pifflesnort

40 ms·

301.
by pifflesnort 14y ago
> Wayne here. We're extremely proud of the work that the team here at Crashlytics has put into our crash reporting solution. Can you explain why you're using headers for private data structures from the Mac SDK on iOS, while also stat
302.
by pifflesnort 14y ago
I would suggest also reviewing Google Breakpad. They've added iOS support, and while I haven't reviewed it first-hand, the I do know that the Google Breakpad developers don't fool around. I do not wish to steal the OP's thunder, in that I w
303.
by pifflesnort 14y ago
Mach exceptions aren't the "holy grail", they're private API on iOS. That is why nobody is using them. If you want Mach exception handling, it should only take a couple days (if that) for a qualified engineer to implement, of which there ar
304.
by pifflesnort 14y ago
These sorts of people have every incentive to target those more likely to be willing to serve as grist for their mill; young, idealistic, inexperienced individuals that will take the bait. Never mind that most of them will fail, or that the
305.
by pifflesnort 14y ago
Another link, with disassembly and a patch: https://twitter.com/landonfuller/status/297592929923502080
306.
by pifflesnort 14y ago
Usury that is enforced by the state is (or ought to be) a privilege, not an inalienable right. Both sides share responsibility.
307.
by pifflesnort 14y ago
> The YAML vulnerability was not from any 'eval' in the YAML library itself, you realize, right? > It was from allowing de-serialization to arbitrary classes, when it turned out that some classes had dangerous side-effects merely fr
308.
by pifflesnort 14y ago
> I'm not sure that means anything. In an OO language, you are always de-serializing into objects, and objects are always 'executable code'. Hashes and Arrays are executable code too, right? No. You're conflating code and state (which w
309.
by pifflesnort 14y ago
> Overall, reduce the number of people that use Ruby/Rails, if that is your intent? Given the number of comments you've made to that effect versus the number of folks using Ruby/Rails, I'd suggest you have a very long battle in front of
310.
by pifflesnort 14y ago
My point is simply that without signatures, there is no means of verification. Having the code isn't enough.
311.
by pifflesnort 14y ago
> It may not be as cathartic for you, but I'd suggest toning it down to "reasonable human being" level in the future. The Rails community has exhibited such self-assured, self-promotional exuberance for so long (and continues to do so
312.
by pifflesnort 14y ago
> You might have said "Yes, I am aware of all these three things. An experienced engineer ought to have said "this is a perfect storm, and it is wrong that YAML can instantiate objects from any class, and there will be a vulnerabili
313.
by pifflesnort 14y ago
> Any sufficiently advanced serialization standard ... it is often going to get instantiated via calling a zero-argument constructor and then firing a bunch of setter methods. Yes, this is always a bad idea. It's actually in a similar
314.
by pifflesnort 14y ago
> Is that seriously what happened? Surprisingly, yes: https://github.com/tenderlove/psych/issues/119 And the RubyGems folks are trying to handle this with whitelisting specific classes that the YAML parsing will still be allowed to in
315.
by pifflesnort 14y ago
This doesn't do any good if it's not required/used, which it's not. As a counter-example, the maven central repository requires signatures, and caching Maven repositories validate those signatures.
316.
by pifflesnort 14y ago
The "everybody has bugs" response is intellectually dishonest. Yes, everybody has bugs, but most people's bugs aren't an intentional feature that a trained monkey ought to have known was a bad idea. - Someone implemented a YAML parser that
317.
by pifflesnort 14y ago
> I don't think the RubyGems people were incompetent. They sat on a publicly disclosed vulnerability in the YAML parser for a week. The YAML parser itself was ridiculously designed to (essentially) eval() YAML. Those were the two acti
318.
by pifflesnort 14y ago
If these things can print money, then they're worth $200-300k. If they can't, then they're not worth $1.k/ea.
319.
by pifflesnort 14y ago
China appears to be engaging in highly sophisticated attacks of the like that major companies need to be aware. The RubyGems fiasco is the result of remarkably incompetent decisions by everyone in the chain of control. The lessons are compl
320.
by pifflesnort 14y ago
It's a tipping point, but not of the kind that they thought.
321.
by pifflesnort 14y ago
This is exactly what I'm wondering. Are there adults in the Ruby community? The vulnerability itself is simply ridiculous: https://github.com/tenderlove/psych/issues/119 The response from the Gem folks has betrayed a serious lack of exp
322.
by pifflesnort 14y ago
> However, publishing database.yml on pastie is TOTALLY 100% NOT COOL ... This whole thing is a joke, from the ridiculously unsafe YAML parser to the response of the RubyGems people. If these are your community social norms, then you
323.
by pifflesnort 14y ago
$100K is nothing for the kinds of profit numbers I'm seeing here.
324.
by pifflesnort 14y ago
> Presumably they want to sell much more than 300 devices (enough that running them themselves would be less efficient than selling them) That still doesn't make sense to me. If these machines work, they're money trees. You build them
325.
by pifflesnort 14y ago
300 at 100 a day is $30k/day. If they're selling them for $1.3k, let's assume a 50% markup; it would only take about 6 days to make back their investment. 12 days if they're selling them at cost. I don't really follow the maths here.
326.
by pifflesnort 14y ago
> It shows you the exact lines, and break down where it happens. So they support DWARF and backtraces. Just like everyone else. > What you showed isn't even important. Yes, exactly.
327.
by pifflesnort 14y ago
They're very big on polish and claiming to be awesome, but it's all smoke and mirrors and gamesmanship. Drill down on a crash for example: https://d1f4seebrc9wq7.cloudfront.net/blog/wp-content/upload... All the information provided at the