staticassertion

220 ms·

1. 3331.▲
   by staticassertion 6y ago

   My point is that ASLR makes assumptions about the attackers capabilities. All good mitigations do. If the attacker has "I can run nearly arbitrary computations on within the processes memory space", that is outside of the model th
2. 3332.▲
   by staticassertion 6y ago

   It's not totally true that attackers have found ways bypass mitigations. In many cases the attackers require entirely new capabilities, or separate vulnerabilities, to get around a mitigation. And in some cases it makes an attack st
3. 3333.▲
   by staticassertion 6y ago

   Oh yeah, I completely glossed over the whole shadow/safestack mitigation. Thanks.
4. 3334.▲
   by staticassertion 6y ago

   It's a mitigation for a software exploitation technique called Return Oriented Programming (ROP). The mitigation is referred to as 'Control Flow Integrity' (CFI). https://software.intel.com/content/www&#x
5. 3335.▲
   by staticassertion 6y ago

   My statement is that I do not believe that Google is well run today, or in the recent future, and that OKRs are part of that. I believe that their position is not earned through strong organizational structure in recent years, but that they
6. 3336.▲
   by staticassertion 6y ago

   I don't think I know of a company that has really nailed being well run at scale, I can maybe think of a few that I don't want to name but they aren't in tech anyway. But I have a very limited view, having lived in SF for a f
7. 3337.▲
   by staticassertion 6y ago

   My personal opinion is that Google has some really strong engineers, and some pockets of engineering are truly exceptional. That is it. The impression is based on lots of anecdotal experience. I know many people at Google, I use many Google
8. 3338.▲
   by staticassertion 6y ago

   I don't know. I don't feel that I have to know to make the statement I made.
9. 3339.▲
   by staticassertion 6y ago

   I don't know that they're a fantastic engineering company. I don't know what Google is great at - a few things, which feel like they're successful almost because they're treated as separate from the rest of the orga
10. 3340.▲
    by staticassertion 6y ago

    Google seems terribly run, frankly. I wouldn't use them as an example of good process, organization, or really anything other than that being early to advertising and being the internet's front page for ~20 years is a great way to
11. 3341.▲
    by staticassertion 6y ago

    OK, so what is it saying?
12. 3342.▲
    by staticassertion 6y ago

    > because it most likely is Is this not you making a prediction, the very sentence after saying one can not predict the future?
13. 3343.▲
    by staticassertion 6y ago

    The power of propaganda is that it's easily digestible. Spending 8 hours reading propaganda requires far less effort than the 1 hour to read something informative or challenging.
14. 3344.▲
    by staticassertion 6y ago

    Based on what's on my existing system I think I could benefit from ~1TB of memory. Above that I'd have to probably try. After maybe ~200GB I bet I'd start to see seriously diminishing returns. My servers could probably benefi
15. 3345.▲
    by staticassertion 6y ago

    I imagine that in C if the compiler can prove that two pointers don't alias than it can elide a load?
16. 3346.▲
    by staticassertion 6y ago

    And this is why we need bounds checking.
17. 3347.▲
    by staticassertion 6y ago

    Audit hooks have a different use case. Here, in this article, we see described a way to package up the interpreter as part of the payload . This is very traditional malware, they 'bring their own binary' so to speak. A much more
18. 3348.▲
    by staticassertion 6y ago

    For what it's worth Go is also gaining traction, from what I can tell. Malware authors do not appear to be particularly afraid of trying new languages.
19. 3349.▲
    by staticassertion 6y ago

    I think you're talking about something very different, which is attacking Python's supply chain. This is talking about malware payloads themselves. I don't agree that those capabilities (taking screenshots, especially eval) a
20. 3350.▲
    by staticassertion 6y ago

    That does seem abnormal, you should see a doctor.
21. 3351.▲
    by staticassertion 6y ago

    I think the tricks are more like "use dynamic dispatch instead of static dispatch". O1 vs O3 is probably a fair way to do things. Some people will do that for debug builds, to get a mix of reasonable performance (for tests) and re
22. 3352.▲
    by staticassertion 6y ago

    The compiler is slow at building code. It's much, much faster at checking it.
23. 3353.▲
    by staticassertion 6y ago

    > I keep reading in Rust surveys that Rustaceans just don't care that much about compile times enough to prioritize improving them. Confusing since this is, to my knowledge, a top 3 issue just about every year. That said, I think Ru
24. 3354.▲
    by staticassertion 6y ago

    Does it provide copy on write semantics? I wasn't aware of that being the case.
25. 3355.▲
    by staticassertion 6y ago

    A week? Might make sense to refactor, or just clone the data? Or ask the subreddit, discord, or whatever place you want for help. I haven't run into a borrowchecker issue that took me more than a few seconds in a few years. The trick i
26. 3356.▲
    by staticassertion 6y ago

    I'm on an intersection with caltrain, muni, and a freeway, but of course it can only be so informative. I'm not trying to say "Buses and trains aren't a problem" at all, I'm saying fuck motorcycles.
27. 3357.▲
    by staticassertion 6y ago

    Yeah, I do imagine it depends a lot on where you are. Even a few blocks from here the Caltrain can get much louder.
28. 3358.▲
    by staticassertion 6y ago

    I live outside Muni/Caltrain. They're not great, noise-wise, but the motorcycles are 10000x worse. I get a number going by a day, and I just can't understand why they're allowed to be so absurdly loud. Buses/trains
29. 3359.▲
    by staticassertion 6y ago

    Cool! Sounds like a good idea. A key stretcher is probably a good idea too if you haven't done so. Given that this is local only, you can go pretty nuts on the key stretching. For example, on a server I'd say >100K rounds of PB
30. 3360.▲
    by staticassertion 6y ago

    For the third point, why not just hash the password with SHA256 first? Sorry, I didn't look at the code, just going off of the described issue. If you have an arbitrarily sized input and you want a fixed 32 byte output, that seems by f