yaakov34

35 ms·

271.
by yaakov34 15y ago
Suppose you have a friend who screws up and gets fired from menial jobs, spends his money on booze and gambling, and ends up in heavy debt. Now you want to help him out, so you can do one of two things: 1. I'll lend you the money if you get
272.
by yaakov34 15y ago
I think the element you are missing is that the Greek government spending is very inefficient; they're not investing in some kind of economy-growing infrastructure revolution, they're spending money on totally unreasonable union contracts a
273.
by yaakov34 15y ago
That's what I thought he was going for - some kind of a history-comes-full-circle argument involving the Balkans. Also, please note that I did not say that I think that economics is more important than the wars in (former) Yugoslavia. I don
274.
by yaakov34 15y ago
Come on, have you actually read the article that you quoted? It says that GS helped Greece borrow an additional $1 billion in 2002 by having it assume unrealistic exchange rates. Assuming for the sake of argument that this is completely tru
275.
by yaakov34 15y ago
OK, OK, I agree now that that's what he meant. But for me, "the Balkan wars" is standard terminology referring to those wars, which really did involve all of the Balkans, and I thought he was making some kind of a point about a century of
276.
by yaakov34 15y ago
I feel like I should have stopped reading this missive after the first phrase, which is "The economic crisis in Greece is the most consequential thing to have happened in Europe since the Balkan wars." The Balkan wars were in 1912-1913. I c
277.
by yaakov34 15y ago
Right, but this doesn't make the search space 2^64 times larger, or anything of the sort. Once you've assigned a unique salt to every password, you're not getting any further benefits from salting. This is what the Mt. Gox owner doesn't see
278.
by yaakov34 15y ago
No, it doesn't. Once the salt is large enough that you don't have several passwords hashed with the same salt value, there is absolutely no further advantage. Frankly, 64 bits of salt seems like enough for anything. Triple-salting sounds li
279.
by yaakov34 15y ago
They were probably using the "last chance" form to reset the password. That form checks the IP address; if they had control of the XP machine, they could have been using it to submit the form with a reasonable IP address and get the account
280.
by yaakov34 15y ago
I meant closing it after going through the "last chance" form. Although it wouldn't surprise me if someone could go through it again and reopen it. Also, if you left a computer with a Google login where someone could access it (not smart, b
281.
by yaakov34 15y ago
I don't understand why so few comments mention that the "last chance form" is a huge security hole. It seems like most of the information for filling it can be seen by someone over my shoulder as I use Gmail. And it's apparently completely
282.
by yaakov34 15y ago
Actually, I hadn't realized that we agreed on that. I will think more about Stepanov's approach, although I still think he is ignoring the different efforts likely to be put into securing different type of programs.
283.
by yaakov34 15y ago
I'm obviously not talking about programs written in memory-safe languages - my point is that they don't have buffer overruns. About the programs written in unsafe languages, I think it's clear that I don't literally mean that every single
284.
by yaakov34 15y ago
Got it, thanks, though I need to be going anyway. Yes, you need to fuzz your code, but that's not a simple process; you need to give fuzzers very complicated information about the possible problem input for your program. And there is no rea
285.
by yaakov34 15y ago
Thanks, I'll edit that, since this seems to be a popular thread. I guess I just provided the visual proof of how people make mistakes even when they should know better. On second thought - let it stay as a reminder.
286.
by yaakov34 15y ago
Sorry, but this sounds exactly like one of these comp-sci things which are perfectly true in theory and not usually true in practice. A compiler is usually written by a very strong team with an understanding of code correctness and techniqu
287.
by yaakov34 15y ago
Leif, we've reached the maximum reply depth here, which I guess means that we need to finish this up. I don't think there are people who can't use valgrind, but it just doesn't give you all that much. It lets you know that there aren't me
288.
by yaakov34 15y ago
I apologize that I got testy, I just don't think there is a need to paste the whole valgrind run into the message. Anyway, problem #1 is that valgrind is not a code-coverage tool - it only sees the execution path that just happened. You can
289.
by yaakov34 15y ago
Believe me, on a lot of examples of real-world code, valgrind &co. will find false positives and miss errors. I've been there and done that. And then you can't pick out the signal from the noise. Again, if just about every team on the p
290.
by yaakov34 15y ago
I might not be quite up to date, and I don't usually write extremely buggy code which compilers yell at, but have compilers really started warning on something like "vector_reference.push_back(&local_object);"? There are lots of ways to
291.
by yaakov34 15y ago
I agree with you, and I didn't mean to imply that ROP is all that new. It's been on my personal radar since 2008, which is when it became really popular. I think this was also when the automated tools for exploits started to appear. Of cour
292.
by yaakov34 15y ago
Right; we're just so used to C/C++ that this seems normal. Here's Eric Lippert telling someone "look, if you check out of a hotel room, your stuff might still be there for a while, right?" Right. Makes sense. (Not blaming Eric Lippert for a
293.
by yaakov34 15y ago
There is also such a thing as opportunity cost. Web browsing, and the online world in general, is execrably insecure. A day doesn't pass without a high-profile target being owned by some attention-seeking script kiddie. I can only imagine w
294.
by yaakov34 15y ago
One last addition - I hope I'm not overstaying my welcome with all these little lectures on security. It used to be that a buffer overrun typically resulted from carelessness, like char name[100]; //Who has a name longer than 100 chara
295.
by yaakov34 15y ago
Not nearly enough. Note that C++ combines C's vulnerabilities with non-transparency. Suppose you have a data structure like "set of maps of strings to pointers to vectors." That's actually not a complicated structure for a modern applicatio
296.
by yaakov34 15y ago
It seems from some of the comments down the thread that the idea of writing over memory in C++ is new to many people. Let me introduce another couple of concepts. You don't have to stop with writing over the variables. You can write over th
297.
by yaakov34 15y ago
I say this as a C++ programmer (C++ is essentially the only choice in the domain in which I currently work), but this really underscores how unreasonable C++ is for writing secure/high reliability applications. On the one hand, the compiler
298.
by yaakov34 15y ago
Oh, and since people misunderstood me in the previous thread, let me add that I am not a Microsoft/Silverlight supporter. Frankly, I do not wish success to Silverlight. It's another technology that nobody really asked for, and it brings its
299.
by yaakov34 15y ago
A [somewhat exaggerated] summary: "there are so many security holes in web browsing already, why do you begrudge us a few more?". OK, I admit there is a kind of madhouse logic to this which I can't refute. There is already a flood of patche
300.
by yaakov34 15y ago
Avi Bar-Zeev says that the solution to WebGL security will be to ask the user to explicitly enable it per site (so it runs only on trusted sites), to sign shaders in the same way drivers and plugins are signed now, and maybe to maintain a w

More ›