News for hackers. Stuff that matters.

tkot

Re:Actively exploited sandbox RCE in all Chromium versions on Sunday September 06, 2026 @11:56AM (#49587759)
I see, so there are certain things that arbitrary native code could try do (let's say, try to execute a certain syscall) that native code produced by the JIT compiler wouldn't normally be able to attempt?
Re:Actively exploited sandbox RCE in all Chromium versions on Saturday September 05, 2026 @01:49PM (#49578924)
Is Firefox actually safer than Chromium-based browsers though?

I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.ht...

but has the situation changed substantially in favor of Firefox?

Re:Actively exploited sandbox RCE in all Chromium versions on Saturday September 05, 2026 @01:40PM (#49578812)
> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

What's the difference between "executing arbitrary code inside the sandbox via a crafted HTML page" and running whatever is in the <script> tag?

Re:Paint.net 5.2 alpha now runs on Linux on Thursday September 03, 2026 @01:57AM (#49546400)
Wow, PixiEditor looks really cool.
Re:Paint.net 5.2 alpha now runs on Linux on Wednesday September 02, 2026 @03:13PM (#49540987)
I know nothing about writing an image editor or graphics programming but maybe someone here can fill me in - would it be more or less difficult ("would it take more or less tokens" is probably the right question to ask these days) to replace the Windows-specific APIs with cross-platform alternatives (I guess Skia instead of Direct2D and something like Avalonia or Uno instead of Win32-based UI?) instead of re-implementing Direct2D?
Re:Inventing Cyrillic on Friday May 08, 2026 @05:34PM (#48069054)
> It's less pronounced with diacritics, but enter Unicode normal forms: you can represent š either as š, or s followed by a diacritic. When you want to compare two strings, you have to normalize them to ensure you are comparing apples to apples. I can guarantee most software is broken in that regard. For Cyrillic, it just works.

It's the same with Unicode encoding of Cyrillic letters - й (U+0439) can be written as й (и U+0438 + ◌̆ U+0306)

> Interestingly — and not many know this — Unicode includes separate codepoints for all of the digraphs too. While well-intentioned, it only makes the problem worse.

Based on your description it seems that the root cause of the issues is using two letters to represent the digraph - for example N (U+004E) J (U+004A) instead of NJ (U+01CA) - and the sorting issues would be identical if people typed Н (U+041D) Ь (U+042C)instead of Њ (U+040A).

What's the reason for the digraph being substituted by 2 letters in the first case more often than in the second case?

Re:Inventing Cyrillic on Friday May 08, 2026 @05:23AM (#48060698)
> it really is also a tool to best codify spoken language of the Slavs (in a sense, it is trivially provable that Cyrillic script is better adapted even to languages which do not use it today, but have to resort to digraphs or glyphs with diacritics — some are thus not using it to distance from a particular influence instead

I've heard this claim many times but never the reasoning behind it - by what metric is "ш" superior to "š" and so on?

Re:Our European search index goes live on Saturday August 09, 2025 @05:46AM (#44845241)
If a search engine (be it Ecosia, Qwant, DDG or Google) is used by someone who is running uBlock Origin, does it benefit the company running the engine or does the cost of queries with no chance of displaying an add to the user outweigh the benefit from the meager amount of data collected (IP address? Interest in given keywords? Some more data for tuning the search results?)?
> For example, the German "Ich sehe die Frau mit dem Fernglas" (I see the woman with the binoculars) is _unambiguous_ because "die Frau" and "mit dem Fernglas" match in both gender and case. If this weren't the case, it could be either "I see (the woman with the binoculars)" or "I see (the woman) with [using] the binoculars".

My German is pretty rusty, why exactly is it unambiguous?

I don't see how changing the noun would make a difference. "Ich sehe" followed by any of these: "den Mann mit dem Fernglas", "die Frau mit dem Fernglas", "das Mädchen mit dem Fernglas" sounds equally ambiguous to me.

Are there any advantages to using the official Reddit app instead of something like RedReader?

https://github.com/QuantumBadger/RedReader

Re:My favorite coding question to give candidates on Tuesday November 21, 2023 @05:58AM (#38362035)
The noun is not the issue but rather the scope of uniqueness:

>Now, given two log files (log file from day 1 and log file from day 2) we want to generate a list of ‘loyal customers’ that meet the criteria of: (a) they came on both days, and (b) they visited at least two unique pages.

It appears to me that the requirement could be interpreted as either:

"(visit on day 1) AND (visit on day 2) AND (total unique pages count > 2)"

a clearer way to put it would be "visited at least two unique pages in total"

or "(visit at least two unique pages on day 1) AND (visit at least two unique pages on day 2)"

a clearer way to put it would be "visited at least two unique pages on each day"

Re:URL Explained – The Fundamentals on Tuesday November 14, 2023 @05:57AM (#38261692)
> Host: (always present, not always visible)

Hostname can be skipped in file URI and localhost will be assumed, maybe that's what the author meant.

Re:My favorite coding question to give candidates on Tuesday November 14, 2023 @05:53AM (#38261674)
Does visiting pages A and B on day 1 and visiting page A on day 2 also make the sentence true? I think that's the source of ambiguity (or maybe it's ambiguous to me only because English is not my native language).
Yup, it's also very useful for doing stuff like checking archive integrity after upload (got bitten by it once when uploading some archives via FTP) and syncing with cloud - I've had a dedicated client remove files from my PC instead of the cloud after desync, rclone makes it easy to check what will be done and works with pretty much every service available.
I specifically mentioned mounting (https://rclone.org/commands/rclone_mount/ which may use some additional storage space depending on the caching configuration) whereas you seem to be talking about mirroring the data in the cloud and on other devices.
What is the advantage of using Spacedrive over mounting the network disk with rclone (https://rclone.org/) and using any other file explorer?
Re:The WebP 0day on Friday September 22, 2023 @09:46AM (#37612008)
Slightly off-topic but I can't resist the urge to ask.

Why is the logo (https://raw.githubusercontent.com/google/wuffs/main/doc/logo...) no longer shown in the readme?

I was pretty sure I had heard of the project before but I had to find the logo to be absolutely certain, it's truly one of a kind.

Re:Full Text of the Federalist Papers on Monday July 17, 2023 @06:42PM (#36765081)
>in your opinion what is the difference between a Republic and a Democracy?

To keep things simple: democracy -> majority rule

republic -> majority rule + no inheritance of public offices (so no monarch)

Of course it can get more complicated than that - democracies can differ in terms of who can and cannot vote, freedom of press, how exactly the separation of powers is handled (or if the powers are separated at all), what method is used to distribute seats in the parliament, how much power is held by the president and how much is held by the prime minister etc.

By that definition US and UK are both (representative) democracies but of these two only the US is a republic and UK is a parliamentary ("constitutional" sounds pretty weird in this context given that there is no codified constitution) monarchy (while still being a democracy).

Re:Full Text of the Federalist Papers on Sunday July 16, 2023 @09:37AM (#36746850)
Isn't it a matter of words changing meaning over time? Could it be that what James Madison called "democracy" corresponds to "direct democracy" in modern understanding and "republic" corresponds to "representative (indirect) democracy" in modern parlance?

If not, then what are the differences between republic described by Madison and representative democracy?

Would adding the account to a mail client so that it logs into the account via IMAP on PC/phone startup help or does Yahoo require a login via the web interface?
Re:Some were meant for C [pdf] on Thursday June 22, 2023 @10:43AM (#36432911)
What are the 'gotchas' that Java has but C does not?
Re:Improbably Right on Monday May 01, 2023 @01:37PM (#35776315)
I was responding to the person mentioning 100km/h as the correct answer (firstlink).
Re:Improbably Right on Monday April 24, 2023 @04:28PM (#35692742)
I think you are thinking about a case where someone goes 120km/h for 1 hour and then 80km/h for 1 hour instead of going over a fixed distance at 120km/h and then going over the same distance at 80km/h.
Re:Z Garbage Collector: The Next Generation on Monday April 24, 2023 @02:02PM (#35690984)
Wouldn't UseCompressedOops flag alleviate the issue for smaller heaps?
Re:Idiot Proof Git on Wednesday November 09, 2022 @04:31PM (#33538168)
I'd probably suggest --force-with-lease just to be sure ;)
Re:List of Creepypastas on Wednesday August 31, 2022 @05:01AM (#32659935)
It won't work in cases where the stories require images or interaction but for text-based stories I use

curl <pasta url> | html2text | less

Just to be sure ;)

Re:Parsing SQL on Tuesday August 23, 2022 @07:28AM (#32563233)
Libraries written in SQL. I'm sure one can search for let's say a snippet that will create a date dimension table for a data warehouse and copy it but it's pretty clunky compared to even Python modules.

I'm criticizing SQL as a language which is lacking in composability (as opposed to criticizing relational algebra or relational data model).

Libraries for working with SQL (full-fledged ORMs or simpler query builders) are themselves written in a different language so they don't necessarily prove anything about SQL itself, though one could argue that if people want to use them then they might not be satisfied with raw SQL.

Re:Parsing SQL on Tuesday August 23, 2022 @05:32AM (#32562402)
I agree regarding SQL views - it's probably the most frequently used way of reusing SQL code.

> And even across vastly different domains, even if not directly reusable, SQL queries are still highly transferable.

That's the point, they are probably transferable in the "copy, paste and tweak" sense which would be highly frowned upon in other popular languages.

> But which data/processing related tasks is SQL a very poor fit for?

I specifically called SQL "a DSL for data processing", I probably should have written "there are many domains that SQL is a very poor fit for" to be more clear.

>In my experience it's much more common to actually see the opposite - inefficient usage of ORMs, exporting datasets only to then perform pre/postprocessing, often requiring building programming "jigs" to circumvent bottlenecks, etc when it could've been done in a more streamlined manner in the DB/warehouse.

Totally agree. Lukas Eder has some nice presentations about it.

Re:Parsing SQL on Tuesday August 23, 2022 @05:22AM (#32562347)
>As much as SQL could be better, it's a very strong local optimum

I mostly agree, though I think that SQL's popularity comes mostly from network effects.

> Yeah and what's wrong with that?

Nothing is wrong wrong with that. I just think that it's reasonable to interpret the words "programming in the large" as "being usable as general purpose programming language" (which I admit is not a very strict definition) whereas SQL (or XSLT or awk or bash...) seem well suited for certain niches (important niches nonetheless).

Re:Parsing SQL on Tuesday August 23, 2022 @03:54AM (#32561787)
It's true though. Relational algebra is a very nice abstraction but SQL as a language is subpar to say the least. SQL is really unergonomic, it's difficult to reuse SQL code which is why there are no SQL libraries worth talking about and it's the reason why people go out of their way to create tools to replace SQL like ORMs or LINQ.

SQL is basically a DSL for data processing just like XSLT for example. Would you call XSLT "designed for large scale programming"?

The "they will not be very productive with it" comment is a bit of a stretch - it can be very productive in the domain it is designed for - but you can often replace SQL at its job (like for example use Dataframe API in Spark instead of SQL API) while there are many tasks that SQL is a very poor fit for.

Older »