bennofs

19 ms·

151.
by bennofs 9y ago
Yes, but to do that, your code needs to use the same branch predictor as the victim code. If the branch prediction buffer is per-core and not shared among multiple cores, then that means you have to run on hte same core as the kernel. If th
152.
by bennofs 9y ago
I like it, at least from the little that I read about it. The name describes the core of what it is: differentiate programs, in order to figure out how changes the the program affect the output and using that for optimization purposes. Do w
153.
by bennofs 9y ago
You would not send requests to keepass in order to leak passwords. Instead, you would try to setup the branch prediction cache in way such that during ordinary execution, keepass will causes cache accesses dependent on secret data b.c. of t
154.
by bennofs 9y ago
The other thing is that it is not necessary to be in the same process for this: you could in theory have one process do the access (which gets killed) and then observe the cache result in another process.
155.
by bennofs 9y ago
Just masking the lower bits is not enough: you can easily reconstruct a high-precision timer from that by observing the clock edges (waiting until rtdsc increases): wait for clock edge, do your experiment, increase counter until next clode
156.
by bennofs 9y ago
These patches should only affect syscall entry/exit performance. So if you're not doing things that do enormous amounts of syscalls, you should be more at the 3% end of the scale. The 30% number comes from doing things like calcul
157.
by bennofs 9y ago
I find it's pretty straightforward using gradle (except that it doesn't build fat jars out of the box). Can you elaborate on what you're having trouble with?
158.
by bennofs 9y ago
Probably pinning the object in memory, so that you can keep a stable reference to it without the danger of the GC moving it away under your pointer.
159.
by bennofs 9y ago
Java? But that's another kind of hell
160.
by bennofs 9y ago
> Why not integrate rust and the libraries into the existing packagement systems, like so many other software projects do? This makes me curious: can you tell me some examples of other software projects which are not written in C that in
161.
by bennofs 9y ago
Isn't an ereader basically such a device? Or where is the difference? Combine it with Pocket or some epub newsletter.
162.
by bennofs 9y ago
> Which grants root to any user with a numeral This formulation may be misunderstood. The bug did not grant users root rights, it ignored the user= setting on a service if the service was intended to run as a user stating with a numeral.
163.
by bennofs 9y ago
Risk is not the only reason to move away from nuclear energy. There's also the problem of radioactive waste, which will need to be dealt with for many, many years (German laws require secure storage for one million years). I won't
164.
by bennofs 9y ago
You can just use `-Weverything -Wno-effc++` then
165.
by bennofs 9y ago
I agree that using `-Werror` in release builds is a bad idea. But I don't think you need to "not make it the default" for this: just provide an easy way to disable it, and do it automatically for release builds. It should be
166.
by bennofs 9y ago
The article also explains this. It seems to be possible to get a much smaller distance if you eat up a lot of stack space using large execve arguments for example (this might be wrong, I haven't 100% understood all details yet). But th
167.
by bennofs 9y ago
You can exploit existing binaries such as ping that have special capabilities or are setuid to get privilege escalation. A better link would have been https://www.qualys.com/2017/09/26/cve-2017-1000253/cv
168.
by bennofs 9y ago
> very different and it has a bunch of interesting non-QuickCheck features. I'm only familar with QuickCheck, but what are those differences / features? Couldn't tell from a quick look at the website of Hypothesis.
169.
by bennofs 9y ago
Just don't do this for things you intend to make public - it makes installing and packaging it really difficult
170.
by bennofs 9y ago
That does sound like a bad UI though. Perhaps vscode could stage the files before, so that they end up in Git's objects at least? Or somehow store them in the reflog
171.
by bennofs 9y ago
Well, the stated goal was to use rust for small hotspots. These hotspots could take very little time but are called a lot, so the overhead of creating a process / communicating with another process can be quite a lot (think of a functi
172.
by bennofs 9y ago
> What annoys me most is that Firefox refuses to show you the certificate if it fails to validate, which makes figuring out validation errors more painful. You can view it in Firefox as well: Advanced -> Add exception -> View Or, a
173.
by bennofs 9y ago
The symbol thing sounds useful and is something I cannot comment on, since most often I either debug open source programs that I run myself (so I have the binary with compiled with debug symbols) or there is no source at all for the binary
174.
by bennofs 9y ago
Oh! That makes sense, thank you. It only raises the question though, does anyone really use hexadecimal line numbers? :)
175.
by bennofs 9y ago
First of all, I agree! GDB without extensions is not that nice to use. But there exist several extensions ( https://github.com/cyrus-and/gdb-dashboard , https://github.com/hugsy/gef , https:/&#
176.
by bennofs 9y ago
Can you tell me some of the things that VS does much better? I've only ever used GDB, and I am kind of lost when trying to debug a binary on windows
177.
by bennofs 9y ago
I found rr to be much better for reverse debugging than gdb's record feature. For some reason, hardware watchpoints while reverse-continuing don't work for me when using gdb record but do when using rr.
178.
by bennofs 9y ago
Ncdu is a command line application that does this (a tree with sizes)
179.
by bennofs 9y ago
How about https://jitsi.org/jitsi-meet/ ?
180.
by bennofs 9y ago
I'm not very familiar with Matrix and new to Ring, but can you explain how Ring is more decentralized than Matrix? I guess Matrix still requires the homeserver, making it somewhat centralized?

More ›