staticassertion

293 ms·

4561.
by staticassertion 10y ago
As I said above, CVE listings are a useless metric for measuring safety of a product. High # of CVEs can easily indicate a safer product with a more mature bug bounty program or an attitude of "Assume it's vulnerable, don't
4562.
by staticassertion 10y ago
CVE listings are not a meaningful metric at all for security. What that could reflect is that Edge's bounty program is far more popular than Chrome's. It could mean that Edge is willing to hand out CVEs for uncomfirmed bugs wherea
4563.
by staticassertion 10y ago
> (excuse me, "unsafe Rust", as if that were a different thing) They are - there is a world of difference between the two. From a security perspective the ability to audit unsafety explicitly is massive . Right now we rely o
4564.
by staticassertion 10y ago
I have two recommendations that anyone with a CS degree or equivalent knowledge should be able to jump into with 0 other training, and come out with a solid understanding of how to find vulnerabilities and exploit them. * Hacking: The Art
4565.
by staticassertion 10y ago
Basically the VM is sandwiched between the host and parent OS. With a full VM you have a separate kernel. With containers, like Docker, you share a kernel. The VM is then considered more secure because it adds that extra layer between them.
4566.
by staticassertion 10y ago
Actors + type safety is a huge selling point for Pony that, to my knowledge, no other language is really providing. I'm definitely keeping an eye on it and I'm very excited to see its development continue.
4567.
by staticassertion 10y ago
Hm. I wonder if this is configurable, or if there's an RFC open for this.
4568.
by staticassertion 10y ago
That would this in rust: if number { true } else { false } If it's the last expression it will implicitly return the values. Easily fits on one line.
4569.
by staticassertion 10y ago
Yeah, I think SIMD will be the next big jump for these benchmarks. I also wish we could see clang used with the C/C++ cases.
4570.
by staticassertion 10y ago
I would say that while Go is boring, it is worth learning. It may not be anything too new or interesting but it'll likely change how you think about programming at least a bit - concurrency and error handling in Go are particularly acc
4571.
by staticassertion 10y ago
I'm used to it I guess. Got &'a str all over my code.
4572.
by staticassertion 10y ago
I bought this book and I've been using it - but I'm writing the interpreter in Rust instead of Go. I really like it, and I think Go is actually a cool language for this due to its simplicity. I had very little Go experience but th
4573.
by staticassertion 10y ago
Should be able to escape docker with this. Docker provides host kernel access, so if you get the kernel you're good to go.
4574.
by staticassertion 10y ago
That makes no sense.
4575.
by staticassertion 10y ago
I don't understand what you're getting at. One program is vulnerable, therefor make all programs vulnerable?
4576.
by staticassertion 10y ago
The non-zero performance impact on ASLR is basically 0, and impacts link-time performance more than anything else, which most devs should not care about. So before you start going for the tiniest of microoptimizations maybe profile. Yes, th
4577.
by staticassertion 10y ago
Not really seeing the contradiction. ASLR is still effective where it was always intended to be effective. ASLR is ineffective given an attacker with more control than ASLR was designed to be useful against.
4578.
by staticassertion 10y ago
ASLR is a mitigation for ROP given certain constraints - the ability to arbitrarily execute code, allocate memory, would break those constraints. This is true of any mitigation technique, there are capabilities an attacker can have that wil
4579.
by staticassertion 10y ago
Developers generally can't make informed decisions about security. It should remain in developer control, I guess, but most developers have no business disabling it.
4580.
by staticassertion 10y ago
What? Which part is not the case? This attack does require executing arbitrary JS on the victim system. This attack is not viable if you're exploiting some RCE against a C program that doesn't evaluate code.
4581.
by staticassertion 10y ago
Entropy isn't obscurity.
4582.
by staticassertion 10y ago
> I'm just happy it's easy to disable for performance reasons If you're disabling ASLR over this post, please don't. Especially for performance reasons - ASLR is very very cheap, and the impact on performance tends to
4583.
by staticassertion 10y ago
Not really. We can simply expand it to "All code has bugs", and then we're simply at Rice's theorem. In C, the class of bugs that can not be proven to not exist are also quite dangerous - remote code execution, as an exe
4584.
by staticassertion 10y ago
I would agree if I felt that the industry were moving towards "better" software - as in, as an industry, we said "Wow, we need to seriously take a step back and start writing systems more reliably, more securely, etc". I
4585.
by staticassertion 10y ago
This is the #1 misconception I see surrounding pure functional programming - that once you run into mutable state, you run into problems. It is entirely the opposite . PFP exposes the murky aspects of mutability, provides abstractions arou
4586.
by staticassertion 10y ago
A little less than half, assuming the popular vote is representative. And considering that the top 3 largest cities were overwhelmingly pro-Hillary it seems very sensible, given that I assume that's who their target consumer is.
4587.
by staticassertion 10y ago
You can easily see this as marketing. I'm certainly more inclined to use their services now.
4588.
by staticassertion 10y ago
Optional forces the null check (at the cost of a pointer dereference :( but that's Java for you). That's the difference. It also provides some nice combinator syntax for handling that null beyond .isPresent, but if you were to jus
4589.
by staticassertion 10y ago
Take submissions for summaries and require that new content/ pull requests provide one. For the record, I'm enjoying everything I've read so far from the list, so thank you.
4590.
by staticassertion 10y ago
I think we like to say things like "C has no GC so it's good for kernels, Python has a GC so it's good for blah blah". In reality, we've definitely written plenty of "python level" (application level) soft

More ›