munin

78 ms·

361.
by munin 11y ago
> They don't exist to serve "national security interests" Yes they do. From their website: "The Software Engineering Institute (SEI) is a not-for-profit Federally Funded Research and Development Center (FFRDC) at Carn
362.
by munin 11y ago
what property would you prove, though? you could create a memory safe program that does not provide anonymity. how do you represent "anonymity" in the proof system?
363.
by munin 11y ago
> Say, on the other hand, that we'd have confirmed reports about zombies (or evil commie nazi aliens) seriously? so you read a piece whose thesis is "talk rationally and empathetically with people that hold different points of
364.
by munin 11y ago
no, this is static and compile time while valgrind is dynamic and run time. also, the rules for the failing states for valgrind are specified ad hoc in tool code while properties of programs checked by frama-c are user extensible via the sp
365.
by munin 11y ago
this is a really cool read, well put together and very thorough, but near the end the author betrays a startling amount of naïveté: > Considering how simple the PoC is, I hope it's clear that in order to be able to exploit a vulnera
366.
by munin 11y ago
ownme.ipredator.se http://trust-in-soft.com/polarSSL_demo.pdf
367.
by munin 11y ago
in some ways it probably doesn't matter - if you are an otherwise safe driver that lives in a county full of side-swiping jerks then your rates will go up because you're a higher risk to the insurance company than a safe driver th
368.
by munin 11y ago
Today, in academia, it's considered risky to do research in computer vision, machine learning, or speech processing, for example, because it's likely that you will get "out-Googled". Google probably has an entire team of
369.
by munin 11y ago
what's ironic is that (as far as I remember my history) Yardley went public because he was angry that the USG shut down the Black Chamber, putting Yardley out of a job. Incidentally, that shutdown was effected by Secretary of State
370.
by munin 11y ago
> 4. A Ph.D on your resume often makes you look like a poor self-learner. This doesn't make any sense because after writing a dissertation, you have by definition learned something that no one else knew, therefore, no one could have
371.
by munin 11y ago
Even if it did (which I don't think is true) you're still doing a radically different job with a radically different exit plan - as an adjunct, you have the sliver of hope that you can get out and get a job doing research. As a K-
372.
by munin 11y ago
> By comparison, the median income for a person with any bachelor's degree is about $50,000 Yes, but if you have a PhD, in a field like CS (which is what we were talking about), these numbers are crazy. Why would I take a job teachi
373.
by munin 11y ago
Formal methods and verification, analysis, compiler technology, type systems, concurrency, and education. Why?
374.
by munin 11y ago
I've investigated that. Two problems: 1. Your PhD is not a credential that will get you a K-12 teaching job. You need a certificate that usually accompanies a Masters program in K-12 education. That's right, it's back to grad
375.
by munin 11y ago
> if there are more opportunities and better pay? Frequently there aren't. The subject of this article is an artist, so cue your STEM lord "do you want fries with that" jokes now. However, this can occur even in fields li
376.
by munin 11y ago
being forced to pray at school events is pretty simple, the teacher asks "why aren't you praying?" and sends you to the principals office. nobody within a 200mi radius of you thinks that there is anything wrong with this beca
377.
by munin 11y ago
ptrace is not an easy way to do this... if you try and make an anti-virus or HIPS system based around ptrace you're going to have a very bad day (it's slow, attackers can detect it) the "normal" way this was done was to
378.
by munin 11y ago
process monitor doesn't work by intercepting system calls, there's a specific API. it's co-operative.
379.
by munin 11y ago
Windows doesn't allow you to "just intercept syscalls" and hasn't for about eight years.
380.
by munin 11y ago
yeah, except there's a solution to "trusting trust" : http://www.dwheeler.com/trusting-trust/
381.
by munin 11y ago
Type checking is static analysis. Languages like C have crappy type systems, so the type checking static analysis is also crappy. This is a property of the type system, not the universe...
382.
by munin 11y ago
What if your type system was rich enough that a "datatype error" was a logic error?
383.
by munin 11y ago
> You make it sound like people don't implement static analyzers from scratch for every static language out there. Yes, except those static analyzers are the compilers for those languages and the rules that define crappy programs ar
384.
by munin 11y ago
like communism?
385.
by munin 11y ago
this is control flow integrity, it's in windows 10 now as a technology called "control flow guard".
386.
by munin 11y ago
when you pronounce them, sure, but why capitalize them like an acronym, but mis-spell the acronym?
387.
by munin 11y ago
> I have seem so many kludges connecting SIPPER and NIPPER networks I don't know how much I trust someone who can't even get the acronym for SIPR and NIPR right ( https://en.wikipedia.org/wiki/SIPRNet http
388.
by munin 11y ago
if DoS was the only problem we had to worry about, we would have won.
389.
by munin 11y ago
> What is the meaning of this work?, I couldn't get that in my very quick glance at this work. you are aware that this document, being a phd thesis, is the result of years of original research and writing, right?
390.
by munin 11y ago
it turns out that every system we've ever devised has had a limit on the amount of time the input is allowed to run, so this really seems more like a matter of degrees. this is also only an "attack" if the availability of the

More ›