HN user

gjasny

43 karma
Posts2
Comments16
View on HN

This is answered in their blog entry: https://www.openssl.org/blog/blog/2022/11/01/email-address-o...

  A: CVE-2022-3602 was originally assessed by the OpenSSL project as CRITICAL as 
  it is an arbitrary 4-byte stack buffer overflow, and such vulnerabilities may 
  lead to remote code execution (RCE).

  During the week of prenotification, several organisations performed testing 
  and gave us feedback on the issue, looking at the technical details of the 
  overflow and stack layout on common architectures and platforms.

  Firstly, we had reports that on certain Linux distributions the stack layout 
  was such that the 4 bytes overwrote an adjacent buffer that was yet to be used 
  and therefore there was no crash or ability to cause remote code execution.

  Secondly, many modern platforms implement stack overflow protections which 
  would mitigate against the risk of remote code execution and usually lead to a 
  crash instead.

  However as OpenSSL is distributed as source code we have no way of knowing how 
  every platform and compiler combination has arranged the buffers on the stack 
  and therefore remote code execution may still be possible on some platforms.

  Our security policy states that a vulnerability might be described as CRITICAL 
  if “remote code execution is considered likely in common situations”. We no 
  longer felt that this rating applied to CVE-2022-3602 and therefore it was 
  downgraded on 1st November 2022 before being released to HIGH.

Same here. Microsoft Defender is a real productivity killer. Cached C++ compilation now takes nearly twice as much time if the cache is hot. And git operations or she'll prompts take forever in large repos like LLVM.

I remember the mixer interface (channel volumes, mute states, routing matrix) was far superior with ALSA.

I used a script to toggle the SPDIF output stream of my Soundblaster Live to get track marks on the Mini Disc player recording the output.

Some years ago I tried submitting some fixes for MacPorts. It usually took a long time before they were picked up.

When I did the same for some homebrew formula I got a response a few hours later.

For me homebrew has a much more responsive community and due to their use of Github also a lower bar for contributions. Both might add to homebrew popularity.

LLVM 11.0 6 years ago

Our internal mono-repo with about 11000 C++ compilation units took about the same time with clang-11 compared to clang-10. I used the Ubuntu 20.04 packages from apt.llvm.org for testing.

If dependencies are a problem, you could always use the pre-compiled version from cmake.org. It uses the bundled 3rd party libs.

I prefer software that uses mature 3rd party libs over NIH driven rewrites. Please also keep in mind that CMake is available for many platforms sone with fading user base like AIX, HPUX, or Solaris. Using a well tested event library like libuv helps to keep those supported.

IBM Type 9 years ago

Printing websites with grey text on a laser printer usually gives you dithered and unpleasant to read text.