News for hackers. Stuff that matters.

cautious_int

I don't trust open systems either.

Don't put words in my mouth please.

I reject the thesis that trust is binary. Were I to accept it, I trust nobody - everyone is vulnerable to being subverted by blackmail, intimidation, making mistakes, etc.

You seem to be using a different definition of the word trust than I did. Everyone is vulnerable, does that mean you cannot trust anyone? No, you certainly can, that is the whole point of trust.

This is a lose-lose scenario. If you don't trust a closed operating system in the first place, why would you then, after performing these steps, trust the system that it really does what it says it does. The point is that you don't know, and you can never be sure. The solution is to either trust or not, switch or stay, there is no middle path, because any middle path implies some amount of non-trust.
The Sun is the center of the Universe. Interesting.
Transmission like this looks really good in a simulation, but I wonder how much lubrication would this require to operate in the real world.

this: https://www.youtube.com/watch?v=NdzSqc8pxVg

Re:Let’s sunset C/C++ on Friday August 14, 2015 @08:24AM (#10059747)
Mill processors? Aren't they still in research stage, only using emulation and no hardware.
Why not put it into a Faraday cage?
Re:Android libstagefright still exploitable on Thursday August 13, 2015 @06:26PM (#10057596)
I was talking about the same line.

Apparently new is a "special" operator, or there is a bug in the compiler. I also can't get a warning with g++.

The problem seems to be that, as I said, [] takes any integer expression, it is there where the value gets truncated when operator sizeof or new is applied on it since they either return or take a size_t value.

Re:Android libstagefright still exploitable on Thursday August 13, 2015 @05:46PM (#10057414)
Because no truncation happens. In this case [] operator doesn't specify any type, only that the expression inside is an integer expression. While normally the type size_t is used for object and array sizes, [] takes any integer expression and the compiler won't complain.
Re:Android libstagefright still exploitable on Thursday August 13, 2015 @03:38PM (#10056674)
This is a common problem in C. Integer types are inherently type unsafe and are silently promoted with many different rules which are hard to remember and understand. As is seen in this case, even the ( borderline paranoid ) flag -Wconversion would not catch the bug.

I think this problem in C would be solved with a single flag: -Wwarn-if-using-integers-of-different-types-in-an-operation , forcing you to cast the integer if the types don't match in a arithmetic operation, or an assignment.

Re:Android libstagefright still exploitable on Thursday August 13, 2015 @02:46PM (#10056334)
Because unsigned overflow will not happen in C, and will instead wrap the value. The variables in question were unsigned.

This is defined and perfectly normal.

However signed integers will cause undefined behavior on overflow and there is a common flag in most compilers to trap on overflow.

Re:Disable Windows 10 Tracking on Thursday August 13, 2015 @11:29AM (#10054936)
Can you also fake/spoof the appropriate signatures/headers? Otherwise separating that data is going to be very easy. Unless you do it on a higher level like emulating input, but then you won't have a very useful machine.
Why?
Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn't connected to a Microsoft Account.

Well there you go. If you ever wondered whether this is happening only on the Microsoft Account(tm).

Re:How We Beat C++ STL Binary Search on Wednesday August 12, 2015 @11:11AM (#10048117)
You got it backwards there. Only if you know your implementation and plan to code only for it, can you even start to consider bending the C Standard, and not the other way around.
Re:“It’s done, there is no way back. We tried, we failed” on Wednesday August 12, 2015 @10:36AM (#10047900)
Since you didn't back it back then, you can now buy it immediately on Steam. It looks like a functional game, and not a failed project.
Re:How We Beat C++ STL Binary Search on Wednesday August 12, 2015 @01:50AM (#10046243)
Actually it is misleading by them( and you ) to assume that in C, an unsigned int can represent values larger than the largest signed int value.

In other words, C allows that UINT_MAX == INT_MAX, in which case you will overflow.

If they made that assumption, they should explicitly mention it, but they didn't.

> Update 17 Feb 2008:... ...Now that we've made this change, we know that the program is correct;)

It seems the article is aware of the irony. Another update would be in order.

Re:How We Beat C++ STL Binary Search on Wednesday August 12, 2015 @01:38AM (#10046213)
It is not true that unsigned wrap is defined? Did you even read my comment, here is the relevant part: unsigned wrap is defined
Re:How We Beat C++ STL Binary Search on Tuesday August 11, 2015 @07:41PM (#10045114)
The conditional move still depends on both values taken from the array, via other variables.
Re:How We Beat C++ STL Binary Search on Tuesday August 11, 2015 @04:54PM (#10044314)
Well a branch will fetch the incorrect cache line if it mispredicts, but a conditional move will fetch both cache lines every time.
Re:How We Beat C++ STL Binary Search on Tuesday August 11, 2015 @04:41PM (#10044239)
That blog is wrong. The program won't be undefined( unsigned wrap is defined ), but the offset will not be correct.
Re:How We Beat C++ STL Binary Search on Tuesday August 11, 2015 @04:19PM (#10044069)
Wouldn't a conditional move transfer the cost from branch mispredict to the cache miss.

I wonder how realistic their test were, and if the same results would be achieved with some cache trashing.

smoothies

They are way better than any soft drink. Even if you pick the fruit with the most fructose/glucose percentage you still get the benefit of slower digestion due to fibers which slow digestion. Slight exaggeration, but in comparison, drinks are almost an injection of sugar into the blood-stream.

I would consider them healthy if they are ingested in appropriate quantities, without any added sugars, and along with some additional food that is rich with protein and fibers, like wheat and grains.

Re:Utf8rewind changes for 1.2.1 on Sunday August 09, 2015 @12:33PM (#10030615)
I think you have a bug in codepoint_read(). The last argument is a pointer to variable unicode_t named decoded. If the first if statement in that function is true, then the a value is never assigned to that variable, the function returns, and immediately outside the function the value of that variable is read. But that variable was never initialized.

https://bitbucket.org/knight666/utf8rewind/src/c22e458912952...

https://bitbucket.org/knight666/utf8rewind/src/c22e458912952...

https://bitbucket.org/knight666/utf8rewind/src/c22e458912952...

The prior while statement makes sure the second parameter src_size is never 0, but the pointer src might be.

Undefined behavior can be caused by passing a NULL pointer as the first parameter and a non-negative second parameter to utf8toutf16().

Re:Utf8rewind changes for 1.2.1 on Sunday August 09, 2015 @12:20PM (#10030583)
And many C Standard types have a _t suffix. It really shouldn't be used.

There are multiple source files.

Re:Utf8rewind changes for 1.2.1 on Sunday August 09, 2015 @07:29AM (#10030064)
Wow, this is interesting. I have never heard of it before. How popular/tested is this library?

Will try to build it for my project that deals with unicode.

Re:Monkey the Cat Hunts for Dinner on Friday August 07, 2015 @05:32AM (#10021578)
I'm trying to think of a useful thing to teach a cat, using this technique, that would be helpful at home.
Re:Movfuscator: A single-instruction C compiler on Friday August 07, 2015 @05:10AM (#10021527)
I suggest taking a look at the slides, which show how much trickery is involved: https://github.com/xoreaxeaxeax/movfuscator/raw/master/slide...
Re:Allocation Adventures: The Buddy Allocator on Thursday August 06, 2015 @04:23PM (#10019164)
Luckily there exist multi-line comments and that the code provided are two short snippets that aren't really useful. No, what this article desperately needs is an actual implementation which can be referred to when needed.
Re:Privacy Badger – Block spying ads and invisible trackers on Thursday August 06, 2015 @03:35PM (#10018832)
The FAQ site has this sentence:

Privacy Badger is governed by EFF's Privacy Policy for Software.

In the privacy policy you have this:

Software Downloads: If you download and install software from EFF's web site, we may collect information about your visit to our site. Once installed, our software may also connect automatically to our site to attempt to determine if updated versions are available. As a result, our site may log information related to the software downloads, such as your computer's IP address. Our collection, anonymization, and use of that data is described our web site privacy policy.

Web site privacy policy has this to say about the collected information:

Disclosure of Your Information

While EFF endeavors to provide the highest level of protection for your information, we may disclose personally identifiable information about you to third parties in limited circumstances, including: (1) with your consent; or (2) when we have a good faith belief it is required by law, such as pursuant to a subpoena or other judicial or administrative order.

So as a start you might want to disable automatic updates

Older »