6 ms·
Half of curl’s vulnerabilities are C mistakes
- deleted 6y ago[deleted]
- krageon 6y agoAre there good solutions for creating (pie) charts that aren't completely opaque to people with color vision deficiencies? This article is especially egregious because I feel like they actually add to the point being made, but for the life of me I can't distinguish some of these colours. Who uses yellow (or orange, idk) for four separate labels? Perhaps related, does anyone know of an overlay-type application that allows me to colorpick part of the screen (on linux)? My current solution is usually to screenshot and open the image in the GIMP or similar, but it's very cumbersome and especially if there are multiple pictures usually not worth it.
- domenukk 6y agoThe pie chart's legend in this post is sorted largest number to smallest number, if that helps. Or as table: Buffer overread: 22 Buffer overflow: 20 Use After Free: 4 Double Free: 3 NULL mistake: 2
- jeroenhd 6y agoI don't know about any resources for accessible colour picking, but if you're looking for a colour picker to work around badly designed charts, there's Pick[1], which is easy to work with. It also displays you the closest colour name, so you don't need to manually parse hex codes to see the difference. I'm not aware of any colour disabilities that I have but I found it difficult to parse the colours as well, specifically in the second pie chart (areas). The colours in the chart only work to distinguish one slice from its neighbours, it's near impossible to map them to the categories listed in the legend. Perhaps the author is working on a super-colour-accurate computer screen where this problem isn't as noticeable, but on my older screens these colour profiles are near useless. If you're in Firefox, you can find a colour picker in the dev tools (top left of the "inspect element" tab). That mostly focuses on devs though, so all you get is HTML colour hex. [1]: https://github.com/stuartlangridge/ColourPicker https://github.com/stuartlangridge/ColourPicker
- SOLAR_FIELDS 6y agoAnother tool that we use in the online mapping world that specifically supports color blindness that generates palettes is ColorBrewer: https://colorbrewer2.org/#type=sequential&scheme=BuGn&n=3 https://colorbrewer2.org/#type=sequential&scheme=BuGn&n=3
- me_me_me 6y agoFirefox F12 and there is a colour picker, it can work in a pinch. But it doesn't matter for this article, author puts values in descending order for the labels so you dont really need colours. Better yet if they put the values next to the label name too, but we can have it all.
- chrisxcross 6y agogpick is a nice tool to do it: http://www.gpick.org http://www.gpick.org
- WanderPanda 6y agoDoes turning your monitor / browser into negative mode help?
- kevincox 6y agoIt seems that to handle this you should have lines between the label and the slice instead of a legend. Google Sheets seems to do this by default but it seems to sort colours from dark to light which may make the boundaries of some colours hard to see for colourblind people. I would assume that putting the slices light-dark-light... would be optimal for the contrast between them, even for people who are not colour vision deficient.
- acdha 6y agoI’ve heard people recommend https://colorbrewer2.org/ https://colorbrewer2.org/ and https://gka.github.io/palettes/ https://gka.github.io/palettes/ for color palettes. I also recommend Color Oracle for testing: http://www.colororacle.org/ http://www.colororacle.org/
- GoblinSlayer 6y agoThe chart is ordered, you don't need to differentiate the colors.
- leephillips 6y agoI don’t understand. If you can’t differentiate the colors, you can’t see the boundaries between segments. I think it would have been good to include tables, as well. EDIT: I see what you’re saying now. You can just read the legend, which lists things in order. But that just gives the ordering, not the sizes of the categories.
- GoblinSlayer 6y agoDifferent colors can be differentiated, it's the three yellow colors that are similar, but don't need to be differentiated, they aren't consecutive.
- Deebster 6y agoThere are different kinds of colourblindness. Deuteranopes are likely to confuse greens with yellows, which are consecutive here.
- Zababa 6y agoI usually find that JS heavy approaches can shine here, like with Chart.js. Here on the donut pie [1] you can hover with your mouse and see the name of the labels and the amount. Where I like this approach is with big line charts like this one [2] (here it's D3 that's used). I am colorblind, and also not good at following things in general (I can have a hard time counting sequences of similar numbers), and I find charts made this way easier to read. [1]: https://www.chartjs.org/docs/latest/charts/doughnut.html https://www.chartjs.org/docs/latest/charts/doughnut.html [2]: https://observablehq.com/@d3/multi-line-chart https://observablehq.com/@d3/multi-line-chart
- nojito 6y agoYou should typically avoid using piecharts because humans are terrible at interpreting size/parts of a whole. Every piechart can be turned into a barchart that communicates the findings in a much clearer way.
- tbrock 6y agoWhy doesn’t he rewrite it in rust then and do himself a favor going forward?
- detaro 6y agoWhy do you think he's adding Rust components to it?
- tbrock 6y agoSeems like re-writing it with extra steps.
- ludamad 6y agoIt's "re-writing" with actual steps
- justsomeuser 6y agoI think he is being paid to, not sure if he would choose to personally. There was a blog post a while back where he more or less said "I am being paid to add Rust".
- duckerude 6y agocurl is very widely used, including on platforms that Rust doesn't support. Broad support is perhaps its killer feature. A rewrite would introduce new bugs, even if they aren't memory issues. The rewrite could end up buggier than the original.
- tbrock 6y agoYeah of course, I just think instead of all this “it could be in rust talk” let’s just get it over with.
- acdha 6y agoAs an example of how widely curl is used, the author has posted things like the support emails he gets from people whose car or IoT device uses curl: https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/ https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/ I love using Rust for new development but curl is _everywhere_ and a port would need to spend a lot of time copying old quirks. Given how clunky C APIs are, I’d think it’d be better to migrate more of the callers to a higher-level interface anyway.
- indymike 6y agoWhat really stood out in the article: It took a lot less time for C mistakes to be fixed vs non C mistakes. That's not saying C is great. More significantly most of the mistake based vulnerabilities took over over half a decade to be identified.
- duckerude 6y agoNot a lot, right? 2400 days vs 3000 days.
- indymike 6y agoThat's roughly two years, so I'd say a lot of time is accurate.
- mantap 6y agoThat strikes me as a bad thing. A bug that is easy to fix is a bug that could have been fixed sooner. That's exactly the kind of bug that causes the worst issues. Bugs that are hard to fix but readily identified are at least possible to work around.
- benibela 6y agoThat is why I wrote my webpage downloader in Pascal No C vulnerabilities at all
- dangerbird2 6y agoNow you have to deal with Pascal vulnerabilities \s
- karmakaze 6y agoI hope that's a small number. Hate to think there are as many logic-intent sorts of bugs as well.
- jayp1418 6y agohttps://github.com/1ma/CurlAda https://github.com/1ma/CurlAda