Hacker Newsnew | past | comments | ask | show | jobs | submit | Leszek's commentslogin

rr (https://rr-project.org/) and memory watchpoints are a godsend when it comes to analysing heap corruptions.


Ah that looks like a great tool, will try to keep it in mind if I run into those kinds of issues again.

Couldn't have caught one of the worst bug I had to track down that was a memory corruption on the PS2, we had some dynamic async loading that used DMA channels and someone had carelessly released memory used by these async loads.

Back then memory addresses was fairly deterministic so I thought I could add a memory breakpoint to catch it (i thought), bewildered me when I first witnessed the memory addresses with breakpoints being corrupted... until it clicked and became the clue that it had to be caused by a system (DMA) that didn't care about the systems hardware memory breakpoints.


Absolutely. Things that took hours or days to debug before take mere minutes once I have an rr recording.


The signed length fields pre-date the sandbox, and at that point being able to corrupt the string length meant you already had an OOB write primitive and didn't need to get one via strings. The sandbox is the new weird thing, where now these in-sandbox corruptions can sometimes be promoted into out-of-sandbox corruptions if code on the boundary doesn't handle these sorts of edge cases.


The V8 sandbox doesn't just protect against JIT issues, it also protects against logical issues in the runtime and object model.


Not exactly. It's the nature of a sandbox that it doesn't remove bugs, it only reduces their blast radius. The Truffle architecture actually removes bugs by changing how you write the language VM to begin with.


I said it "protects" against bugs, not that it "removes" them. The Truffle architecture removes mismatches between JIT and interpreted code (when it doesn't have bugs itself, which is not guaranteed either), but it doesn't remove runtime or object model logic errors that affect both.


Because, Truffle is reused in multiple language VMs their overall attack surface is smaller than it would be with classical language VM architectures.


Ok, person with anonymous account name.


More likely in feet than metres.


Are you down for looking for counterexamples? Do you want to get to the bottom of why people cherry pick examples for their argument? Is this what you want to base your argument on, or should it be grounded in a more complete linguistic analysis?


Interestingly, except for your first example, yours are all related to building or stacking things and returning to a fundamental, dare I say foundational, aspect.

Also "being down" to do something likely came from writing your name down as a commitment, or putting a bet down, committing your money.


Leszek, I don’t think your reply invalidates what blargey said. Showing that "down" can also be neutral, impactful or enthusiastic (like "down for" or "get to the bottom of") is useful, but it adds nuance rather than disproving the broader pattern that up = good / down = bad runs deep across languages.


It certainly disproves that it's a pattern without exceptions, and therefore invalidates or at least questions the idea that every instance of up and down (like which way up north is) has to be mapped to good and bad.


It's all just anecdotes vs. anecdotes. The alleged "broader pattern" is not proven by one any more than it is disproven by the other. (For what it's worth, I do think there is a cultural pattern, especially in biblical metaphors, but in general use it's far weaker than what TFA is making it out to be.)


The Dual-Kawase blur sounds like a texture-sampling-efficient variant of building a Gaussian pyramid (https://en.wikipedia.org/wiki/Pyramid_(image_processing))?


"The data presented in this article is sourced from the United Nations International Migration Stock for the year 2020."


It's not - the general path is a bailout for the fast path which continues where the fast path stopped, so you don't have to check the whole object for fastness (and you get the fast path up until the bailout)


What can't though?


A TAN generator or security key stored in a drawer at home. At least it reduces the opportunities for theft since people don't carry these devices with them all the time as opposed to their phones. Opportunity makes the thief.


Idk how this would play out, they might force you to go get that


if i have to use it every time i want to make a payment, then i have to carry it with me,


Yeah I often think the issue with cash and crypto is that it can be easily forced away from an individual by any sufficienty armed and unscrupulous party. Money in a financial institution tends to have an upper limit on what could be forced away in a single act, or at least a single transction cycle.


Staying anonymous. For every single multimillionaire or billionaire out there flaunting their wealth, there is another who's equally secretive about it. There are many folks with tens of billions in assets who don't make their wealth part of their brand.

Like that guy in Texas whose estate paid billions in tax when he passed away.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: