howdydoo
Joined 8 years ago
Joined 8 years ago
https://en.cppreference.com/w/cpp/filesystem
> The behavior is undefined if the calls to functions in this library introduce a file system race, that is, when multiple threads, processes, or computers interleave access and modification to the same object in a file system.
---
Golang also seems vulnerable to the same issue
https://github.com/golang/go/blob/d15481b8c7f5f73a8b987a0c1d...
Line 78 checks that the path isn't a symlink (time-of-check). Then line 97 calls openFdAt which on line 174 opens the path by name, without NOFOLLOW (time-of-use).
I bet this is a pretty common vulnerability.
Let's say "→" misrepresents the meaning of "->" even as much as 0.1% of the time. Would you rather your risk of error be 99.9%, or 0.1%?
I'm sick of anti-ligature people telling everyone else not to enjoy their fonts, on every single post about a font. Ligatures have caught on for a reason.
Well that's good news, at least
https://www.doc.ic.ac.uk/~mjw03/PersonalWebpage/pdfs/quickso...
This is the kind of thing I hate about "New Windows". Once upon a time MS used to strive for backward compatibility. These days every few years there's a new function you need to call. You can't get optimal behavior just by writing good code from the start. You need to do that, and also call the YesIKnowHowPixelsWork api call, and set <yesIAmCompetent>true</yesIAmCompetent> in your manifest to get what should be the default behavior. It's a mess.