QNX - The Search for the Release Notes

Looking at QNX for the past 3 months has been enjoyable for the most part. But the thing that annoys me the most is the difficulty of finding the release notes for each QNX SDP. While I do have some internal access to a document that links to all the QNX release notes at work, I found it annoying how it cannot be easily obtained through a google search. (imagine if web search and web indexing services did not exist, the internet would be unnavigatable).

Read More

Dev Blog - Bufferoverflow

Being bored and not wanting to study, I randomly checked up my Github repo and realized the static analyzer flagged a critical vulnerability in my code. For those of you not familiar with static analyzer, it is a security tool that reviews/analyzes code to determine if there are any obvious security vulnerabilities in your code. On Github, there is a pipeline workflow feature that allows you to execute specific scripts/actions for any code changes you push called Github Actions. Github has made it convenient to setup security analysis on your repo. The static analyzer I am using is called CodeQL, a tool created by Github. Here’s an example of the report that was flagged:

Read More

How to Check if an Application is PAM-Aware

PAM stands for Pluggable Authentication Module and its purpose from my understanding is to separate application developers from writing an authentication scheme into their program. Think of it as an authentication “API” for “privilege granting” applications but is flexible how each application authenticates the user. System administrators are given the control and decision to how each application authenticates a user by modifying PAM configs (policies) that could be found in locations such as /etc/pam.d (location may vary depending on the OS).

Read More