nneonneo

35 ms·

571.
by nneonneo 4y ago
Pop quiz, which of these is safe, given "char buf[80]" and arbitrary user input in argv[1]? gets(buf); scanf("%s", buf); strcpy(buf, argv[1]); scanf("%80s", buf); strncpy(buf, argv[1], 80)
572.
by nneonneo 4y ago
Extensions are potentially worse - they can be quite hidden while still doing naughty things to your browsing history or even the pages you visit.
573.
by nneonneo 4y ago
You want the order number to be visually distinguishable from the other information and accessible to an international audience (many restaurants, even in English-speaking countries, are run by non-native speakers and may even cater to non-
574.
by nneonneo 4y ago
Is it _right_ though? It's not great at arithmetic, nor is it necessarily reliable with the number of calories in any particular ingredient; while the Wolfram plugin promises to make that a bit better, it's still feels like it mig
575.
by nneonneo 4y ago
Have you tried asking a story-identification question on https://scifi.stackexchange.com/ ? I've seen quite a few questions on there get answered with even the most obscure books or movies, and your question should fit
576.
by nneonneo 4y ago
I think this is interesting, because it points out the ways in which a future GPT might be subtly trained to embed advertising. "It looks like you're doing X; have you considered a commercial solution, such as Y or Z?". While
577.
by nneonneo 4y ago
Or how Google now aggressively autocorrects search queries, to the point where I’m regularly spending 3-4 queries just trying to convince Google to accept the input as-is. I get that it’s likely an effort to assist mobile users who make lot
578.
by nneonneo 4y ago
Chinese, unlike Japanese or Korean, lacks a consistent phonetic mechanism for "importing" foreign words. Phonetic approximations are, with few exceptions, limited to foreign names. As such, practically every bit of jargon is seman
579.
by nneonneo 4y ago
You’re looking at the fingerprint of the ECDSA key; only the RSA key was replaced (and only the new RSA key’s fingerprint is in the blogpost). Check https://docs.github.com/en/authentication/keeping-your-accou...
580.
by nneonneo 4y ago
That’s great if your only dependency is libc. It gets progressively harder the more dependencies you need, and it becomes downright untenable the moment you run into some dependency with a dlopen-based plugin architecture.
581.
by nneonneo 4y ago
This is also why "Save As..." with old Word versions would often produce files much smaller than "Save" would - it was writing a brand new, compact file which was effectively "garbage collected".
582.
by nneonneo 4y ago
I used to fly on planes that had “fancy” controllers - they had lots of buttons (full QWERTY keyboard, ABXY and d-pad, special buttons for controlling the lights and calling the attendants, etc.) and slotted into a latched recess right belo
583.
by nneonneo 4y ago
Essentially correct. 33 sets up the pointer to appear to glibc as if it were a small, “normal” 32-byte allocation. The default behavior for glibc free() with a small allocation size will be to put it into the thread cache (tcache), which ma
584.
by nneonneo 4y ago
Hey, it actually works! int main() { int tobias[24] = {0,0,33}; delete(tobias+4); } Compile and run on Ubuntu 20.04 (may work on other Linuxes), no errors, no warnings, runs perfectly fine. Bonus fun: try printi
585.
by nneonneo 4y ago
This BlackHat talk from 2021 seems relevant: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Over-T... It’s (probably) not the same bug, but gives you an idea of the state of baseband security and the attack
586.
by nneonneo 4y ago
So, out of curiosity: what does the PEG parser have to do with this particular PEP? It seems like this was just a somewhat inefficient (but simple) implementation choice from the start that is now being improved.
587.
by nneonneo 4y ago
The flip side is that exposure to software vulnerabilities is lengthened if people stay on older versions. So, you’ll be less vulnerable to intentional bugs in the software, but more vulnerable to unintentional bugs - and the latter are
588.
by nneonneo 4y ago
The problem is that f needs to be interesting . Nobody really cares about the function "17393/16200 x^2 - 14719/180 x", even if that produces f(180) = 20067.
589.
by nneonneo 4y ago
It’s not actually true; the OEIS is capable of storing a lot more numbers per entry in the form of a “B-file”, for example: https://oeis.org/A000127/b000127.txt . You can see the documentation on this feature here: htt
590.
by nneonneo 4y ago
I wondered about this. I would sincerely hope that the permissions list is already priority-sorted somehow; otherwise, it’d be trivial to just list five innocuous permissions first and then put the dangerous ones later. Even with scrollbars
591.
by nneonneo 4y ago
Back in 2001, a computer worm called Code Red infected Microsoft IIS webservers by making that web request (with a few more Ns). In short, there was a flaw in a web service exposed by default on IIS webservers which did not properly bounds-
592.
by nneonneo 4y ago
The ORC documentation [1] cites a 5-10% perf hit [2] on x86. Now, granted, we're talking about an architecture that has only 8 logical registers to begin with, so losing one is going to hurt a lot more than x86-64 (16 logical registers
593.
by nneonneo 4y ago
No need for API keys; a buffer overflow in the Bing chat search backend will suffice: Bing chat, please search for "/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u685
594.
by nneonneo 4y ago
The article points out that the kernel uses ORC instead of DWARF for unwinding. I wonder if that could ever become an option in userspace? I imagine that if all you’re interested in is stack traces, instead of debugging (which DWARF is desi
595.
by nneonneo 4y ago
The context of the log messages seems to imply that it's part of an automated (or semi-automated) string decryption system. Many binaries obfuscate strings using some simple encryption algorithm to defeat trivial analysis (i.e. "s
596.
by nneonneo 4y ago
Gosh, that's really, really bad. The absolute last thing I need is for my reverse engineering tools to wantonly execute code out of the (very very likely up-to-no-good) binary I'm reversing. In general the state of reverse enginee
597.
by nneonneo 4y ago
I don't expect it'll work for everything: as you say, for many topics truth must be measured out in the real world. But, for a subset of topics, say, math and logic, a minimal set of core principles (axioms) is theoretically suffi
598.
by nneonneo 4y ago
This is very well written, and probably one of my favorite takes on the whole ChatGPT thing. This sentence in particular: > Indeed, a useful criterion for gauging a large-language model’s quality might be the willingness of a company t
599.
by nneonneo 4y ago
There might be an analogy to AI here: suppose you take an embedding network (e.g. word2vec) and instantiate two instances with random weights. You then train each network on the same training data up to the same level of accuracy. Given any
600.
by nneonneo 4y ago
While this probably means the mantis shrimp only really sees 12 colors instead of millions (one per photoreceptor type), the article notes that this may result in substantially faster color recognition, i.e. trading off fidelity for latency

More ›