazio #Lupo and a dozen others are arrested in #NewYorkCity for running a #counterfeiting plant at an upstate #NewYork location.
-
RE: https://infosec.exchange/@cheri_alliance/115304565481924558
Morello is a modified quad-core Neoverse N1 with CHERI support. The UK Government funded a lot of the development and there are a few tens of them left over that don't yet have homes.
They look like real computers (ATX case, HDMI out). The under my desk runs CheriBSD (FreeBSD fork), KDE with its Wayland compositor and a bunch of userspace apps, with everything including the GPU drivers memory safe. It can also run AArch64 binaries, but that's less fun.
If you're doing interesting research that would benefit from CHERI or if you are looking to evaluate building products on CHERI systems, reach out to the CHERI Alliance.
CHERI RISC-V (the 'Y' base) is near to standardisation, so there should be RISC-V CHERI application cores available fairly soon, but the Neoverse N1 is a fairly advanced microarchitecture (designed for server chips) and it will probably take a while for RISC-V chips to equal it in performance. It was a fairly rushed conversion to CHERI, so has a few significant performance artefacts that won't be there in a production chip, but this is still probably the best opportunity to get a desktop CHERI system for at least the next year or two.
-
Colin Percival's AWS re:Invent asks
https://www.daemonology.net/blog/2024-12-04-My-reinvent-asks.html
-
Tom Morello
https://www.youtube.com/watch?v=X72sMwSx1ac
#youtube_arteconcert #tom_morello #tom_morello_arte #tom_morello_hellfest #arte #concert #arte_concert #tom_morello_live #tom #morello #rock_music #hellfest_open_air #hellfest_arte_concert #hellfest_open_air_2024 #hellfest #hellfest_arte #hellfest_2024 #live #music #2024 #rage_against_the_machine #metal #metal_music -
Done 2 jars of cherries in alcohol and 1 of cherries in syrup, which is enough as I still have some from previous years. Next job is Hungarian style chilled cherry soup - 400g of cherries makes 2 portions.
#Morello #Cherries #HomeGrown #Cooking
https://www.jim-easterbrook.me.uk/2022/06/hungarian-sour-cherry-soup-revisited/ -
Arm Morello
https://www.youtube.com/watch?v=2zi28s83exk
– overheard during day one of the FreeBSD Developer Summit at BSDCan 2024.
-
Do you want to see #CHERIoT talking to #Morello, showing big server and tiny IoT-class #CHERI systems from the #DSbD ecosystem? Come to the UKRI stand at CyberUK this week!
-
Okay, I lied slightly on Monday. That wasn't the world's most overengineered light switch. How can you make it more over-engineered? By adding a JavaScript interpreter!
In this version, the #CHERIoT system is connecting to the MQTT broker (still running on a #Morello) and downloading some JavaScript bytecode. An instance of a JavaScript interpreter then runs in a separate compartment, where it can subscribe to MQTT topics, publish on those topics, read the status of the buttons and switches, and control the LEDs.
This brings the total up to 10 compartments (on a device with 256 KiB of RAM), with full spatial and temporal memory safety. In the case of the JavaScript code, with a copying garbage collector. This composes well with the lower-level CHERI memory safety. When a pointer is passed from JavaScript to C/C++, the JavaScript interpreter sets bounds. The JavaScript heap is composed of regions where objects are stable. During a collection, objects are moved to a new allocation and the old blocks are freed. If C/C++ code holds a dangling pointer then it remains valid until the next GC pass and is then invalidated by the underlying CHERIoT temporal safety mechanisms.
Would real IoT devices use JavaScript to control light switches? Maybe not (though you never know), but it demonstrates how flexible the CHERIoT platform is.
We didn't have to modify Microvium to run in a CHERIoT compartment but we did upstream a few (very small!) things to them apply bounds and to allow Microvium to run as a shared library. This means that, if you've got a compartment using JavaScript, you can add another with a tiny memory overhead (on the order of 1-2 KiBs, depending on the amount of JavaScript).
Oh, and although JavaScript is type safe, we don't rely on that for isolation. The JavaScript compartment has access to a very small attack surface and so even bugs in the JavaScript interpreter don't give very much power to an attacker. This means that you can allow device owners to provide their own JavaScript if they want to (with some small extra validation of the messages that they send), without compromising the security of your back-end service.
-
@bugaevc I'll mention, but not advocate, CheriBSD <https://www.cheribsd.org/> …
-
@alilleybrinker It's interesting to see the evolution of attacks. It's worth noting that the higher percentage of non-memory-safety bugs in some aspects of the corpus is because everything in those domains is written in memory-safe languages. Web APIs in PHP, JavaScript, Python, Ruby, and so on are not going to see memory safety bugs.
Memory safety bugs are particularly bad because they step outside of the abstract machine and so are more likely than anything else to lead to arbitrary code execution.
I'm also somewhat amused by Herb's claim that C++ can reach 98% memory safety: On #Morello and #CHERIoT, we've been running 100% memory-safe C++ for years! The improvements that Herb's proposing are important for availability, but we already prevent memory-safety bugs from being confidentiality and integrity violations. We also enforce those same properties even in things that are out of scope for the C++ standard, such as inline assembly.
The growth of the other bug classes is why I say that I don't care about memory safety except as a building block for higher-level abstractions. It's a useful baseline, but language-level enforcement isn't sufficient because your TCB code (the highest-value target for attackers) always needs to step outside of language-level safety to implement those abstractions. We couldn't build things like the CHERIoT compartmentalised network stack and even if we did then we'd be bringing a few million lines of a compiler into our trusted computing base.