{"uuid": "8f5c8cd5-2069-4dae-abe4-e1e7122d10d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-3094", "type": "seen", "source": "https://gist.github.com/xanimo/66cdb8d25ec9cdff44c541792f6d13c4", "content": "# The Whole Ballgame\n\nThe four curricula \u2014 [Dogecoin Core], [systems programming], [RF/SIGINT],\n[defensive security] \u2014 are the *game*. This is the stadium, the broadcast, and\nthe copyrights: how the field actually works as an institution, an economy, and\na legal environment.\n\nThis is the layer that decides whether good technical work matters. Most people\nlearn it by accident, late, and expensively.\n\n*Not legal advice. Jurisdictions differ enormously and the differences are the\npoint.*\n\n---\n\n## Part I \u2014 The Map\n\nFour fields, one substrate. They are not separate subjects; they are the same\nknowledge approached from different sides.\n\n```\n                    physics / mathematics\n                             \u2502\n        \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n        \u2502                    \u2502                    \u2502\n   electronics          computation           information\n        \u2502                    \u2502                    \u2502\n      RF/SIGINT        systems / C          cryptography\n        \u2502                    \u2502                    \u2502\n        \u2514\u2500\u2500\u2500\u2500 side channels \u2500\u2534\u2500 malware/RE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                             \u2502\n                    defensive security\n                             \u2502\n                    \u2190 institutions, law, economics \u2192\n```\n\nThe connections that actually matter:\n\n- **Constant-time crypto and TEMPEST are one problem.** If execution time\n  correlates with a secret, so does power draw, and so does EM emission. The\n  *dudect* approach and the EM side-channel literature are the same threat model\n  in different domains.\n- **Serialization bugs are consensus bugs.** In distributed systems, a parser\n  that disagrees with the reference implementation is a chain split, not a crash.\n- **Fuzzing is the empirical method applied to code.** Hypothesis, adversarial\n  input, falsification.\n- **Reverse engineering is science with a hostile subject.** The system is not\n  merely unknown; it was built to mislead you.\n\n---\n\n## Part II \u2014 The Stadium: institutions\n\nWho actually holds power, produces knowledge, and decides what counts.\n\n### Standards and specification bodies\n\n- **IETF** \u2014 internet protocols, via RFCs. Open participation, rough consensus\n  and running code. Anyone can join a mailing list and contribute.\n- **NIST** \u2014 US standards; FIPS, SP 800 series, the CSF. Effectively global\n  because procurement follows it. Also: the body whose crypto competitions\n  (AES, SHA-3, post-quantum) shape the field for decades.\n- **ISO/IEC** \u2014 27001 for management systems, 15408 (Common Criteria) for\n  evaluation. Paywalled, which tells you something about who they serve.\n- **W3C, IEEE, 3GPP, ETSI** \u2014 web, hardware/networking, cellular, European\n  telecoms.\n- **BIP/BOLT process** \u2014 how Bitcoin-family protocol changes are proposed and\n  argued. Directly relevant to you: BIP157, BIP152 and BIP32 all came through it.\n\n**Skill worth having:** read a spec as a normative document. Learn what MUST,\nSHOULD and MAY mean (RFC 2119), and notice what a spec leaves *undefined* \u2014\nundefined behaviour is where implementations diverge and where the bugs live.\n\n### Vulnerability infrastructure\n\n- **CVE / MITRE** \u2014 identifiers. A CVE is a name, not a severity.\n- **CNAs** \u2014 organisations authorised to assign CVEs. Vendors are often their own\n  CNA, which is a conflict worth understanding.\n- **NVD** \u2014 enrichment and scoring. Chronically backlogged; do not treat absence\n  as safety.\n- **CVSS** \u2014 a score, widely misused as a priority. **EPSS** estimates actual\n  exploitation probability and is usually more useful. **CISA KEV** lists what is\n  being exploited *now*, and is the most actionable of the three.\n- **MITRE ATT&CK** \u2014 the shared vocabulary for adversary behaviour. Learn it\n  because it is how defenders communicate, not because it is complete.\n\n### Response and coordination\n\n- **CERT/CC** (Carnegie Mellon) \u2014 coordination for multi-vendor issues.\n- **National CERTs** \u2014 NCSC (UK), CISA (US), BSI (Germany), and equivalents.\n- **FIRST** \u2014 the global forum of incident response teams; also publishes CVSS.\n- **ISACs** \u2014 sector-specific sharing (financial, energy, health).\n\n### Where knowledge is produced\n\n- **Academia** \u2014 the *big four* security conferences: **USENIX Security, IEEE\n  S&P (Oakland), ACM CCS, NDSS**. All papers free. This is where the real\n  research lives, and most practitioners never read it.\n- **Industry conferences** \u2014 Black Hat and DEF CON (US), CCC (Germany, the most\n  intellectually serious), Infiltrate, Recon (reverse engineering), FIRST.\n- **Vendor research** \u2014 Google Project Zero, Talos, Mandiant, Kaspersky GReAT,\n  Citizen Lab. Read Project Zero's blog specifically; the writeups are a\n  masterclass in method.\n- **Independent** \u2014 the field is unusually open to outsiders who publish good\n  work. This is your route in.\n\n**Citizen Lab deserves special mention** given your stated motivation: they do\ntechnical work in direct service of protecting people \u2014 journalists, dissidents,\nactivists \u2014 and their reports are a model of rigour applied to human stakes.\n\n---\n\n## Part III \u2014 The Broadcast: disclosure and publishing\n\nHow findings travel, and how to not cause harm doing it.\n\n### Disclosure models\n\n- **Full disclosure** \u2014 publish immediately. Maximum pressure on vendors,\n  maximum exposure for users.\n- **Coordinated (CVD)** \u2014 notify vendor, agreed embargo, then publish. The\n  modern default.\n- **Responsible disclosure** \u2014 the same thing with a loaded name; the term\n  implies anyone who disagrees is irresponsible. Prefer \"coordinated.\"\n- **No disclosure** \u2014 the exploit market. Legal in many places, ethically\n  contested, and the reason the offensive market is well funded.\n\n**Practical norms:** 90 days is the widely accepted default (Project Zero's\nconvention, now near-universal). Extensions for genuine engineering difficulty.\nPublish on schedule regardless if the vendor stalls \u2014 the deadline is what makes\nthe process work.\n\n### Doing it well\n\n- **Write the report for the person who has to fix it.** Reproduction steps,\n  affected versions, impact, and a suggested fix. Vague reports get ignored,\n  correctly.\n- **Attach severity to a threat model**, not a vibe. Who does this hurt, and how?\n- **Expect the first response to be wrong.** Vendors under-triage. Be patient and\n  specific rather than loud.\n- **Do not test on systems you do not own** without written authorisation. This\n  is the line between research and crime, and it is a *legal* line, not an\n  ethical one.\n\n### Publishing as a scientist\n\n- **Reproducibility.** Code, data, environment. A result nobody can reproduce is\n  an anecdote.\n- **Negative results.** \"This did not work, here is why\" is rare and valuable.\n- **Preprints** \u2014 arXiv and IACR ePrint. Get work out; iterate in public.\n- **Peer review** as a skill: reviewing others' work well teaches you more than\n  writing your own.\n\n**Your public record is your credential.** A repository of analyses, detection\nrules and honest writeups outweighs certifications for anyone hiring on\njudgement. The commit messages in your own repo \u2014 the ones that record what was\nchecked and what turned out wrong \u2014 are exactly this.\n\n---\n\n## Part IV \u2014 The Copyrights: law\n\nThe part that ends careers when ignored. Specifics vary by jurisdiction; know\n*yours*.\n\n### Computer misuse\n\n- **US: CFAA.** Broad, historically abused. *Van Buren* (2021) narrowed\n  \"exceeds authorised access\" to mean access you have no right to at all, not\n  terms-of-service violations. **DOJ policy (2022)** says good-faith security\n  research should not be charged \u2014 policy, not law, and not binding on states or\n  private plaintiffs.\n- **UK: Computer Misuse Act 1990.** Notably has **no research exemption**, which\n  the CyberUp campaign has been trying to change for years. Unauthorised access\n  is an offence regardless of intent. Be careful.\n- **EU** \u2014 varies by member state; the NIS2 directive shapes obligations.\n\n**The practical rule everywhere: authorisation must be explicit, in writing,\nbefore you touch anything.**\n\n### Copyright and reverse engineering\n\n- **DMCA \u00a71201** (US) \u2014 circumventing access controls. There is a **standing\n  security research exemption**, renewed triennially, but it is narrower than\n  people assume: good faith, lawfully obtained device, not facilitating other\n  violations.\n- **EU Software Directive** \u2014 an explicit right to decompile *for\n  interoperability*. Broader than US law in this respect.\n- **Reverse engineering for interoperability** is generally protected; RE to\n  clone is generally not. *Sega v Accolade*, *Sony v Connectix* are the US\n  landmarks.\n\n### Export control\n\nGenuinely catches researchers by surprise.\n\n- **Wassenaar Arrangement** \u2014 includes \"intrusion software\" controls. The 2013\n  language was so broad it would have criminalised ordinary research; amended in\n  2017 after sustained pushback.\n- **EAR / ITAR** (US) \u2014 cryptography export was liberalised but not eliminated.\n  Publishing open-source crypto is generally fine; selling exploits abroad is\n  not.\n- Relevant to you: **exporting cryptographic software** has notification\n  requirements in some jurisdictions even when open source.\n\n### Licensing, which you deal with daily\n\n- **Permissive** \u2014 MIT, BSD, Apache 2.0 (which includes an explicit patent\n  grant \u2014 a real advantage).\n- **Copyleft** \u2014 GPL 2/3, LGPL, AGPL (network use triggers distribution).\n- **Compatibility** matters and is not intuitive. GPLv2 and Apache 2.0 are\n  incompatible.\n- **CLAs vs DCO.** libdogecoin and most Bitcoin-family projects use a DCO \u2014 a\n  sign-off asserting you have the right to contribute. Understand what you are\n  signing.\n- **Dependency licensing** is a supply-chain problem: you inherit obligations.\n\n### Privacy and breach law\n\n- **GDPR** (EU/UK) \u2014 72-hour breach notification, DPIAs, the concept of data\n  minimisation as a legal duty.\n- **US state laws** \u2014 CCPA/CPRA and a growing patchwork.\n- Sector rules: HIPAA, PCI-DSS, DORA (EU financial).\n\n### Bug bounty terms \u2014 read them\n\nBounty programmes are **contracts**. Some contain NDAs preventing you ever\npublishing. Some define scope so narrowly that accidental out-of-scope testing\nvoids your safe harbour. Read the terms *before* testing, and prefer programmes\nwith clear, public safe-harbour language.\n\n---\n\n## Part V \u2014 The economics\n\nKnowing who pays for what explains most behaviour in this field.\n\n- **Defence is a cost centre; offence is a product.** This asymmetry drives\n  salaries, tooling quality, and why detection engineering is under-resourced.\n- **The exploit market** \u2014 brokers (Zerodium et al.), government buyers, and\n  bounty programmes competing at wildly different price points. A browser chain\n  is worth more than most researchers' annual salary.\n- **The security industry sells confidence**, sometimes decoupled from\n  effectiveness. Learn to distinguish controls that work from controls that\n  audit well.\n- **Compliance \u2260 security**, but compliance is where budget lives. Being able to\n  translate real risk into a framework's language is a genuine and underrated\n  skill.\n- **Open source is critical infrastructure maintained by volunteers.** You are\n  currently one of them. xz-utils (CVE-2024-3094) is the case study: a multi-year\n  social engineering campaign against a single exhausted maintainer.\n\n---\n\n## Part VI \u2014 Ethics, which is the actual point\n\nYou said you want to keep people safe. That is a position, and positions have\nconsequences.\n\n- **Dual use is unavoidable.** Every defensive technique implies an offensive\n  one. The question is never whether knowledge is dangerous but what you choose\n  to do with it.\n- **You will be offered money to do harm**, and it will be framed reasonably \u2014\n  lawful intercept, national security, a research contract. Decide where your\n  line is *before* someone with a budget asks.\n- **The people most at risk are least equipped.** Journalists, activists,\n  domestic abuse survivors, the elderly. Consumer-grade stalkerware harms more\n  people than nation-state implants. The unglamorous work has the highest human\n  return.\n- **Punching down is easy and worthless.** Finding bugs in a hobbyist's project\n  and publishing loudly is not research.\n- **Consider where you sit.** Vendor, independent, government, non-profit \u2014 each\n  has different constraints on what you may find and say.\n\nOrganisations doing this well and worth knowing: **Citizen Lab**, **EFF**,\n**Access Now** (digital security helpline), **Tor Project**, **OTF**.\n\n---\n\n## Part VII \u2014 How to actually enter\n\n1. **Pick a lane, go deep, stay curious sideways.** Breadth without depth is\n   commentary.\n2. **Publish continuously.** Analyses, tools, rules, negative results. Your\n   public record *is* your reputation.\n3. **Contribute upstream.** Sigma rules, YARA signatures, fuzz harnesses, docs.\n   You already do this.\n4. **Read primary sources.** Specs, RFCs, papers, reference implementations.\n   Secondary sources propagate errors confidently.\n5. **Find people better than you and be useful to them.** The field runs on\n   reputation and reciprocity far more than credentials.\n6. **Learn to write.** The constraint on impact is almost never technical skill;\n   it is the ability to make a finding legible and actionable to someone who is\n   not you.\n\n**The one-line version:** the technical work is necessary and insufficient. The\nstadium decides what gets built, the broadcast decides what gets fixed, and the\nlaw decides what you are allowed to find out. Learn all four, and be the person\nwho tells the truth about what they actually verified.\n\n---\n\n[Dogecoin Core]: https://gist.github.com/xanimo/e806eccb26cdfacbee299446693adab7\n[systems programming]: https://gist.github.com/xanimo/7872e5ac69cab58380d2e1d740ecd413\n[RF/SIGINT]: https://gist.github.com/xanimo/c0f5fc41858a6183d6709af353dc35ef\n[defensive security]: https://gist.github.com/xanimo/ce9ec19b9d2d26c781296c737e93e751\n", "creation_timestamp": "2026-08-04T05:04:30.263102Z"}