20k
Joined 12 years ago
Joined 12 years ago
No security expert can or should work that fast. Its a completely reasonable thing to do given the hyperbolic reporting just in case it turns out to be true. Some websites being down for a few hours doesn't end the world
1. These tools are wrong a significant % of the time
2. They have an upper complexity bound where they start to fall apart
Relying on AI to check AI papers is a terrible idea
The last 20 years of experience have told me that that's the #1 variable that correlates with the death of a project, so I'm in no hurry to speed that along. People have been trying to find some way to skip that difficult step of actually understanding what's happened since programming was invented, and its always a bad idea - because that process of internalising a projects structure is the single most valuable thing for a project. Creating a project structure that can be internalised by human beings - and then doing that - is software engineering
There's no difference between the flag being set/unset by your build system, and #define-ing or #undef-ing the symbol in code
If you want to use asserts, you need to control the definition of NDEBUG. You either do this with your build system (common), or manually (slightly less common). This is literally <assert.h> 101
The preprocessor is widely used for a variety of things when its necessary, including #includes and #defines, because there's literally no other mechanism for this. Its bizarre to say that nobody controls the definition status of NDEBUG because people don't use the preprocessor
Its trivially easy to guarantee that an assert always runs, and its well defined behaviour according to the spec. There's no reason not to if you want to use asserts in a way that guarantees that they always fire, which is a supported use case. Its common practice
There's no equivalent for contracts
The programming model for C++ contracts as described by the authors, and spec, is that they are 'ghost code'. You must never assume that a contract check is actually executed, even if you've asked your compiler to execute your contract checks. This is because ABI/ODR problems can and will cause your contract checks to be deleted, as well as the 'observe' contract mode which is a strange one
So its hard to know what the use case for them is as a result. You can't use them for safety checks, because you must assume they won't be run. Hilariously, they actually introduce safety problems vs asset: Eg take two pieces of code:
assert(p != nullptr);
assert(p->some_value());
vs contract_assert(p != nullptr);
contract_assert(p->some_value());
People mistakenly transform #1 into #2 unconditionally, not realising that this is actually a misuse of the contracts feature. It can, and will lead to undefined behaviour - while being perfectly well defined with assertsI have a feeling that in 10 years the advice will be to never use contracts in anything approaching code that needs safety, as they're generally less safe than using an assert for no real reason. So what's their use case?
Valve rightly get a lot of flak for the gambling and high % cut, but you do get a functional useful service in return at least, that doesn't appear to be actively trying to screw you over
Its kind of appalling that people think this is an acceptable way to behave
1. AI games
2. AI Art
3. AI Music
4. AI literature in most forms, except for factual text like search
Or at least, they won't pay money for it
AI hatred isn't being pushed by people with a narrative. I can't use AI for my game, because it'll sell £0 if I do. That's the net result of millions of other people telling me that they despise AI and won't purchase my product if it contains any AI, and I'm just making a business decision
Also google and some other big tech companies were widely loved for a while. Microsoft/gates managed to entirely rehabilitate their image at one point, and google was seen as one of the good guys. Those days died with the cambridge analytica scandal, and there's no evidence its coming back