{"version":"1.0.0","segments":[{"startTime":0.3,"endTime":2.31,"body":"In the trust zone."},{"startTime":2.73,"endTime":2.97,"body":"Exactly."},{"startTime":2.97,"endTime":4.68,"body":"With white curtains?"},{"startTime":4.68,"endTime":5.61,"body":"No, it's the other way around."},{"startTime":5.638,"endTime":7.303,"body":"In the white room with black curtains."},{"startTime":7.603,"endTime":9.588,"body":"have nothing to do with any of"},{"startTime":7.603,"endTime":9.588,"body":"what you guys are talking about."},{"startTime":14.74,"endTime":17.799,"body":"Hello, welcome to Security"},{"startTime":14.74,"endTime":17.799,"body":"Cryptography Whatever."},{"startTime":17.799,"endTime":18.699,"body":"I'm Deirdre,"},{"startTime":19.119,"endTime":21.744,"body":"I am David"},{"startTime":21.854,"endTime":21.894,"body":"episode."},{"startTime":22.509,"endTime":23.469,"body":"That's Thomas."},{"startTime":23.829,"endTime":24.459,"body":"Uh,"},{"startTime":24.549,"endTime":27.189,"body":"every episode, and yet"},{"startTime":24.549,"endTime":27.189,"body":"everyone keeps coming back."},{"startTime":27.579,"endTime":27.999,"body":"Yeah."},{"startTime":28.479,"endTime":34.389,"body":"we tried really hard to get a special"},{"startTime":28.479,"endTime":34.389,"body":"guest for to today's episode on Apple's"},{"startTime":34.449,"endTime":38.499,"body":"Memory Integrity Enforcement, and"},{"startTime":34.449,"endTime":38.499,"body":"no one from Apple would come on our"},{"startTime":38.499,"endTime":41.139,"body":"podcast, so we are talking about it."},{"startTime":41.649,"endTime":42.134,"body":"Um,"},{"startTime":42.434,"endTime":42.754,"body":"to nobody."},{"startTime":42.904,"endTime":43.034,"body":"nobody."},{"startTime":43.394,"endTime":44.609,"body":"Yeah, no, it like it."},{"startTime":44.609,"endTime":50.274,"body":"This is a fool's errand, but, uh, we"},{"startTime":44.609,"endTime":50.274,"body":"are trying to dig through this very"},{"startTime":50.604,"endTime":58.184,"body":"cool innovation in low level, operating"},{"startTime":50.604,"endTime":58.184,"body":"system security or system security."},{"startTime":58.664,"endTime":62.624,"body":"and all we have to go on is"},{"startTime":58.664,"endTime":62.624,"body":"basically their long blog post."},{"startTime":63.164,"endTime":67.574,"body":"and so we're trying to go through what"},{"startTime":63.164,"endTime":67.574,"body":"the hell is memory integrity enforcement."},{"startTime":68.189,"endTime":70.799,"body":"And how is it different than"},{"startTime":68.189,"endTime":70.799,"body":"all this other stuff that's been"},{"startTime":70.799,"endTime":73.409,"body":"deployed in say, Android or arm?"},{"startTime":74.126,"endTime":75.266,"body":"so that's what we're trying to do."},{"startTime":75.933,"endTime":77.613,"body":"And just know Apple people."},{"startTime":77.673,"endTime":78.783,"body":"We know you're listening."},{"startTime":78.783,"endTime":80.313,"body":"We know you know who you are."},{"startTime":80.373,"endTime":83.403,"body":"We know that you know"},{"startTime":80.373,"endTime":83.403,"body":"that we know who you are."},{"startTime":83.643,"endTime":87.423,"body":"And when we say things that are slightly"},{"startTime":83.643,"endTime":87.423,"body":"inaccurate, you could have fixed this."},{"startTime":87.473,"endTime":87.823,"body":"Uhhuh."},{"startTime":89.336,"endTime":89.876,"body":"Okay."},{"startTime":89.936,"endTime":93.836,"body":"So this is the post that, apple"},{"startTime":89.936,"endTime":93.836,"body":"released, uh, put out back in"},{"startTime":93.836,"endTime":99.011,"body":"September This is an improvement"},{"startTime":93.836,"endTime":99.011,"body":"that's getting actually shipped in"},{"startTime":99.311,"endTime":102.401,"body":"iPhone 17, it's available now."},{"startTime":102.921,"endTime":103.211,"body":"Okay."},{"startTime":103.571,"endTime":107.771,"body":"I bought one for myself, but I"},{"startTime":103.571,"endTime":107.771,"body":"accidentally shipped it to an address"},{"startTime":107.771,"endTime":111.641,"body":"I don't live at anymore, and then"},{"startTime":107.771,"endTime":111.641,"body":"had to cancel and refund it, and I"},{"startTime":111.641,"endTime":114.401,"body":"haven't gotten a replacement yet since."},{"startTime":115.018,"endTime":117.928,"body":"Very good, very good OPSEC or something."},{"startTime":118.635,"endTime":123.592,"body":"okay, so this is this whole"},{"startTime":118.635,"endTime":123.592,"body":"memory integrity enforcement"},{"startTime":123.592,"endTime":125.302,"body":"is like a suite of things."},{"startTime":125.412,"endTime":130.579,"body":"basically it seems to be a bunch of"},{"startTime":125.412,"endTime":130.579,"body":"improvements that they've already"},{"startTime":130.579,"endTime":135.379,"body":"shipped to their kernel allocators"},{"startTime":130.579,"endTime":135.379,"body":"and to their user land allocators."},{"startTime":135.979,"endTime":141.499,"body":"But also how they're actually managing"},{"startTime":135.979,"endTime":141.499,"body":"memory much farther down in the stack."},{"startTime":141.979,"endTime":146.759,"body":"And some of these are becoming available"},{"startTime":141.979,"endTime":146.759,"body":"to previous ioss and Mac oss and I"},{"startTime":146.759,"endTime":149.339,"body":"assume, you know, vision OSS or whatever."},{"startTime":149.709,"endTime":154.089,"body":"but some of them are like explicitly"},{"startTime":149.709,"endTime":154.089,"body":"because of the hardware and improvements,"},{"startTime":154.339,"endTime":157.609,"body":"in the chips and the like, memory"},{"startTime":154.339,"endTime":157.609,"body":"integrity and things like that,"},{"startTime":157.609,"endTime":160.999,"body":"that like are specifically to the"},{"startTime":157.609,"endTime":160.999,"body":"hardware that's actually getting"},{"startTime":160.999,"endTime":164.709,"body":"shipped, from iPhone 17 and forward."},{"startTime":165.219,"endTime":170.829,"body":"and this is explicitly to try to improve"},{"startTime":165.219,"endTime":170.829,"body":"the security posture of the entire system,"},{"startTime":171.109,"endTime":177.999,"body":"against, memory, attacks, which tend to"},{"startTime":171.109,"endTime":177.999,"body":"be some of the most, dangerous, costly in"},{"startTime":177.999,"endTime":180.309,"body":"terms of the impact and the blast radius."},{"startTime":180.634,"endTime":182.464,"body":"but also are difficult."},{"startTime":182.864,"endTime":185.594,"body":"a lot of times on our podcast we've"},{"startTime":182.864,"endTime":185.594,"body":"talked about, you know, write your"},{"startTime":185.594,"endTime":187.034,"body":"code in a memory safe language."},{"startTime":187.634,"endTime":191.204,"body":"And a lot of these vulnerabilities"},{"startTime":187.634,"endTime":191.204,"body":"are addressed by writing code"},{"startTime":191.204,"endTime":192.164,"body":"in a memory safe language."},{"startTime":192.644,"endTime":197.054,"body":"But, you know, there's a lot of os code"},{"startTime":192.644,"endTime":197.054,"body":"that's still written in non-member safe"},{"startTime":197.054,"endTime":200.324,"body":"languages for very, for one, they're"},{"startTime":197.054,"endTime":200.324,"body":"just been a lot of investment in there."},{"startTime":200.604,"endTime":203.334,"body":"you can't just like throw the baby"},{"startTime":200.604,"endTime":203.334,"body":"out with the bath water and rewriting"},{"startTime":203.334,"endTime":206.094,"body":"everything in memory, safe language,"},{"startTime":203.334,"endTime":206.094,"body":"or the most important things in memory,"},{"startTime":206.094,"endTime":210.811,"body":"safe language is, you know, either"},{"startTime":206.094,"endTime":210.811,"body":"impossible, difficult, takes a long"},{"startTime":210.811,"endTime":213.601,"body":"time, or you know, you have to pick"},{"startTime":210.811,"endTime":213.601,"body":"and choose what those things are."},{"startTime":213.811,"endTime":216.706,"body":"But also there are things"},{"startTime":213.811,"endTime":216.706,"body":"that you do and you are."},{"startTime":217.373,"endTime":221.423,"body":"Os and at like the lower than the"},{"startTime":217.373,"endTime":221.423,"body":"OS level, like in your kernel and"},{"startTime":221.423,"endTime":225.203,"body":"like at your bootloader level and,"},{"startTime":221.423,"endTime":225.203,"body":"further down, you really need to"},{"startTime":225.203,"endTime":227.343,"body":"like get your your hands grubby in."},{"startTime":227.343,"endTime":230.523,"body":"And you can't just, you have"},{"startTime":227.343,"endTime":230.523,"body":"to be doing weird things with"},{"startTime":230.523,"endTime":231.693,"body":"memory and stuff like that."},{"startTime":231.693,"endTime":233.823,"body":"So you can't just rewrite"},{"startTime":231.693,"endTime":233.823,"body":"the world in rust."},{"startTime":234.273,"endTime":238.613,"body":"this is a lot of stuff that's trying to"},{"startTime":234.273,"endTime":238.613,"body":"address that sort of, security posture,"},{"startTime":238.613,"endTime":240.653,"body":"like deep, deep, deep in the stack."},{"startTime":241.033,"endTime":244.423,"body":"in a way that when you have"},{"startTime":241.033,"endTime":244.423,"body":"full control tip to tail, top to"},{"startTime":244.423,"endTime":249.193,"body":"bottom, of your system, they seem"},{"startTime":244.423,"endTime":249.193,"body":"to be uniquely positioned to do."},{"startTime":249.223,"endTime":249.463,"body":"Okay."},{"startTime":249.463,"endTime":253.0,"body":"So, we're just basically gonna"},{"startTime":249.463,"endTime":253.0,"body":"plow through this post and"},{"startTime":253.0,"endTime":254.44,"body":"just branch out from there."},{"startTime":255.107,"endTime":259.697,"body":"iOS attacks, mercenary"},{"startTime":255.107,"endTime":259.697,"body":"software, blah, blah, blah."},{"startTime":259.757,"endTime":260.147,"body":"Yes."},{"startTime":260.147,"endTime":261.227,"body":"Very important."},{"startTime":261.417,"endTime":266.614,"body":"And common denominator targeting"},{"startTime":261.417,"endTime":266.614,"body":"using US iOS, windows and Android."},{"startTime":266.614,"endTime":269.194,"body":"They exploit memory safety"},{"startTime":266.614,"endTime":269.194,"body":"vulnerabilities, which are"},{"startTime":269.854,"endTime":272.374,"body":"interchangeable, powerful, and"},{"startTime":269.854,"endTime":272.374,"body":"exist throughout the industry."},{"startTime":272.524,"endTime":274.579,"body":"I think the interchangeable thing"},{"startTime":272.524,"endTime":274.579,"body":"is actually a really big deal."},{"startTime":275.122,"endTime":277.732,"body":"it's like a thing I think I like,"},{"startTime":275.122,"endTime":277.732,"body":"it's a thing I think people are"},{"startTime":277.732,"endTime":278.992,"body":"probably not gonna talk about enough."},{"startTime":279.172,"endTime":286.072,"body":"So are you saying that's like if you have"},{"startTime":279.172,"endTime":286.072,"body":"your kind of spyware as a service service"},{"startTime":286.072,"endTime":290.572,"body":"stack, you basically have something that"},{"startTime":286.072,"endTime":290.572,"body":"you can deploy cross platform, and then"},{"startTime":290.572,"endTime":294.802,"body":"you're like, cool, I'm on iOS, I'm gonna"},{"startTime":290.572,"endTime":294.802,"body":"plug in this, but if I'm on Android,"},{"startTime":294.802,"endTime":296.332,"body":"I'm gonna plug in this exploit and"},{"startTime":296.377,"endTime":298.987,"body":"I think it's like, I think"},{"startTime":296.377,"endTime":298.987,"body":"it's lower level than that."},{"startTime":298.987,"endTime":302.557,"body":"Now I'm, I'm, I'm talking out of"},{"startTime":298.987,"endTime":302.557,"body":"my ass and extrapolating things"},{"startTime":302.557,"endTime":304.717,"body":"that we like, talk to mark dowd"},{"startTime":302.557,"endTime":304.717,"body":"about and things like that."},{"startTime":304.717,"endTime":305.077,"body":"Right?"},{"startTime":305.347,"endTime":308.577,"body":"But I have no inside knowledge into"},{"startTime":305.347,"endTime":308.577,"body":"how these shops are organized, But"},{"startTime":308.627,"endTime":312.677,"body":"my impression is you've got like,"},{"startTime":308.627,"endTime":312.677,"body":"um, you know, you've got individual"},{"startTime":312.677,"endTime":316.277,"body":"vulnerabilities and then you have a"},{"startTime":312.677,"endTime":316.277,"body":"whole stack of enabling software around"},{"startTime":316.277,"endTime":319.127,"body":"the individual vulnerabilities in kind"},{"startTime":316.277,"endTime":319.127,"body":"of the same way that you would have"},{"startTime":319.127,"endTime":320.987,"body":"multiple sandbox breaks in Chrome,"},{"startTime":321.407,"endTime":325.527,"body":"Like to get from one, area of the"},{"startTime":321.407,"endTime":325.527,"body":"Chrome architecture to another, right?"},{"startTime":325.557,"endTime":328.347,"body":"It is weird to call them components, or"},{"startTime":325.557,"endTime":328.347,"body":"maybe they are components, I don't know."},{"startTime":328.347,"endTime":331.967,"body":"But there's techniques that people"},{"startTime":328.347,"endTime":331.967,"body":"use to pivot from, one kind of exploit"},{"startTime":331.967,"endTime":333.827,"body":"primitive to the next exploit primitive."},{"startTime":333.887,"endTime":337.307,"body":"And I think a lot of modern exploit"},{"startTime":333.887,"endTime":337.307,"body":"development depends on kind of"},{"startTime":337.307,"endTime":339.617,"body":"plugging and playing techniques, right?"},{"startTime":339.677,"endTime":342.587,"body":"Like you've built code that takes"},{"startTime":339.677,"endTime":342.587,"body":"like a write what, where primitive"},{"startTime":342.617,"endTime":346.127,"body":"from, you know, point X to point"},{"startTime":342.617,"endTime":346.127,"body":"y or this kind of type confusion"},{"startTime":346.127,"endTime":347.807,"body":"to point X and point y, right?"},{"startTime":348.107,"endTime":353.177,"body":"And in addition to just trying to solve"},{"startTime":348.107,"endTime":353.177,"body":"those, to break those primitives directly,"},{"startTime":353.387,"endTime":357.047,"body":"it's also valuable to make it so that"},{"startTime":353.387,"endTime":357.047,"body":"every time you have a new vulnerability,"},{"startTime":357.257,"endTime":361.247,"body":"you have to rebuild the whole stack"},{"startTime":357.257,"endTime":361.247,"body":"of enablement stuff around it, right?"},{"startTime":361.307,"endTime":364.917,"body":"So the path from the primitive to actually"},{"startTime":361.307,"endTime":364.917,"body":"doing something useful, has to be built"},{"startTime":364.917,"endTime":366.297,"body":"uniquely for every one of these things."},{"startTime":366.597,"endTime":367.797,"body":"Yeah, that makes sense."},{"startTime":368.117,"endTime":368.777,"body":"It also maybe."},{"startTime":369.202,"endTime":372.982,"body":"The case that like, that path is like"},{"startTime":369.202,"endTime":372.982,"body":"the individual components within that"},{"startTime":372.982,"endTime":377.332,"body":"path are also operating specific and"},{"startTime":372.982,"endTime":377.332,"body":"not just in the, the like obvious"},{"startTime":377.332,"endTime":380.602,"body":"location where like, you know, the part"},{"startTime":377.332,"endTime":380.602,"body":"that gives you control of the windows"},{"startTime":380.602,"endTime":382.312,"body":"kernel is gonna be dependent on windows."},{"startTime":382.312,"endTime":388.529,"body":"But like in a browser renderer process, if"},{"startTime":382.312,"endTime":388.529,"body":"you can find like a privilege escalation"},{"startTime":388.529,"endTime":393.089,"body":"through some syscall that is exposed to"},{"startTime":388.529,"endTime":393.089,"body":"the render process, then you can like skip"},{"startTime":393.089,"endTime":398.939,"body":"the step or you do like a browser sandbox"},{"startTime":393.089,"endTime":398.939,"body":"escape if you can like go straight from"},{"startTime":398.969,"endTime":402.959,"body":"say a render process to the operating"},{"startTime":398.969,"endTime":402.959,"body":"system, but how your mechanism for doing"},{"startTime":402.959,"endTime":404.489,"body":"that is gonna vary platform to platform."},{"startTime":404.999,"endTime":405.329,"body":"Okay."},{"startTime":405.839,"endTime":406.409,"body":"That makes sense."},{"startTime":407.116,"endTime":411.593,"body":"I wasn't sure what's the specifics"},{"startTime":407.116,"endTime":411.593,"body":"were about interchangeable, but Yeah."},{"startTime":411.653,"endTime":412.163,"body":"That makes sense."},{"startTime":412.88,"endTime":415.88,"body":"Apple, improving memory,"},{"startTime":412.88,"endTime":415.88,"body":"safety, swift, blah, blah, blah."},{"startTime":416.547,"endTime":421.377,"body":"In iOS 15, we introduced kalloc_type,"},{"startTime":416.547,"endTime":421.377,"body":"a secure memory allocator for"},{"startTime":421.377,"endTime":424.857,"body":"the kernel, followed in iOS 17"},{"startTime":421.377,"endTime":424.857,"body":"with its usual level counterpart,"},{"startTime":425.157,"endTime":427.617,"body":"X zone malic, secure allocator."},{"startTime":427.617,"endTime":430.737,"body":"Take advantage of knowing the type"},{"startTime":427.617,"endTime":430.737,"body":"or purpose of allocation so that"},{"startTime":430.737,"endTime":431.937,"body":"memory can be organized with it."},{"startTime":431.937,"endTime":435.627,"body":"It makes exploiting most memory corruption"},{"startTime":431.937,"endTime":435.627,"body":"vulnerabilities inherently difficult."},{"startTime":435.957,"endTime":440.247,"body":"So I think this is the stuff that's like"},{"startTime":435.957,"endTime":440.247,"body":"getting back ported to earlier devices."},{"startTime":440.277,"endTime":443.617,"body":"if they can support 15"},{"startTime":440.277,"endTime":443.617,"body":"and iOS 15 and 17, well,"},{"startTime":443.812,"endTime":446.392,"body":"it already exists in those"},{"startTime":443.812,"endTime":446.392,"body":"devices, so it's not really getting"},{"startTime":446.659,"endTime":453.269,"body":"Kal type is basically, an allocator"},{"startTime":446.659,"endTime":453.269,"body":"that like, looks at the structures"},{"startTime":453.269,"endTime":457.769,"body":"that are used in the kernel and then"},{"startTime":453.269,"endTime":457.769,"body":"generates a type signature basically"},{"startTime":457.769,"endTime":463.439,"body":"based off of the, uh, uh, the layout of"},{"startTime":457.769,"endTime":463.439,"body":"the various fields in the struct itself."},{"startTime":464.169,"endTime":464.709,"body":"that's cool."},{"startTime":464.784,"endTime":466.134,"body":"and then only like."},{"startTime":466.801,"endTime":469.976,"body":"And then all, you have like various"},{"startTime":466.801,"endTime":469.976,"body":"buckets that are used at the like"},{"startTime":469.976,"endTime":473.006,"body":"page level allocation, and then"},{"startTime":469.976,"endTime":473.006,"body":"you only put objects of the same"},{"startTime":473.066,"endTime":474.686,"body":"type signature in the same bucket."},{"startTime":475.226,"endTime":479.596,"body":"So that like, you can't ever say,"},{"startTime":475.226,"endTime":479.596,"body":"like have a object that has like an"},{"startTime":479.596,"endTime":481.186,"body":"integer in the first eight bytes."},{"startTime":481.186,"endTime":484.126,"body":"Then be in the same bucket as an object"},{"startTime":481.186,"endTime":484.126,"body":"that has the pointer in the first eight"},{"startTime":484.126,"endTime":488.326,"body":"bytes, and then a bunch of like, stuff"},{"startTime":484.126,"endTime":488.326,"body":"to make that actually work in practice."},{"startTime":488.796,"endTime":494.323,"body":"so the idea is that like in a use"},{"startTime":488.796,"endTime":494.323,"body":"after free situation, you'd only"},{"startTime":494.323,"endTime":498.343,"body":"ever be replacing the object with"},{"startTime":494.323,"endTime":498.343,"body":"an object of the same type, which is"},{"startTime":498.343,"endTime":502.153,"body":"presumably harder to exploit than an"},{"startTime":498.343,"endTime":502.153,"body":"object of a completely different type."},{"startTime":502.188,"endTime":502.608,"body":"Mm-hmm."},{"startTime":502.993,"endTime":505.873,"body":"Thomas, can you explain what a"},{"startTime":502.993,"endTime":505.873,"body":"use after free vulnerability is?"},{"startTime":506.54,"endTime":508.52,"body":"You all know what a use"},{"startTime":506.54,"endTime":508.52,"body":"after free vulnerability is"},{"startTime":508.615,"endTime":509.895,"body":"Explain to our audience?"},{"startTime":510.085,"endTime":510.375,"body":"Yeah,"},{"startTime":510.41,"endTime":514.275,"body":"mean the name is pretty self-explanatory,"},{"startTime":510.41,"endTime":514.275,"body":"but like why is it a vulnerability?"},{"startTime":514.455,"endTime":517.155,"body":"I actually like didn't understand"},{"startTime":514.455,"endTime":517.155,"body":"this until I worked on Chrome."},{"startTime":517.822,"endTime":520.752,"body":"I mean, I think the type confusion thing"},{"startTime":517.822,"endTime":520.752,"body":"might be the simpl— like you just kind"},{"startTime":520.752,"endTime":522.822,"body":"of laid out the obvious case, right?"},{"startTime":522.822,"endTime":523.437,"body":"So like you."},{"startTime":524.104,"endTime":527.314,"body":"Especially in like complicated C and"},{"startTime":524.104,"endTime":527.314,"body":"C++ code bases, like you're allocating"},{"startTime":527.314,"endTime":529.534,"body":"memory and then explicitly freeing memory."},{"startTime":529.534,"endTime":532.114,"body":"And that happens in totally"},{"startTime":529.534,"endTime":532.114,"body":"different places on the call chain."},{"startTime":532.114,"endTime":532.774,"body":"Sometimes."},{"startTime":532.984,"endTime":535.344,"body":"Like you might have something"},{"startTime":532.984,"endTime":535.344,"body":"fire in response to a timer"},{"startTime":535.344,"endTime":536.454,"body":"or something like that, right?"},{"startTime":536.634,"endTime":539.664,"body":"So like this is a really"},{"startTime":536.634,"endTime":539.664,"body":"pernicious class of bugs."},{"startTime":539.664,"endTime":541.014,"body":"Not even necessarily vulnerability."},{"startTime":541.014,"endTime":541.944,"body":"It's just bugs, right?"},{"startTime":541.944,"endTime":544.504,"body":"Like you freed something when you"},{"startTime":541.944,"endTime":544.504,"body":"didn't expect to free something"},{"startTime":544.524,"endTime":546.084,"body":"and you held onto a pointer for it."},{"startTime":546.384,"endTime":549.519,"body":"If you induce those bugs"},{"startTime":546.384,"endTime":549.519,"body":"deliberately, you wind up with."},{"startTime":550.129,"endTime":553.459,"body":"this dangling pointer, and in the"},{"startTime":550.129,"endTime":553.459,"body":"best case, like the dangling pointer"},{"startTime":553.459,"endTime":556.519,"body":"gets used and the program crashes"},{"startTime":553.459,"endTime":556.519,"body":"because it's no longer mapped anything."},{"startTime":556.519,"endTime":558.169,"body":"That's what you want"},{"startTime":556.519,"endTime":558.169,"body":"to have happen, right?"},{"startTime":558.199,"endTime":561.739,"body":"But an attacker inducing this, will set"},{"startTime":558.199,"endTime":561.739,"body":"it up so that, you freed the memory, you"},{"startTime":561.739,"endTime":564.769,"body":"held the dangling pointer, and then it"},{"startTime":561.739,"endTime":564.769,"body":"made a whole bunch of other allocations."},{"startTime":564.769,"endTime":568.219,"body":"And like really strategically with the"},{"startTime":564.769,"endTime":568.219,"body":"allocation pattern picked what your"},{"startTime":568.219,"endTime":569.719,"body":"dangling pointer will now point to."},{"startTime":569.959,"endTime":573.569,"body":"So in that situation, like, David"},{"startTime":569.959,"endTime":573.569,"body":"was just saying, right, you had a"},{"startTime":573.569,"endTime":577.889,"body":"struct, it had like two integers in"},{"startTime":573.569,"endTime":577.889,"body":"the front of it, and now it has a"},{"startTime":577.889,"endTime":579.299,"body":"pointer in the front of it, right?"},{"startTime":579.629,"endTime":582.599,"body":"And like the code path that's"},{"startTime":579.629,"endTime":582.599,"body":"holding that dangling pointer"},{"startTime":582.749,"endTime":584.849,"body":"somehow responds to user input."},{"startTime":585.059,"endTime":588.569,"body":"You write to the integer, and by writing"},{"startTime":585.059,"endTime":588.569,"body":"to that integer, you're writing a pointer"},{"startTime":588.569,"endTime":591.299,"body":"instead of, you know, just the integer."},{"startTime":591.419,"endTime":594.749,"body":"So, like, you're kind of, you're using"},{"startTime":591.419,"endTime":594.749,"body":"that piece of, you're using that piece"},{"startTime":594.749,"endTime":597.449,"body":"of memory as two different types in"},{"startTime":594.749,"endTime":597.449,"body":"two different locations in the code."},{"startTime":597.689,"endTime":600.419,"body":"Like the code is confused about"},{"startTime":597.689,"endTime":600.419,"body":"what the type it is, right?"},{"startTime":600.719,"endTime":604.079,"body":"And you are now rewriting a pointer out"},{"startTime":600.719,"endTime":604.079,"body":"from underneath the code and you can have"},{"startTime":604.079,"endTime":605.939,"body":"it write to a location of your choosing."},{"startTime":606.606,"endTime":610.656,"body":"This is, extremely valuable to an"},{"startTime":606.606,"endTime":610.656,"body":"adversary who's able to just be like,"},{"startTime":611.046,"endTime":616.296,"body":"you thought you were doing this, but I'm"},{"startTime":611.046,"endTime":616.296,"body":"going to twiddle it and I get to make"},{"startTime":616.296,"endTime":618.426,"body":"you do something you weren't expecting."},{"startTime":618.426,"endTime":622.026,"body":"Like, execute this piece of code"},{"startTime":618.426,"endTime":622.026,"body":"when you weren't supposed to."},{"startTime":622.626,"endTime":625.076,"body":"And then you can, leverage"},{"startTime":622.626,"endTime":625.076,"body":"that however you like"},{"startTime":625.551,"endTime":628.461,"body":"it's a way of getting a"},{"startTime":625.551,"endTime":628.461,"body":"write-what-where primitive, right?"},{"startTime":628.671,"endTime":631.671,"body":"Usually a pretty constrained,"},{"startTime":628.671,"endTime":631.671,"body":"write-what-where primitive of, I"},{"startTime":631.671,"endTime":634.161,"body":"get to pick what you're gonna write"},{"startTime":631.671,"endTime":634.161,"body":"and where it's gonna be written to."},{"startTime":634.591,"endTime":638.941,"body":"and that usually historically is game"},{"startTime":634.591,"endTime":638.941,"body":"over and making that not be game over."},{"startTime":639.608,"endTime":641.828,"body":"I'm saying it's game over and it"},{"startTime":639.608,"endTime":641.828,"body":"was probably game over in like"},{"startTime":641.828,"endTime":644.708,"body":"2011 and it's been not game over"},{"startTime":641.828,"endTime":644.708,"body":"ever since then, but whatever."},{"startTime":644.968,"endTime":648.845,"body":"kind of one of the big things about MIE"},{"startTime":644.968,"endTime":648.845,"body":"is making that not be game over anymore."},{"startTime":649.512,"endTime":650.082,"body":"Oh yeah."},{"startTime":650.112,"endTime":652.002,"body":"Making it not be game over."},{"startTime":652.062,"endTime":654.522,"body":"It's game over for the attacker."},{"startTime":654.942,"endTime":655.902,"body":"Ha ha ha."},{"startTime":656.569,"endTime":657.079,"body":"cool."},{"startTime":657.746,"endTime":658.646,"body":"So."},{"startTime":659.313,"endTime":659.673,"body":"Kay."},{"startTime":659.673,"endTime":665.163,"body":"Alec did its nice little"},{"startTime":659.673,"endTime":665.163,"body":"thing inside the, the kernel."},{"startTime":665.733,"endTime":670.083,"body":"And then we have exon maek that's"},{"startTime":665.733,"endTime":670.083,"body":"used by, you know, user land code."},{"startTime":670.633,"endTime":670.813,"body":"yeah,"},{"startTime":670.838,"endTime":673.868,"body":"I would just add that even if you"},{"startTime":670.838,"endTime":673.868,"body":"magically do this in the allocator,"},{"startTime":673.898,"endTime":678.278,"body":"like doing that, this can cause weird"},{"startTime":673.898,"endTime":678.278,"body":"shit to happen because like sometimes"},{"startTime":678.278,"endTime":680.978,"body":"you just might want to like treat some"},{"startTime":678.278,"endTime":680.978,"body":"memory of a different memory and maybe"},{"startTime":680.978,"endTime":683.408,"body":"there's two pointers that are different"},{"startTime":680.978,"endTime":683.408,"body":"types that happen to point at the same"},{"startTime":683.408,"endTime":685.178,"body":"spot and then like stuff gets weird."},{"startTime":685.178,"endTime":685.508,"body":"Right?"},{"startTime":686.058,"endTime":687.678,"body":"or maybe you want to change something out."},{"startTime":688.103,"endTime":690.233,"body":"For something else because"},{"startTime":688.103,"endTime":690.233,"body":"it's the kernel and you're"},{"startTime":690.233,"endTime":691.973,"body":"fundamentally doing unsafe things."},{"startTime":692.313,"endTime":696.213,"body":"like if someone does crap like that"},{"startTime":692.313,"endTime":696.213,"body":"and just like a user land C program,"},{"startTime":696.243,"endTime":699.393,"body":"it's, you know, it's 2025, you have"},{"startTime":696.243,"endTime":699.393,"body":"permission to just go slap them."},{"startTime":699.723,"endTime":703.953,"body":"But in the kernel, like that's just"},{"startTime":699.723,"endTime":703.953,"body":"kind of the way the world is sometimes."},{"startTime":703.953,"endTime":706.833,"body":"So just 'cause you have the"},{"startTime":703.953,"endTime":706.833,"body":"allocator actually using it"},{"startTime":706.833,"endTime":708.243,"body":"can be fairly complicated."},{"startTime":708.243,"endTime":714.37,"body":"Which Apple talks a lot about, in their"},{"startTime":708.243,"endTime":714.37,"body":"massive Kal post from a couple years ago."},{"startTime":715.037,"endTime":718.427,"body":"Which, I'm just, I keep scrolling"},{"startTime":715.037,"endTime":718.427,"body":"through because this is like the"},{"startTime":718.427,"endTime":719.537,"body":"first time I'm looking at it."},{"startTime":719.537,"endTime":724.247,"body":"This is in fact ginormous and"},{"startTime":719.537,"endTime":724.247,"body":"I am not a kernel hacker, so,"},{"startTime":724.964,"endTime":729.314,"body":"I feel like type specific, like"},{"startTime":724.964,"endTime":729.314,"body":"general purpose type specific"},{"startTime":729.314,"endTime":731.384,"body":"allocator was new, right?"},{"startTime":731.564,"endTime":734.664,"body":"Like not a super common, building"},{"startTime":731.564,"endTime":734.664,"body":"program primitive, right?"},{"startTime":734.694,"endTime":737.604,"body":"So you have like, um, you have"},{"startTime":734.694,"endTime":737.604,"body":"protections on like a page-based level"},{"startTime":737.604,"endTime":740.394,"body":"based mostly on allocation sizes, right?"},{"startTime":740.604,"endTime":744.444,"body":"Like you could be strategic about whether,"},{"startTime":740.604,"endTime":744.444,"body":"you know, and I guess you could put"},{"startTime":744.444,"endTime":748.194,"body":"things in different arenas and manually"},{"startTime":744.444,"endTime":748.194,"body":"in your code pick which areas things"},{"startTime":748.224,"endTime":752.514,"body":"are coming out of all with the intent"},{"startTime":748.224,"endTime":752.514,"body":"of trying to avoid that situation where"},{"startTime":752.514,"endTime":755.094,"body":"the struct with the integer and the"},{"startTime":752.514,"endTime":755.094,"body":"struct with the pointer at the beginning."},{"startTime":755.094,"endTime":756.474,"body":"Don't overshare the same memory."},{"startTime":756.524,"endTime":758.834,"body":"And then like, doing that at"},{"startTime":756.524,"endTime":758.834,"body":"the level of a type thing,"},{"startTime":758.834,"endTime":760.784,"body":"which requires compiler help."},{"startTime":761.184,"endTime":761.604,"body":"Mm-hmm."},{"startTime":762.129,"endTime":762.549,"body":"Mm-hmm."},{"startTime":762.854,"endTime":763.334,"body":"compiler help."},{"startTime":763.784,"endTime":764.084,"body":"Yeah."},{"startTime":764.084,"endTime":765.584,"body":"That's, that's, that's newish."},{"startTime":766.251,"endTime":766.731,"body":"Yeah."},{"startTime":766.761,"endTime":770.901,"body":"So Apple gets a lot of benefit here"},{"startTime":766.761,"endTime":770.901,"body":"from basically controlling their own"},{"startTime":770.901,"endTime":775.378,"body":"clang implementation, which they rely"},{"startTime":770.901,"endTime":775.378,"body":"on to be able to do this in the kernel."},{"startTime":775.702,"endTime":780.202,"body":"there is a recent actual, CL"},{"startTime":775.702,"endTime":780.202,"body":"and like c plus plus extension."},{"startTime":780.662,"endTime":785.592,"body":"typed operator knew that, I believe,"},{"startTime":780.662,"endTime":785.592,"body":"I don't remember if LLVM like directly"},{"startTime":785.592,"endTime":787.062,"body":"or if Apple or Google added it."},{"startTime":787.362,"endTime":793.122,"body":"Or some combination thereof, but like in"},{"startTime":787.362,"endTime":793.122,"body":"c plus plus, instead of just overloading"},{"startTime":793.122,"endTime":797.622,"body":"operator new, which takes a size T and it"},{"startTime":793.122,"endTime":797.622,"body":"like gives back some bytes or whatever,"},{"startTime":797.862,"endTime":802.842,"body":"it lets you overload operator new like"},{"startTime":797.862,"endTime":802.842,"body":"a size T, and then a type T, which is"},{"startTime":802.842,"endTime":805.782,"body":"like a 128 bit integer or something."},{"startTime":805.782,"endTime":811.152,"body":"And it just like, it's like, hey, you"},{"startTime":805.782,"endTime":811.152,"body":"know, here's a random type information."},{"startTime":811.152,"endTime":812.502,"body":"Don't ask questions about it."},{"startTime":812.502,"endTime":812.742,"body":"Right?"},{"startTime":812.772,"endTime":817.489,"body":"Um, I think there might be a way to"},{"startTime":812.772,"endTime":817.489,"body":"provide it to define it yourself in"},{"startTime":817.489,"endTime":822.059,"body":"code, but the idea is to make like a"},{"startTime":817.489,"endTime":822.059,"body":"type aware global allocator, something"},{"startTime":822.059,"endTime":824.969,"body":"you could do and use your land c plus"},{"startTime":822.059,"endTime":824.969,"body":"plus code, but it relies on like c"},{"startTime":824.969,"endTime":827.009,"body":"plus plus semantics of operating new."},{"startTime":827.119,"endTime":827.749,"body":"That's nice."},{"startTime":828.416,"endTime":829.256,"body":"I didn't know any of this."},{"startTime":829.973,"endTime":830.423,"body":"okay."},{"startTime":831.09,"endTime":836.55,"body":"I think that's like the first chunk of"},{"startTime":831.09,"endTime":836.55,"body":"memory integrity enforcement, which is"},{"startTime":836.55,"endTime":838.56,"body":"like stuff they already shipped basically."},{"startTime":838.65,"endTime":843.57,"body":"And it's the user land updates to ExOne"},{"startTime":838.65,"endTime":843.57,"body":"Malick or introduction of ex Exxon"},{"startTime":843.57,"endTime":847.49,"body":"Malick and the kernel land, chaotic type."},{"startTime":847.89,"endTime":850.83,"body":"keep in mind the total number"},{"startTime":847.89,"endTime":850.83,"body":"of buckets here is limited."},{"startTime":850.88,"endTime":854.06,"body":"the whole point of the way they'd"},{"startTime":850.88,"endTime":854.06,"body":"score the like structs is to try to"},{"startTime":854.06,"endTime":857.36,"body":"minimize like impact of where like one"},{"startTime":854.06,"endTime":857.36,"body":"thing's an in and one thing's a pointer."},{"startTime":857.36,"endTime":860.48,"body":"But there's an arbitrarily large"},{"startTime":857.36,"endTime":860.48,"body":"number, at least in user land"},{"startTime":860.52,"endTime":862.2,"body":"of types that you can encounter."},{"startTime":862.2,"endTime":864.57,"body":"And like at some point you"},{"startTime":862.2,"endTime":864.57,"body":"have to start reusing buckets."},{"startTime":864.65,"endTime":870.327,"body":"So in 2018, we were the first to deploy"},{"startTime":864.65,"endTime":870.327,"body":"pointer authentication codes in the A 12"},{"startTime":870.327,"endTime":875.674,"body":"chip to protect cont code flow integrity"},{"startTime":870.327,"endTime":875.674,"body":"in the presence of memory corruption."},{"startTime":876.274,"endTime":879.911,"body":"This was very successful,"},{"startTime":876.274,"endTime":879.911,"body":"with PAC behind us."},{"startTime":880.578,"endTime":885.378,"body":"PAC is like a goofy thing because"},{"startTime":880.578,"endTime":885.378,"body":"like, well, I mean, it's not like"},{"startTime":885.748,"endTime":887.378,"body":"I know nothing about P PAC."},{"startTime":887.638,"endTime":891.688,"body":"really hard to describe specifically"},{"startTime":887.638,"endTime":891.688,"body":"what PAC does because it can be used"},{"startTime":891.688,"endTime":895.828,"body":"as a primitive to just build like"},{"startTime":891.688,"endTime":895.828,"body":"your regular control flow integrity,"},{"startTime":895.828,"endTime":899.518,"body":"like forwards edge, backwards"},{"startTime":895.828,"endTime":899.518,"body":"edge or, or only one of the edges."},{"startTime":899.518,"endTime":900.898,"body":"I never remember which one is which."},{"startTime":901.058,"endTime":904.838,"body":"and like basically it boils down"},{"startTime":901.058,"endTime":904.838,"body":"to like, you replace like the"},{"startTime":904.838,"endTime":910.198,"body":"function header, and assembly with"},{"startTime":904.838,"endTime":910.198,"body":"like a pack where, jump and return."},{"startTime":910.865,"endTime":912.905,"body":"and you're supposed to get CFI out of it."},{"startTime":912.965,"endTime":916.685,"body":"And then there's like broader,"},{"startTime":912.965,"endTime":916.685,"body":"but the like base concept behind"},{"startTime":916.685,"endTime":919.655,"body":"pointer off is just somehow"},{"startTime":916.685,"endTime":919.655,"body":"that like there is a signature."},{"startTime":920.06,"endTime":923.09,"body":"In the semi cryptographic"},{"startTime":920.06,"endTime":923.09,"body":"sense in every pointer."},{"startTime":923.09,"endTime":926.3,"body":"And like that signature needs to be"},{"startTime":923.09,"endTime":926.3,"body":"valid for the pointer to be valid."},{"startTime":926.3,"endTime":929.15,"body":"So if you're just dinking around"},{"startTime":926.3,"endTime":929.15,"body":"with pointers, like your signature's"},{"startTime":929.15,"endTime":934.317,"body":"probably not valid, but I mean, or it's"},{"startTime":929.15,"endTime":934.317,"body":"like not valid in the right location."},{"startTime":934.877,"endTime":938.927,"body":"but I don't actually understand how"},{"startTime":934.877,"endTime":938.927,"body":"it works specifically other than"},{"startTime":938.927,"endTime":943.127,"body":"like there are people posting PAC"},{"startTime":938.927,"endTime":943.127,"body":"bypasses, like there, there's at"},{"startTime":943.127,"endTime":947.447,"body":"least one PAC bypass on Apple hardware"},{"startTime":943.127,"endTime":947.447,"body":"submitted to Black Hat like every year,"},{"startTime":947.53,"endTime":951.884,"body":"which is the same thing as CET, the"},{"startTime":947.53,"endTime":951.884,"body":"like intel control, flow integrity."},{"startTime":951.884,"endTime":956.534,"body":"it helps, but like at the end of the day,"},{"startTime":951.884,"endTime":956.534,"body":"like you can usually find a way around it."},{"startTime":957.059,"endTime":957.359,"body":"Okay."},{"startTime":957.659,"endTime":960.149,"body":"Brandon Aza had a talk about"},{"startTime":957.659,"endTime":960.149,"body":"this in like 2020 blackout"},{"startTime":960.816,"endTime":962.046,"body":"CET or pac."},{"startTime":962.713,"endTime":963.338,"body":"of PAC Bypasses."},{"startTime":963.853,"endTime":964.123,"body":"Okay."},{"startTime":965.09,"endTime":967.22,"body":"So that brings us to."},{"startTime":967.655,"endTime":971.525,"body":"MTE itself, or memory tagging"},{"startTime":967.655,"endTime":971.525,"body":"extension, which is an arm"},{"startTime":971.525,"endTime":975.575,"body":"specification that is technically in"},{"startTime":971.525,"endTime":975.575,"body":"more things than just Apple devices."},{"startTime":975.992,"endTime":977.612,"body":"Memory, tagging, extension."},{"startTime":977.612,"endTime":979.712,"body":"MTE is from arm."},{"startTime":979.712,"endTime":981.002,"body":"It's independent of Apple."},{"startTime":981.669,"endTime":984.609,"body":"It's just a thing anyone"},{"startTime":981.669,"endTime":984.609,"body":"can use for arm chips."},{"startTime":985.459,"endTime":989.749,"body":"I believe it's mandatory to implement in"},{"startTime":985.459,"endTime":989.749,"body":"ARM 11 or ARM 10 or something like that."},{"startTime":989.779,"endTime":990.454,"body":"But like,"},{"startTime":990.754,"endTime":991.084,"body":"nice,"},{"startTime":991.384,"endTime":994.534,"body":"or it's not mandatory to implement, you"},{"startTime":991.384,"endTime":994.534,"body":"know, it's a sign, not a cop, right?"},{"startTime":994.534,"endTime":994.624,"body":"Like."},{"startTime":995.041,"endTime":996.161,"body":"I can't make you do anything."},{"startTime":996.828,"endTime":1000.698,"body":"Um, yeah, memory tagging"},{"startTime":996.828,"endTime":1000.698,"body":"and tag checking system."},{"startTime":1001.358,"endTime":1003.818,"body":"Every memory allocation"},{"startTime":1001.358,"endTime":1003.818,"body":"is tagged with a secret."},{"startTime":1004.228,"endTime":1007.218,"body":"this is sort of similar to"},{"startTime":1004.228,"endTime":1007.218,"body":"the PAC signatures, except"},{"startTime":1007.248,"endTime":1008.358,"body":"in the cryptographic sense."},{"startTime":1008.358,"endTime":1011.208,"body":"They're probably closer"},{"startTime":1008.358,"endTime":1011.208,"body":"to MACs or whatever."},{"startTime":1011.733,"endTime":1012.093,"body":"Well, hold on."},{"startTime":1012.093,"endTime":1013.338,"body":"Like MTEM."},{"startTime":1013.383,"endTime":1013.833,"body":"MTE."},{"startTime":1014.163,"endTime":1014.343,"body":"Yeah."},{"startTime":1014.343,"endTime":1015.453,"body":"MTE tags are tiny."},{"startTime":1015.618,"endTime":1017.808,"body":"Yeah, MTE tag is just a four bit number."},{"startTime":1017.808,"endTime":1021.678,"body":"So you've got your 64 bit pointer and"},{"startTime":1017.808,"endTime":1021.678,"body":"then somewhere else there is a four bit"},{"startTime":1021.678,"endTime":1023.778,"body":"number associated with that pointer."},{"startTime":1023.988,"endTime":1024.523,"body":"That's your tag."},{"startTime":1025.003,"endTime":1025.293,"body":"okay."},{"startTime":1025.323,"endTime":1028.173,"body":"pack, pack signatures"},{"startTime":1025.323,"endTime":1028.173,"body":"are larger, I thought."},{"startTime":1028.683,"endTime":1029.193,"body":"Right."},{"startTime":1029.283,"endTime":1031.953,"body":"Like one of the, like one of the,"},{"startTime":1029.283,"endTime":1031.953,"body":"the, the, like the model pack"},{"startTime":1031.953,"endTime":1035.483,"body":"bypasses is, finding a gadget that'll"},{"startTime":1031.953,"endTime":1035.483,"body":"resign, you know, pointers, right?"},{"startTime":1035.483,"endTime":1040.503,"body":"I just dunno anything about pack"},{"startTime":1035.483,"endTime":1040.503,"body":"signatures, or whatever they're called."},{"startTime":1041.17,"endTime":1042.02,"body":"yeah, there's signatures."},{"startTime":1042.385,"endTime":1044.102,"body":"Okay, cool."},{"startTime":1044.519,"endTime":1047.579,"body":"I believe PAC is just using some"},{"startTime":1044.519,"endTime":1047.579,"body":"of the high bits and the pointers,"},{"startTime":1047.579,"endTime":1049.979,"body":"not actually making the pointers"},{"startTime":1047.579,"endTime":1049.979,"body":"wider because that would like"},{"startTime":1049.979,"endTime":1051.629,"body":"totally screw up everybody's code."},{"startTime":1051.629,"endTime":1051.749,"body":"Right?"},{"startTime":1051.749,"endTime":1052.889,"body":"It's supposed to be transparent."},{"startTime":1053.289,"endTime":1053.489,"body":"Uhhuh,"},{"startTime":1053.789,"endTime":1058.649,"body":"So I think you get like 16 to 24 bits"},{"startTime":1053.789,"endTime":1058.649,"body":"of your 64 bits on an Apple machine,"},{"startTime":1058.649,"endTime":1062.771,"body":"a reserve for pack, and then the"},{"startTime":1058.649,"endTime":1062.771,"body":"virtual address space is like 48 bits."},{"startTime":1063.438,"endTime":1064.123,"body":"that's neat."},{"startTime":1064.79,"endTime":1065.18,"body":"Okay."},{"startTime":1065.3,"endTime":1071.057,"body":"So unlike that, MTE has four bits,"},{"startTime":1065.3,"endTime":1071.057,"body":"that they have to be kept secret."},{"startTime":1072.024,"endTime":1076.704,"body":"But they are kept secret in the sense that"},{"startTime":1072.024,"endTime":1076.704,"body":"they're like not in the pointer, right?"},{"startTime":1076.704,"endTime":1078.114,"body":"They are somewhere else."},{"startTime":1078.781,"endTime":1082.591,"body":"They're associated with a pointer, but"},{"startTime":1078.781,"endTime":1082.591,"body":"they're fundamentally like four bits of"},{"startTime":1082.591,"endTime":1088.981,"body":"entropy associated with every pointer that"},{"startTime":1082.591,"endTime":1088.981,"body":"in theory like you do not have access to"},{"startTime":1089.206,"endTime":1091.516,"body":"and like the security model"},{"startTime":1089.206,"endTime":1091.516,"body":"here is more like graph color."},{"startTime":1091.666,"endTime":1093.916,"body":"Like graph coloring than"},{"startTime":1091.666,"endTime":1093.916,"body":"like signing things."},{"startTime":1093.916,"endTime":1094.276,"body":"Right."},{"startTime":1094.426,"endTime":1098.006,"body":"What you care about is a diversity"},{"startTime":1094.426,"endTime":1098.006,"body":"of different tags, within the"},{"startTime":1098.006,"endTime":1099.386,"body":"locality of a piece of memory."},{"startTime":1099.386,"endTime":1100.856,"body":"Like if you, you know, right."},{"startTime":1100.976,"endTime":1103.016,"body":"You know, right off the end of"},{"startTime":1100.976,"endTime":1103.016,"body":"one thing to the next thing."},{"startTime":1103.016,"endTime":1106.406,"body":"You need the tags to be different"},{"startTime":1103.016,"endTime":1106.406,"body":"and you need to not leak the tags."},{"startTime":1106.406,"endTime":1110.861,"body":"Yeah, the idea is that if you access,"},{"startTime":1106.406,"endTime":1110.861,"body":"when you allocate some piece of memory,"},{"startTime":1110.861,"endTime":1113.051,"body":"it will have some tag if you then free it."},{"startTime":1113.051,"endTime":1115.871,"body":"But the point, and it gets used"},{"startTime":1113.051,"endTime":1115.871,"body":"for a new allocation, it will have"},{"startTime":1115.871,"endTime":1119.471,"body":"a new tag and the used after free"},{"startTime":1115.871,"endTime":1119.471,"body":"pointer will still have the old tag."},{"startTime":1119.621,"endTime":1123.641,"body":"And when you go to do something with"},{"startTime":1119.621,"endTime":1123.641,"body":"it, the processor will compare the"},{"startTime":1123.641,"endTime":1129.708,"body":"expected tag to the actual tag and then"},{"startTime":1123.641,"endTime":1129.708,"body":"be like, oh no, crash your program."},{"startTime":1130.375,"endTime":1132.865,"body":"it'll crash your program if"},{"startTime":1130.375,"endTime":1132.865,"body":"it's in synchronous mode."},{"startTime":1133.045,"endTime":1135.775,"body":"And if it's in asynchronous"},{"startTime":1133.045,"endTime":1135.775,"body":"mode, it'll keep running your"},{"startTime":1135.775,"endTime":1137.725,"body":"program and then crash it later."},{"startTime":1138.392,"endTime":1140.229,"body":"Hmm, okay."},{"startTime":1140.409,"endTime":1140.589,"body":"yeah."},{"startTime":1140.589,"endTime":1142.989,"body":"It will continue execution"},{"startTime":1140.589,"endTime":1142.989,"body":"until there's a context switch"},{"startTime":1143.706,"endTime":1144.726,"body":"I mean, I guess interrupt."},{"startTime":1145.176,"endTime":1148.186,"body":"Yeah, I guess that's, part"},{"startTime":1145.176,"endTime":1148.186,"body":"of the whole async thing,"},{"startTime":1148.426,"endTime":1148.876,"body":"Yes."},{"startTime":1149.296,"endTime":1149.686,"body":"Okay."},{"startTime":1150.353,"endTime":1151.763,"body":"much more performant."},{"startTime":1151.793,"endTime":1155.063,"body":"'cause you can delay the check till"},{"startTime":1151.793,"endTime":1155.063,"body":"later and like keep executing the"},{"startTime":1155.063,"endTime":1157.493,"body":"code and probably do the checks less."},{"startTime":1157.493,"endTime":1160.793,"body":"'cause like imagine you abuse"},{"startTime":1157.493,"endTime":1160.793,"body":"the same pointer like eight"},{"startTime":1160.793,"endTime":1162.203,"body":"times in a row to do something."},{"startTime":1162.203,"endTime":1164.753,"body":"Like you really only need to"},{"startTime":1162.203,"endTime":1164.753,"body":"like check it the first time."},{"startTime":1165.053,"endTime":1165.713,"body":"Oh, okay."},{"startTime":1166.38,"endTime":1169.452,"body":"Async is like effectively free"},{"startTime":1166.38,"endTime":1169.452,"body":"right's, what the graphing"},{"startTime":1169.527,"endTime":1173.787,"body":"it's not, I mean, it's like a one,"},{"startTime":1169.527,"endTime":1173.787,"body":"a little over 1% impact I think."},{"startTime":1174.454,"endTime":1174.814,"body":"Okay."},{"startTime":1174.974,"endTime":1175.534,"body":"then you can B."},{"startTime":1175.834,"endTime":1178.624,"body":"this has been something that's been"},{"startTime":1175.834,"endTime":1178.624,"body":"around for a while, but like in the"},{"startTime":1178.624,"endTime":1182.284,"body":"sense that it's been defined, but it"},{"startTime":1178.624,"endTime":1182.284,"body":"just hasn't really existed in chips much."},{"startTime":1182.284,"endTime":1183.424,"body":"It's in pixel phones."},{"startTime":1183.914,"endTime":1187.244,"body":"I think it's in like pixel starting"},{"startTime":1183.914,"endTime":1187.244,"body":"in 10 or something like that."},{"startTime":1187.544,"endTime":1187.894,"body":"eight"},{"startTime":1187.974,"endTime":1188.574,"body":"pixel eight."},{"startTime":1188.624,"endTime":1188.984,"body":"pixel eight."},{"startTime":1189.651,"endTime":1194.271,"body":"And so you can actually go into Android"},{"startTime":1189.651,"endTime":1194.271,"body":"settings somewhere and enable this."},{"startTime":1194.451,"endTime":1197.111,"body":"and apps that are like"},{"startTime":1194.451,"endTime":1197.111,"body":"aware of it can leverage it."},{"startTime":1197.111,"endTime":1200.621,"body":"So if you turn MTE on in a"},{"startTime":1197.111,"endTime":1200.621,"body":"pixel phone, like Chrome will"},{"startTime":1200.981,"endTime":1203.021,"body":"run itself in async MTE mode."},{"startTime":1203.461,"endTime":1205.591,"body":"and in fact, this will happen"},{"startTime":1203.461,"endTime":1205.591,"body":"automatically if you're in"},{"startTime":1205.591,"endTime":1208.411,"body":"like the Android advanced"},{"startTime":1205.591,"endTime":1208.411,"body":"protection mode on your device."},{"startTime":1208.491,"endTime":1211.041,"body":"and your device supports"},{"startTime":1208.491,"endTime":1211.041,"body":"MTE, it will get turned on."},{"startTime":1211.041,"endTime":1215.151,"body":"And like Chrome, for example, will"},{"startTime":1211.041,"endTime":1215.151,"body":"start using MTE in Async mode."},{"startTime":1215.818,"endTime":1217.478,"body":"oh, this is a developer option."},{"startTime":1217.738,"endTime":1218.248,"body":"yeah."},{"startTime":1218.248,"endTime":1221.308,"body":"So otherwise it's in developer"},{"startTime":1218.248,"endTime":1221.308,"body":"option, but it's not on by default"},{"startTime":1221.308,"endTime":1225.238,"body":"because like it's a battery hit,"},{"startTime":1221.308,"endTime":1225.238,"body":"not just like a performance hit."},{"startTime":1225.238,"endTime":1225.568,"body":"So,"},{"startTime":1226.235,"endTime":1228.93,"body":"And then synchronous classically"},{"startTime":1226.235,"endTime":1228.93,"body":"has been very expensive."},{"startTime":1229.597,"endTime":1229.837,"body":"yeah."},{"startTime":1229.837,"endTime":1234.097,"body":"And then synchronous has been like,"},{"startTime":1229.837,"endTime":1234.097,"body":"like double digit percentage expenses."},{"startTime":1234.764,"endTime":1238.064,"body":"But like, so graphene, for instance,"},{"startTime":1234.764,"endTime":1238.064,"body":"graphene does synchronous in the"},{"startTime":1238.064,"endTime":1239.864,"body":"kernel and async out of the kernel."},{"startTime":1240.194,"endTime":1244.514,"body":"And then I'm guessing that the intuition"},{"startTime":1240.194,"endTime":1244.514,"body":"there is you spend most of your time"},{"startTime":1244.514,"endTime":1246.014,"body":"in usual land, not in the kernel."},{"startTime":1246.314,"endTime":1249.524,"body":"So like a double digit percentage"},{"startTime":1246.314,"endTime":1249.524,"body":"hit to a place where you're only"},{"startTime":1249.524,"endTime":1252.644,"body":"spending a small percentage of your"},{"startTime":1249.524,"endTime":1252.644,"body":"time is not that big of a thing."},{"startTime":1252.914,"endTime":1256.064,"body":"So you can be, and also there are much"},{"startTime":1252.914,"endTime":1256.064,"body":"more fun vulnerabilities in the kernel."},{"startTime":1256.274,"endTime":1257.414,"body":"So there's a higher payoff."},{"startTime":1257.889,"endTime":1258.699,"body":"Yes."},{"startTime":1258.799,"endTime":1264.596,"body":"a 1% performance hit on the latest"},{"startTime":1258.799,"endTime":1264.596,"body":"high-end phone is not the same thing"},{"startTime":1264.656,"endTime":1270.303,"body":"as a 1% performance hit on an older"},{"startTime":1264.656,"endTime":1270.303,"body":"phone or even a higher percentage"},{"startTime":1270.303,"endTime":1273.383,"body":"hit on an older phone, that's"},{"startTime":1270.303,"endTime":1273.383,"body":"probably a more realistic comparison."},{"startTime":1273.383,"endTime":1277.103,"body":"It's like, okay, it's a 1% performance"},{"startTime":1273.383,"endTime":1277.103,"body":"hit here, but on an older phone it's"},{"startTime":1277.103,"endTime":1279.443,"body":"actually a five to 10% performance hit."},{"startTime":1280.11,"endTime":1284.737,"body":"it can be easy to like be like, oh,"},{"startTime":1280.11,"endTime":1284.737,"body":"I have a MacBook Pro, or I have a. A"},{"startTime":1284.737,"endTime":1289.237,"body":"high-end Chromebook or I have a pixel,"},{"startTime":1284.737,"endTime":1289.237,"body":"um, so I'll just take a couple percent"},{"startTime":1289.237,"endTime":1290.857,"body":"here and there and trade it off."},{"startTime":1290.857,"endTime":1294.367,"body":"When, like, when you're not on"},{"startTime":1290.857,"endTime":1294.367,"body":"the highest end devices, that can"},{"startTime":1294.367,"endTime":1295.897,"body":"actually be much more impactful."},{"startTime":1296.564,"endTime":1297.734,"body":"I could definitely see that."},{"startTime":1298.401,"endTime":1298.611,"body":"Yeah."},{"startTime":1298.611,"endTime":1299.661,"body":"I just confirmed that."},{"startTime":1299.666,"endTime":1304.796,"body":"If you are enrolled in advanced protection"},{"startTime":1299.666,"endTime":1304.796,"body":"and you are logged into your Google"},{"startTime":1304.796,"endTime":1309.106,"body":"account, on an Android phone that"},{"startTime":1304.796,"endTime":1309.106,"body":"supports it, it enables MTE for you."},{"startTime":1309.136,"endTime":1312.166,"body":"'cause I was like, I don't remember"},{"startTime":1309.136,"endTime":1312.166,"body":"turning the saw on my phone."},{"startTime":1312.166,"endTime":1314.693,"body":"It's like, no, you did, but  by"},{"startTime":1314.738,"endTime":1318.548,"body":"can enable it on an individual"},{"startTime":1314.738,"endTime":1318.548,"body":"device without enabling it on your"},{"startTime":1318.628,"endTime":1319.148,"body":"your account."},{"startTime":1319.278,"endTime":1321.558,"body":"but if you enable it on your"},{"startTime":1319.278,"endTime":1321.558,"body":"account and sign in, it will"},{"startTime":1321.558,"endTime":1322.818,"body":"get enabled on that device."},{"startTime":1323.328,"endTime":1323.548,"body":"Yes."},{"startTime":1323.738,"endTime":1324.028,"body":"Yeah."},{"startTime":1324.153,"endTime":1325.053,"body":"That's how it happened."},{"startTime":1325.72,"endTime":1326.14,"body":"Cool."},{"startTime":1326.17,"endTime":1331.11,"body":"Okay, I'm going back, uh, that's"},{"startTime":1326.17,"endTime":1331.11,"body":"general MTE that's been available"},{"startTime":1331.11,"endTime":1333.955,"body":"to like broad armed devices in"},{"startTime":1334.255,"endTime":1336.835,"body":"Well, I wouldn't say"},{"startTime":1334.255,"endTime":1336.835,"body":"broad arm devices, right?"},{"startTime":1336.835,"endTime":1339.775,"body":"There was like a spec for"},{"startTime":1336.835,"endTime":1339.775,"body":"this, but it really didn't"},{"startTime":1339.775,"endTime":1342.215,"body":"exist in hardware, for a while."},{"startTime":1342.215,"endTime":1347.045,"body":"It's never been in server software"},{"startTime":1342.215,"endTime":1347.045,"body":"like Google jammed it into Pixel."},{"startTime":1347.045,"endTime":1351.345,"body":"We learned that, you know, apple"},{"startTime":1347.045,"endTime":1351.345,"body":"put it into, some of their devices."},{"startTime":1351.735,"endTime":1354.585,"body":"but like it is not cheap."},{"startTime":1354.585,"endTime":1358.365,"body":"It is like a large percentage"},{"startTime":1354.585,"endTime":1358.365,"body":"of the die area to put"},{"startTime":1358.48,"endTime":1358.7,"body":"Oh."},{"startTime":1359.025,"endTime":1361.605,"body":"into a chip and it is not fast."},{"startTime":1361.605,"endTime":1365.385,"body":"Like there are other, there are"},{"startTime":1361.605,"endTime":1365.385,"body":"other like things in this vein,"},{"startTime":1365.385,"endTime":1369.525,"body":"like CHERI for example, that"},{"startTime":1365.385,"endTime":1369.525,"body":"take like much less dye area."},{"startTime":1369.735,"endTime":1372.475,"body":"It's like a very small number"},{"startTime":1369.735,"endTime":1372.475,"body":"of gates to add, CHERI."},{"startTime":1372.795,"endTime":1376.635,"body":"But, uh, you have to like do a"},{"startTime":1372.795,"endTime":1376.635,"body":"code rewrite where you like, are"},{"startTime":1376.635,"endTime":1378.735,"body":"like, all my pointers are 128 bits."},{"startTime":1378.735,"endTime":1379.875,"body":"Now let's see what happens."},{"startTime":1379.905,"endTime":1380.505,"body":"Um, for"},{"startTime":1380.575,"endTime":1383.015,"body":"CHERI's also a bear"},{"startTime":1380.575,"endTime":1383.015,"body":"performance hit, right?"},{"startTime":1383.382,"endTime":1384.612,"body":"I'm not sure actually."},{"startTime":1384.612,"endTime":1386.082,"body":"I think it's smaller actually."},{"startTime":1386.082,"endTime":1389.082,"body":"It's just like you to"},{"startTime":1386.082,"endTime":1389.082,"body":"make, use it effectively."},{"startTime":1389.082,"endTime":1391.722,"body":"You have to kind of define pointer"},{"startTime":1389.082,"endTime":1391.722,"body":"domains and coach yourself."},{"startTime":1391.722,"endTime":1394.272,"body":"And at some point it's just like,"},{"startTime":1391.722,"endTime":1394.272,"body":"dude, just rewrite it and rust."},{"startTime":1394.602,"endTime":1397.817,"body":"Well, you know, CHERI is supposed"},{"startTime":1394.602,"endTime":1397.817,"body":"to, isn't CHERI also supposed to"},{"startTime":1397.817,"endTime":1402.147,"body":"help mitigate, like Specter micro"},{"startTime":1397.817,"endTime":1402.147,"body":"architectural attacks to a degree as well."},{"startTime":1402.177,"endTime":1404.067,"body":"It's not just about the"},{"startTime":1402.177,"endTime":1404.067,"body":"memory safety stuff."},{"startTime":1404.097,"endTime":1407.637,"body":"I didn't think so, but I'm"},{"startTime":1404.097,"endTime":1407.637,"body":"not sure I can feel Ben, Lori"},{"startTime":1407.637,"endTime":1409.197,"body":"getting upset listening to this."},{"startTime":1409.547,"endTime":1416.317,"body":"CHERI supposed to be trying to address a"},{"startTime":1409.547,"endTime":1416.317,"body":"whole host of up and down the stack, like"},{"startTime":1416.677,"endTime":1423.827,"body":"CPU design, vulnerabilities, not just, the"},{"startTime":1416.677,"endTime":1423.827,"body":"sort of memory safety stuff that, uh, I"},{"startTime":1423.827,"endTime":1426.077,"body":"guess the MIE stuff is trying to address."},{"startTime":1426.417,"endTime":1429.474,"body":"so, anyway, M ds cord memory tagging."},{"startTime":1429.474,"endTime":1430.224,"body":"Check sec Chad."},{"startTime":1430.891,"endTime":1433.561,"body":"Memory tagging and tag checking system."},{"startTime":1433.661,"endTime":1434.981,"body":"this got deployed on Pixel."},{"startTime":1434.981,"endTime":1438.191,"body":"It's been available in some"},{"startTime":1434.981,"endTime":1438.191,"body":"places, but there's costs."},{"startTime":1438.501,"endTime":1442.161,"body":"Apple conducted a deep evaluation and"},{"startTime":1438.501,"endTime":1442.161,"body":"research process to determine whether"},{"startTime":1442.161,"endTime":1443.631,"body":"MTV is designed would meet our goals"},{"startTime":1443.931,"endTime":1444.221,"body":"Okay."},{"startTime":1444.246,"endTime":1445.506,"body":"We don't need to read."},{"startTime":1445.536,"endTime":1447.426,"body":"We don't need to read these parts of the"},{"startTime":1447.531,"endTime":1449.171,"body":"Well, I'm getting back into it."},{"startTime":1449.171,"endTime":1449.786,"body":"We went to fucking"},{"startTime":1450.086,"endTime":1454.106,"body":"Apple applied the fame and method"},{"startTime":1450.086,"endTime":1454.106,"body":"to MTE and came up, thought real"},{"startTime":1454.106,"endTime":1460.196,"body":"hard about the problem and came up"},{"startTime":1454.106,"endTime":1460.196,"body":"with EMTE, um, which is basically,"},{"startTime":1460.496,"endTime":1463.676,"body":"the iPhone, which has never"},{"startTime":1460.496,"endTime":1463.676,"body":"been compromised before, now has"},{"startTime":1463.676,"endTime":1466.436,"body":"groundbreaking new protections"},{"startTime":1463.676,"endTime":1466.436,"body":"for the things it was never"},{"startTime":1466.736,"endTime":1470.786,"body":"nevermind the fact that there's no"},{"startTime":1466.736,"endTime":1470.786,"body":"malware at all on iPhone anyway, here's"},{"startTime":1470.786,"endTime":1475.576,"body":"an entire post explaining how we're"},{"startTime":1470.786,"endTime":1475.576,"body":"patching security holes on the iPhone."},{"startTime":1475.936,"endTime":1479.806,"body":"apple doesn't really say what"},{"startTime":1475.936,"endTime":1479.806,"body":"EMTE does beyond like, it's just"},{"startTime":1479.806,"endTime":1481.966,"body":"MTE in synchronous mode and fast,"},{"startTime":1482.266,"endTime":1482.626,"body":"Hold on."},{"startTime":1482.686,"endTime":1486.896,"body":"So my understanding is that EMTE"},{"startTime":1482.686,"endTime":1486.896,"body":"is just another name for MTE four."},{"startTime":1487.346,"endTime":1487.796,"body":"Right?"},{"startTime":1487.916,"endTime":1490.946,"body":"Which is a set of like"},{"startTime":1487.916,"endTime":1490.946,"body":"four MTE extensions."},{"startTime":1491.613,"endTime":1493.083,"body":"It's canonical pack checking."},{"startTime":1493.083,"endTime":1495.363,"body":"It's the one they list in the blog post."},{"startTime":1495.643,"endTime":1499.813,"body":"the one I list in the blog post is"},{"startTime":1495.643,"endTime":1499.813,"body":"like your global variables, or I guess"},{"startTime":1499.813,"endTime":1503.323,"body":"your tech, your BSS or whatever the"},{"startTime":1499.813,"endTime":1503.323,"body":"data segment is or whatever, right?"},{"startTime":1503.323,"endTime":1506.473,"body":"Like you have variables that are"},{"startTime":1503.323,"endTime":1506.473,"body":"not in tagged regions, right?"},{"startTime":1506.683,"endTime":1509.533,"body":"And in standard MTE, those aren't,"},{"startTime":1506.683,"endTime":1509.533,"body":"there's no checking for that."},{"startTime":1509.923,"endTime":1514.533,"body":"And in MTE four, I don't totally"},{"startTime":1509.923,"endTime":1514.533,"body":"understand how this works, but there"},{"startTime":1514.533,"endTime":1519.683,"body":"is checking for, memory accesses"},{"startTime":1514.533,"endTime":1519.683,"body":"that transition from a tagged memory"},{"startTime":1519.683,"endTime":1523.11,"body":"region to an untagged memory region."},{"startTime":1523.777,"endTime":1526.207,"body":"So like, in theory, it should"},{"startTime":1523.777,"endTime":1526.207,"body":"automatically detect, right?"},{"startTime":1526.257,"endTime":1529.947,"body":"if you're running off the end of a"},{"startTime":1526.257,"endTime":1529.947,"body":"tagged memory region into untagged"},{"startTime":1529.947,"endTime":1532.797,"body":"memory, then the tag has changed"},{"startTime":1529.947,"endTime":1532.797,"body":"even though the new tag is nil."},{"startTime":1533.307,"endTime":1536.217,"body":"And I guess that wasn't chucked"},{"startTime":1533.307,"endTime":1536.217,"body":"before and now it is with MTE four."},{"startTime":1536.742,"endTime":1537.012,"body":"Hmm."},{"startTime":1537.679,"endTime":1543.369,"body":"So this is the arm docs for that, that"},{"startTime":1537.679,"endTime":1543.369,"body":"the apple linked, canonical tag checking"},{"startTime":1544.029,"endTime":1549.759,"body":"reporting all non-ad address bits on a"},{"startTime":1544.029,"endTime":1549.759,"body":"fault store only tag checking and memory"},{"startTime":1549.759,"endTime":1551.949,"body":"tagging with address tagging disabled."},{"startTime":1552.069,"endTime":1555.459,"body":"I thought we already had store only tag"},{"startTime":1552.069,"endTime":1555.459,"body":"checking, or maybe I just don't know"},{"startTime":1555.459,"endTime":1558.759,"body":"what store only tag checking is, but I"},{"startTime":1555.459,"endTime":1558.759,"body":"was saying earlier that graphene does"},{"startTime":1558.759,"endTime":1563.009,"body":"like the kernel of synchronous and then"},{"startTime":1558.759,"endTime":1563.009,"body":"the, the usual end is asynchronous."},{"startTime":1563.039,"endTime":1565.769,"body":"But there's also a thing with them"},{"startTime":1563.039,"endTime":1565.769,"body":"where, like reads are synchronous"},{"startTime":1566.129,"endTime":1570.086,"body":"and, writes are asynchronous, which"},{"startTime":1566.129,"endTime":1570.086,"body":"I, I thought that might have been"},{"startTime":1570.086,"endTime":1571.376,"body":"what store only attack checking is."},{"startTime":1571.376,"endTime":1572.096,"body":"I don't, I don't know."},{"startTime":1572.763,"endTime":1573.333,"body":"Fuck do I know"},{"startTime":1573.766,"endTime":1578.191,"body":"So we have a few more capabilities"},{"startTime":1573.766,"endTime":1578.191,"body":"around MTE itself with MT four slash e"},{"startTime":1578.191,"endTime":1584.711,"body":"mte, and then more importantly, whatever"},{"startTime":1578.191,"endTime":1584.711,"body":"they did on their chips in conjunction"},{"startTime":1584.711,"endTime":1587.471,"body":"with the capabilities in MT. E four"},{"startTime":1588.138,"endTime":1589.068,"body":"We're coming up on my,"},{"startTime":1589.158,"endTime":1589.998,"body":"done fast."},{"startTime":1590.508,"endTime":1592.908,"body":"we're coming up on my favorite"},{"startTime":1590.508,"endTime":1592.908,"body":"section of this post, or my"},{"startTime":1592.908,"endTime":1594.258,"body":"favorite sentence in the post."},{"startTime":1594.438,"endTime":1598.368,"body":"Just like consider that you could"},{"startTime":1594.438,"endTime":1598.368,"body":"do either AY or synchronous mode."},{"startTime":1598.668,"endTime":1602.058,"body":"Synchronous is the good mode and"},{"startTime":1598.668,"endTime":1602.058,"body":"asynchronous is the bad mode We"},{"startTime":1602.058,"endTime":1603.498,"body":"could have implemented asynchronous."},{"startTime":1603.948,"endTime":1605.838,"body":"We would not implement such a mechanism."},{"startTime":1606.505,"endTime":1609.212,"body":"Apple, please run these things by me."},{"startTime":1609.879,"endTime":1612.076,"body":"Now, just to baseless"},{"startTime":1612.361,"endTime":1613.141,"body":"the writing,"},{"startTime":1613.756,"endTime":1619.726,"body":"you know, as someone Apple who's like"},{"startTime":1613.756,"endTime":1619.726,"body":"been making their own chips for years,"},{"startTime":1619.771,"endTime":1623.086,"body":"you could imagine that presumably"},{"startTime":1619.771,"endTime":1623.086,"body":"they didn't, this isn't their first"},{"startTime":1623.086,"endTime":1625.216,"body":"iteration of, you know, MTE, right?"},{"startTime":1625.216,"endTime":1629.536,"body":"They've presumably been experimenting"},{"startTime":1625.216,"endTime":1629.536,"body":"with this and just like not turning it on."},{"startTime":1629.536,"endTime":1633.556,"body":"Like, I can't imagine this is the first"},{"startTime":1629.536,"endTime":1633.556,"body":"time they ever taped out some of the"},{"startTime":1633.556,"endTime":1638.686,"body":"chip that is required for MTE, which"},{"startTime":1633.556,"endTime":1638.686,"body":"suggests to me that at some point someone"},{"startTime":1638.686,"endTime":1641.926,"body":"might have implemented such a mechanism,"},{"startTime":1638.686,"endTime":1641.926,"body":"they just didn't tell us about it."},{"startTime":1641.996,"endTime":1642.116,"body":"it."},{"startTime":1642.286,"endTime":1644.056,"body":"all they had to do was use"},{"startTime":1642.286,"endTime":1644.056,"body":"a different verb there."},{"startTime":1644.056,"endTime":1646.846,"body":"They could have just said, we didn't"},{"startTime":1644.056,"endTime":1646.846,"body":"implement such a mechanism and it"},{"startTime":1646.846,"endTime":1650.031,"body":"would've read fine, but they wrote,"},{"startTime":1646.846,"endTime":1650.031,"body":"we wouldn't, which reads so weird."},{"startTime":1650.086,"endTime":1650.546,"body":"So weird."},{"startTime":1651.313,"endTime":1651.533,"body":"Um,"},{"startTime":1651.868,"endTime":1657.123,"body":"what you mean by implement, which"},{"startTime":1651.868,"endTime":1657.123,"body":"in this very, uh, very massage,"},{"startTime":1657.123,"endTime":1661.113,"body":"public facing texts might mean"},{"startTime":1657.123,"endTime":1661.113,"body":"implement and deploy and ship."},{"startTime":1661.48,"endTime":1664.6,"body":"I want to call out here that the"},{"startTime":1661.48,"endTime":1664.6,"body":"Graphene Project, who, by the way, if"},{"startTime":1664.6,"endTime":1668.5,"body":"a graphene person listens to this, we"},{"startTime":1664.6,"endTime":1668.5,"body":"would very much love to get you on and"},{"startTime":1668.5,"endTime":1671.74,"body":"have you go through a dramatic reading"},{"startTime":1668.5,"endTime":1671.74,"body":"of this with us and then call out."},{"startTime":1671.89,"endTime":1673.33,"body":"'cause look, you, you hear us?"},{"startTime":1673.33,"endTime":1674.23,"body":"We don't know what we're talking."},{"startTime":1674.32,"endTime":1677.11,"body":"David knows a little bit about what"},{"startTime":1674.32,"endTime":1677.11,"body":"he's talking about, but I don't Right."},{"startTime":1677.11,"endTime":1678.13,"body":"We could use the help."},{"startTime":1678.31,"endTime":1680.83,"body":"I wanna call out though that the"},{"startTime":1678.31,"endTime":1680.83,"body":"graphene project, there's an angry"},{"startTime":1680.83,"endTime":1682.54,"body":"thread that, responded to this thing."},{"startTime":1682.78,"endTime":1684.97,"body":"I won't read that whole"},{"startTime":1682.78,"endTime":1684.97,"body":"thread, but it's worth reading."},{"startTime":1685.21,"endTime":1688.09,"body":"And they say that there's basically"},{"startTime":1685.21,"endTime":1688.09,"body":"no difference that they've seen"},{"startTime":1688.09,"endTime":1690.85,"body":"in terms of breaking exploits"},{"startTime":1688.09,"endTime":1690.85,"body":"by having ay versus synchronous."},{"startTime":1691.09,"endTime":1692.59,"body":"Like to them ayc is enough."},{"startTime":1692.957,"endTime":1693.247,"body":"Okay."},{"startTime":1693.914,"endTime":1696.044,"body":"Depends on how much you care"},{"startTime":1693.914,"endTime":1696.044,"body":"about what graphene thinks."},{"startTime":1696.134,"endTime":1699.134,"body":"I wanna say I care a lot about what"},{"startTime":1696.134,"endTime":1699.134,"body":"graphene thinks because I would like"},{"startTime":1699.234,"endTime":1702.714,"body":"research from Project Zero"},{"startTime":1699.234,"endTime":1702.714,"body":"suggests otherwise, depending"},{"startTime":1702.714,"endTime":1703.739,"body":"on the setup that you're in."},{"startTime":1704.499,"endTime":1704.659,"body":"Interesting."},{"startTime":1704.669,"endTime":1705.209,"body":"is what it is."},{"startTime":1705.876,"endTime":1709.476,"body":"the thing about MTE generally and"},{"startTime":1705.876,"endTime":1709.476,"body":"then particularly about async, right?"},{"startTime":1709.476,"endTime":1713.956,"body":"Is that like you have, so you have"},{"startTime":1709.476,"endTime":1713.956,"body":"four bits, of entropy with the pointer."},{"startTime":1714.226,"endTime":1718.456,"body":"And in some cases, like let's"},{"startTime":1714.226,"endTime":1718.456,"body":"say you're a web browser that"},{"startTime":1718.456,"endTime":1722.066,"body":"runs like arbitrary JavaScript,"},{"startTime":1718.456,"endTime":1722.066,"body":"depending on what the behavior is."},{"startTime":1722.096,"endTime":1728.816,"body":"When, like in the failure case, like if"},{"startTime":1722.096,"endTime":1728.816,"body":"you can just run your exploit 16 times"},{"startTime":1729.056,"endTime":1735.123,"body":"and then you know, have a more likely"},{"startTime":1729.056,"endTime":1735.123,"body":"than expected value of having it be"},{"startTime":1735.123,"endTime":1740.29,"body":"successful, one of those times, if all"},{"startTime":1735.123,"endTime":1740.29,"body":"of the other 15 times are like a huge"},{"startTime":1740.29,"endTime":1743.2,"body":"disaster and you can't actually write"},{"startTime":1740.29,"endTime":1743.2,"body":"that loop, like maybe that's a problem."},{"startTime":1743.867,"endTime":1747.467,"body":"like if you're able to just do it"},{"startTime":1743.867,"endTime":1747.467,"body":"in the background and like no one's"},{"startTime":1747.467,"endTime":1749.297,"body":"really the wiser somehow by like."},{"startTime":1749.964,"endTime":1754.284,"body":"Having some JavaScripts that then like"},{"startTime":1749.964,"endTime":1754.284,"body":"loads another page that tries it 16 times."},{"startTime":1754.284,"endTime":1756.684,"body":"So that, like that process that"},{"startTime":1754.284,"endTime":1756.684,"body":"you never see is the one that"},{"startTime":1756.684,"endTime":1759.061,"body":"dies because it's whatever."},{"startTime":1759.121,"endTime":1765.825,"body":"Then, um, then suddenly like, you know,"},{"startTime":1759.121,"endTime":1765.825,"body":"MTE is not like this be all, end all."},{"startTime":1765.895,"endTime":1769.885,"body":"it's much more useful in a situation"},{"startTime":1765.895,"endTime":1769.885,"body":"where you only get one shot at it"},{"startTime":1770.245,"endTime":1775.555,"body":"or a limited, um, number of tries"},{"startTime":1770.245,"endTime":1775.555,"body":"or a limited reaction time to it."},{"startTime":1775.705,"endTime":1778.945,"body":"And the more shots you get at it or"},{"startTime":1775.705,"endTime":1778.945,"body":"the more instructions you get after"},{"startTime":1778.945,"endTime":1782.725,"body":"it fails, like the more likely it is"},{"startTime":1778.945,"endTime":1782.725,"body":"that you'll be able to, can cock a"},{"startTime":1782.725,"endTime":1786.685,"body":"situation in which you can get a tag"},{"startTime":1782.725,"endTime":1786.685,"body":"match and then can do something bad."},{"startTime":1786.985,"endTime":1787.405,"body":"Mm-hmm."},{"startTime":1787.755,"endTime":1790.745,"body":"but that's all gonna depend on"},{"startTime":1787.755,"endTime":1790.745,"body":"like, you know, what your program"},{"startTime":1791.045,"endTime":1791.465,"body":"mm-hmm."},{"startTime":1791.765,"endTime":1794.835,"body":"and of course like web browsers are stuck"},{"startTime":1791.765,"endTime":1794.835,"body":"with the hardest mode of the problem"},{"startTime":1794.865,"endTime":1800.002,"body":"'cause they're like, let's just run a"},{"startTime":1794.865,"endTime":1800.002,"body":"bunch of code from arbitrary sites and"},{"startTime":1800.002,"endTime":1804.322,"body":"like isolate some of it per process"},{"startTime":1800.002,"endTime":1804.322,"body":"And some of it like within the process."},{"startTime":1804.457,"endTime":1804.622,"body":"yeah."},{"startTime":1805.394,"endTime":1806.249,"body":"Oh, poor web browsers"},{"startTime":1806.549,"endTime":1808.139,"body":"And it can all change dynamically."},{"startTime":1808.806,"endTime":1812.496,"body":"You don't even get a canonical version of"},{"startTime":1808.806,"endTime":1812.496,"body":"the code to download before you run it."},{"startTime":1812.796,"endTime":1815.496,"body":"downloaded that webpage two minutes ago."},{"startTime":1815.526,"endTime":1815.976,"body":"Fuck you."},{"startTime":1816.643,"endTime":1818.383,"body":"You don't get to rely on that at all."},{"startTime":1819.05,"endTime":1820.07,"body":"Apple says."},{"startTime":1820.595,"endTime":1825.155,"body":"That always on synchronous MTE"},{"startTime":1820.595,"endTime":1825.155,"body":"across key attack surfaces."},{"startTime":1825.395,"endTime":1830.795,"body":"While preserving a great high performance"},{"startTime":1825.395,"endTime":1830.795,"body":"user experience is extremely demanding"},{"startTime":1830.795,"endTime":1836.105,"body":"on hardware well lucky Apple, that"},{"startTime":1830.795,"endTime":1836.105,"body":"they seem to be very good at designing"},{"startTime":1836.345,"endTime":1840.275,"body":"fresh brand span new hardware to"},{"startTime":1836.345,"endTime":1840.275,"body":"do everything they need to do."},{"startTime":1840.992,"endTime":1845.672,"body":"MT for M-T-V-M-T-E to provide memory"},{"startTime":1840.992,"endTime":1845.672,"body":"safety in an adversarial context."},{"startTime":1845.672,"endTime":1850.382,"body":"We need to finely tune the os, define"},{"startTime":1845.672,"endTime":1850.382,"body":"new semantics and the confidentiality"},{"startTime":1850.382,"endTime":1855.402,"body":"of memory tags on which MTE relies,"},{"startTime":1850.382,"endTime":1855.402,"body":"to do what we think we need to do."},{"startTime":1856.069,"endTime":1859.639,"body":"We would carry out a massive"},{"startTime":1856.069,"endTime":1859.639,"body":"engineering effort spending all of,"},{"startTime":1860.306,"endTime":1864.296,"body":"All of Apple, apple silicon operating"},{"startTime":1860.306,"endTime":1864.296,"body":"systems are software frameworks."},{"startTime":1864.296,"endTime":1865.136,"body":"Excuse me."},{"startTime":1865.136,"endTime":1869.546,"body":"I think there's some computers in Apple"},{"startTime":1865.136,"endTime":1869.546,"body":"that run in the cloud, the Apple cloud."},{"startTime":1869.551,"endTime":1875.763,"body":"That, that they were not listed in that"},{"startTime":1869.551,"endTime":1875.763,"body":"list there, so citation needed, okay."},{"startTime":1876.213,"endTime":1880.443,"body":"With the highly successful secure memory"},{"startTime":1876.213,"endTime":1880.443,"body":"allocator work that we've talked about"},{"startTime":1880.443,"endTime":1886.263,"body":"before, transform MTE from a debugging"},{"startTime":1880.443,"endTime":1886.263,"body":"tool into a new security feature."},{"startTime":1886.373,"endTime":1891.39,"body":"And so the thing that they're"},{"startTime":1886.373,"endTime":1891.39,"body":"calling memory integrity enforcement,"},{"startTime":1891.94,"endTime":1897.13,"body":"includes the new memory allocators"},{"startTime":1891.94,"endTime":1897.13,"body":"in the kernel and end user land"},{"startTime":1897.55,"endTime":1903.58,"body":"enhanced memory tagging extension in"},{"startTime":1897.55,"endTime":1903.58,"body":"synchronous mode, and extensive tag"},{"startTime":1903.58,"endTime":1905.92,"body":"confidentially enforcement policies."},{"startTime":1906.505,"endTime":1908.875,"body":"We haven't talked about that"},{"startTime":1906.505,"endTime":1908.875,"body":"at all, and I don't think, I"},{"startTime":1908.875,"endTime":1910.075,"body":"think that's down at the bottom."},{"startTime":1910.075,"endTime":1911.762,"body":"We have to get to that."},{"startTime":1912.479,"endTime":1915.089,"body":"and it's built into Apple"},{"startTime":1912.479,"endTime":1915.089,"body":"hardware and software and all"},{"startTime":1915.089,"endTime":1917.429,"body":"models of iPhone 17, iPhone air."},{"startTime":1917.799,"endTime":1920.889,"body":"and I think they said in"},{"startTime":1917.799,"endTime":1920.889,"body":"their announcement that it's"},{"startTime":1920.889,"endTime":1924.149,"body":"gonna come to either the next"},{"startTime":1920.889,"endTime":1924.149,"body":"MacBook or the latest MacBook."},{"startTime":1924.149,"endTime":1925.019,"body":"I forget which one."},{"startTime":1925.529,"endTime":1926.639,"body":"soon."},{"startTime":1927.306,"endTime":1927.816,"body":"Cool."},{"startTime":1928.483,"endTime":1934.07,"body":"And it seems like the real win here"},{"startTime":1928.483,"endTime":1934.07,"body":"is doing all of these things together."},{"startTime":1934.737,"endTime":1942.317,"body":"And the novel thing that they did is"},{"startTime":1934.737,"endTime":1942.317,"body":"updating their M chips or their a chips"},{"startTime":1942.317,"endTime":1949.217,"body":"or whatever to be able to do all of"},{"startTime":1942.317,"endTime":1949.217,"body":"this and not like crawl on all the time."},{"startTime":1949.217,"endTime":1950.117,"body":"Synchronously always."},{"startTime":1950.747,"endTime":1954.177,"body":"And not crawl the os to a halt."},{"startTime":1954.237,"endTime":1956.397,"body":"They were able to make all"},{"startTime":1954.237,"endTime":1956.397,"body":"these improvements, to do"},{"startTime":1956.397,"endTime":1957.897,"body":"all this stuff all the time."},{"startTime":1958.327,"endTime":1960.877,"body":"and it's still a performant"},{"startTime":1958.327,"endTime":1960.877,"body":"iPhone and it's not, you know,"},{"startTime":1960.937,"endTime":1962.377,"body":"killing your battery, basically."},{"startTime":1962.887,"endTime":1968.084,"body":"and that's a thing that Apple is in"},{"startTime":1962.887,"endTime":1968.084,"body":"a unique position to do, to do well."},{"startTime":1968.451,"endTime":1971.181,"body":"I think that like, that's the,"},{"startTime":1968.451,"endTime":1971.181,"body":"actually the big takeaway is"},{"startTime":1971.181,"endTime":1972.261,"body":"that they're doing it fast."},{"startTime":1972.261,"endTime":1976.011,"body":"Like all of this stuff has existed"},{"startTime":1972.261,"endTime":1976.011,"body":"for a while and is like good."},{"startTime":1976.251,"endTime":1979.701,"body":"It's, it's effective, but it's not"},{"startTime":1976.251,"endTime":1979.701,"body":"like a hundred percent effective"},{"startTime":1979.731,"endTime":1981.351,"body":"and it's been in stuff for a while."},{"startTime":1981.351,"endTime":1983.481,"body":"Like not just, just Apple, right?"},{"startTime":1983.481,"endTime":1988.041,"body":"Like Chrome has had partition Alec"},{"startTime":1983.481,"endTime":1988.041,"body":"for a number of years now, which is"},{"startTime":1988.041,"endTime":1992.671,"body":"another user land allocator, that"},{"startTime":1988.041,"endTime":1992.671,"body":"basically does ref counting and then"},{"startTime":1992.671,"endTime":1997.081,"body":"zaps the memory once the ref goes to"},{"startTime":1992.671,"endTime":1997.081,"body":"zero in such a way that if it is used"},{"startTime":1997.081,"endTime":2000.241,"body":"after freed, you end up with a crash."},{"startTime":2000.908,"endTime":2002.178,"body":"that only works for heap pointers."},{"startTime":2002.198,"endTime":2005.238,"body":"It doesn't work for all pointers and you"},{"startTime":2002.198,"endTime":2005.238,"body":"have to make source level changes that"},{"startTime":2005.238,"endTime":2007.178,"body":"can't be automated, but it can be done."},{"startTime":2007.478,"endTime":2007.878,"body":"Mm-hmm."},{"startTime":2008.178,"endTime":2009.648,"body":"you have that stuff in other places."},{"startTime":2009.648,"endTime":2012.918,"body":"You have had asynchronous"},{"startTime":2009.648,"endTime":2012.918,"body":"MTE on other devices."},{"startTime":2013.278,"endTime":2016.458,"body":"The real takeaway is that like they"},{"startTime":2013.278,"endTime":2016.458,"body":"bundled all of this together and"},{"startTime":2016.458,"endTime":2021.408,"body":"made it fast such that they like"},{"startTime":2016.458,"endTime":2021.408,"body":"turn it all on by default everywhere."},{"startTime":2021.708,"endTime":2022.128,"body":"Mm-hmm."},{"startTime":2022.478,"endTime":2026.108,"body":"Alec is on in like most of Chrome,"},{"startTime":2022.478,"endTime":2026.108,"body":"but it's not on like everywhere."},{"startTime":2026.108,"endTime":2027.578,"body":"Everywhere, for example."},{"startTime":2027.878,"endTime":2028.088,"body":"Okay."},{"startTime":2028.755,"endTime":2028.975,"body":"Yep."},{"startTime":2029.692,"endTime":2032.279,"body":"so they're reviewing"},{"startTime":2029.692,"endTime":2032.279,"body":"the memory allocators."},{"startTime":2032.946,"endTime":2036.066,"body":"Are you familiar with Lib"},{"startTime":2032.946,"endTime":2036.066,"body":"Pass Web kit's, web Pass?"},{"startTime":2036.483,"endTime":2039.693,"body":"I believe it's just their way of"},{"startTime":2036.483,"endTime":2039.693,"body":"basically doing like per object"},{"startTime":2039.693,"endTime":2041.223,"body":"heaps at like the type level."},{"startTime":2041.433,"endTime":2046.72,"body":"Um, but yeah, it's just like a c"},{"startTime":2041.433,"endTime":2046.72,"body":"plus plus e version of, of doing"},{"startTime":2046.72,"endTime":2048.31,"body":"the like type based allocations."},{"startTime":2048.677,"endTime":2052.127,"body":"all use type information to decide"},{"startTime":2048.677,"endTime":2052.127,"body":"how to organize memory allocations."},{"startTime":2052.527,"endTime":2057.927,"body":"so if those are all c which"},{"startTime":2052.527,"endTime":2057.927,"body":"is not strongly typed,"},{"startTime":2058.227,"endTime":2059.472,"body":"Lib has a c plus plus"},{"startTime":2059.512,"endTime":2060.112,"body":"Okay."},{"startTime":2060.112,"endTime":2060.442,"body":"All right."},{"startTime":2061.109,"endTime":2066.749,"body":"The other two are passing more"},{"startTime":2061.109,"endTime":2066.749,"body":"information about types to the compiler"},{"startTime":2067.139,"endTime":2071.549,"body":"to actually like, be able to use the"},{"startTime":2067.139,"endTime":2071.549,"body":"type information to do the layout and"},{"startTime":2071.549,"endTime":2073.559,"body":"allocations and all that sort of stuff."},{"startTime":2073.739,"endTime":2076.469,"body":"Yeah, I mean, I think all of these"},{"startTime":2073.739,"endTime":2076.469,"body":"required like some amount of compiler"},{"startTime":2076.469,"endTime":2078.539,"body":"extensions to make work in practice"},{"startTime":2078.929,"endTime":2080.009,"body":"you just have to free outta the bounce."},{"startTime":2080.009,"endTime":2080.789,"body":"Bugs overlap."},{"startTime":2080.879,"endTime":2081.419,"body":"Yeah, go ahead."},{"startTime":2081.719,"endTime":2084.149,"body":"I was say, speaking of compiler"},{"startTime":2081.719,"endTime":2084.149,"body":"extensions, I don't think they cover"},{"startTime":2084.149,"endTime":2087.569,"body":"this in here at all, but there's a"},{"startTime":2084.149,"endTime":2087.569,"body":"couple other compiler extensions that,"},{"startTime":2087.959,"endTime":2092.789,"body":"um, apple has driven and LLVM that have"},{"startTime":2087.959,"endTime":2092.789,"body":"been adopted outside of Apple, including"},{"startTime":2092.789,"endTime":2098.976,"body":"Chrome for basically, um, tagging,"},{"startTime":2092.789,"endTime":2098.976,"body":"um, like in CA common pattern as you"},{"startTime":2098.976,"endTime":2100.806,"body":"pass a pointer in a size parameter."},{"startTime":2101.473,"endTime":2105.733,"body":"and basically at the compiler"},{"startTime":2101.473,"endTime":2105.733,"body":"level ensuring that like that"},{"startTime":2105.733,"endTime":2109.003,"body":"size parameter is in fact enforced"},{"startTime":2105.733,"endTime":2109.003,"body":"and that like there are checks."},{"startTime":2109.583,"endTime":2113.513,"body":"just like you would if you're using like"},{"startTime":2109.583,"endTime":2113.513,"body":"stood array or stood vector in c plus"},{"startTime":2113.513,"endTime":2119.228,"body":"plus that like you, you annotate, the, the"},{"startTime":2113.513,"endTime":2119.228,"body":"function call and then the compiler puts"},{"startTime":2119.228,"endTime":2124.215,"body":"the bounds checks on the, on the pointer,"},{"startTime":2119.228,"endTime":2124.215,"body":"a accesses to make sure that, um, you"},{"startTime":2124.215,"endTime":2127.875,"body":"don't have, uh, spatial memory on safety."},{"startTime":2128.195,"endTime":2131.925,"body":"and then also like corresponding, compiler"},{"startTime":2128.195,"endTime":2131.925,"body":"passes if you don't want to enforce that"},{"startTime":2131.925,"endTime":2133.935,"body":"just for detecting, um, when it happens."},{"startTime":2133.935,"endTime":2139.245,"body":"So you can like ban new uses of, of"},{"startTime":2133.935,"endTime":2139.245,"body":"just like unsafe pointer accesses and"},{"startTime":2139.245,"endTime":2143.265,"body":"see, um, also very effective and can"},{"startTime":2139.245,"endTime":2143.265,"body":"be like slowly rolled out over a code"},{"startTime":2143.265,"endTime":2145.155,"body":"base on like a file by file basis."},{"startTime":2145.155,"endTime":2149.895,"body":"You can be like, no more raw"},{"startTime":2145.155,"endTime":2149.895,"body":"pointer accesses in this directory,"},{"startTime":2149.895,"endTime":2151.245,"body":"aside from the existing ones."},{"startTime":2151.505,"endTime":2151.745,"body":"nice."},{"startTime":2151.745,"endTime":2155.855,"body":"I haven't heard about that at all,"},{"startTime":2151.745,"endTime":2155.855,"body":"but I am not paying very close"},{"startTime":2155.855,"endTime":2157.43,"body":"attention to that side of the world"},{"startTime":2157.655,"endTime":2160.955,"body":"F bound safety or something"},{"startTime":2157.655,"endTime":2160.955,"body":"like that is the flag for clang."},{"startTime":2161.615,"endTime":2162.155,"body":"Cool."},{"startTime":2162.822,"endTime":2165.762,"body":"And so like, this is sort of stuff"},{"startTime":2162.822,"endTime":2165.762,"body":"that's been kind of going on for years"},{"startTime":2165.762,"endTime":2168.252,"body":"and they're taking advantage of it"},{"startTime":2165.762,"endTime":2168.252,"body":"for this, and then they've already"},{"startTime":2168.252,"endTime":2170.172,"body":"rolled out these, improved allocators."},{"startTime":2170.472,"endTime":2172.482,"body":"and to their credit, they were"},{"startTime":2170.472,"endTime":2172.482,"body":"driving a lot of it too, right?"},{"startTime":2172.482,"endTime":2173.952,"body":"Like they have a lot of clang developers"},{"startTime":2174.372,"endTime":2174.582,"body":"Yeah."},{"startTime":2174.792,"endTime":2176.589,"body":"Well, I'm not surprised,"},{"startTime":2177.039,"endTime":2182.206,"body":"and they used to have, what's his name,"},{"startTime":2177.039,"endTime":2182.206,"body":"who like created LLVM, Chris Latner."},{"startTime":2182.691,"endTime":2182.981,"body":"Cool."},{"startTime":2183.648,"endTime":2183.768,"body":"Yeah."},{"startTime":2184.068,"endTime":2185.988,"body":"That's a, that makes a lot of sense."},{"startTime":2186.655,"endTime":2187.255,"body":"okay."},{"startTime":2187.795,"endTime":2191.365,"body":"Tpo wear placement policies over"},{"startTime":2187.795,"endTime":2191.365,"body":"secure memory allocators helped"},{"startTime":2191.365,"endTime":2193.535,"body":"work memory corruption, Okay."},{"startTime":2193.535,"endTime":2194.165,"body":"Yes."},{"startTime":2194.225,"endTime":2196.475,"body":"Does not, does hit performance."},{"startTime":2196.575,"endTime":2199.365,"body":"performance is either even"},{"startTime":2196.575,"endTime":2199.365,"body":"as the same or better."},{"startTime":2200.025,"endTime":2203.115,"body":"Allocators can apply protections"},{"startTime":2200.025,"endTime":2203.115,"body":"only at the granularity of"},{"startTime":2203.115,"endTime":2205.785,"body":"memory pages 16 kilobytes on iOS."},{"startTime":2206.215,"endTime":2210.355,"body":"for smaller allocations, secure"},{"startTime":2206.215,"endTime":2210.355,"body":"allocators can use page level protections"},{"startTime":2210.655,"endTime":2213.835,"body":"to help prevent memory corruption"},{"startTime":2210.655,"endTime":2213.835,"body":"attacks across different type buckets."},{"startTime":2213.835,"endTime":2217.135,"body":"However, page level protections"},{"startTime":2213.835,"endTime":2217.135,"body":"are to coarse defending as attacks"},{"startTime":2217.135,"endTime":2218.605,"body":"within the same type bucket."},{"startTime":2218.695,"endTime":2220.555,"body":"And we use memory tagging"},{"startTime":2218.695,"endTime":2220.555,"body":"to close this gap."},{"startTime":2220.585,"endTime":2224.672,"body":"So it's not just like, cool, we do"},{"startTime":2220.585,"endTime":2224.672,"body":"stuff at the allocators and then we"},{"startTime":2224.672,"endTime":2226.982,"body":"do memory tagging, you know, as well."},{"startTime":2226.982,"endTime":2229.642,"body":"It's like, no, no, no, we have to cover."},{"startTime":2230.152,"endTime":2232.822,"body":"The page level and cross page stuff."},{"startTime":2232.882,"endTime":2237.887,"body":"We, via our kernel level and user land"},{"startTime":2232.882,"endTime":2237.887,"body":"level memory allocators because, and then"},{"startTime":2237.887,"endTime":2241.577,"body":"we also have to do the memory tagging"},{"startTime":2237.887,"endTime":2241.577,"body":"stuff because like there's fine grain"},{"startTime":2241.577,"endTime":2246.377,"body":"stuff that is not covered by the page"},{"startTime":2241.577,"endTime":2246.377,"body":"level memory allocation protection."},{"startTime":2246.677,"endTime":2247.007,"body":"Cool."},{"startTime":2247.157,"endTime":2247.487,"body":"All right."},{"startTime":2248.117,"endTime":2250.877,"body":"And that's where the EMT is comes in to be"},{"startTime":2251.147,"endTime":2253.097,"body":"And to be fair, that's like most objects."},{"startTime":2253.764,"endTime":2253.944,"body":"Okay."},{"startTime":2254.204,"endTime":2257.504,"body":"most objects are smaller than"},{"startTime":2254.204,"endTime":2257.504,"body":"the full 16 kilobyte page."},{"startTime":2257.864,"endTime":2260.144,"body":"Not out, out here allocating pages."},{"startTime":2260.761,"endTime":2265.581,"body":"Um, EMT protects against two of"},{"startTime":2260.761,"endTime":2265.581,"body":"the most common types of memory"},{"startTime":2265.581,"endTime":2268.701,"body":"corruption, buffer overflows in use"},{"startTime":2265.581,"endTime":2268.701,"body":"after free, which we talked about."},{"startTime":2269.131,"endTime":2272.521,"body":"But for overflows, allocator is"},{"startTime":2269.131,"endTime":2272.521,"body":"responsible for using different"},{"startTime":2272.521,"endTime":2274.441,"body":"tags for name allocations."},{"startTime":2274.871,"endTime":2278.051,"body":"If a request to access memory spills"},{"startTime":2274.871,"endTime":2278.051,"body":"over to adjacent memory, it has a"},{"startTime":2278.051,"endTime":2281.891,"body":"different tag, the hardware blocks"},{"startTime":2278.051,"endTime":2281.891,"body":"it, and the operating system can take"},{"startTime":2281.891,"endTime":2282.976,"body":"action and terminate the process."},{"startTime":2283.276,"endTime":2283.566,"body":"Yeah."},{"startTime":2283.571,"endTime":2283.781,"body":"Yeah."},{"startTime":2283.781,"endTime":2285.311,"body":"This is the easiest one"},{"startTime":2283.781,"endTime":2285.311,"body":"to get your head around."},{"startTime":2285.356,"endTime":2290.861,"body":"where they diagram it and we covered it"},{"startTime":2285.356,"endTime":2290.861,"body":"earlier, they have a nice diagram with"},{"startTime":2291.401,"endTime":2294.401,"body":"emoji and colors to show how MTE works."},{"startTime":2294.401,"endTime":2297.251,"body":"It's not very complicated to"},{"startTime":2294.401,"endTime":2297.251,"body":"understand the core concept."},{"startTime":2297.618,"endTime":2299.928,"body":"We will save you from"},{"startTime":2297.618,"endTime":2299.928,"body":"explaining the diagrams."},{"startTime":2300.588,"endTime":2302.988,"body":"Um, uh,"},{"startTime":2303.348,"endTime":2306.318,"body":"wait, that's, yeah, that's the"},{"startTime":2303.348,"endTime":2306.318,"body":"buffer overflow where you're just"},{"startTime":2306.318,"endTime":2308.208,"body":"going over the type over the area."},{"startTime":2308.208,"endTime":2312.228,"body":"And this is the one where"},{"startTime":2308.208,"endTime":2312.228,"body":"you're, using after free."},{"startTime":2312.258,"endTime":2316.888,"body":"diagram both bound safety and spatial"},{"startTime":2312.258,"endTime":2316.888,"body":"safety and then, temporal safety,"},{"startTime":2316.888,"endTime":2318.058,"body":"which would be use after free,"},{"startTime":2318.553,"endTime":2323.623,"body":"Which like my intuition for the use after"},{"startTime":2318.553,"endTime":2323.623,"body":"free MTE story, it's like you can free"},{"startTime":2323.623,"endTime":2325.008,"body":"the pointer along with the actual memory."},{"startTime":2325.675,"endTime":2326.065,"body":"Nice."},{"startTime":2326.215,"endTime":2326.575,"body":"or less."},{"startTime":2326.575,"endTime":2326.905,"body":"Yeah."},{"startTime":2327.572,"endTime":2331.522,"body":"I would also just say in modern,"},{"startTime":2327.572,"endTime":2331.522,"body":"projects, there can be spatial"},{"startTime":2331.522,"endTime":2332.842,"body":"memory safety errors, like when."},{"startTime":2333.427,"endTime":2334.987,"body":"First learn about memory on safety."},{"startTime":2334.987,"endTime":2338.527,"body":"I feel like buffer overflow is the main"},{"startTime":2334.987,"endTime":2338.527,"body":"thing everyone learns, but like in, in"},{"startTime":2338.527,"endTime":2345.217,"body":"practice it's not that hard to mitigate"},{"startTime":2338.527,"endTime":2345.217,"body":"the like 99% plus of your spatial safety"},{"startTime":2345.217,"endTime":2351.897,"body":"things by like, I using containers and c"},{"startTime":2345.217,"endTime":2351.897,"body":"plus plus, using F bound safety, writing"},{"startTime":2351.897,"endTime":2358.497,"body":"sane c code without like limits where you"},{"startTime":2351.897,"endTime":2358.497,"body":"access things like having a SPAN class or"},{"startTime":2358.497,"endTime":2360.447,"body":"a span dropped or whatever you call it."},{"startTime":2360.447,"endTime":2361.767,"body":"Like, is, is fairly common."},{"startTime":2362.082,"endTime":2364.617,"body":"And, and like enforcing"},{"startTime":2362.082,"endTime":2364.617,"body":"everybody uses that."},{"startTime":2364.617,"endTime":2369.237,"body":"Like, you get pretty close to"},{"startTime":2364.617,"endTime":2369.237,"body":"very high coverage of like your,"},{"startTime":2369.237,"endTime":2372.297,"body":"your spatial memory safety, at"},{"startTime":2369.237,"endTime":2372.297,"body":"least when it comes to containers."},{"startTime":2372.747,"endTime":2375.837,"body":"Um, not necessarily like"},{"startTime":2372.747,"endTime":2375.837,"body":"a crap on the stack or"},{"startTime":2376.272,"endTime":2376.632,"body":"mm-hmm."},{"startTime":2376.697,"endTime":2377.922,"body":"lifecycle is a nightmare."},{"startTime":2378.237,"endTime":2380.037,"body":"yeah, lifecycle is a nightmare."},{"startTime":2380.097,"endTime":2383.907,"body":"So in practice, like the most memory,"},{"startTime":2380.097,"endTime":2383.907,"body":"safety, vulnerabilities that matter,"},{"startTime":2383.907,"endTime":2386.787,"body":"they're all used after freeze because"},{"startTime":2383.907,"endTime":2386.787,"body":"like we understand how to write a"},{"startTime":2386.787,"endTime":2388.017,"body":"container these days and make it."},{"startTime":2388.684,"endTime":2392.014,"body":"It's the ones where it's like,"},{"startTime":2388.684,"endTime":2392.014,"body":"okay, we've handled all of those."},{"startTime":2392.014,"endTime":2396.964,"body":"It's like, okay, later in the lifetime"},{"startTime":2392.014,"endTime":2396.964,"body":"of this piece of memory or whatever, it"},{"startTime":2396.964,"endTime":2401.294,"body":"either got used, when it was supposed"},{"startTime":2396.964,"endTime":2401.294,"body":"to be already freed or something to"},{"startTime":2401.294,"endTime":2404.174,"body":"that effect, because you can't just"},{"startTime":2401.294,"endTime":2404.174,"body":"like write a container around it."},{"startTime":2404.174,"endTime":2408.464,"body":"they're intrinsically inter procedural"},{"startTime":2404.174,"endTime":2408.464,"body":"lifecycle vulnerabilities where spatial"},{"startTime":2408.464,"endTime":2411.494,"body":"ones aren't necessarily like, all you"},{"startTime":2408.464,"endTime":2411.494,"body":"have to do is store enough information"},{"startTime":2411.494,"endTime":2414.284,"body":"with the data so that whatever loop"},{"startTime":2411.494,"endTime":2414.284,"body":"you're doing or whatever right you're"},{"startTime":2414.284,"endTime":2417.014,"body":"doing into it, can just check to see"},{"startTime":2414.284,"endTime":2417.014,"body":"if you're within bounds or whatever."},{"startTime":2417.374,"endTime":2420.744,"body":"But a lifecycle vulnerability"},{"startTime":2417.374,"endTime":2420.744,"body":"could span, 15 different functions"},{"startTime":2420.744,"endTime":2421.734,"body":"called the different times."},{"startTime":2421.804,"endTime":2422.094,"body":"Yeah."},{"startTime":2422.324,"endTime":2422.614,"body":"Okay."},{"startTime":2422.981,"endTime":2427.031,"body":"you can enable like hardened lib c"},{"startTime":2422.981,"endTime":2427.031,"body":"plus plus, I think with a pound f"},{"startTime":2427.031,"endTime":2428.621,"body":"or maybe a compiler flag or both."},{"startTime":2429.011,"endTime":2433.728,"body":"Um, that just like puts checks"},{"startTime":2429.011,"endTime":2433.728,"body":"everywhere in, in like the CC plus"},{"startTime":2433.728,"endTime":2435.048,"body":"plus standard lib, for example."},{"startTime":2435.378,"endTime":2439.008,"body":"Um, 'cause like by default only some of"},{"startTime":2435.378,"endTime":2439.008,"body":"the methods actually like do check access."},{"startTime":2439.675,"endTime":2442.485,"body":"it was less so that like we didn't"},{"startTime":2439.675,"endTime":2442.485,"body":"know how to do this for years."},{"startTime":2442.485,"endTime":2445.185,"body":"It was just like, oh, well the performance"},{"startTime":2442.485,"endTime":2445.185,"body":"impact of putting the checks everywhere"},{"startTime":2445.185,"endTime":2446.415,"body":"is too high, so we can't do it."},{"startTime":2446.415,"endTime":2448.365,"body":"We'll assume the programmer"},{"startTime":2446.415,"endTime":2448.365,"body":"put it in the right spot."},{"startTime":2448.785,"endTime":2453.015,"body":"But like, what actually happened, like"},{"startTime":2448.785,"endTime":2453.015,"body":"is like some people got hardened lib c"},{"startTime":2453.015,"endTime":2457.305,"body":"plus plus and the lib c plus plus Chrome"},{"startTime":2453.015,"endTime":2457.305,"body":"enabled that like years ago at this point."},{"startTime":2457.635,"endTime":2462.285,"body":"Um, and then eventually, like some other"},{"startTime":2457.635,"endTime":2462.285,"body":"people followed as well and like that"},{"startTime":2462.285,"endTime":2464.025,"body":"got the compiler people looking at it."},{"startTime":2464.205,"endTime":2467.715,"body":"Then the compiler people were like,"},{"startTime":2464.205,"endTime":2467.715,"body":"oh, actually we can write a ton of"},{"startTime":2467.715,"endTime":2471.135,"body":"optimizations for this because like"},{"startTime":2467.715,"endTime":2471.135,"body":"most of the time that you insert checks,"},{"startTime":2471.135,"endTime":2474.915,"body":"like you can, like deterministically"},{"startTime":2471.135,"endTime":2474.915,"body":"prove you don't need to do the check"},{"startTime":2474.915,"endTime":2476.235,"body":"because you did the check earlier."},{"startTime":2476.325,"endTime":2478.875,"body":"This happens a lot in like"},{"startTime":2476.325,"endTime":2478.875,"body":"rust with Iterators and stuff."},{"startTime":2478.875,"endTime":2481.695,"body":"Like the vast majority of the checks"},{"startTime":2478.875,"endTime":2481.695,"body":"end up getting optimized out by the"},{"startTime":2481.695,"endTime":2483.685,"body":"compiler, because they're redundant."},{"startTime":2484.065,"endTime":2487.7,"body":"and so like once you actually put it, the"},{"startTime":2484.065,"endTime":2487.7,"body":"effort into writing those optimizations."},{"startTime":2488.367,"endTime":2489.807,"body":"Then the harden mode gets faster."},{"startTime":2489.807,"endTime":2492.207,"body":"But we had like this chicken and egg"},{"startTime":2489.807,"endTime":2492.207,"body":"problem for a while where people were"},{"startTime":2492.207,"endTime":2495.267,"body":"like, we can't use harden mode 'cause the"},{"startTime":2492.207,"endTime":2495.267,"body":"compiler doesn't know how to optimize it."},{"startTime":2495.267,"endTime":2497.367,"body":"And then the compiler people"},{"startTime":2495.267,"endTime":2497.367,"body":"were like, we're not optimizing"},{"startTime":2497.367,"endTime":2498.507,"body":"that 'cause no one's using it."},{"startTime":2498.567,"endTime":2498.657,"body":"this."},{"startTime":2498.657,"endTime":2503.307,"body":"And it was just like, oh, well actually"},{"startTime":2498.657,"endTime":2503.307,"body":"with like a modicum of effort, like"},{"startTime":2503.307,"endTime":2506.637,"body":"a year of effort from a compiler"},{"startTime":2503.307,"endTime":2506.637,"body":"team at a big tech company, like you"},{"startTime":2506.637,"endTime":2511.107,"body":"can reclaim like the fast ma, the"},{"startTime":2506.637,"endTime":2511.107,"body":"like 1% performance loss or whatever"},{"startTime":2511.107,"endTime":2513.584,"body":"you got for, hardened c plus plus"},{"startTime":2513.639,"endTime":2513.929,"body":"Yeah."},{"startTime":2514.596,"endTime":2517.866,"body":"okay, we're, we're trying to zoom"},{"startTime":2514.596,"endTime":2517.866,"body":"through this so we can wrap up"},{"startTime":2517.866,"endTime":2519.386,"body":"before, we all have to disappear."},{"startTime":2519.836,"endTime":2523.676,"body":"weakness of original MTE access"},{"startTime":2519.836,"endTime":2523.676,"body":"to non-tech memory, global"},{"startTime":2523.676,"endTime":2525.386,"body":"variables not checked by hardware."},{"startTime":2525.676,"endTime":2526.846,"body":"this is nice for attackers."},{"startTime":2527.146,"endTime":2527.971,"body":"I don't get this."},{"startTime":2528.631,"endTime":2530.731,"body":"There's a thing I don't"},{"startTime":2528.631,"endTime":2530.731,"body":"get about this, right."},{"startTime":2530.821,"endTime":2537.698,"body":"Which is like, so the, the mitigation here"},{"startTime":2530.821,"endTime":2537.698,"body":"is that attackers have to know the tag"},{"startTime":2537.698,"endTime":2539.198,"body":"of the region that they're coming from."},{"startTime":2539.198,"endTime":2543.218,"body":"Now to do this, we're talking about"},{"startTime":2539.198,"endTime":2543.218,"body":"writing into untagged memory, right?"},{"startTime":2543.368,"endTime":2545.168,"body":"So what is the actual pattern here?"},{"startTime":2545.228,"endTime":2547.778,"body":"This is just a thing where like, I'm"},{"startTime":2545.228,"endTime":2547.778,"body":"sure this is obvious if, if you've"},{"startTime":2547.778,"endTime":2550.985,"body":"looked at an exploit or whatever, but"},{"startTime":2547.778,"endTime":2550.985,"body":"like, what does it mean to know the"},{"startTime":2550.985,"endTime":2554.645,"body":"region's tag from like you're writing"},{"startTime":2550.985,"endTime":2554.645,"body":"from an untagged to a tagged region."},{"startTime":2554.645,"endTime":2556.805,"body":"What does it mean to know the"},{"startTime":2554.645,"endTime":2556.805,"body":"tag of the, of the tagged region?"},{"startTime":2557.472,"endTime":2558.162,"body":"Do any of us know?"},{"startTime":2558.802,"endTime":2559.282,"body":"I dunno,"},{"startTime":2559.949,"endTime":2563.709,"body":"I mean, it's presumably that when you're"},{"startTime":2559.949,"endTime":2563.709,"body":"accessing the global variable, you're"},{"startTime":2563.709,"endTime":2567.999,"body":"doing so from some location and code"},{"startTime":2563.709,"endTime":2567.999,"body":"and that location has a tag and you"},{"startTime":2567.999,"endTime":2572.689,"body":"need to like know it yourself, I don't"},{"startTime":2567.999,"endTime":2572.689,"body":"know what it would mean to actually tag"},{"startTime":2572.689,"endTime":2576.619,"body":"the like instruction segment or like"},{"startTime":2572.689,"endTime":2576.619,"body":"what that mean, or like, is it, is it"},{"startTime":2576.619,"endTime":2578.179,"body":"all sent through a function pointer?"},{"startTime":2578.179,"endTime":2581.389,"body":"Then that function pointer as a tag"},{"startTime":2578.179,"endTime":2581.389,"body":"Because the function pointer is in the,"},{"startTime":2581.689,"endTime":2583.549,"body":"whatever the non-data segment is called."},{"startTime":2583.549,"endTime":2584.179,"body":"I don't remember."},{"startTime":2584.539,"endTime":2587.149,"body":"It's like the centerpiece Of"},{"startTime":2584.539,"endTime":2587.149,"body":"how they're describing EMTE."},{"startTime":2587.519,"endTime":2590.016,"body":"Well, I don't believe in reading assembly."},{"startTime":2590.076,"endTime":2595.848,"body":"So, so beyond global variables, they also"},{"startTime":2590.076,"endTime":2595.848,"body":"talk about trying to mitigate, specter or,"},{"startTime":2596.148,"endTime":2596.568,"body":"Oh right."},{"startTime":2596.653,"endTime":2601.672,"body":"the, the other common bypass for MTEs to"},{"startTime":2596.653,"endTime":2601.672,"body":"use some sort of speculative execution"},{"startTime":2601.672,"endTime":2605.932,"body":"side channel to read out whatever the tag"},{"startTime":2601.672,"endTime":2605.932,"body":"is and then on your first attempt to like"},{"startTime":2605.932,"endTime":2607.582,"body":"overwrite you just use the correct value."},{"startTime":2608.075,"endTime":2608.565,"body":"this is"},{"startTime":2608.865,"endTime":2611.27,"body":"and they say they mitigate this Yes."},{"startTime":2611.27,"endTime":2615.67,"body":"With tag confidentiality enforcement,"},{"startTime":2611.27,"endTime":2615.67,"body":"which they, back using their secure"},{"startTime":2615.67,"endTime":2619.66,"body":"page table monitor, which I think"},{"startTime":2615.67,"endTime":2619.66,"body":"is something along the lines of an"},{"startTime":2619.66,"endTime":2624.407,"body":"armed trust zone or Intel, SGX, um."},{"startTime":2624.407,"endTime":2625.997,"body":"all we know about"},{"startTime":2626.027,"endTime":2626.987,"body":"No, we know a lot."},{"startTime":2627.287,"endTime":2627.587,"body":"No."},{"startTime":2627.617,"endTime":2629.867,"body":"We know a lot about the"},{"startTime":2627.617,"endTime":2629.867,"body":"secured page, stable monitor,"},{"startTime":2630.027,"endTime":2632.577,"body":"there's a paper about it that"},{"startTime":2630.027,"endTime":2632.577,"body":"kind of unwinds the whole thing."},{"startTime":2632.577,"endTime":2633.717,"body":"Works out what all the function calls"},{"startTime":2633.747,"endTime":2635.607,"body":"Oh, this, this one."},{"startTime":2635.907,"endTime":2636.297,"body":"Yeah."},{"startTime":2636.597,"endTime":2638.037,"body":"We'll throw this in the notes."},{"startTime":2638.197,"endTime":2639.187,"body":"and great job."},{"startTime":2639.187,"endTime":2642.967,"body":"To the authors of this paper"},{"startTime":2639.187,"endTime":2642.967,"body":"whose names I will slaughter,"},{"startTime":2642.997,"endTime":2645.187,"body":"paper from, did I find that paper?"},{"startTime":2645.187,"endTime":2647.467,"body":"Was that paper released"},{"startTime":2645.187,"endTime":2647.467,"body":"like seven days ago?"},{"startTime":2648.134,"endTime":2648.644,"body":"maybe,"},{"startTime":2648.694,"endTime":2651.574,"body":"10th of October, 2025, current revision."},{"startTime":2652.084,"endTime":2653.164,"body":"12 days ago."},{"startTime":2653.464,"endTime":2653.614,"body":"yeah."},{"startTime":2653.644,"endTime":2654.454,"body":"And that's V one."},{"startTime":2654.754,"endTime":2655.244,"body":"Hell yeah."},{"startTime":2655.394,"endTime":2660.346,"body":"so I guess they were, we were not the"},{"startTime":2655.394,"endTime":2660.346,"body":"only people intrigued by, uh, intrigued"},{"startTime":2660.346,"endTime":2662.356,"body":"by this blog post in reference."},{"startTime":2663.023,"endTime":2666.713,"body":"perhaps, although this looks like"},{"startTime":2663.023,"endTime":2666.713,"body":"it's also a master's thesis, so"},{"startTime":2666.743,"endTime":2669.66,"body":"maybe they were starting long before."},{"startTime":2669.96,"endTime":2673.83,"body":"the vibe is that you're running a big"},{"startTime":2669.96,"endTime":2673.83,"body":"chunk of the virtual memory subsystem"},{"startTime":2673.83,"endTime":2675.72,"body":"of the kernel in like an enclave."},{"startTime":2676.385,"endTime":2676.805,"body":"Mm-hmm."},{"startTime":2676.83,"endTime":2677.67,"body":"I guess so."},{"startTime":2677.74,"endTime":2681.61,"body":"my understanding was the driving purpose"},{"startTime":2677.74,"endTime":2681.61,"body":"for this originally was kernel exploits"},{"startTime":2681.61,"endTime":2684.46,"body":"that would bounce off of gadgets that"},{"startTime":2681.61,"endTime":2684.46,"body":"would change the page tables and stuff."},{"startTime":2684.465,"endTime":2684.885,"body":"Mm-hmm."},{"startTime":2685.3,"endTime":2687.91,"body":"Like you just, you've got control"},{"startTime":2685.3,"endTime":2687.91,"body":"over memory in the kernel."},{"startTime":2687.91,"endTime":2690.67,"body":"You can bounce around, you can"},{"startTime":2687.91,"endTime":2690.67,"body":"just flip things to be executable"},{"startTime":2690.67,"endTime":2691.9,"body":"or not executable, whatever."},{"startTime":2692.267,"endTime":2697.277,"body":"whenever anyone mentions a trust zone,"},{"startTime":2692.267,"endTime":2697.277,"body":"I just immediately think of it in"},{"startTime":2697.427,"endTime":2699.347,"body":"to the tune of the song, white Room."},{"startTime":2699.347,"endTime":2702.167,"body":"In the White Room, but"},{"startTime":2699.347,"endTime":2702.167,"body":"I wanna say cream, but"},{"startTime":2702.497,"endTime":2704.507,"body":"In the trust zone."},{"startTime":2704.927,"endTime":2705.167,"body":"Exactly."},{"startTime":2705.167,"endTime":2706.877,"body":"With white curtains?"},{"startTime":2706.877,"endTime":2707.807,"body":"No, it's the other way around."},{"startTime":2708.347,"endTime":2710.012,"body":"In the white room with black curtains."},{"startTime":2710.312,"endTime":2712.297,"body":"have nothing to do with any of"},{"startTime":2710.312,"endTime":2712.297,"body":"what you guys are talking about."},{"startTime":2712.964,"endTime":2717.741,"body":"We need to educate you on"},{"startTime":2712.964,"endTime":2717.741,"body":"your classic proto metal"},{"startTime":2718.071,"endTime":2722.361,"body":"we need to educate the oldest person in"},{"startTime":2718.071,"endTime":2722.361,"body":"the chat on music that came out before"},{"startTime":2722.646,"endTime":2723.216,"body":"we were all"},{"startTime":2723.271,"endTime":2723.751,"body":"I was born."},{"startTime":2724.296,"endTime":2724.586,"body":"Yeah."},{"startTime":2725.253,"endTime":2725.763,"body":"Okay."},{"startTime":2725.823,"endTime":2727.293,"body":"So those are the three main pieces."},{"startTime":2727.293,"endTime":2732.153,"body":"Then we've got the improved type"},{"startTime":2727.293,"endTime":2732.153,"body":"informed allocate, secure allocators."},{"startTime":2732.433,"endTime":2737.75,"body":"we've got the enhanced extended"},{"startTime":2732.433,"endTime":2737.75,"body":"memory tagging, extension, whatever."},{"startTime":2737.99,"endTime":2742.86,"body":"And we've got, this whatever tag"},{"startTime":2737.99,"endTime":2742.86,"body":"confidentially enforcement, which is"},{"startTime":2742.86,"endTime":2747.15,"body":"basically they're storing all this"},{"startTime":2742.86,"endTime":2747.15,"body":"stuff in their, their trust zone"},{"startTime":2747.42,"endTime":2750.87,"body":"t type of deal that they already"},{"startTime":2747.42,"endTime":2750.87,"body":"had, the secure page table monitor."},{"startTime":2751.18,"endTime":2752.51,"body":"and that's based, that's it."},{"startTime":2752.54,"endTime":2756.17,"body":"that's memory integrity"},{"startTime":2752.54,"endTime":2756.17,"body":"enforcement or whatever."},{"startTime":2756.65,"endTime":2757.13,"body":"cool."},{"startTime":2757.797,"endTime":2758.427,"body":"Let's see."},{"startTime":2758.517,"endTime":2764.007,"body":"And then they prob they of course aren't"},{"startTime":2758.517,"endTime":2764.007,"body":"going to say the specifics of how they"},{"startTime":2764.007,"endTime":2769.377,"body":"made all of this fast enough, but that is"},{"startTime":2764.007,"endTime":2769.377,"body":"like the secret sauce of like how they're"},{"startTime":2769.377,"endTime":2771.747,"body":"able to ship all of it in the first place."},{"startTime":2772.147,"endTime":2775.687,"body":"Evaluating pointer authentication"},{"startTime":2772.147,"endTime":2775.687,"body":"instructions, speculatively."},{"startTime":2775.807,"endTime":2778.627,"body":"Yeah, that's, that's Specter V one, right?"},{"startTime":2778.987,"endTime":2783.614,"body":"Yes, that's Vector V one, which was"},{"startTime":2778.987,"endTime":2783.614,"body":"basically never fully mitigated."},{"startTime":2783.704,"endTime":2785.774,"body":"We just kind of were like,"},{"startTime":2783.704,"endTime":2785.774,"body":"eh, it's probably fine."},{"startTime":2786.344,"endTime":2790.821,"body":"We'll split stuff at the like, like"},{"startTime":2786.344,"endTime":2790.821,"body":"the kernel will deal with it if you"},{"startTime":2790.821,"endTime":2792.046,"body":"care about it at a per process level."},{"startTime":2792.266,"endTime":2793.126,"body":"And if you know."},{"startTime":2793.793,"endTime":2796.163,"body":"You care about it within a"},{"startTime":2793.793,"endTime":2796.163,"body":"process, well just split your stuff"},{"startTime":2796.163,"endTime":2797.543,"body":"into multiple processes, right?"},{"startTime":2797.543,"endTime":2798.113,"body":"Like that."},{"startTime":2798.113,"endTime":2801.323,"body":"That's what the usual mitigation is,"},{"startTime":2798.113,"endTime":2801.323,"body":"is like figure out what your security"},{"startTime":2801.323,"endTime":2803.153,"body":"boundary is and then, you know, cut it."},{"startTime":2803.273,"endTime":2803.333,"body":"it."},{"startTime":2803.573,"endTime":2803.963,"body":"Yep."},{"startTime":2804.013,"endTime":2806.713,"body":"is why like Chrome has site isolation."},{"startTime":2807.073,"endTime":2809.503,"body":"Well, there's a number of reasons"},{"startTime":2807.073,"endTime":2809.503,"body":"why Chrome has site isolation, but"},{"startTime":2809.503,"endTime":2814.348,"body":"the best mitigation for one site"},{"startTime":2809.503,"endTime":2814.348,"body":"can speculative, speculatively read"},{"startTime":2814.348,"endTime":2815.668,"body":"private data from another site."},{"startTime":2815.668,"endTime":2819.463,"body":"In the same process is to simply not"},{"startTime":2815.668,"endTime":2819.463,"body":"put two sites in the same process."},{"startTime":2819.523,"endTime":2819.973,"body":"same process."},{"startTime":2820.303,"endTime":2820.783,"body":"Yep."},{"startTime":2821.46,"endTime":2825.42,"body":"And this is like, if you really"},{"startTime":2821.46,"endTime":2825.42,"body":"care about Specter V one."},{"startTime":2826.087,"endTime":2830.887,"body":"Just run that process on like a core"},{"startTime":2826.087,"endTime":2830.887,"body":"that you trust that you don't share with"},{"startTime":2830.887,"endTime":2835.147,"body":"other processes from people you don't"},{"startTime":2830.887,"endTime":2835.147,"body":"trust, uh, and you're, you're good to go."},{"startTime":2835.357,"endTime":2839.017,"body":"That's a bit expensive and getting"},{"startTime":2835.357,"endTime":2839.017,"body":"that isolation is, is kind of"},{"startTime":2839.017,"endTime":2842.647,"body":"difficult if you like to have run"},{"startTime":2839.017,"endTime":2842.647,"body":"things on a cloud, uh, hypervisor."},{"startTime":2842.887,"endTime":2843.487,"body":"Oh, sorry."},{"startTime":2843.487,"endTime":2844.854,"body":"Money, please."},{"startTime":2846.581,"endTime":2850.331,"body":"let's see if we can cover"},{"startTime":2846.581,"endTime":2850.331,"body":"the rest of this real quick."},{"startTime":2850.691,"endTime":2851.831,"body":"Okay."},{"startTime":2851.831,"endTime":2852.011,"body":"Specter"},{"startTime":2852.016,"endTime":2852.456,"body":"to cover."},{"startTime":2853.123,"endTime":2855.433,"body":"No solution to this problem, blah, blah,"},{"startTime":2855.438,"endTime":2858.855,"body":"they  addressed Specter with the secure"},{"startTime":2855.438,"endTime":2858.855,"body":"page, table thing that we just discussed."},{"startTime":2859.522,"endTime":2863.002,"body":"And then they're protecting their users"},{"startTime":2859.522,"endTime":2863.002,"body":"with memory integrity enforcement."},{"startTime":2863.669,"endTime":2868.019,"body":"Um, and that user does not involve"},{"startTime":2863.669,"endTime":2868.019,"body":"me because of my aforementioned"},{"startTime":2868.019,"endTime":2870.929,"body":"inability to input the correct"},{"startTime":2868.019,"endTime":2870.929,"body":"address when ordering a phone."},{"startTime":2872.856,"endTime":2877.73,"body":"Protect all users by defaults and yeah."},{"startTime":2877.73,"endTime":2881.93,"body":"Google took a great first step last year"},{"startTime":2877.73,"endTime":2881.93,"body":"when they offered MTE, those to opt in."},{"startTime":2882.38,"endTime":2885.305,"body":"Good for them, but technically"},{"startTime":2885.605,"endTime":2888.575,"body":"into MTE without opting into"},{"startTime":2885.605,"endTime":2888.575,"body":"the program for at-risk users."},{"startTime":2888.575,"endTime":2892.025,"body":"But yes, it's been on the phone for"},{"startTime":2888.575,"endTime":2892.025,"body":"a number of years at this point."},{"startTime":2892.31,"endTime":2892.52,"body":"you."},{"startTime":2892.52,"endTime":2895.4,"body":"Just, you just have to go in and"},{"startTime":2892.52,"endTime":2895.4,"body":"you have to tap like the version"},{"startTime":2895.4,"endTime":2898.91,"body":"number of Android like 15 times and"},{"startTime":2895.4,"endTime":2898.91,"body":"turn on dev options and flick a bit."},{"startTime":2898.91,"endTime":2902.57,"body":"But you have to opt, you have"},{"startTime":2898.91,"endTime":2902.57,"body":"to opt into it unless you are in"},{"startTime":2902.57,"endTime":2903.8,"body":"the Advanced Protection Program."},{"startTime":2904.22,"endTime":2907.37,"body":"Uh, but even so limited by lack"},{"startTime":2904.22,"endTime":2907.37,"body":"of diva integration and the"},{"startTime":2907.37,"endTime":2908.21,"body":"opportunity system, blah, blah,"},{"startTime":2908.255,"endTime":2911.285,"body":"while Deirdre figures out if there's"},{"startTime":2908.255,"endTime":2911.285,"body":"anything left in this blog post, which I"},{"startTime":2911.285,"endTime":2915.115,"body":"don't think there is, the other thing that"},{"startTime":2911.285,"endTime":2915.115,"body":"I would add is that this is all arm stuff."},{"startTime":2915.475,"endTime":2919.375,"body":"Which brings us to like the"},{"startTime":2915.475,"endTime":2919.375,"body":"elephant in the room of X 64."},{"startTime":2919.925,"endTime":2923.045,"body":"so like X 64 right?"},{"startTime":2923.045,"endTime":2928.685,"body":"Is like a MD and Intel and they have some"},{"startTime":2923.045,"endTime":2928.685,"body":"sort of like intracompany board that like"},{"startTime":2928.685,"endTime":2931.085,"body":"sets what the instruction set is, right?"},{"startTime":2931.085,"endTime":2935.615,"body":"Because it was basically an instruction"},{"startTime":2931.085,"endTime":2935.615,"body":"set written by AMD to look like Intel."},{"startTime":2936.045,"endTime":2941.385,"body":"they are still discussing"},{"startTime":2936.045,"endTime":2941.385,"body":"what the instructions for MTE"},{"startTime":2941.475,"endTime":2944.205,"body":"would even look like on X 64."},{"startTime":2944.355,"endTime":2949.395,"body":"So for all intents and purposes and"},{"startTime":2944.355,"endTime":2949.395,"body":"the, the like near to medium future,"},{"startTime":2949.675,"endTime":2952.885,"body":"you should not expect like MTE on any"},{"startTime":2953.4,"endTime":2953.62,"body":"any"},{"startTime":2953.965,"endTime":2955.525,"body":"X 64 devices."},{"startTime":2955.995,"endTime":2961.275,"body":"so this is really like an ARM 64"},{"startTime":2955.995,"endTime":2961.275,"body":"thing and a subset of arm 64 thing."},{"startTime":2961.845,"endTime":2967.012,"body":"And so like, it's not clear like"},{"startTime":2961.845,"endTime":2967.012,"body":"these are good hardware features to"},{"startTime":2967.012,"endTime":2971.092,"body":"leverage when you have them, but I don't"},{"startTime":2967.012,"endTime":2971.092,"body":"think they take away from the need."},{"startTime":2971.497,"endTime":2977.377,"body":"To like write things in memory safe"},{"startTime":2971.497,"endTime":2977.377,"body":"languages as much as possible to"},{"startTime":2977.377,"endTime":2983.804,"body":"like fully mitigate the underlying"},{"startTime":2977.377,"endTime":2983.804,"body":"uh, um, the underlying problems,"},{"startTime":2983.834,"endTime":2985.604,"body":"um, where possible, right?"},{"startTime":2985.604,"endTime":2987.134,"body":"There's still edge cases with that."},{"startTime":2987.134,"endTime":2990.434,"body":"Like what happens in your program"},{"startTime":2987.134,"endTime":2990.434,"body":"writes out other code into"},{"startTime":2990.434,"endTime":2992.724,"body":"the process and, uh, is a JIT."},{"startTime":2992.744,"endTime":2996.164,"body":"And that has logic bugs where it"},{"startTime":2992.744,"endTime":2996.164,"body":"writes out the wrong code, right?"},{"startTime":2996.164,"endTime":2999.829,"body":"Like memory, safe languages don't"},{"startTime":2996.164,"endTime":2999.829,"body":"help, rust, it doesn't help you there."},{"startTime":3000.129,"endTime":3000.549,"body":"Mm-hmm."},{"startTime":3000.899,"endTime":3004.439,"body":"hopefully you know that these"},{"startTime":3000.899,"endTime":3004.439,"body":"are all things that can happen"},{"startTime":3004.439,"endTime":3008.729,"body":"in parallel, um, and should all"},{"startTime":3004.439,"endTime":3008.729,"body":"combine to build a better system."},{"startTime":3009.224,"endTime":3009.444,"body":"Yes."},{"startTime":3009.754,"endTime":3014.524,"body":"but in no world can you assume that"},{"startTime":3009.754,"endTime":3014.524,"body":"like your software will only run on,"},{"startTime":3014.614,"endTime":3021.138,"body":"on, um, a device that will have MTE"},{"startTime":3014.614,"endTime":3021.138,"body":"unless maybe you're like, um, apple"},{"startTime":3021.138,"endTime":3022.608,"body":"in like five years or something,"},{"startTime":3023.063,"endTime":3023.353,"body":"Yeah."},{"startTime":3024.02,"endTime":3027.675,"body":"And even we'll see if they even"},{"startTime":3024.02,"endTime":3027.675,"body":"do like emulation stuff still."},{"startTime":3027.735,"endTime":3031.395,"body":"'cause they still have the old stuff and"},{"startTime":3027.735,"endTime":3031.395,"body":"they still have a bunch of apple silicon."},{"startTime":3031.395,"endTime":3034.965,"body":"So yeah, you, you won't even have"},{"startTime":3031.395,"endTime":3034.965,"body":"that, even if you're Apple for"},{"startTime":3034.965,"endTime":3036.315,"body":"a long, long, long, long time."},{"startTime":3036.982,"endTime":3040.912,"body":"and like we said, it is, there is a"},{"startTime":3036.982,"endTime":3040.912,"body":"probabilistic element to all of this."},{"startTime":3040.912,"endTime":3042.822,"body":"It's not deterministic, and so"},{"startTime":3043.122,"endTime":3043.542,"body":"Mm-hmm."},{"startTime":3043.642,"endTime":3048.892,"body":"it may be the case that we figure out"},{"startTime":3043.642,"endTime":3048.892,"body":"ways to make that, one in 16 chance"},{"startTime":3048.892,"endTime":3050.782,"body":"your exploit works to be much higher."},{"startTime":3051.449,"endTime":3055.146,"body":"Or the lower, the chance"},{"startTime":3051.449,"endTime":3055.146,"body":"that it works, lower"},{"startTime":3055.251,"endTime":3056.901,"body":"it works to be much higher, right?"},{"startTime":3056.901,"endTime":3057.111,"body":"Like"},{"startTime":3057.411,"endTime":3057.771,"body":"Oh."},{"startTime":3057.826,"endTime":3057.996,"body":"right."},{"startTime":3058.036,"endTime":3061.486,"body":"It could be the case that we figure out"},{"startTime":3058.036,"endTime":3061.486,"body":"like, oh, it turns out there's this one"},{"startTime":3061.486,"endTime":3066.506,"body":"cool trick to double your likelihood"},{"startTime":3061.486,"endTime":3066.506,"body":"of guessing the tag on the first try,"},{"startTime":3066.851,"endTime":3067.211,"body":"Okay."},{"startTime":3067.511,"endTime":3071.691,"body":"So basically the lowest chances for"},{"startTime":3067.511,"endTime":3071.691,"body":"the attacker are right now because this"},{"startTime":3071.841,"endTime":3073.251,"body":"yeah, one in, one in 16."},{"startTime":3073.716,"endTime":3074.016,"body":"yeah."},{"startTime":3074.046,"endTime":3075.036,"body":"They could only get better."},{"startTime":3075.336,"endTime":3075.606,"body":"Yeah."},{"startTime":3075.786,"endTime":3076.116,"body":"Okay."},{"startTime":3076.783,"endTime":3078.433,"body":"Use the secure allocators first."},{"startTime":3078.433,"endTime":3081.793,"body":"Use extended MTE to protect"},{"startTime":3078.433,"endTime":3081.793,"body":"smaller individual allocations"},{"startTime":3081.793,"endTime":3082.933,"body":"within the type bucket."},{"startTime":3083.323,"endTime":3087.313,"body":"And then knowing where and how we"},{"startTime":3083.323,"endTime":3087.313,"body":"should deploy EMTE, we could accurately"},{"startTime":3087.313,"endTime":3091.273,"body":"model the tag checking demand of the OS"},{"startTime":3087.313,"endTime":3091.273,"body":"and design our silicon to satisfy it."},{"startTime":3091.693,"endTime":3096.553,"body":"So yeah, knowing, being able to bleed"},{"startTime":3091.693,"endTime":3096.553,"body":"through or look through all these"},{"startTime":3096.553,"endTime":3100.843,"body":"layers of abstraction and control"},{"startTime":3096.553,"endTime":3100.843,"body":"it, um, control, your designs on"},{"startTime":3101.053,"endTime":3104.383,"body":"both sides allows you to optimize."},{"startTime":3104.433,"endTime":3107.073,"body":"our hardware implementation"},{"startTime":3104.433,"endTime":3107.073,"body":"influence additional software"},{"startTime":3107.073,"endTime":3110.133,"body":"design decisions, reducing overhead"},{"startTime":3107.073,"endTime":3110.133,"body":"of tag extracts even further."},{"startTime":3110.553,"endTime":3116.733,"body":"And like, this is the power that you get"},{"startTime":3110.553,"endTime":3116.733,"body":"by having a full vertically integrated"},{"startTime":3116.733,"endTime":3122.253,"body":"system like this is that you can do all"},{"startTime":3116.733,"endTime":3122.253,"body":"of that optimization work to make all"},{"startTime":3122.253,"endTime":3125.543,"body":"of this work, on by default and ship it."},{"startTime":3125.543,"endTime":3129.443,"body":"And it isn't a performance cost,"},{"startTime":3125.543,"endTime":3129.443,"body":"it's actually like, it's, I don't"},{"startTime":3129.443,"endTime":3133.703,"body":"know if they have any numbers,"},{"startTime":3129.443,"endTime":3133.703,"body":"but it's definitely not slower."},{"startTime":3133.883,"endTime":3138.333,"body":"And I don't know if it is slightly"},{"startTime":3133.883,"endTime":3138.333,"body":"faster than the previous generation."},{"startTime":3138.673,"endTime":3143.25,"body":"but it's definitely not slower, which is"},{"startTime":3138.673,"endTime":3143.25,"body":"not for all the other instances is not the"},{"startTime":3143.25,"endTime":3150.087,"body":"case or equivalent deployments of MTE so"},{"startTime":3143.25,"endTime":3150.087,"body":"far that are not Apple, that we're aware."},{"startTime":3150.117,"endTime":3150.627,"body":"Aware about."},{"startTime":3150.657,"endTime":3151.167,"body":"Okay."},{"startTime":3151.347,"endTime":3156.124,"body":"And then checking how secure it is."},{"startTime":3156.319,"endTime":3159.799,"body":"any developer can begin testing"},{"startTime":3156.319,"endTime":3159.799,"body":"the protection including EMT on"},{"startTime":3159.799,"endTime":3162.739,"body":"hardware that supports it using"},{"startTime":3159.799,"endTime":3162.739,"body":"enhanced security settings next code."},{"startTime":3162.769,"endTime":3165.619,"body":"So if you're a dev, you"},{"startTime":3162.769,"endTime":3165.619,"body":"still have to opt in."},{"startTime":3166.286,"endTime":3170.486,"body":"but I would also note that, it's kind"},{"startTime":3166.286,"endTime":3170.486,"body":"of, when it comes to web browsers, it's"},{"startTime":3170.486,"endTime":3174.596,"body":"basically safari only because Safari is"},{"startTime":3170.486,"endTime":3174.596,"body":"the only, like the web kit is the only"},{"startTime":3174.596,"endTime":3177.673,"body":"underlying, browsing engine on, iOS."},{"startTime":3178.003,"endTime":3182.443,"body":"But why don't we, they have a, a diagram"},{"startTime":3178.003,"endTime":3182.443,"body":"or a table further down describing,"},{"startTime":3182.473,"endTime":3186.673,"body":"How it breaks various real"},{"startTime":3182.473,"endTime":3186.673,"body":"world exploit change chains."},{"startTime":3187.043,"endTime":3188.153,"body":"they have a big diagram here."},{"startTime":3188.87,"endTime":3194.12,"body":"for, three iMessages change a safari"},{"startTime":3188.87,"endTime":3194.12,"body":"chain and some kernel stuff about"},{"startTime":3194.12,"endTime":3197.24,"body":"where it gets either blocked by"},{"startTime":3194.12,"endTime":3197.24,"body":"a secure allocator or blocked by"},{"startTime":3197.24,"endTime":3200.637,"body":"EMTE or somehow blocked by both."},{"startTime":3201.604,"endTime":3201.844,"body":"that's"},{"startTime":3201.919,"endTime":3206.541,"body":"like  I, I think some of the secure,"},{"startTime":3201.919,"endTime":3206.541,"body":"like, it's not clear to me like this"},{"startTime":3206.541,"endTime":3211.221,"body":"isn't necessarily a fair way of looking"},{"startTime":3206.541,"endTime":3211.221,"body":"at things in the sense that like, all of"},{"startTime":3211.221,"endTime":3215.601,"body":"these exploits were like, no one's doing"},{"startTime":3211.221,"endTime":3215.601,"body":"extra work to get around a mitigation"},{"startTime":3215.661,"endTime":3218.091,"body":"that doesn't exist at the time they wrote"},{"startTime":3218.156,"endTime":3218.446,"body":"Yeah."},{"startTime":3218.873,"endTime":3221.963,"body":"like, you can be like, okay, you"},{"startTime":3218.873,"endTime":3221.963,"body":"know, we've reversed this chain from"},{"startTime":3221.963,"endTime":3226.193,"body":"whatever, and determined that like,"},{"startTime":3221.963,"endTime":3226.193,"body":"nowadays this would be broken and like."},{"startTime":3226.748,"endTime":3229.028,"body":"Four or five of eight steps."},{"startTime":3229.158,"endTime":3232.548,"body":"but like, what does that,"},{"startTime":3229.158,"endTime":3232.548,"body":"what does that really mean?"},{"startTime":3232.758,"endTime":3238.795,"body":"And so I, I think the notable thing"},{"startTime":3232.758,"endTime":3238.795,"body":"for me more in, um, this graph is"},{"startTime":3238.795,"endTime":3247.349,"body":"just like, how far to the right is"},{"startTime":3238.795,"endTime":3247.349,"body":"the EMTE, um, uh, circle or, or icon"},{"startTime":3247.379,"endTime":3250.409,"body":"indicator, um, in each of these chains?"},{"startTime":3250.739,"endTime":3257.646,"body":"Um, and like the, the further to the"},{"startTime":3250.739,"endTime":3257.646,"body":"left, it is, I suspect the like more,"},{"startTime":3258.313,"endTime":3262.55,"body":"um, more effective E-E-M-T-E is, right?"},{"startTime":3262.55,"endTime":3262.91,"body":"Like"},{"startTime":3263.527,"endTime":3268.957,"body":"And so we've got one kernel, LPE"},{"startTime":3263.527,"endTime":3268.957,"body":"where it's very far left and then"},{"startTime":3269.624,"endTime":3275.554,"body":"we've got a mess, iMessages chain"},{"startTime":3269.624,"endTime":3275.554,"body":"or messages chain and that's it."},{"startTime":3275.584,"endTime":3277.304,"body":"It's pretty far right for the rest of 'em."},{"startTime":3277.971,"endTime":3281.121,"body":"Whereas like the allocators things,"},{"startTime":3277.971,"endTime":3281.121,"body":"I almost look at like the opposite"},{"startTime":3281.121,"endTime":3284.811,"body":"direction where like if a allocator"},{"startTime":3281.121,"endTime":3284.811,"body":"change blocks something very early"},{"startTime":3284.811,"endTime":3287.271,"body":"on, it's just like, okay, well they"},{"startTime":3284.811,"endTime":3287.271,"body":"weren't thinking about it at all."},{"startTime":3287.691,"endTime":3291.051,"body":"Versus like something like"},{"startTime":3287.691,"endTime":3291.051,"body":"EMTE is more likely to kind of"},{"startTime":3291.051,"endTime":3293.001,"body":"like cut off the base concept."},{"startTime":3293.668,"endTime":3295.782,"body":"Um, but who knows?"},{"startTime":3296.082,"endTime":3296.352,"body":"yeah."},{"startTime":3297.012,"endTime":3297.372,"body":"Cool."},{"startTime":3297.492,"endTime":3298.032,"body":"I like this."},{"startTime":3298.032,"endTime":3298.892,"body":"It's, informative."},{"startTime":3298.922,"endTime":3300.339,"body":"It's, yeah."},{"startTime":3301.006,"endTime":3301.576,"body":"Cool."},{"startTime":3302.243,"endTime":3302.843,"body":"Nice stuff."},{"startTime":3302.843,"endTime":3303.353,"body":"Apple."},{"startTime":3304.055,"endTime":3307.82,"body":"Apple, I think has a team that's called"},{"startTime":3304.055,"endTime":3307.82,"body":"SEAR and a team that's called Spear,"},{"startTime":3307.82,"endTime":3309.38,"body":"and they're both in the security team."},{"startTime":3309.38,"endTime":3310.73,"body":"And I find it confusing."},{"startTime":3311.06,"endTime":3311.27,"body":"Yeah."},{"startTime":3311.27,"endTime":3313.07,"body":"And this post was by seer."},{"startTime":3313.13,"endTime":3315.2,"body":"I don't know what SPEAR stands for."},{"startTime":3315.59,"endTime":3317.247,"body":"Platform, software"},{"startTime":3317.447,"endTime":3319.034,"body":"I don't know what either of 'em stand for."},{"startTime":3319.164,"endTime":3319.284,"body":"for."},{"startTime":3319.354,"endTime":3319.644,"body":"Yeah."},{"startTime":3320.044,"endTime":3320.284,"body":"SEER is,"},{"startTime":3320.344,"endTime":3323.404,"body":"I know is people join them and then"},{"startTime":3320.344,"endTime":3323.404,"body":"you never hear from them again."},{"startTime":3323.764,"endTime":3324.814,"body":"They disappear."},{"startTime":3325.531,"endTime":3328.011,"body":"SEAR, security, engineering"},{"startTime":3325.531,"endTime":3328.011,"body":"and architecture."},{"startTime":3328.216,"endTime":3328.756,"body":"I assume."},{"startTime":3328.756,"endTime":3331.876,"body":"Eventually what happens is everyone"},{"startTime":3328.756,"endTime":3331.876,"body":"that joins either of those teams"},{"startTime":3332.086,"endTime":3337.186,"body":"eventually accidentally walks into"},{"startTime":3332.086,"endTime":3337.186,"body":"the glass exterior wall at the apple"},{"startTime":3337.186,"endTime":3341.836,"body":"UFO building that they like didn't see"},{"startTime":3337.186,"endTime":3341.836,"body":"because the wall is glass and clean."},{"startTime":3342.056,"endTime":3346.76,"body":"and it like gives them amnesia and they,"},{"startTime":3342.056,"endTime":3346.76,"body":"how to interact with the rest of industry."},{"startTime":3347.69,"endTime":3353.655,"body":"Uhhuh Apple's doing its damnedest to be"},{"startTime":3347.69,"endTime":3353.655,"body":"like, no, really, we're very, very secure."},{"startTime":3354.075,"endTime":3354.915,"body":"Uh, phone."},{"startTime":3355.582,"endTime":3357.502,"body":"You by our phones, so"},{"startTime":3357.874,"endTime":3360.149,"body":"we'll see if anyone introduces, uh uh."},{"startTime":3360.816,"endTime":3364.116,"body":"Some sort of hardware fault"},{"startTime":3360.816,"endTime":3364.116,"body":"isolation for securing things"},{"startTime":3364.116,"endTime":3365.646,"body":"like JITs in the future, but"},{"startTime":3365.946,"endTime":3366.696,"body":"That'd be nice."},{"startTime":3367.603,"endTime":3367.873,"body":"Cool."},{"startTime":3367.903,"endTime":3369.883,"body":"I have a whole blog post about"},{"startTime":3367.903,"endTime":3369.883,"body":"that if you're interested."},{"startTime":3370.498,"endTime":3372.038,"body":"security, cryptography, whatever is a."},{"startTime":3372.673,"endTime":3373.303,"body":"Oh yeah."},{"startTime":3373.97,"endTime":3374.26,"body":"Cool."},{"startTime":3374.6,"endTime":3377.27,"body":"Security, Cryptography, Whatever is"},{"startTime":3374.6,"endTime":3377.27,"body":"a side project from Deirdre Connolly,"},{"startTime":3377.27,"endTime":3378.71,"body":"Thomas Ptacek and David Adrian."},{"startTime":3378.71,"endTime":3379.94,"body":"Our editor is Netty Smith."},{"startTime":3379.97,"endTime":3383.04,"body":"You can find the podcast online at scwpod."},{"startTime":3383.42,"endTime":3387.18,"body":"And the host online at durumcrustulum"},{"startTime":3383.42,"endTime":3387.18,"body":"at tqbf, and at davidcadrian."},{"startTime":3387.38,"endTime":3390.96,"body":"You go by merch online at merch dot"},{"startTime":3387.38,"endTime":3390.96,"body":"security cryptography whatever dot com."},{"startTime":3390.98,"endTime":3394.04,"body":"If you like the pod, give us a"},{"startTime":3390.98,"endTime":3394.04,"body":"five star review wherever you"},{"startTime":3394.04,"endTime":3396.2,"body":"rate your favorite podcast."},{"startTime":3396.2,"endTime":3397.13,"body":"Thank you for listening."},{"startTime":3397.13,"endTime":3398.24,"body":"Yay."}]}