nneonneo

56 ms·

931.
by nneonneo 7y ago
Many PNG readers that I've tested do verify the CRC-32, but there are obviously many that don't. Verification chews up cycles that are useless 99+% of the time, and for PNG, verifying a chunk's CRC32 would delay decoding if t
932.
by nneonneo 7y ago
I publicly reverse-engineered a cute bit of C code many years ago that employs some of these tricks: https://stackoverflow.com/questions/15393441/obfuscated-c-co... It's a digital clock (which has to be compi
933.
by nneonneo 7y ago
In general, most compressed file formats don't even bother to be resilient against errors, since error correction mostly runs against the point of compression (to make files as small as possible). Some file formats do have error detect
934.
by nneonneo 7y ago
I propose that names be considered more like probability distributions. For example the name “red” has a probability distribution that probably peaks in the neighbourhood of #FF0000 but includes a large range of colors; the distribution of
935.
by nneonneo 7y ago
Intel SGX is really a big gift to security researchers, second only to speculative execution and friends. Intel is selling it as a way to keep secrets safe inside the processor against attackers with root/hypervisor software access or
936.
by nneonneo 7y ago
But bpf(2) isn't the only entry point for bpf filters in the kernel. Unprivileged user programs have access to the SOL_SOCKET SO_ATTACH_FILTER sockopt, as well as the PR_SET_SECCOMP SECCOMP_MODE_FILTER prctl. Now, these take cBPF progr
937.
by nneonneo 7y ago
Unprivileged processes can load bpf filters though - they can attach filters to sockets or load seccomp syscall filters, to name two examples. Just because it is a sandbox doesn’t mean that loading and executing user-supplied code in kernel
938.
by nneonneo 7y ago
Python "knows what it's doing" in the sense that it guarantees that it checks return values from write() and has an exception mechanism to ensure that errors aren't accidentally ignored. Therefore, they can get away with
939.
by nneonneo 7y ago
The suppression of SIGPIPE was done in the Go code, not in the Python code. Does the POSIX standard mandate that programs receiving EPIPE/SIGPIPE die silently? I don’t know of such a rule, and there’s plenty of programs that violate th
940.
by nneonneo 7y ago
This article promotes bad practices for dealing with SIGPIPE. 1. Closing stderr in Python is not a good idea because that’ll swallow any other errors that occur at exit. Redirecting stdout to devnull is really just a way to prevent the flus
941.
by nneonneo 7y ago
This is also compiled without optimizations which makes fastcall look less efficient. In practice fastcall is usually much leaner when you’re not having to store the arguments to the stack.
942.
by nneonneo 7y ago
The Web Coffee API ( https://github.com/luruke/browser-2020#web-coffee-api ) is my favorite of the bunch. I definitely recommend checking out the linked WHATWG documentation, as well as the relevant RFC for the HTTP prot
943.
by nneonneo 7y ago
Apple is in a bit of an odd place right now with respect to development and end-user programming. Ever since they released Swift Playgrounds they’ve seemingly decided to be much nicer to programming apps. Pythonista is probably the most pro
944.
by nneonneo 7y ago
The biggest problem is that iOS completely bans executing native code that isn’t code signed, with the sole exception of the Safari JIT (and possibly Swift Playgrounds - not sure how that works). There’s weird hacks to get around this, e.g.
945.
by nneonneo 7y ago
Ah, nomenclature fail on my part. You're right, it's LLVM. This is an LLVM bug - it affects C code too (when it should only apply to C++). If you compile this code: static void die() { while(1) ; } int main() { die(); }
946.
by nneonneo 7y ago
The posted program is one instruction too! main: ud2 (ud2 is a permanently illegal instruction on x86)
947.
by nneonneo 7y ago
The worst is behind China because they've instituted heavy lockdown measures beyond what would be acceptable in the US, and enacted emergency measures like constructing temporary hospitals and isolation centres. They're still un
948.
by nneonneo 7y ago
My "favourite" recent compiler bug comes from Rust. Compile the following code in Release mode: fn main() { (|| loop {})() } This defines an anonymous function containing an infinite loop, and calls it. Any sane compiler
949.
by nneonneo 7y ago
There was a CTF this weekend (UTCTF) featuring a task to exploit a program running in a secure SGX enclave. As part of solving that task I spent some time looking into the design of SGX, and I gotta say it doesn’t sound promising. The basic
950.
by nneonneo 7y ago
I’m not convinced that the eye is conclusively better than any camera out there. The human brain is incredible at stitching together visual input into a coherent view of the world. The retina has high resolution but covers an incredibly sma
951.
by nneonneo 7y ago
The best part about this cycle is that developers can always point to some metric which shows improvement to justify their actions, resulting in an Escher-like loop where they think they’re always going up. These cycles pop up all the time
952.
by nneonneo 7y ago
It’s all about raising the bar for mishandling. Sure, if an unethical handling company messes up your shipment they could go at it and try and reset the indicator(s), but they could also just get the job done right and not risk getting sued
953.
by nneonneo 7y ago
Some considerations: these packages have a very strong adhesive on the back which is hard to remove without damaging the package or surface; they have unique serial numbers (barcoded on newer versions under the bubble packaging) so that the
954.
by nneonneo 7y ago
A saner design would have been to split that API up, e.g. “killgrp” to kill groups of processes by whatever identifier (current process group, foreign process group, all processes, etc.). This way, your intent is encoded in the function you
955.
by nneonneo 7y ago
System calls can return them separately, but don’t have to. On Linux a failing syscall returns -errno; the syscall wrapper assumes any return value in the range -1 to -4095 is an error, stashes the positive error number in the C errno var
956.
by nneonneo 7y ago
Meanwhile, the ancient Maytag fridge in our lab has been going for probably 20 years without fault (fingers crossed). I know there’s probably some survivorship bias, but it really does feel like appliances aren’t built to last anymore.
957.
by nneonneo 7y ago
Why is it hard to calculate? Suppose I maintain lots of complex calculations that require variable amounts of buffered measurements (e.g. the last few seconds, the last few minutes at lower resolution, some extrapolations from measurements
958.
by nneonneo 7y ago
The more I look at platforms like Twitter and Facebook, the more I start liking the WeChat “anti-viral” timeline concept. Posts on your WeChat timeline show only likes from your friends. This applies even on posts from other people - you ca
959.
by nneonneo 7y ago
Exactly this. A single person can put up 50 yard signs. Seeing 50 signs for a candidate just means there’s someone really enthusiastic about that candidate (or paid by them), it’s not automatically an indicator of wide support. On the other
960.
by nneonneo 7y ago
Yeah, I remember this. It requires setting up a custom signal handler though. IIRC something similar is used to get system/library calls (which also can’t be expressed purely with mov instructions, normally). If I recall correctly tom7

More ›