ZoFreX

34 ms·

301.
by ZoFreX 12y ago
The most important thing is to make the API design not only easy to use, but also slightly defensive. If people should doing things one way, guide them toward that in the API, and make it harder for them to do the wrong thing. A lot of docu
302.
by ZoFreX 12y ago
Especially given how many small startup / tech products don't let you sign up without Tweeting about them - at least it's optional in this case!
303.
by ZoFreX 12y ago
You can reduce the above 5 steps to just one if you want to do it for the currently open application by pressing CTRL and DOWN :)
304.
by ZoFreX 12y ago
Read article, then type!
305.
by ZoFreX 12y ago
To be fair, many of our judges have excellent senses of humour. Unlike the US we don't have a constitution, at times I feel like our batty old judges are all we have to protect us.
306.
by ZoFreX 12y ago
There is nothing new or special about the Twitter rulings in the UK. Whether you agree with it or not, if you wrote similar messages to someone via letter 20 years ago you could get in trouble. Simply changing the medium hasn't changed
307.
by ZoFreX 12y ago
> Just to prove that what happens is nothing but the truth. No, it isn't, except in the most myopic and unhelpful way possible. It would be the truth to measure how much force is required and compare it to other phones on the market
308.
by ZoFreX 12y ago
It may be a "dumb experiment" if you already understand how the underlying systems (both the file system, and video encoding) work - but the author did not, and now having done the experiment, they understand more about them.
309.
by ZoFreX 12y ago
Relevant Calvin & Hobbes: http://www.gocomics.com/calvinandhobbes/1993/01/25
310.
by ZoFreX 12y ago
If you have bash installed, but it isn't the system bash (/bin/sh), and none of your scripts explicitly call bash or have a bash shebang, then you aren't vulnerable. However, if bash is your /bin/sh, then eve
311.
by ZoFreX 12y ago
They didn't rewrite it, they made changes to it - and they removed hundreds of bugs and potential bugs, on balance it's a huge improvement.
312.
by ZoFreX 12y ago
You can pretty much guarantee that nothing in the core system for FreeBSD calls Bash, because Bash isn't in the core system :)
313.
by ZoFreX 12y ago
On the upside, they got thoroughly smacked down, and I learned something interesting about Genesis today :)
314.
by ZoFreX 12y ago
I think the "super-hype" is warranted. You've missed out a large number of possible ways this could be exploited, so the above advice would leave a lot of people vulnerable. Furthermore, because it's such a common thing
315.
by ZoFreX 12y ago
It doesn't necessarily. But what it does do is pass information about the request in environment variables - that's step 1: attacker controls the contents of an environment variable. Then, if at any point the script invokes bash,
316.
by ZoFreX 12y ago
The other reason is that bash has dependencies outside the core system and is therefore possible to totally break on FreeBSD. Never change root's shell to bash!
317.
by ZoFreX 12y ago
Here's one way: if you have SSH access to a server but aren't allowed to log in (a Git server, for example) you can use this exploit to execute commands on the server. Only with your own privileges admittedly but without this expl
318.
by ZoFreX 12y ago
Interesting, I'll test this. Thanks! Btw, what is the advantage of this over dividing? Is it faster, does it give better distribution?
319.
by ZoFreX 12y ago
In my (naive and possibly flawed) tests, the division method is giving uniformly distributed results. Can you explain more what the limitations of that approach are?
320.
by ZoFreX 12y ago
There's a really big problem with dumping random bytes straight into a float, which is that you'll end up with a distribution that, while random, is not linear - i.e. the chance of it being between 0 and 0.5 will not be the same a
321.
by ZoFreX 12y ago
I'm dividing by UULONG_MAX + 1.0, because it expects a number between 0 (inclusive) and 1.0 (exclusive). I'm not sure how portable it is though.
322.
by ZoFreX 12y ago
I don't think it would be a common use-case when creating new software, but when patching legacy software to use better RNGs it's not unheard of for them to be using older RNGs that return a float between 0 and 1 (drand48 as an ex
323.
by ZoFreX 12y ago
The only part of this I care about right now is the random number generation. It looks good. Pity there's no way to get a float though, for a drop-in drand replacement.
324.
by ZoFreX 12y ago
I have to agree. A lot of the more detailed advice is muddled, misleading or even wrong. Very little discussion and collaboration seems to be happening on the wiki - just people editing in what they think is right. Are there any freely avai
325.
by ZoFreX 12y ago
Well for that matter so is the assurance that only you can purchase a valid SSL certificate for a domain you own. At some point, you gotta trust some people!
326.
by ZoFreX 12y ago
This is hardly a unique situation for the US. There are lots of countries where the state is surveilling their own citizens en masse, some for much more nefarious purposes, and it's not all tiny dictatorships either - plenty of large W
327.
by ZoFreX 12y ago
Ah-ha, Adblock was to blame!
328.
by ZoFreX 12y ago
> "We can email you when we launch new languages." How? Presumably I'm being slow because others have managed it, but I can't figure out how to sign up to be notified...
329.
by ZoFreX 12y ago
Is there a way for me to be notified if/when the Android app is available?
330.
by ZoFreX 12y ago
> Even if there were a skim-proof ATM, they could probably get a retired machine on the cheap, program it to accept cards and pins and then print 'Sorry, this machine is out of operation. Please call 1-800-FAK-ENUM to notify a techn

More ›