munin

58 ms·

511.
by munin 12y ago
And it's not arrogant to say "it's too hard"?
512.
by munin 12y ago
When you say "I don't think it's worth the effort for everybody", that's exclusionary, and totally counter the tone of the article, so I don't think your comment belongs in the thread about this article.
513.
by munin 12y ago
> decided not to have firm answers right now I'm remembering this for the next question my boss asks me...
514.
by munin 12y ago
> If the government decided to fund maths PhDs directly, they'd need a ready-made corpus of people who could decide who gets funding. They'd need people who have published and who have proved that they know what they're ta
515.
What is memory safety?(pl-enthusiast.net)
80 points by munin 12y ago|5 comments
516.
by munin 12y ago
Slight disagree, the article has a section where they wonder at a lack of research on education and programming in academia.
517.
by munin 12y ago
It's hard to disagree with a statement like "learning inherently must be done by the learner", because what are the instructors to do, stick their hands into the minds of a student and place the knowledge there? However I thi
518.
by munin 12y ago
as an aside it's kind of interesting why there isn't as much research on teaching programming as their is say on refinement types, separation logic or pointer aliasing. I think the reasons are annoying. In academic research, nobod
519.
by munin 12y ago
Trail of Bits is hiring. We’re working on many funded research projects focusing on software security, program analysis, compiler construction, trusted computing and network security. We also have a commercial product for automated enterpri
520.
by munin 12y ago
actually that story is the opposite of true. John Regher and CSmith fuzzed CompCert and they found no bugs. from the csmith PLDI paper: "The striking thing about our CompCert results is that the middleend bugs we found in all other com
521.
by munin 12y ago
> Trust is easily obtained, but very difficult to regain once lost. I don't believe you. People still shop at Target, people still use Heartland payment processing systems, people still use Comodo and Verisign as digital certificate
522.
by munin 12y ago
We could do this right now and sell it as an app http://www.mimisbrunnr.net/~munin/blog/apps-for-privacy.html
523.
by munin 12y ago
> but we all know how it ends... billion dollar companies?
524.
by munin 12y ago
I think HNs idea of old fashioned police work is a Victorian Bobby interrupting a back alley mugging by saying "wots all this then", and anything else is Stalinist
525.
by munin 12y ago
IME it's less about the content leaking and more about an anonymous party making weird edits to the document and you not noticing
526.
by munin 12y ago
Now the Chinese hackers will have no choice but to go to the security conferences in Asia. All of them are way better than Defcon though, so who is really losing?
527.
by munin 12y ago
> Turing-complete and thus capable of mischief. because something is "Turing-complete", does not imply it is capable of mischief. something can be capable of mischief, yet not "Turing-complete."
528.
by munin 12y ago
> you upgrade your compiler, and you see some mysterious new backtraces showing up in the crash reporter, then it's entirely possible your compiler is buggy. IME, there are two more likely causes of this, that are kind of rooted in
529.
by munin 12y ago
Attitudes like this are why stories like this still happen in 2014.
530.
by munin 12y ago
How does what you say square with the evidence that klee found a bug in OpenSSL which is about as real world as it gets?
531.
Using Clang to Identify Heartbleed(blog.trailofbits.com)
7 points by munin 13y ago|0 comments
532.
by munin 13y ago
nice!
533.
by munin 13y ago
I don't think so, there have been bugs in ghc before, the problem would be a bug in ghc that emits code that crashes.
534.
by munin 13y ago
friends of mine have still segfaulted mlton-compiled SML programs. as I understand it, you need to have a bisimulation-based proof that shows equivalence in states between ML and x86, and as far as I know that just hasn't been done. un
535.
by munin 13y ago
> if a program compiles one can know that it will never crash that is not true, you need much stronger guarantees than just typechecking gives you. you also have a large wodge of native code for the runtime that is not written in the str
536.
by munin 13y ago
you might be interested in this work: http://research.microsoft.com/pubs/176601/js-star.pdf
537.
by munin 13y ago
they still do, but everyone (including the windows DDK) offers a "secure memset" that casts to volatile and preserves the call. in Windows, it's called RtlSecureZeroMemory and I would think that know about this would be one o
538.
by munin 13y ago
yeah but the state police can examine a crash after the fact to determine a brake line was cut. even if the software survives a high-speed crash, it's possible for the surreptitiously placed modification to erase itself as its final ac
539.
by munin 13y ago
> Build almost everything on top of the STL and Boost, which are safe. this is not really true, you can have temporal memory safety issues using STL and boost.
540.
by munin 13y ago
cool! would you be okay if someone hacked your computer and posted all of your e-mail to the public?

More ›