21 ms·

How dooyou tell something is dodgy from the call graph? Don't you have to decipher what FUN_918243 represents, or whatever?

intelVISA 4y ago
Easy: all nonfree software you have to decompile to view the 'source' is dodgy by design. Tools like Ghidra et al. merely lay bare the truth you already know.
- saagarjha 4y ago
  [flagged]
  - dang 4y ago
    Please don't do this here.
    - saagarjha 4y ago
      What would you suggest is an appropriate response to that comment? I could of course ignore or downvote it, but I'm not sure this actually conveys my sentiment towards it.
      - dang 4y ago
        You can't just express unprocessed annoyance. You have to let the annoyance metabolize inside yourself until one of two things happens: either (1) you have something genuinely interesting to contribute; or (2) the need to respond goes away.
        saagarjha 4y ago
        On the contrary, I have spent quite a while considering how to respond to comments like these and this was the best I could come up with. I'm open to suggestions on what I might do instead but I will point out that the current options you've put forward either 1. make it very asymmetric to respond to stupid comments or 2. allow them to proliferate, which drives away and buries interesting conversation.
        dang 4y ago
        Responding to "stupid" comments fuels them, so it's better to post nothing. It's certainly much better to post nothing than to post something like https://news.ycombinator.com/item?id=35351862 https://news.ycombinator.com/item?id=35351862. Re "allowing them to proliferate", the solution for that is flagging. (In case anyone doesn't know: to flag a comment, click on its timestamp to go to its page, then click the 'flag' link at the top. There's a small karma threshold before flag links appear.) And downvoting, of course (the karma threshold for that is higher). If the comment was bad enough to respond the way you did, why didn't you downvote and/or flag it?
        saagarjha 4y ago
        I don't flag comments very often unless they egregiously break the rules, but I've downvoted things like this before. Usually what happens is the person gets upset that they've been penalized by the system if the downvotes stick, or someone comes along and actually thinks the comment is good, and the effects of downranking it are reversed. I don't want to propose that my opinions on comments should overrule everyone else's, but I know you agree that just because people upvote vapid or clichéd content doesn't make it appropriate for Hacker News. So, I haven't really found your solution to work in practice. What I could absolutely do is sit down and write a long reply about why I think the comment missed the mark, and how it could improve. I have done this in the past too. The problem here is that doing so is a lot of work. My thought process is that most of the people who are posting like this know that they're just posting low quality stuff, and if there's an easy reminder to stop doing that, they will. If they happen to reply with "no, I'm serious, here's why…" then there's no harm done; otherwise it signals (to other people too) that we're looking for something better than that.
        dang 4y ago
        I understand that writing a substantive comment can be a lot of work, but how can we be arguing about https://news.ycombinator.com/item?id=35351862 https://news.ycombinator.com/item?id=35351862? It was obviously unsubstantive and provocative, and would even probably land as a personal attack. It was even a case of the "vapid and cliché" that you're wanting to counteract. Downvoting a bad comment is fine. Not posting is fine. If you want to neutrally let someone know that their comment isn't substantive enough for a good HN post, that's ok as long as you're careful how you do it. Dropping an insult on them is never helpful.
- biggieshellz 4y ago
  What if someone gives you a binary that they claim is built from a particular source code? If you don't decompile it, how do you know if that's true or not? Or what if you can't trust your compiler (a la https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html)?
  - intelVISA 4y ago
    I could never trust a bin I didn't build myself (with my own C compiler ofc).
    - arjvik 4y ago
      Did you build that C compiler yourself? Using what compiler? Unless you bootstrapped it from a handwritten assembler, you'll need to consider the attack outlined in Reflections on Trusting Trust
      - intelVISA 4y ago
        I did but I foolishly relied on GCC before it was self-hosted now I guess I should scrap the whole thing and build by hand.
        pxc 4y ago
        There's actually someone out there who has done some impressive work on this, believe it or not! https://savannah.nongnu.org/projects/stage0/ https://savannah.nongnu.org/projects/stage0/
  - JCWasmx86 4y ago
    Reproducible builds. Sure not every project can be built in a reproducible manner, but it at least reduces the chances of getting shady binaries
    - pxc 4y ago
saagarjha 4y ago
Generally you can click around some code and see what functions it calls, what strings it references, etc. to get a basic understanding of what it does.
amrb 4y ago
You can see imported library, strings and possible network calls, working backwards you going to see red flags if it's a basic app.

intelVISA 4y ago

Easy: all nonfree software you have to decompile to view the 'source' is dodgy by design. Tools like Ghidra et al. merely lay bare the truth you already know.

saagarjha 4y ago
[flagged]
- dang 4y ago
  Please don't do this here.
  - saagarjha 4y ago
    What would you suggest is an appropriate response to that comment? I could of course ignore or downvote it, but I'm not sure this actually conveys my sentiment towards it.
    - dang 4y ago
      You can't just express unprocessed annoyance. You have to let the annoyance metabolize inside yourself until one of two things happens: either (1) you have something genuinely interesting to contribute; or (2) the need to respond goes away.
      - saagarjha 4y ago
        On the contrary, I have spent quite a while considering how to respond to comments like these and this was the best I could come up with. I'm open to suggestions on what I might do instead but I will point out that the current options you've put forward either 1. make it very asymmetric to respond to stupid comments or 2. allow them to proliferate, which drives away and buries interesting conversation.
        dang 4y ago
        Responding to "stupid" comments fuels them, so it's better to post nothing. It's certainly much better to post nothing than to post something like https://news.ycombinator.com/item?id=35351862 https://news.ycombinator.com/item?id=35351862. Re "allowing them to proliferate", the solution for that is flagging. (In case anyone doesn't know: to flag a comment, click on its timestamp to go to its page, then click the 'flag' link at the top. There's a small karma threshold before flag links appear.) And downvoting, of course (the karma threshold for that is higher). If the comment was bad enough to respond the way you did, why didn't you downvote and/or flag it?
        saagarjha 4y ago
        I don't flag comments very often unless they egregiously break the rules, but I've downvoted things like this before. Usually what happens is the person gets upset that they've been penalized by the system if the downvotes stick, or someone comes along and actually thinks the comment is good, and the effects of downranking it are reversed. I don't want to propose that my opinions on comments should overrule everyone else's, but I know you agree that just because people upvote vapid or clichéd content doesn't make it appropriate for Hacker News. So, I haven't really found your solution to work in practice. What I could absolutely do is sit down and write a long reply about why I think the comment missed the mark, and how it could improve. I have done this in the past too. The problem here is that doing so is a lot of work. My thought process is that most of the people who are posting like this know that they're just posting low quality stuff, and if there's an easy reminder to stop doing that, they will. If they happen to reply with "no, I'm serious, here's why…" then there's no harm done; otherwise it signals (to other people too) that we're looking for something better than that.
        dang 4y ago
        I understand that writing a substantive comment can be a lot of work, but how can we be arguing about https://news.ycombinator.com/item?id=35351862 https://news.ycombinator.com/item?id=35351862? It was obviously unsubstantive and provocative, and would even probably land as a personal attack. It was even a case of the "vapid and cliché" that you're wanting to counteract. Downvoting a bad comment is fine. Not posting is fine. If you want to neutrally let someone know that their comment isn't substantive enough for a good HN post, that's ok as long as you're careful how you do it. Dropping an insult on them is never helpful.
biggieshellz 4y ago
What if someone gives you a binary that they claim is built from a particular source code? If you don't decompile it, how do you know if that's true or not? Or what if you can't trust your compiler (a la https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html)?
- intelVISA 4y ago
  I could never trust a bin I didn't build myself (with my own C compiler ofc).
  - arjvik 4y ago
    Did you build that C compiler yourself? Using what compiler? Unless you bootstrapped it from a handwritten assembler, you'll need to consider the attack outlined in Reflections on Trusting Trust
    - intelVISA 4y ago
      I did but I foolishly relied on GCC before it was self-hosted now I guess I should scrap the whole thing and build by hand.
      - pxc 4y ago
        There's actually someone out there who has done some impressive work on this, believe it or not! https://savannah.nongnu.org/projects/stage0/ https://savannah.nongnu.org/projects/stage0/
- JCWasmx86 4y ago
  Reproducible builds. Sure not every project can be built in a reproducible manner, but it at least reduces the chances of getting shady binaries
  - pxc 4y ago

saagarjha 4y ago

Generally you can click around some code and see what functions it calls, what strings it references, etc. to get a basic understanding of what it does.

amrb 4y ago

You can see imported library, strings and possible network calls, working backwards you going to see red flags if it's a basic app.