jjnoakes

72 ms·

781.
by jjnoakes 9y ago
A person who can destroy servers is no more indispensable than an employee who can destroy a physical office.
782.
by jjnoakes 9y ago
There are more choices than malloc/free vs gc.
783.
by jjnoakes 9y ago
Regardless of any of this, the person didn't attack anything. I'm not saying my position on whether the fork was right or wrong, but I think folks on either side should not characterize that incident as an attack.
784.
by jjnoakes 9y ago
Can you really call the person an attacker when they simply used the contact as-written? I think that's spinning things a bit to fit a narrative.
785.
by jjnoakes 9y ago
$331b, not $400b. And the article talks about ways to pay for it. You just have to read to the end is all...
786.
by jjnoakes 9y ago
"cheaper binary test" shouldn't be the way to decide though.
787.
by jjnoakes 9y ago
They do if you set them up right.
788.
by jjnoakes 9y ago
Read page 6: "To extrapolate the study on humans, ghrelin levels were measured in male subjects after drinking any of the aforementioned beverages, in addition to CW (no caloric content, no sugar)."
789.
by jjnoakes 9y ago
When you have prior knowledge about what X does (deletes evidence) and there's no reason to say "the password is not X" other than to trick someone into trying X as the password, that's how.
790.
by jjnoakes 9y ago
> That is literally the definition of hypocrisy; the behavior of people who do things that they tell other people not to do Except I'm not saying that at all. I said it's fine to use unwrap() or expect() if you want script-like
791.
by jjnoakes 9y ago
In the context of this article and discussion, panics via unwrap (or better, expect) is a fine answer, and I'm not sure why you think it is hypocritical to suggest it, especially to Rust newcomers who are looking to write script-like p
792.
by jjnoakes 9y ago
How do you know all parties involved in this discussion are experienced?
793.
by jjnoakes 9y ago
How so? We aren't talking about strcpy(), just strcmp(), and all the strings in question should be nul-terminated (if they aren't then mem* routines should be used and more length checks would be needed; there are also timing atta
794.
by jjnoakes 9y ago
> also it's the "safer" version of strcmp when used with n calculated another way This isn't true; first off it isn't "safer" than strcmp() at all (this isn't strcpy vs strncpy after all), and seco
795.
by jjnoakes 9y ago
> unwrap [...] causes application level crashes in way that is very much easier to avoid in other languages Unwrap does what just about every other language with exceptions-by-default does: it prints out a message for developers and exit
796.
by jjnoakes 9y ago
> At what point does it become reasonable to conclude that strncmp, and every other string API that treats the pointer to the string and its length as separable variables, are too dangerous to be used in security-sensitive software? In g
797.
by jjnoakes 9y ago
> The bug is that they used strncmp, but used the length of the incoming hash from the client as the string length to compare, versus the actual length that the hash string is supposed to be. Ignoring timing attacks, they should have use
798.
by jjnoakes 9y ago
You don't want to use strncmp() for this; aside from the timing attacks it opens up, using strncmp() for these kinds of comparisons implies that the operation you are performing is "string a is a prefix of string b" (or vice-
799.
by jjnoakes 9y ago
> your 'safe' language then happily crashes and burns everytime something goes wrong I'm not sure why you put 'safe' in quotes here; nothing about 'unwrap()' (or even 'panic') is unsafe in the
800.
by jjnoakes 9y ago
What ambiguity?
801.
by jjnoakes 10y ago
You should have set up post office address forwarding and had your replacement card sent to your original address so it could have been forwarded.
802.
by jjnoakes 10y ago
Blow the whistle anonymously. Let people know which site it is.
803.
by jjnoakes 10y ago
> I would caution against being offended without confirming the intent and/meaning behind the statements. Which is why I merely replied with "I don't know why you think this has anything to do with lack of intelligence.&qu
804.
by jjnoakes 10y ago
> Note that "find someone smarter" doesn't necessarily mean "you are stupid". It does imply that further discussion with this person on this topic will be pointless though. It also implies "Someone smarter w
805.
by jjnoakes 10y ago
> then that person is not worth talking to That's a highly charitable reading of what was written. I responded to only part of the comment because only part of the comment offended me: "I'll find someone smarter." Sur
806.
by jjnoakes 10y ago
Where did I say I thought you were stupid?
807.
by jjnoakes 10y ago
I don't know why you think my reply is a joke. The person I replied to basically said (paraphrasing) "compilers which optimize based on undefined behavior and follow the standards are written by idiots", and I don't thin
808.
by jjnoakes 10y ago
Why would they choose the more expensive one?
809.
by jjnoakes 10y ago
I don't know why you think this has anything to do with lack of intelligence.
810.
by jjnoakes 10y ago
I think if you had a way to enable warnings about deleted code you would be flooded with warnings from macro expansions, function inlining, template instantiations, and other valid and desirable optimizations.

More ›