3 ms·

But then you are saying a specific great new feature, performance, and not just the claim and concept performance, but numbers.

LtWorf 3y ago
I'm sure they actually had new features…
- CanaryLayout 3y ago
  Yeah... RISCV routine was put in, then some binary test files were added later that are probably now suspect. don't miss out on the quality code, like the line that has: i += 4 - 2; https://git.tukaani.org/?p=xz.git;a=commitdiff;h=50255feeaabcc7e7db22b858a6bd64a9b5b4f16d;hp=db5eb5f563e8baa8d912ecf576f53391ff861596 https://git.tukaani.org/?p=xz.git;a=commitdiff;h=50255feeaab...
  - gamer191 3y ago
    > some binary test files were added later that are probably now suspect That's confirmed From https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4: > The files containing the bulk of the exploit are in an obfuscated form in > tests/files/bad-3-corrupt_lzma2.xz > tests/files/good-large_compressed.lzma > committed upstream. They were initially added in > https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0 https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf...
    - m0dest 3y ago
      It probably makes sense to start isolating build processes from test case resources.
      - saagarjha 3y ago
        Sure but then you can smuggle it into basically any other part of the build process…?
  - jwilk 3y ago
    FWIW, "4 - 2" is explained earlier in the file: // The "-2" is included because the for-loop will // always increment by 2. In this case, we want to // skip an extra 2 bytes since we used 4 bytes // of input. i += 4 - 2;
- Brian_K_White 3y ago
  What are they specifically? I don't know how you can be missing the essence of the problem here or that comments point. Vague claims are meaningless and valueless and are now even worse than that, they are a red flag. Please don't tell me that you would accept a pr that didn't explain what it did, and why it did it, and how it did it, with code that actually matched up with the claim, and was all actually something you wanted or agreed was a good change to your project. Updating to the next version of a library is completely unrelated. When you update a library, you don't know what all the changes were to the library, _but the librarys maintainers do_, and you essentially trust that librarys maintainers to be doing their job not accepting random patches that might do anything. Updating a dependency and trusting a project to be sane is entirely a different prospect from accepting a pr and just trusting that the submitter only did things that are both well intentioned and well executed. If you don't get this then I for sure will not be using or trusting your library.

LtWorf 3y ago

I'm sure they actually had new features…

CanaryLayout 3y ago
Yeah... RISCV routine was put in, then some binary test files were added later that are probably now suspect. don't miss out on the quality code, like the line that has: i += 4 - 2; https://git.tukaani.org/?p=xz.git;a=commitdiff;h=50255feeaabcc7e7db22b858a6bd64a9b5b4f16d;hp=db5eb5f563e8baa8d912ecf576f53391ff861596 https://git.tukaani.org/?p=xz.git;a=commitdiff;h=50255feeaab...
- gamer191 3y ago
  > some binary test files were added later that are probably now suspect That's confirmed From https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4: > The files containing the bulk of the exploit are in an obfuscated form in > tests/files/bad-3-corrupt_lzma2.xz > tests/files/good-large_compressed.lzma > committed upstream. They were initially added in > https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf8c78aef377c10f71e274f63c0 https://github.com/tukaani-project/xz/commit/cf44e4b7f5dfdbf...
  - m0dest 3y ago
    It probably makes sense to start isolating build processes from test case resources.
    - saagarjha 3y ago
      Sure but then you can smuggle it into basically any other part of the build process…?
- jwilk 3y ago
  FWIW, "4 - 2" is explained earlier in the file: // The "-2" is included because the for-loop will // always increment by 2. In this case, we want to // skip an extra 2 bytes since we used 4 bytes // of input. i += 4 - 2;
Brian_K_White 3y ago
What are they specifically? I don't know how you can be missing the essence of the problem here or that comments point. Vague claims are meaningless and valueless and are now even worse than that, they are a red flag. Please don't tell me that you would accept a pr that didn't explain what it did, and why it did it, and how it did it, with code that actually matched up with the claim, and was all actually something you wanted or agreed was a good change to your project. Updating to the next version of a library is completely unrelated. When you update a library, you don't know what all the changes were to the library, _but the librarys maintainers do_, and you essentially trust that librarys maintainers to be doing their job not accepting random patches that might do anything. Updating a dependency and trusting a project to be sane is entirely a different prospect from accepting a pr and just trusting that the submitter only did things that are both well intentioned and well executed. If you don't get this then I for sure will not be using or trusting your library.