foxhill

34 ms·

301.
by foxhill 12y ago
i'm sorry, but proof by convention or consensus is not a proof. you have an idea of the linux kernel, and it's not entirely unwarranted. but whilst there have obviously been security issues, it would be a mistake to suggest that t
302.
by foxhill 12y ago
except that literally every piece of software you have ever written or used goes through some level of C, and lets face it, most of the C projects out there are actually pretty well tested. and it's not like higher level languages are
303.
by foxhill 12y ago
> build/run cycle > non-compiled language C isn't trying to fit in that space. regardless, C code takes far less time to parse, optimise, and convert into machine code than all the languages i know of.
304.
by foxhill 12y ago
i would argue that had the function prototype had names for it's arguments that this might not have happened.
305.
by foxhill 12y ago
DRY principle - you give the variables a name once, in the function definition. e.g: //decl in the header int pow(int exponent, int base); if you only look at the header you might think that the arguments are one way,
306.
by foxhill 12y ago
he's not arguing the craigslist UX is broken just that there are lots of areas where it could be improved . > they're features you wish existed the netflix UX is not broken. it just hasn't changed. yea, we clearly want
307.
by foxhill 12y ago
> Should have gone with the neutral screencap - OS X... or.. you know.. a few screenshots on different platforms.
308.
by foxhill 12y ago
> I try hard not to let personal irritation leak through in my HN comments, but I do fail at it. we are all, for good and for bad, unavoidably human.
309.
by foxhill 12y ago
i don't know for certain but i'd guess at; for each file specified in tupfile is target output file's creation date older than input file's last modified date? yes -> build, no
310.
by foxhill 12y ago
even though, prior to this thread, i'd never heard of 2 bugs exploiting this issue, i'm not denying their existence at all. only their likelihood of occurring. 10 years since i started programming, 7 of which i consider good enou
311.
by foxhill 12y ago
either you mean intercepting malloc/realloc calls, in which case can't happen as the function signature is different, or you mean literally modifying the source code of existing programs, and releasing that. which, lets face it, i
312.
by foxhill 12y ago
> If you're going to validate user input, you first need to get it into kernel space, which requires allocating memory for it. i don't buy this - if you are going to allocate space, you must know the size of the space you are a
313.
by foxhill 12y ago
yes, i understand. as you correctly state, user input of 2^30 is.. well, it's unlikely. more likely, is a user being able cause a program to do billions of reallocs. in which case, OOM is going to happen before overflow and exploitatio
314.
by foxhill 12y ago
there is no need to apologise. if i am wrong, i am wrong. i must say, this is the first (or second..) time i've heard of such an attack. and, whilst i'm not saying you're incorrect, i will say this - if you take user input an
315.
by foxhill 12y ago
prior to now, no. if you're referring to the 2003 exploit, well, i was 14 when that happened. as i previously mentioned, an exploit from allocating data based on unvalidated untrusted user input is.. practically a tautology.
316.
by foxhill 12y ago
whilst i appreciate the prudence of this measure, it doesn't do anything for existing programs. this will not fix any codes in OpenBSD that currently ship with it.
317.
by foxhill 12y ago
> This single overflow check could very well be the difference between denial-of-service-via-OOM and heap overflow OOM in general cannot be used for remote code execution. heap overflow can . > Should we then abandon ASLR or PIE or o
318.
by foxhill 12y ago
well the solution is to validate user input. user input should certainly be limited to 4gb, at least. a wrapper around an allocator is definitely not the solution.
319.
by foxhill 12y ago
darwin, NT, and linux all do this. that is the majority of systems. it's not a silly optimisation at all. at worst, it performs exactly as well as malloc. at best, it saves allocating memory. which in the mobile platform (again, most
320.
by foxhill 12y ago
> Yes, you should certainly suppose it's good, because it means the difference between an early out-of-memory error and a serious security vulnerability that can result in arbitrary code execution, like a buffer overflow. my point i
321.
by foxhill 12y ago
am i the only one that thinks this is a total non-issue? if you're going to overflow a size_t, you're already in trouble. realloc is used for.. um, reallocating data. it's probably grown many times before you come close to ex
322.
by foxhill 12y ago
how does this get upvoted? > I work for Bing really. the majority of the features listed that make bing "better" are in google. the rest are either entirely subjective, or re-hashes of the previous "feature". if you l
323.
by foxhill 12y ago
a spy agency.. doing.. spy work? outrageous. (i'm not saying i'm ok with it, but if you hire an electrician, don't be surprised when they start fixing electrical problems..)
324.
by foxhill 12y ago
whilst i concur with the premise that passwords should die, saying that xkcd-passwords are hence incorrect would be like saying.. hi-dpi monitors are not better than their low-dpi predecessors - we should be using direct computer/bra
325.
by foxhill 12y ago
at the risk of sounding rude, this guy probably only learned C last week. i mean, all but one of his complaints are noise. > k&r function headers unusual, but totally valid, even in C99. a minor syntactical difference. not a style i&
326.
by foxhill 12y ago
> The entire GPU programming landscape is so fragmented and unapproachable now. it's fragmented, true, but it's not that bad. > If they'd only exposed the processors directly and worked to unify behind a common compiler
327.
by foxhill 12y ago
well, yes, technically correct, but a CPU has much better double precision performance than that. 1/24th (or 1/32th in maxwell) of single precision performance doesn't really sell the usefulness of CUDA.
328.
by foxhill 12y ago
of course they all can do double, but at 1/24th of the speed of single. (1/32th in maxwell) they use a GK104 based tesla, i.e a "dual GPU" GTX680, so it has no real double precision. unless you consider 2x 95GFlops note
329.
by foxhill 12y ago
at least in the UK, it's fairly easy to get "unlimited" texts (for some values of "unlimited", of course) US pricing for texts seems much more extortionate, for some reason..
330.
by foxhill 12y ago
it could very easily run double precision, but then they'd have to use their tesla cards to run it, and at several thousand dollars a piece, wont be quite as attractive to the user..

More ›