zedshaw

31 ms·

271.
by zedshaw 15y ago
Wrong, I make a clear example of the copy() function being broken, give a demonstration of fuzzing it to break it, and show how to do it yourself. And, if you think the copy() function is valid, then you also think strcpy() function is val
272.
by zedshaw 15y ago
> I noticed that the things he makes you look up on your own are generally specific enough that it makes the task of filtering out all the nonsense much easier than if you were researching it on your own. That's my trick. I actually go
273.
by zedshaw 15y ago
Nothing is more enjoyable than watching idiots like you imagine that the world is a fully formed perfect thing that can't possibly be a work in-progress. I watch you guys never put anything out there for fear that someone will think it's j
274.
by zedshaw 15y ago
Alright cool, thanks. I actually have a video course, and what I tell people is to use the videos to get them "over the hump", then use the book like homework to complete. I may make that more explicit in later versions and point out that
275.
by zedshaw 15y ago
Ah, so it was the video aspect of the google course. Tell me, you watched the video and read the code in the video, so can you think about why a video with code in it was superior to a book with code in it? Was it the talking? The active
276.
by zedshaw 15y ago
Mind if I ask why you thought google's content was better and also what your previous background was? Could you code already?
277.
by zedshaw 15y ago
Being someone who actually does teach people how to code, I say don't listen to the above comment and give it a shot anyway. I see people all the time go from nothing to building their own projects in a few months. Yes, many don't do this
278.
by zedshaw 15y ago
To be both pedantic and correct, there is no way to define a C function to restrict a string input so that it is correctly terminated. So no, it's at best documented that you shouldn't do that and definitely doesn't prevent you from doing
279.
by zedshaw 15y ago
Well when my book is finished you can come back read all of the ones I find, but demanding that someone go through the book and write down every example they found to answer your one-liner is a bit unfair.
280.
by zedshaw 15y ago
In the earlier chapters they setup a Makefile with full debugging on so these don't get removed. It's mostly just for this one exercise, and in the rest of the book they use a set of debug macros I wrote: http://c.learncodethehardway.org/
281.
by zedshaw 15y ago
My criticisms are only partially stylistic, but also that people copy this code to other situations and it breaks. So, I'm showing them why it only works in that one specific context and how to break the code.
282.
by zedshaw 15y ago
I partially agree with you, but in a different way. I feel that the real problem is the OS doesn't give code access to its own internal accounting of allocated memory. It already knows the size of any heap chunk you make, so why can't we
283.
by zedshaw 15y ago
Add a new statement to the while-loop. Now you've figured out why that style isn't so hot. You now have to remember to go add the new braces, and typically people are mentally putting them in so they forget. Same with the last if-stateme
284.
by zedshaw 15y ago
Nope, and what I'm actually doing is fuzzing the input to this function, which is a common breaking technique. You see, programmers tend to go around only using functions exactly as they were intended. Hackers come along and then use them
285.
by zedshaw 15y ago
Thanks, I do like breaking things.
286.
by zedshaw 15y ago
You should go read about fuzzing. It's amazing what throwing "random garbage" at programs can break.
287.
by zedshaw 15y ago
That's basically the point of this chapter. It's getting people to think like a hacker and try to break the code in unintended ways. That makes them better programmers and helps when avoiding common mistakes in C code. Using K&R to do
288.
by zedshaw 15y ago
I do not pretend anything about null-terminated strings in the book. In fact, I have many exercises and assignments where they use Valgrind to buffer overflow C strings repeatedly and don't introduce bstring until much later.
289.
by zedshaw 15y ago
I use bstring but there's a few others. Generally it's the easiest way to avoid some common buffer overflows and other problems.
290.
by zedshaw 15y ago
It's fairly vague in the standard, but most of the time this is what happens so nobody hits the bug. Also, many OS are notorious for being loose with the stack and strict on the heap for various reasons.
291.
by zedshaw 15y ago
The problem is in the word "expects". This function expects certain things but doesn't assert that they're happening. Because of this you get bugs when you try to use that function in other code, which is what beginners do. And yes, the s
292.
by zedshaw 15y ago
> I don't see his point, really. The point is three fold: 1. K&R has defects in it when the functions in it are used out of context because they didn't include defensive programming practices considered standard today. 2. People can
293.
by zedshaw 15y ago
Yes, strcpy is almost universally understood as a security problem. In fact, here's a nice regex to apply to some C code to find buffer overflows: LC_ALL=C egrep '[^_.>a-zA-Z0-9](str(n?cpy|n?cat|xfrm|n?dup|str|pbrk|tok|_)|stpn?cpy|r?in
294.
by zedshaw 15y ago
> Braces have a cognitive load, particularly if they're given whole lines to themselves. Which is easier to read, Checking braces has a higher load when they aren't there and when they aren't consistently used. But, without evidence bo
295.
by zedshaw 15y ago
The inputs I'm throwing at it are a common problem mistake in C programming which demonstrates a buffer overflow. K&R's code assumes that it will only be used in each program they've written, but it usually get copied out into other so
296.
by zedshaw 15y ago
Yes, they'll be pretty good at C unlike you because they'll read the whole book instead of just this one half-finished chapter.
297.
by zedshaw 15y ago
> but no function with that signature could possibly work in this case. This is the source of the bugs in C. People write functions that only work given all calls to them are never changed, which is absurd. Good modern C code involves
298.
by zedshaw 15y ago
It is a really nice idea, which is why I used it in Mongrel and now it looks Puma is a fork of Mongrel so I'm doing it again!
299.
by zedshaw 15y ago
Welcome to the free market. It requires open information for everyone, which includes criticisms. As long as it's true or obviously a hilarious joke or parody, he's totally allowed to say it. And, doing that benefits everyone else becaus
300.
by zedshaw 15y ago
Ah, I was thinking this was another book that he didn't finish. Thanks.

More ›