HN user

syncopate

116 karma
Posts7
Comments31
View on HN

Isn't that called geofencing? It's been around for years. I always felt that the main reason e.g. Facebook wants you to use their app is to be able to supply data for conversions of geofencing ad campaigns, e.g. someone saw an ad for a promotion at some burger place and then actually came to close proximity of their wlan.

I am not Jeremy but I have taken part in the current course and also took some lessons by Siraj (who also does lessons at udacity), Andrew NG, and Karpathy. I think all of them are awesome teachers. Like Siraj's lessons, the fastai course is full of practical examples, whereas Ng/Karpathy's courses are more theoretical. What makes the fast.ai course unique compared to Siraj (who covers a lot of topics very briefly) is that Jeremy delves into depth, taking a long time explaining things, so you have a lot of opportunities to understand what's going on. In the 2018 course there is actually not that much different content compared to the 2017 course, rather Jeremy took the time and tried to make everything easier for everyone to understand and built a better python library. Also another unique point about Jeremy is that he and Rachel want not only to teach people but rather inspire a community of people working together in teams. The fast.ai library will not be just a project for the course, it will be something that a lot of people will use and contribute to to make pytorch better.

How does that work? Should the kernel walk the stack to change all the saved cookie values of the forked copy? I doubt the kernel even knows where the saved cookie values are stored on the stack. Also, that would make fork quite slow, depending on how the deep the stack was when the fork happened.

It increases the complexity of the attack. Usually, stack cookies make ROP harder these days but guessing the cookie only has a complexity of 8*256 (on OpenBSD), but xor'ing the return address with another value does increase the complexity even more. And that might be good news for programs that use fork a lot (like nginx) and hence don't get a refresh for ASLR/stack cookies for every request (like e.g. sshd on OpenBSD does [which does does fork/exec to ensure ASLR/cookies are refreshed]).

When you deploy: Will you lose requests that are currently being processed while you restart the service? Also, will a server still receive requests while the new code is being started?

Hey, I am a bit late, but I wonder how you generally handle unicode in C++, since the language itself does not have much support for it. That's what always makes me weary of writing any kind of server in C++.

A good way to learn asm is through books but there are not many for current architectures (especially x64, except the official Intel manuals which are quite good but also hard to read). Nevertheless, there are some on ARM which I can recommend, namely: ARM System Developer's Guide by Sloss, Symes and Wright. ARM Assembly Language by Hohl. ARM SoC Architecture by Furber.

IDA Pro is the industry standard for reverse engineering but it also is expensive (like USD $2k). There is a free version but it doesn't offer 64bit, so not really an option for modern ObjC or Intel computers. As you've mentioned ObjC chances are you work on OS X. IDA pro is not working well on OS X (the recommended way is to use the Windows version via virtualbox and not the OS X version). Still, Hopper.app is a great alternative on OS X. Not as good as IDA, but it has a Python interface, GDB support, and decompile support for ARM, Intel (and some knowledge regarding Objc). And it's only ~USD$100. [There is also a Windows version of hopper.app but it seems not yet ready to use, as I've only heard bad things about it there so far.]

AFAIU, the length is negative but it is then treated as an unsigned integer by vDSP_sveD. So the function iterates over the given vector until there is a memory exception (As the length is very close to to UINT_MAX). It doesn't look very exploitable to me but it is surely annoying. I've found it a bit odd that neither TStorageRange::SetStorageSubRange nor vDSP_sveD do any kind of sanity checks for the values they calculate or which are passed to them.

I've been looking at the stack trace in gdb a bit. And it seems that inside CoreText TStorageRange::SetStorageSubRange calls

    void vDSP_sveD(double *__vDSP_A, vDSP_Stride __vDSP_I, double *__vDSP_C, vDSP_Length __vDSP_N)
with a negative length argument.

It should be noted that on the official llvm irc channel (#llvm@oftc.net) people do not like llvm's IR being called a "progamming language". Rather it's intended to be a representation of llvm's internal data structures. It may look similar to a programming language for sure but it's not the intent behind it. It's a representation that should help compiler engineers debugging their llvm-using parsers.

Also, if you've ever looked at clang's "-emit-llvm" output you will notice that there are some parts of the IR which are hard to be generated by humans, e.g. dgb by sequential number references.

See e.g.: http://llvm.org/docs/SourceLevelDebugging.html#object-lifeti...

Zsh 5.0 released 14 years ago

My favorite feature is that zsh offers vi mode when editing your commandline, just press ESC.

Just some numbers, based on my hardware:

Lion OS X install on disk: 7GB

iOS 5.0.1 install: 1.7GB

My MacBook's RAM: 8GB

iPod Touch: 512KB

MB's disk size: 100GB

iPod Touch: 8GB

So: Maybe they removed 80% of the API in general because the iPhone/iPod touch is only 10-20% of a normal computer? Something had to go.

Anyone remember Jordan Hubbard, co-founder of the FreeBSD project? He joined Apple around that time. I am not really sure how he compares to Linus but working for Apple does not go well with wanting to be a public person.

Why software sucks? 14 years ago

who opens a ticket in the bug reporting database detailing what they want to do and then letting IT support do it.