muldvarp

15 ms·

211.
by muldvarp 3y ago
I did research on parser differentials for my bachelor's thesis. My initial hope was that I would find a few mismatches for formats without a formal specification. I found mismatches for _every single_ pair of parsers I looked at and t
212.
by muldvarp 3y ago
Especially for things aimed at teenagers reddit is mostly replaced by Discord. This isn't a new development though and I doubt the API debacle had much of an impact on that.
213.
by muldvarp 3y ago
> You can still "do" a lot, but you still have to get another user with the token you want to interact with the page with your XSS to "do" what you want. You need to do this in both cases.
214.
by muldvarp 3y ago
> so all it takes is a little injected script If you can inject javascript, it's game over anyway. > HTTPOnly cookies are safe from XSS attacks. No, you can still do pretty much anything that cookie enables you to do. You just ca
215.
by muldvarp 3y ago
It doesn't sound like the author had to google for specific library methods (otherwise they wouldn't have had to think about the problem for a few minutes beforehand). It sounds like they genuinely couldn't figure it out (eve
216.
by muldvarp 3y ago
I don't think a "so-so programmer" would need to google to figure out how to select random lines from a file.
217.
by muldvarp 3y ago
What's the motivation for this problem if there is any? It's a really specific problem.
218.
by muldvarp 3y ago
Giving to "effective altruism" organizations as part of their effective "altruism" is so funny. Empowering "effective altruism" organizations because they think it's the most altruistic thing to do perfect
219.
by muldvarp 3y ago
> I wasn't following the case closely enough, but did the prosecution have access to Alameda source code, or was it only FTX? This blog post [0] contains screenshots of git commits that were used as evidence in the trial. It only sh
220.
by muldvarp 3y ago
Is front-running something you could/would do manually? The prosecution had access to the source code and git history of FTX.
221.
by muldvarp 3y ago
> * You can choose to use handles smaller than a pointer. Did you measure any performance improvements due to using small handles? I have a medium-sized project that uses a ton of `usize`s to reference elements in `Vec`s and would love t
222.
by muldvarp 3y ago
Prof. Kevin Buzzard got a research grant for formalizing FLT in Lean. https://twitter.com/XenaProject/status/1712488019016515662
223.
by muldvarp 3y ago
> "We're pretending security is not an issue." has been the feedback every time this is raised with the Cargo team. Do you have a specific link where I can read this response, because this is not at all the responses I hav
224.
by muldvarp 3y ago
Their comment specifically mentions that they're talking about _new_ software.
225.
by muldvarp 3y ago
> "out of bounds read = bad" even though realistically you can't do anything bad with it. I have absolutely seen more than enough exploits for "obviously unexploitable" vulnerabilties that I think the "out o
226.
by muldvarp 3y ago
It's reviewed by someone without any knowledge on the exploitable software. And even if it wouldn't take hours to even set up a testing environment, most CVEs don't include enough information to build an exploit anyway. No ne
227.
by muldvarp 3y ago
I don't think summarizing the criticality of a vulnerability as a single number is possible. Many vulnerabilities really are critical, but only to some users of a software that have some feature enabled (that might be disabled by defau
228.
by muldvarp 3y ago
> Humans use techniques like natural deduction to apply a series of transformations that do not lead to absurd results. All men are immortal. Socrates is a man. Therefore, Socrates is immortal. If you were to give a group of C
229.
by muldvarp 3y ago
"3.4.3 undefined behavior behavior, upon use of a nonportable or erroneous program construct or of erroneous data, for which this International Standard imposes no requirements" It is _very_ explicit. The following note is (as all
230.
by muldvarp 3y ago
The standard is explicit that the behavior of code with undefined behavior is well... undefined and that implementations can do whatever they want.
231.
by muldvarp 3y ago
Which part of the standard is ignored? Again, the standard is _very_ explicit about what undefined behavior means. If you don't like that you can either try to change the standard or use the numerous command line options provided by mo
232.
by muldvarp 3y ago
> The C standard leaves a lot "undefined" or "implementation defined" that is actually well-defined on a concrete machine the compiled code runs on. This assumes there is a one-to-one correspondence between C construc
233.
by muldvarp 3y ago
You have never changed the wording of anything you had written to make your intent clearer?
234.
by muldvarp 3y ago
> The standard joke is a joke, because it is wrong. No, it's a joke because it's _physically_ impossible but allowed. That said, clang and gcc are of course not antagonistic and don't make use of UB to anger their users. I
235.
by muldvarp 3y ago
> ignoring the fact that an array access is out of bounds and performing the array access This doesn't mean anything. The standard imposes no requirements that an array access is translated into a memory access by the compiler. And
236.
by muldvarp 3y ago
> One of those transformation detects that we are reading uninitialized memory and acts accordingly. This might be pedantic but variables do not have to correspond to memory locations. The compiler could decide to keep the variable in a
237.
by muldvarp 3y ago
There are enough high-performance languages without undefined behavior and I don't think they suffer heavily for it.
238.
by muldvarp 3y ago
> compiler-writers think UB is The current standard is _very_ explicit that undefined behavior is indeed undefined, i.e. "do whatever you want". > pretend it isn't UB, do it anyway, consequences be damned. This explicit
239.
by muldvarp 3y ago
> How useful is it to have a program that's very fast but entirely wrong? This only affects you if your program has undefined behavior, at that point your program was wrong anyway, you were just lucky that the compiler compiled it i
240.
by muldvarp 3y ago
> The idea of C as a portable assembler is not without its problems The main problem is that C is not a "portable assembler". You mainly argue that it should be, but it simply isn't (and hasn't been for a long time if

More ›