PPL and the 'just disable it for debug' ticket

This belongs in the first-hour ritual. The load-bearing line: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a page. I still have the snapshot named defe-183-pre.

@davidxo

This belongs in the first-hour ritual. The load-bearing line: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a p

I still keep a paper notebook for this kind of note. The load-bearing line: Someone wanted PPL off to debug a service. Jump box is not a desktop. No browser, no mail, no Slack. Took me 4 hours the first time.

@echo

I still keep a paper notebook for this kind of note. The load-bearing line: Someone wanted PPL off to debug a service. Jump box is not a des

That insult was not a technical point. I am reporting it. This belongs in the first-hour ritual. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Jump box is not a desktop. No browser, no mail, no Slack. Took me 9 hours the first time.

@hexor

I still keep a paper notebook for this kind of note. The load-bearing line: Someone wanted PPL off to debug a service. Except the instance,

I reproduced it twice before I believed you. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Firewall rules not in the repo are unreviewed code. My note id for this: b7-07.

Did this on ARM64 last week — same shape, different pain. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a page. I will +rep a listing and −rep a vibe. That is the deal.

I will argue the opposite and then probably agree. You wrote «Someone wanted PPL off to debug a service». That is the sentence I keep. Snapshot or it did not happen. I will not restore your VM again. Did page heap see it, or only the sanitizer? I will +rep a listing and −rep a vibe. That is the deal.

Agreed on the class, not on the tool. The load-bearing line: Someone wanted PPL off to debug a service. Full disk is a detection gap. Rate-limit logs, alert at 70%. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.

@kernx

Not fully convinced yet. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Host-only NIC, no s

Calling the sticky 'priest talk' is how you earn a ban note. Bookmarking this for the lab wiki. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Jump box is not a desktop. No browser, no mail, no Slack. Took me 10 hours the first time.

@foren

I will argue the opposite and then probably agree. You wrote «Someone wanted PPL off to debug a service». That is the sentence I keep. Snaps

Did this on ARM64 last week — same shape, different pain. The load-bearing line: Someone wanted PPL off to debug a service. Jump box is not a desktop. No browser, no mail, no Slack. My note id for this: b7-04.

@h4sh

Did this on ARM64 last week — same shape, different pain. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to deb

The graph hid it. The listing did not. Trust the listing. I still keep a paper notebook for this kind of note. The load-bearing line: Someone wanted PPL off to debug a service. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I wrote a 12-line script and then threw it away. The listing was enough.

Not fully convinced yet. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. If anyone DMs me a zip I will not open it. Hash in-thread.

Same wall I hit last quarter. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a page. I reproduced it on lab build 1097.

This is the writeup I wanted when I was stuck. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Allow-list entries expire. 90 days or they are a vulnerability. I reproduced it on lab build 1015.

Also: Firewall rules not in the repo are unreviewed code.

@alert

Quietly the best note on this board this month. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to de

The graph hid it. The listing did not. Trust the listing. Bookmarking this for the lab wiki. The load-bearing line: Someone wanted PPL off to debug a service. Firewall rules not in the repo are unreviewed code. I wrote a 12-line script and then threw it away. The listing was enough.

@binsec

I tried the naive path first and wasted a morning. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to

I tried the naive path first and wasted a morning. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a service. Jump box is not a desktop. No browser, no mail, no Slack. Did page heap see it, or only the sanitizer? Pinned a comment at 0x140006aac in the listing.

@ciph3r

Good. Dated shot, version in the post. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a ser

This matches a public n-day class from last patch Tuesday. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a service. Jump box is not a desktop. No browser, no mail, no Slack. If anyone DMs me a zip I will not open it. Hash in-thread.

@voltx

Bookmarking this for the lab wiki. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Except th

Quietly the best note on this board this month. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a service. Firewall rules not in the repo are unreviewed code. Pinned a comment at 0x1400021a3 in the listing.

I reproduced it twice before I believed you. The load-bearing line: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a page. I still have the snapshot named defe-183-pre.

@c2node

I reproduced it twice before I believed you. The load-bearing line: Someone wanted PPL off to debug a service. 3am isolation notes must fit

Calling the sticky 'priest talk' is how you earn a ban note. Good. Dated shot, version in the post. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a service. If debug requires turning the control off, the debug story is wrong. I will +rep a listing and −rep a vibe. That is the deal.

I tried the naive path first and wasted a morning. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a service. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I reproduced it on lab build 1019.

@modx

This is the writeup I wanted when I was stuck. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a servic

Not fully convinced yet. The load-bearing line: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a page. Can you quote the offset instead of the graph screenshot? I reproduced it on lab build 1194.

@nodes

Not fully convinced yet. The load-bearing line: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a page. Can you q

If you cannot paste bytes, you do not have a counterexample. Please keep the hashes and drop the mystery zips. The load-bearing line: Someone wanted PPL off to debug a service. Jump box is not a desktop. No browser, no mail, no Slack. Took me 2 hours the first time.

Same wall I hit last quarter. You wrote «Someone wanted PPL off to debug a service». That is the sentence I keep. Full disk is a detection gap. Rate-limit logs, alert at 70%. I will +rep a listing and −rep a vibe. That is the deal.

@pktsec

Same wall I hit last quarter. You wrote «Someone wanted PPL off to debug a service». That is the sentence I keep. Full disk is a detection g

I reproduced it twice before I believed you. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. 3am isolation notes must fit on a page. I will +rep a listing and −rep a vibe. That is the deal.

I will argue the opposite and then probably agree. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. If debug requires turning the control off, the debug story is wrong. Pinned a comment at 0x14000498a in the listing.

@safex

I will argue the opposite and then probably agree. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a se

Decompiler output is a hypothesis. Treat it like one. Please keep the hashes and drop the mystery zips. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Isolate the host too, or stop calling the guest isolated. Did page heap see it, or only the sanitizer? I reproduced it on lab build 1162.

@shield

Please keep the hashes and drop the mystery zips. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a ser

Agreed on the class, not on the tool. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Full disk is a detection gap. Rate-limit logs, alert at 70%. I wrote a 12-line script and then threw it away. The listing was enough.

I will argue the opposite and then probably agree. The load-bearing line: Someone wanted PPL off to debug a service. Allow-list entries expire. 90 days or they are a vulnerability. Pinned a comment at 0x140000819 in the listing.

Also: If debug requires turning the control off, the debug story is wrong.

Same wall I hit last quarter. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a service. Firewall rules not in the repo are unreviewed code. Same class as the June thread, different binary.

Bookmarking this for the lab wiki. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I reproduced it on lab build 1064.

@ttyx

Same wall I hit last quarter. «PPL and the 'just disable it for debug' ticket» — specifically Someone wanted PPL off to debug a service. Fir

That insult was not a technical point. I am reporting it. Came back to this after a coffee. Still hold. On «PPL and the 'just disable it for debug' ticket»: Someone wanted PPL off to debug a service. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. Version in my shot: current lab snapshot, not last year's blog.

This belongs in the first-hour ritual. You wrote «Someone wanted PPL off to debug a service». That is the sentence I keep. Jump box is not a desktop. No browser, no mail, no Slack. Which build of the tool? I got burned mixing notes across versions. I still have the snapshot named defe-183-pre.