staticassertion

92 ms·

4411.
by staticassertion 9y ago
Most people are willing to accept the risk that the NSA is listening in on them. Most people are not willing to accept the risk of an arbitrary person being able to steal their identity.
4412.
by staticassertion 9y ago
OK, but it means a billion android devices are vulnerable to various attacks. It would be cool if we could have, idk, backported security fixes for devices that hold tons of critical information?
4413.
by staticassertion 9y ago
I don't think they're trying to suggest using rust, just curious why Cloudflare chose a language with a GC for workloads that apparently do not play well with GC. "We already used Go" is a totally valid reason. "It&
4414.
by staticassertion 9y ago
It's a statement of agreement, followed by an elaboration on their point. Seems completely fine.
4415.
by staticassertion 9y ago
I still trust Chrome's sandbox - I have less understanding of where Firefox does sandboxing, how it works across platforms, etc. Whereas I have a solid understanding of how Chrome uses seccomp on Linux. While pieces of Firefox are movi
4416.
by staticassertion 9y ago
I don't think so. If you were willing to hire a team to implement some solution that existed in OSS form, why wouldn't you just pay for the OSS version, which would likely be cheaper (since you're spreading the price across m
4417.
by staticassertion 9y ago
Hopefully more developers stop giving their work away for free so that this attitude can change.
4418.
by staticassertion 9y ago
Not really, no.
4419.
by staticassertion 9y ago
This is making a ton of assumptions about your target. Is it a desktop user? Then possibly. Is it a server? What type? Does it have a keyboard/ monitor? Maybe a USB is how you access this device - so a USB that can get control over the
4420.
by staticassertion 9y ago
> I don't see many scenarios in which launching a USB denial of service attack would be the most effective thing to do. High security servers that don't have typical interfaces are super common in government facilities. Sometim
4421.
by staticassertion 9y ago
But if you actually read the descriptions there are plenty that look like they'd have great potential for code execution.
4422.
by staticassertion 9y ago
It's unclear whether or not these are all strictly DOS. Some seem like they may be exploitable.
4423.
by staticassertion 9y ago
It's not really comparable to IE. MS had a pretty explicit goal of destroying Netscape - to the extent that they were making deals with other companies to break compat with Netscape. Chrome is breaking 'autofill=false' on web
4424.
by staticassertion 9y ago
Attacks on servers are of a different nature. No one runs Linux desktop, so it is not a valuable target for trojans or other attacks like that. If it were popular we'd see just as much malware for linux.
4425.
by staticassertion 9y ago
I guess I'm not everyone. I'd bet that the majority of the 'busts' are due to: a) Infiltrating chats where people are more likely to share sensitive information / trust the people they're talking to b) Poor con
4426.
by staticassertion 9y ago
This seems extremely unfair. As has been pointed out they did disclose this, Chrome shipped a patch a while back by disabling the optimization. Microsoft is contributing interesting, valuable information with this post.
4427.
by staticassertion 9y ago
Spin up 100k threads on linux vs 100k actors in erlang.
4428.
by staticassertion 9y ago
So they give you two products and a month of prime... what response did you want on the customer service end?
4429.
by staticassertion 9y ago
What makes you think debian is missing ASLR?
4430.
by staticassertion 9y ago
Building policy by just auditing is a bad idea - you'll end up with overly general roles. Policy building is best left to the author of the applications so that they can test against it and lock it down.
4431.
by staticassertion 9y ago
"Some attacks will be harder to employ, some less" - I'm interpreting this sentence that way.
4432.
by staticassertion 9y ago
> It isn't "due to C." This is a popular meme on HN, but it's incorrect in its focus. You can call it a meme but that doesn't change my opinion. > Some attacks will be harder to employ, some less, but on avera
4433.
by staticassertion 9y ago
"All of the performance of C without the footguns" Nowhere in this sentence do I see "for every platform C targets". Given no other requirement other than C without the footguns (memory unsafe) is there a good reason not
4434.
by staticassertion 9y ago
> I'm quite bored by the obsession of some for replacing C. That's fine... but the billions of dollars spent on security and the massive trove of user data that's been exfiltrated due to C is kinda a problem regardless of
4435.
by staticassertion 9y ago
You can express what you're talking about (non aliasing mutable pointers) for free, at compile time. In fact, you can't express this in C (or, restricted, whatever), so I do wonder if your assumption that because it's UB it
4436.
by staticassertion 9y ago
But as a new project they didn't have to worry about breaking things, supporting current users, etc.
4437.
by staticassertion 9y ago
I think it's best to keep unsafe blocks as small as possible. Within an unsafe block there is undefined behavior, so you want to get out of there ASAP. Just my opinion.
4438.
by staticassertion 9y ago
It's hard to emphasize the auditability enough. With auditing a C/C++ codebase, in my experience, you rely a lot on intuition. "Well, there's parsing done here, so I'll focus my efforts" or "Historically w
4439.
by staticassertion 9y ago
I've also found this to be a really good approach to unsafe. Declare why something is actually safe and you may realize it isn't. It also helps when writing tests to assert safety - you have a comment explaining exactly the inva
4440.
by staticassertion 9y ago
> So FF might actually be slower. It's definitely not noticeably faster than Chrome. Yep, on some pages, on some benchmarks, it can go either way. I think this more brings Firefox to a competitive place, and shows the potential f

More ›