Notices by daniel:// stenberg:// (bagder@mastodon.social), page 5

If you want to help us make everything #curl even better, I've created a few issues for things that are missing from the book:

https://github.com/bagder/everything-curl/issues

Today is 4 years since the fun Mr Robot curls reveal. https://daniel.haxx.se/blog/2019/12/10/mr-robot-curls/ #curl

7. The initial bootloader to load Rockbox was then just such a crafted HTML file that would load the correct firmware, and since it still worked after reboots it was a pretty neat hack.

8. Eventually the encryption key for the bootloader was found in the SRAM of the running device, and we could encrypt and create custom "real" bootloaders for the devices.

9. Rockbox would then boot and run natively on ipods.

The rest is history.

5. Now the exploit was rewritten to read memory, and *blink* out the contents using the LCD backlight. A LEGO construction was built and a webcam would register the binary stream of a few megabytes of memory contents. Slooooow.

6. Using this method, the USB controller memory mapped registers were found and it was similar to another device Rockbox did USB on. The memory-dump code was rewritten to instead dump the entire memory over USB.

(...)

3. The buffer in the HTML file had to be written without using a zero byte, and someone wrote a ARM assembler loop that would just write data to memory. We had a rough idea what SoC was in there, so we knew a little of what to try.

4. Eventually, one day, that operation made the LCD backlight blink! The LCD controller was found in memory.

(..)

How the first gen ipod was reverse engineered to run #Rockbox:

1. Someone figured out that when loading a particular HTML page (for viewing on the device), the device would reboot. It crashed. A buffer overflow in the HTML viewer!

2. The device remembered what it did before the crash, so it would reload the HTML page again after boot. Unless you connected to it over USB and removed the HTML file it would stick in this cycle.

(continues...)

buckle up, at this time tomorrow #curl 8.5.0 is out.

180+ bugfixes, 78 contributors, 40 authors, two CVEs. And more.

Took a lunch walk in the sun to prepare for next week

I never used any of the modern AI tools for writing code, copilot etc. I'm old. Traditional. Using emacs. And I write my code manually - like a cave man.

You'd think there would be a theoretical max we would eventually reach, but clearly we are not there yet.

101

The updated 100 operating systems #curl has run on. (Dropped two, added two)

""Mastering #libcurl" starts on November 16 with part 1. I just reached 170 slides (!) in the full presentation. And I'm not done yet...

https://daniel.haxx.se/blog/2023/11/01/mastering-libcurl/

#curl coasters

https://daniel.haxx.se/blog/2023/11/03/curl-coasters/

tiny-curl 8.4.0 is here for you running RTOSes on really small systems: https://curl.se/tiny/ #curl

Daniel’s weekly report April 14, 2023
https://lists.haxx.se/pipermail/daniel/2023-April/000012.html
live-stream, haxx.se, URL, trurl, CVE, keynote, HTTP/2 with proxy

"mastering the #curl command line" has been viewed 12,000 times in less than two months.

https://youtu.be/V5vZWHP-RqU

@nixCraft that would be me and my friends. You're welcome!

I'm slowly working on my keynote presentation for #Pycon Stockholm on November 9 https://www.pycon.se/

Here's a sneak preview of a slide with an Open Source maintainer truth it took me a long time to figure out.

Some people say the #libcurl API provides so many options it is hard to navigate. Then I just show them this slide listing them all. 😁

(working on the pending monster "master libcurl" video tutorial)

New plot added to old graph. Number of lines of code in the #curl tool. From 3,400 lines back in 2000 when libcurl was created, to 22,800 lines now.