Tibbes
Joined 16 years ago
Karma
60
Submissions
22
Member since
Nov 16
Recent submissions
Comment · 4 years ago
Comment · 5 years ago
It's clear what the incentive is for Taylor (the ice cream machine maker), but I wonder what the incentive is for McDonalds.
There must be some cash-flow from Taylor to McDonalds, but something as simple as "pay McDonalds $X million to specify Taylor machines in their franchise contracts" seems like a kickback.
Maybe the key is that the video shows that this particular machine is "by Taylor and McDonalds" (the McDonalds logo is on the instruction manuals). Perhaps McDonalds therefore get royalties or something similar.
Comment · 8 years ago
The dataflow analysis libraries in QL have significantly improved since 2015, and were used to find the ICMP vulnerability mentioned in the article. See the blog post for the query used. [1]
Dataflow analysis is a form of execution simulation that estimates the flow of control and data from one part of the program to another. Of course, there are many forms of simulation, and they vary in accuracy and the expense of computing them.
[1]: https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407
Comment · 8 years ago
That's the interesting thing about the approach used to find this bug (automatic variant analysis): whilst there are no doubt more bugs to find in XNU, there aren't any more bugs like this.
The article says that the problem was found by codifying the mistake that led to a previous CVE as a query in a logic language called QL, and then running that query over XNU, so if there were any more they would have been found at the same time.
(edit: corrected typography)
Comment · 8 years ago
Semmle | Research/Software/Security Engineer | Oxford, UK | Onsite, Full-time
Semmle helps some of the biggest software and financial companies, such as Microsoft, Google, and Credit Suisse, develop more secure software, faster.
If you'd like to get a taste of our technology go to https://lgtm.com where we analyse over 70,000 of the most popular open source projects, or check out the vulnerabilities we've recently reported at https://lgtm.com/blog
We are looking for great engineers work on a mix of problems ranging from compiler work and program analysis to vulnerability finding to building solid 1000-node distributed systems.
Go to https://semmle.com/careers or email [email protected]
Comment · 10 years ago
Insert it any time, yes, possibly.
Remove it at any time, no. The chip on the card is cryptographically signing the transaction, which includes the total. It can't sign it until the total is known.
In practice, I suspect the equipment is designed not to allow you to insert the card early so that you check the total first.
Comment · 10 years ago
For those interested in the "Static Source Code Analysis" section, "Semil" is a typo for "Semmle" [1]
Comment · 13 years ago
Does anyone know the purpose of the self-assignment on page 3? (in the body of IsWriteCombined)
DWORD error = GetLastError();
error = errorComment · 13 years ago
Hmmmm, make that:
def gauss(x):
return (x+1)*x/2
You gotta admit, on an article about the difference between integer and floating-point arithmetic, that's pretty ironic!
Comment · 13 years ago
The 'unlock' operation, at least on most central locking systems I've used, is the perfect example of an idempotent unary operation.
It doesn't matter how many times you apply the 'unlock' operation, it has the same effect as applying it once[1]. However, the 'unlock' operation is not safe[2].
Comment · 14 years ago
"If you ever want to git-bisect your code-base to track down when you introduced a bug then you'll be very thankful that every commit is functional and passes your test-suite"
I agree that this property is very useful, but I disagree that it it is necessarily implied by the workflow as described in the article. By using "git add -p", he is constructing a tree that probably never actually existed during development - hence there is no guarantee that it works and passes the tests.
I strongly agree with you that a clean logical progression of commits is a good thing (especially for code review). However, making sure that each stage works and passes the tests takes extra discipline.
Comment · 14 years ago
"this difference is largely due to the differences in the size of the respective populations. The panel report notes that the U.S. has a population about five times the size of the UK, but there have been fewer than twice the number of people extradited to the U.S. than to the UK."
What? That seems extremely nonsensical to me.
Wouldn't one reasonably expect the number of extradition requests to a country to be proportional to the number of people in that country, not the number of people in the country doing the extraditing?
(edit: italics)
Comment · 15 years ago
Brief summary of computing in UK schools:
Back in the days of the BBC Micro, computing in schools involved some programming.
After that (probably in the early nineties), the subject split into two: Computer Science and IT. Then with the rise of the internet IT was renamed CIT (Communications and Information Techologies) and finally reordered to ICT. Computer Science was also renamed Computing at some stage.
ICT involves no or extremely minimal programming. Computing does, but it has proved the less popular option and died out in the majority of schools - partly due to an uninspiring syllabus and lack of teachers.
Comment · 15 years ago
From the article:
Those problem-set hours total almost a whole other working week laid on top of the other academic tasks of attending lectures and reading notes. In college as in grade school, where is the time for deliberate practice?
I can't help but think that this is a case of not seeing the wood for the trees. In a good university problem-sets obey most of the requirements of deliberate practice: they are designed, there is repetition, they are mentally demanding, and they gradually get harder so that you are working at the edge of your abilities.
The remaining requirements of deliberate practice are to do with meta-cognition - i.e. thinking about what you are doing - and that is down to you.
It reminds me of stories my mum (who's a teacher) tells about pupils complaining that they had no time for revision because of the practice exams she set. I mean, what do they think revision is?
(So be careful not to assume this problem is specific to Java, the JVM, Mesos, or Twitter's environment)