News for hackers. Stuff that matters.

LeafStorm

Re:The Shadow Brokers EPICBANANAS and EXTRABACON Exploits on Friday August 19, 2016 @03:50PM (#12322962)
Is this a standard naming convention for exploits?
I have seen xkcd #927 used to dismiss discussions of standards on HN so many times that it is the only xkcd comic I can recognize by number.
Re:The Problem With Single-threaded Shared Mutability on Sunday May 17, 2015 @02:47PM (#9561197)
Rust has two types called Rc and Arc that have this behavior. When you clone an Rc pointer, the internal reference count increments, and as each clone disappears, the reference count decrements. (Arc works like Rc, but it uses atomic increment and decrement operators, so you can share it across threads.)

Rc: http://doc.rust-lang.org/stable/std/rc/struct.Rc.html

Arc: http://doc.rust-lang.org/stable/std/sync/struct.Arc.html

Re:The Freak Attack SSL/TLS Vulnerability on Tuesday March 03, 2015 @11:00PM (#9142574)
> support unauthorized vulnerability attempts

That was probably just a random student who learned some fun stuff in Security class and slept through the Ethics lesson. I can't speak for UMich, but security research at my university (NC State) has a very strict "don't attack civilians" policy.

> hosting a .com commercial site

First off, .com sites are not necessarily commercial. Second, this isn't a commercial site, it's an informational page about a recently discovered TLS vulnerability.

Re:Light Table 0.7.0 on Thursday November 20, 2014 @08:20AM (#8635537)
If you don't want to support commercial plugins, then those companies have no legitimate usecase that would require avoiding the GPL.
Re:Rewriting Reddit (2005) on Monday October 27, 2014 @03:59PM (#8517814)
I almost went down this route on a project once. As soon as I noticed myself writing an identity map, I slapped myself in the face and just downloaded Symfony.
Re:First Impressions of Systemd, and They Are Not Good on Monday October 13, 2014 @03:33PM (#8450151)
It seems to me that the author's system was in an incredibly unstable state to begin with. He's running a Debian prerelease with an unsupported filesystem, that had gone without updates for months at a time. I have a hard time seeing how changing the init system would not cause problems in a setup like that.
Re:MacStadium: Dedicated Mac Pro Hosting and Colocation on Friday January 03, 2014 @09:07PM (#7009587)
Oddly enough, back when the cylindrical Mac Pro was first announced, a coworker and I discussed how exactly one would rack them. We came up with something very similar, but slightly asymmetric, and designed to hook into a standard 19" rack.

(This was prompted by the question of what Apple's Web site runs on if they don't make servers any more.)

Flashing reds are based entirely off of how long it takes an "average" person to cross. As a relatively tall young adult, I walk much faster than the "average," so I can frequently make it across by walking even if it's been flashing red for a few seconds. Furthermore, the "Don't Walk" sign becoming solid is timed to correspond to the yellow lights appearing for the parallel traffic, so the opposing traffic won't start moving for a few seconds after the "Don't Walk" signs appear.

(Disclaimer: This is based on Raleigh, NC's traffic lights. I don't know what level this is standardized at.)

Re:Talks, Tutorials, and Poster selections announced on Friday December 20, 2013 @01:00AM (#6940167)
My lightning talk - "Traversing the Montreal Métro with Python" - was accepted, and I'm super-excited!

But also I'm super-excited about the rest of the schedule. There are 36 talks that I'm really interested in seeing, and I don't think that's even physically possible. So I guess I have to decide which ones I'll have to settle for watching on pyvideo.org.

Re:The Taxonomy of Terrible Programmers on Thursday December 19, 2013 @10:16PM (#6939712)
The "moderators on StackExchange" shot was good, but I really take offense to the "PyCon 2013" one. The reason stuff went wrong at that conference was because of the actions of one attendee, who specifically did not go through the process the conference organizers set up for dealing with reports of harassment.
Also, this post jumped from #20 on the front page to somewhere below #360 in the time it took me to write my other comment.
Ah, the wonders of low-level assembly programming. I was a teaching assistant for an assembly course this semester at school, and one of the students was running a program in the debugger. (Specifically, Microsoft CodeView running in DOSBox.) F10, F10, F10, until she got to the load instruction that would fill the cx register. Press F10 again, and suddenly, the debugger shows "cx = DEAD."

She freaks out a bit, I freak out a lot. We're both worried that something really bad happened, then I realized that DEAD is actually a number in hex. I look through the data segment, and I see a AD DE in there (yay Intel byte reversal!).

I check through the code a bit, and even though it looks like the data segment is being initialized properly, it's still reading from the Program Segment Prefix. So, I find the Wikipedia article on the PSP and see that address 05h in the PSP has a cross-segment jump to CP/M compatibility code.

But, there's nothing at address DEAD (at least, nothing sensible). So I go searching through the DOSBox code for that string, and I find these lines:

    // far call to interrupt 0x21 - faked for bill & ted
    // lets hope nobody really uses this address
    sSave(sPSP,cpm_entry,RealMake(0xDEAD,0xFFFF));
As it turns out, because DOSBox doesn't implement CP/M compatibility, they simply made it jump to DEAD instead, just to make sure that if anyone tried running a CP/M program they would get the picture. And the assembler just happened to put the variable in the right place that the load pulled the DEAD instead of random nonsense.

I can only imagine the problems that can manifest when you're dealing directly with hardware, and don't have access to commented source code.

Re:The Power of a Pronoun on Saturday November 30, 2013 @05:03PM (#6824831)
> On the one hand, it seems ridiculous (absurd, perhaps) to fire someone over a pronoun -- but to characterize it that way would be a gross oversimplification: it's not the use of the gendered pronoun that's at issue (that's just sloppy), but rather the insistence that pronouns should in fact be gendered. To me, that insistence can only come from one place: that gender—specifically, masculinity—is inextricably linked to software, and that's not an attitude that Joyent tolerates.

They're not opposing the use of the word "he," they're opposing him saying "no, go away, I don't see any reason someone could take offense" when the issue was pointed out instead of "thanks for the patch."

Re:The Power of a Pronoun on Saturday November 30, 2013 @05:00PM (#6824815)
He didn't quote Strunk & White to justify rejecting the patch, nor did he bring up the grammatical argument at all when reverting it. He just said "this is not worth spending time on" and closed the ticket. (And if it was truly not worth spending time on, he wouldn't have contramanded one of his fellow maintainers to revert the patch, then rewrite the repository's history to cover himself.)
Re:Why GitHub is not your CV on Friday November 15, 2013 @10:15AM (#6739842)
I use Symfony at work. I would love to contribute some of the patches and helpers I have written to Symfony, or release them as an independent bundle, but (a) I'm the only programmer on the project so I don't really have time, and (b) my company doesn't really do OSS, so I would need to explain all this to our legal department before I could get authorization to release it.
Re:RFC 7049 - Concise Binary Object Representation (CBOR) on Tuesday October 29, 2013 @10:48AM (#6634495)
This looks like a fairly well-designed format. My main concern is that this seems to have suddenly appeared out of nowhere and gone directly to RFC. (Presumably there was an Internet-Draft, but I have never seen anything about this before.)
Re:Does Our Industry Have a Drinking Problem? on Thursday October 24, 2013 @10:11AM (#6605314)
Here's a point that gets forgotten in a lot of discussions of this issue:

> We’re also underlining that our events are for over-18s, maybe even over-21s, by holding them in licensed premises. Most of us know students or even those who are working professionally in our field long before they are “adult.” Should they be excluded?

Re:So You'd Like to Make a Map using Python on Thursday October 24, 2013 @09:41AM (#6605172)
Can you draw brightly colored lines on roads for a bus map? I like to mess around analyzing bus routes, but so far I haven't been able to find a computer-based tool for drawing them effectively.
Re:What’s New In Python 3.4 on Sunday October 20, 2013 @04:18PM (#6581294)
I like the implementation of the "Enum" class, especially the way they allow for enums with variant behavior and "abstract Enums" (something I could have used in Java recently).

But, ever since I found out about algebraic data types from other languages, I keep wanting those. There's not quite a good way to do those in Python. (I've used both "tuple subclass" and "__slots__," but both of those have their own little quirks.)

Re:Hostnames on Saturday October 12, 2013 @08:35PM (#6540975)
At ITECS, our Systems division uses practical names like engr-ras-201 for servers. However, we have a bit more fun with workstations. My machine was named "waytso." I asked my boss what it stood for once, and she said that after the machine that used to sit on that desk had died, Desktop Support sat down an old Dell Dimension to hold us over until they could get a newer machine ready.

It ended up taking a few months, and one day, they called her and said, "Hey, we're ready to image the new Webteam workstation. What should we set the hostname to?" "Waytso." "Waytso? What does that mean?" "Why Are You Taking SO long!?"

Re:A list of free programming books on Friday October 11, 2013 @09:40PM (#6536899)
Two and a half years into my bachelor's, Sipser's Introduction to the Theory of Computation is the only computer science textbook I've had so far that I'd say I really found useful for anything beyond the homework problems, besides K.N. King's C Programming: A Modern Approach.

(To keep this on topic, my assembly instructor -- the legendary [to NC State students] Dana Lasher -- posts his course pack online. [1] It's a comprehensive introduction to computer architecture topics and original 8086 assembly programming.)

[1] http://courses.ncsu.edu/csc236/lec/001/cops.htm

Re:Poll: What are your liked and disliked programming languages? on Thursday October 10, 2013 @12:40PM (#6528620)
Working with basic data structures like maps, sets, and lists that you don't have to manually allocate takes approximately 20 times as much code as it does in nicer languages like Python.
Re:Poll: What are your liked and disliked programming languages? on Thursday October 10, 2013 @11:03AM (#6528097)
For me, it just feels like instead of taking efforts to carefully design the language, they just picked the first thing that worked and froze it. And while I really like some features of the type system (such as interfaces, lambda/function types, multiple return values, and the "type switch"), the lack of overloading and generics does have some pretty serious effects on readability (especially when you have compiler-supported functions that do overloading and generics, but don't allow it in userland).

It also seems like the way they resolved a lot of issues in the surrounding tooling was to not decide. For example: how many spaces should we use? Screw it, we'll use hard tabs! How should we handle dependency loading and package management? Screw it, we'll hard-code the URL to our dependencies in the source code! How to handle dependency versions? Screw it, we won't!

It's not a horrible language (like shellscript), but I think they wasted a lot of opportunity to make something better.

Re:.museum domains held in the US on Friday October 04, 2013 @06:46PM (#6498519)
I noticed http://northcarolina.history.museum/ in the listing. I clicked it, and it resolves to an IP that is no longer routable. http://asheville.art.museum/ suffered a similar fate, and http://ncmls.durham.museum/ immediately redirected to http://lifeandscience.org/.

I imagine a lot of these were purchased as "Hey! There's a .museum top-level domain! Let's buy it! ...You know, we should probably write this down somewhere."

Re:Taking PHP Seriously [pdf] on Friday September 27, 2013 @10:50PM (#6460681)
Anecdata: I just wrote a PHP application where the HTML never touched the database at all. And I'm right now working on a Java application where the database is mixed into the HTML just like the worst of the worst PHP, except because it's Java all the code is two times longer.
Re:Taking PHP Seriously [pdf] on Friday September 27, 2013 @10:48PM (#6460679)
Deployment, for one. sudo apt-get install Apache and PHP, then edit the Apache config to say, "use this directory." I love Django and Flask to pieces, but deploying a Python app is like building a hovercraft compared to PHP.
Re:Deciphering the Business Card Raytracer on Sunday September 22, 2013 @08:29AM (#6426539)
When I took Calculus III, Z was up. When I took Engineering Physics the same semester, Y was up.

According to legend, this is why the Math and Physics departments hate each other.

Older »