coekie

3 ms·

1.
by coekie 1y ago
Yes indeed. A nice surprise to stumble upon my old blog post again here. I don't think much has changed since then, most of the problems are still there in newer Java versions. And that's fine, in practice they don't hurt. St
2.
by coekie 2y ago
No, that must have been something different. It would be possible to extend what FlowTracker does to also find SQL (or other) injection vulnerabilities. So it's possible the tool you're thinking of used a similar approach.
3.
by coekie 2y ago
Thanks. As I was developing FlowTracker, a lot of the work was driven by making tracking of specific example programs work. I knew what result I was aiming for, but it was hard to predict what lower level mechanisms needed to be supported t
4.
Show HN: FlowTracker – Track data flowing through Java programs(github.com)
280 points by coekie 2y ago|32 comments
5.
by coekie 3y ago
I just added solutions to the empty String challenge in the blog post. This includes a very interesting find from Xavier Cooney, that causes the same problem without involving any concurrency. It instead makes StringBuilder misbehave by thr
6.
by coekie 3y ago
> The reality is that it's permitted to do all these things Yes, given the code in the String class, the JVM is allowed to execute it in this way. I'm not claiming that is wrong, I'm claiming the code in the String class s
7.
by coekie 3y ago
Author of the blog here. Yes, this is a bug. While the javadoc doesn't state it explicitly, immutable classes in the core library are expected to be thread safe. Java tries to be and mostly succeeds at being a safe language, where (by
8.
Breaking java.lang.String(wouter.coekaerts.be)
220 points by coekie 3y ago|198 comments
9.
by coekie 7y ago
You can see what IP it uses to send requests to google using https://captcha.nsa.gov/search?q=what+is+my+ip