Reelin

75 ms·

721.
by Reelin 7y ago
It's a fundamentally flawed approach in my opinion; viewing the users of a language as a single unified user base is a mistake. Various projects and groups will inevitably have vastly different use cases, and thus needs and considerati
722.
by Reelin 7y ago
Are you aware that Crystal uses GC? ( https://github.com/crystal-lang/crystal/wiki/FAQ#language-x-... )
723.
by Reelin 7y ago
An attacker would have to set such a flag before the binary was loaded, meaning they've already achieved code execution (and syscalls). This feature is yet another layer of defense against remote exploitation of a currently running p
724.
by Reelin 7y ago
It really is a sad state of affairs when disabling the linter requires patching the compiler. I wonder if any of the LLVM-based Go compilers will adopt a saner policy?
725.
by Reelin 7y ago
Python works just fine with tabs, but the language-endorsed style guide (PEP 8) recommends against them. (However, the usual plugin for Vim requires adding "let g:python_recommended_style = 0" to work correctly.)
726.
by Reelin 7y ago
I think Zig is probably just being opinionated there; many of the new languages seem to be overly so. Last I checked, both the Zig and Nim compilers refused (on principle, not for any technical reason) to compile code containing tabs (among
727.
by Reelin 7y ago
Also see Etherpad ( https://etherpad.org/ ), which is integrated into Sandstorm ( https://sandstorm.io/ ). For lots of other self-hosted things: ( https://news.ycombinator.com/item?id=21235957 ).
728.
by Reelin 7y ago
> If it's operational in seconds it was hibernated or suspended. This is not true. Are you still using a platter hard drive? (If an SSD, have you looked up benchmarks for it?) My ~5 year old laptop used to cold boot Windows 7 in le
729.
by Reelin 7y ago
Something tells me it won't work with privacy oriented systems like hass.io ( https://www.home-assistant.io/hassio ), but I'd be happy to be wrong.
730.
by Reelin 7y ago
> fear that there would be a flood of low quality products That's mental gymnastics. The fear is having to compete against cheaper products (possibly low quality, but possibly not). Even broken DRM is an excellent anti-competitive t
731.
by Reelin 7y ago
I too would like to know more about this. * The essay appeared to continually interchange the terms API and ABI, which to my mind are very different things. * The examples provided weren't as concrete and concise as I would have liked.
732.
by Reelin 7y ago
To add to this, hashed username-password material is leaked only by the first variant described in the paper. The second variant described only leaks hashed username material. They reportedly used the first variant during testing but have n
733.
by Reelin 7y ago
I'd like to add that (IIUC) this scheme doesn't require Google to retain plaintext credentials or even password hashes. (They still might of course, but they don't have to.) If implemented as described in the linked paper, it
734.
by Reelin 7y ago
> I also tell Google that the password is between 40 and 50. (Equivalent to sending three characters of cleartext.) I believe the (first 3 bytes of the) hash of your username is used, as opposed to your plaintext password. I realize you
735.
by Reelin 7y ago
> why couldn't they be compelled to silently push a special update that exfiltrates all of my messages in plaintext? See the FBI vs Apple case from a few years ago for an analysis of that. > Why couldn't they use an escrow k
736.
by Reelin 7y ago
Thanks for explaining, that makes much more sense. It seems to me that double ratchet is really to blame here. Without it, you could simply share a single key across all devices. With it, your choice is to either deal with this sort of comp
737.
by Reelin 7y ago
> Multi-device E2E requires ONE device be the source of truth for the private key. That doesn't sound right to me. It may well be the case for a particular implementation, but I don't see why it would hold for the general case.
738.
by Reelin 7y ago
I'm not proposing anything, I'm asking for a concrete explanation of the supposed security hole. I agree that ASLR isn't a complete security solution and never implied otherwise. AFAIU, the entire security benefit here is d
739.
by Reelin 7y ago
This does not match my experience at all. I have never (including in academia) encountered use of Big O which implicitly referred to the worst case - it has _always_ referred to the average case. That being said, usage has rarely been impli
740.
by Reelin 7y ago
My understanding is that LTO (and thus any cross-language inlining) takes place using a low level IR where language barriers aren't relevant. The GCC and LLVM backends both have full support as far as I know. Hypothetically it's s
741.
by Reelin 7y ago
> you need to lift the called-once restrictions, which opens a hole for an attacker I don't see how that's the case; my original question was essentially asking what that security hole is. Provided that syscall ability is opt-o
742.
by Reelin 7y ago
C is the wrong comparison to make here - it's extremely low level. Java or perhaps C++ would be much closer. * Ahead of time compiled languages reduce flexibility but allow the compiler to do more reasoning about the system. * Statical
743.
by Reelin 7y ago
Currently ls.so upon linking in libc; invoking msyscall() is only permitted once per process. Seeing as msyscall() is itself a system call, any calls to it must themselves originate from an authorized region.
744.
by Reelin 7y ago
Perhaps "strict" would have been a better word choice than "severe". It does seem that there's a very reasonable security concern about doing so from +w+x memory, or from non-PIE regions, or without first explicitly
745.
by Reelin 7y ago
The type of bug (and related failure modes) is important though. Would you willingly board a plane if the avionics software and firmware had been written in a dynamically typed language? Alternatively, usage of Rust may not be correlated
746.
by Reelin 7y ago
My understanding is that system calls can currently only be made from -w+x regions; attempting otherwise results in the process being killed. The idea is to extend this protection to only allow system calls from expected address ranges, so
747.
by Reelin 7y ago
Related (AFAIU): https://news.ycombinator.com/item?id=21653119 > We've been concerned about adding even one additional syscall entry point I don't understand the need for such a severe "only libc syscalls
748.
by Reelin 7y ago
It's the lingua franca in that it's the standard for interoperating. Every high level language I've used has had at least one C FFI readily available.
749.
by Reelin 7y ago
> curious why people want this? It's important for core infrastructure to have multiple competing implementations. On a related note, does Rust have a standard yet or are they still doing the reference implementation thing? > I w
750.
by Reelin 7y ago
I believe I was primarily using Architexa ( https://github.com/i3labs/architexa ), but it was a number of years ago when I was working exclusively in Java. JetBrains also provides a few diagramming plugins, but I've

More ›