ievans

10 ms·

61.
by ievans 6y ago
This is sad to see. More context on BugTraq (it looks like the wiki page has already been updated with this note): https://en.wikipedia.org/wiki/Bugtraq
62.
by ievans 6y ago
Possibly of interest to the HN crowd, just before this Mudge was (and I think still is) involved in a non-profit named CITL that focuses on performing static and dynamic analysis (eg fuzzing) to evaluate hardening measures in consumer softw
63.
by ievans 6y ago
Good catch. Currently we only support constant propagation for literals. Here's a working example: $ semgrep -e "not_exec('somestr)" will match foo = "somestr" not_exec(foo) Here's a
64.
by ievans 6y ago
The CLI does have an --autofix flag, but the replacement it uses has to be specified through a local config file rather than as a command line arg. There is a ticket that though! https://github.com/returntocorp/semgrep
65.
by ievans 6y ago
The good news is that we’ve replaced almost all the homegrown parsers that were written while the tool was at Facebook and we’re using the now tree-sitter project, which already has parsers for 40+ languages. There is a tree-sitter-cpp proj
66.
by ievans 6y ago
@Borkdude I love your project & the name! I work on a similar tool ( https://github.com/returntocorp/semgrep ), we've recently switched to using tree-sitter under the hood so that we can add new languages faster
67.
by ievans 6y ago
Hey HN, I’m the author of this post and a contributor to Semgrep. Happy to answer questions and hear feedback! I’m excited to try to lower the barrier to writing a simple lint (or more complex program analysis) that previously only a static
68.
by ievans 6y ago
Interesting. Any kind of sanitizer like this seems doomed to fail repeatedly--I like the discussion at http://langsec.org/ I wrote a Semgrep rule (I'm one of the maintainers) to look for calls to the .sanitize() method
69.
Continuous compliance with lightweight verification tools [pdf](homes.cs.washington.edu)
3 points by ievans 6y ago|0 comments
70.
Not all attacks are equal: understanding and preventing DoS in web applications(r2c.dev)
46 points by ievans 6y ago|13 comments
71.
Type-Awareness in Semantic Grep(r2c.dev)
3 points by ievans 6y ago|0 comments
72.
by ievans 6y ago
C# is high on the list, F# isn't a priority at the moment though. Behind the scenes, we've recently changed to use tree-sitter as the parser library; if there is a good F# tree-sitter library integration becomes quite easy. I don&
73.
by ievans 6y ago
https://github.com/facebookarchive/pfff where it was named “sgrep”. pfff is maintained by @aryx who was the original author and is a Facebook alum, see https://github.com/returntocorp/pfff for the
74.
by ievans 6y ago
I work on Semgrep; there are a bunch of examples at https://semgrep.live if you're curious about what the syntax looks like. For context, Semgrep started as a Facebook open-source project inspired from a Inria project named
75.
Tree-sitter: a parser generator tool and an incremental parsing library(tree-sitter.github.io)
3 points by ievans 6y ago|0 comments
76.
Coccigrep, a semantic grep for the C language(github.com)
1 points by ievans 6y ago|0 comments
77.
by ievans 6y ago
When they get big enough, they add the static analysis on top of the language to make it more robust. There's a good read by Instagram (all Python) on this: https://instagram-engineering.com/static-analysis-at-scale-a..
78.
by ievans 6y ago
I thought this was pretty clever: since most websites have nice APIs on the backend, what if they were exposed directly to the user? There are some demo videos on the press announcement: https://www.csail.mit.edu/news/s
79.
ScrAPIr: Making Web Data APIs Accessible to Everyone(mit.edu)
2 points by ievans 6y ago|1 comments
80.
Fortify Source: A Deeper Dive into Function Hardening on Linux and OS X(cyber-itl.org)
4 points by ievans 7y ago|0 comments
81.
Malicious code in the purescript NPM installer(harry.garrood.me)
2 points by ievans 7y ago|0 comments
82.
by ievans 7y ago
It's been taken down, but here's what the malicious payload inside electron-native-notify looked like: https://gist.github.com/ievans/7e10101cadb823583f77a5d40c64e...
83.
Understanding Google’s new online/offline conversion tracking(linc.cnil.fr)
1 points by ievans 8y ago|0 comments
84.
by ievans 8y ago
It looks like the manifest specifies permissions for https://keybase.io/_/api/1.0/*; you may want to make it a bit more general because if you ever need to bump the API version, Chrome will (sensibly) disable
85.
by ievans 10y ago
Feature idea: can I take a previously-recorded speech and have it show me the filler words after-the-fact? Could be cool to track improvements over time.
86.
by ievans 11y ago
I've been very impressed with the modeling in in Wargame: Airland Battle, which is available for Linux via Steam
87.
by ievans 12y ago
I found your comment to be very thought-provoking. There's a lot to make fun of with regards to North Korea (as "The Interview" obviously does) but the regime's human rights abuses are well-documented and horrifying. I h
88.
by ievans 13y ago
This, absolutely. I kept pressing space and the right arrow key expecting the page to change.
89.
by ievans 14y ago
This is really cool. Perhaps you could add some indicator that a box is under force by one or multiple users - just arrows, or even a colored pattern representing stress by conflicting force vectors.
90.
by ievans 14y ago
FYI: there's a typo on the homepage screenshot: "you to to"

More ›