temac

74 ms·

721.
by temac 7y ago
There is even more depth to the alloca() fiasco than most people realize. cppcheck could detect the bug without any hard setup effort (launching it in systemd codebase, with maybe an option to activate all checks, was enough) at least 2 yea
722.
by temac 7y ago
You are technically correct about processes not absolutely needing to use graphical resources. But the whole thing is nevertheless backed in and coupled with low layers, including the kernel. There is just a kind of lazy init of GDI resou
723.
by temac 7y ago
IIRC shatter attack was exploiting a badly designed general purpose window message protocol that by design quasi-directly allowed arbitrary code execution (especially at the time, with no mitigation). This one is way more indirect and goes
724.
by temac 7y ago
> For example; If Google finds a bug in your product YOU get 90 days before they put you on blast in front of 8 billion people. > But if you find a bug in GOOGLE'S product and put them on blast YOU will find yourself in court. Re
725.
by temac 7y ago
That's quite arbitrary and you likely defined it as this to fit your current business or occupation. Or even just your current main competencies. I could say a real-full-stack should actually include EE, chip design, compiler design, k
726.
by temac 7y ago
It's both.
727.
by temac 7y ago
I'm pretty sure typing for even just 4 hours a day is not going to end well for anybody. I should try to measure the time I spent typing, but in fact I'm not sure I could even find a way to just have enough things to type for 4
728.
by temac 7y ago
So you remove all the traditional services from the OS "definition", and roll your owns (in one particular context). Don't worry, soon enough some people will be tired of reinventing the wheel each in their own corner, and
729.
by temac 7y ago
OTOH, Intel found ways to segment without attempting insane things like "oh but I don't allow you to put a Core i5 in a datacenter". A kind of clause which might very well be void in tons of jurisdictions, by the way.
730.
by temac 7y ago
I agree, it depends of the code, and if you need to replace it: by what. I'm actually more found of when I don't even have to replace it: just delete the damn obsolete shit. Not replace. Delete. Most of the time it for cases whe
731.
by temac 7y ago
I'm not sure you understand the amount of embedded software that runs the world -- or at least think about it appropriately. And the amount of system and infra software that is needed to even let the web exist. An "application&quo
732.
by temac 7y ago
The web has nothing magic. People have been maintaining SW developed by 3rd parties for several decades. Something like 5 or 6, probably. With all the various amount of available documentation you can imagine, and that includes no documenta
733.
by temac 7y ago
The secret is, you don't have to not write and/or delete everything indiscriminately. The second thing is: companies do not only try to avoid existential threats; they also attempt to have economical approaches. If anything need
734.
by temac 7y ago
I'm a fan of that idea and I'm taking it even further: Erase existing software, so we have less amount of shit software. I'm actually applying that technique at work with great results (really!)
735.
by temac 7y ago
Well it can not only be a LED that is supposed to be one-way, but the whole circuitry driving it. Likewise for the receptor. With some appropriate review of the physical design, you can have a reasonable expectation that the comm will be li
736.
by temac 7y ago
I don't want to segregate Android from other Linux systems or anything like that, but I was just making the remark that this is a (very) different system compared to classic GNU/Linux distros. With different actors at different
737.
by temac 7y ago
Android is typically the system that does not permit the workflow I was talking about. It does not make it necessarily the worst thing ever, simply it is an extremely different system than what GNU/Linux is. Now obviously it also uses
738.
by temac 7y ago
If you redefine "agile" as common sense and what currently works for you, and "waterfall" as failure, then obviously every good thing will be "agile", and wrong stuff will be "waterfall". Can we do an
739.
by temac 7y ago
Something like pledge seems to have better successes... Maybe a middle ground could be achieved, but honestly I prefer simple proven approaches to grand overcomplicated designs. And it has to be in the kernel (or at least shipped and instal
740.
by temac 7y ago
Yes but like I said: this layer does not exist, and to my knowledge nobody intend to create it. It would be a big amount of work too, compared to the pledge approach...
741.
by temac 7y ago
The submission actually states (correctly): "UCS-2 can only represent the first 65536 characters of Unicode, also known as the Basic Multilingual Plane." UTF-16 can represent all Unicode code points, through surrogate pairs when n
742.
by temac 7y ago
This class of problem for seccomp has been known for ages. This makes it quasi-unusable IMO (or reserved for full-contained binaries, maybe in some JIT scenario but probably not a lot else), and even quasi in self-contradiction with the ker
743.
by temac 7y ago
It works very well until even kernel hackers hit the very problem we are talking about -- which is precisely the same class of problem that classic GNU/Linux userspace is having when trying to use it -- and then it does not work very w
744.
by temac 7y ago
> but correcting it would break existing valid programs That's very often the case when enhancing static safety guarantees. And that's often worth it.
745.
by temac 7y ago
> It would be interesting if you could just program with an L1 exposed and structured as a main memory rather than a cache ... During the boot of the computer, you can. At least you could a few years ago, I'm not sure about brand ne
746.
by temac 7y ago
> I'm not sure I quite buy that. In practice, what would happen is that a suitably large, optimized VLIW core would start fetching more than one wide instruction in a cycle and issuing the resulting ops in parallel with interlocks f
747.
by temac 7y ago
Note that the post seems to be discussing about the old-school RISC reasoning, more than what we consider "RISC" in the modern world. Now RISC is just a style of ISA (and/or more informally some description of some internal
748.
by temac 7y ago
Is forcing the use of online account compliant with GDPR? If not (or unsure), how do we report it?
749.
by temac 7y ago
IMO MCAS (the version properly respecified and reimplemented, of course) really fits in the "envelop protection" category (even if slightly pre-emptive), why do you classify it otherwise?
750.
by temac 7y ago
> It's worse than that, as I understand it a professional airline pilot can only remain type-certified in a single type rating at one time. That's not my understanding: I think you can simultaneously be certified for multiple p

More ›