Mordak

7 ms·

1.
by Mordak 2mo ago
The article points out what I think is the crux of the discussion: With Fil-C they become crashes . Errors manifest at runtime, not at compile time. I realized some time ago when I talk to people about rust, I don't really mention mem
2.
by Mordak 6y ago
I feel like rust has some good sweet spots right now. I care about these but maybe not everyone else does. - Parsing untrusted inputs. nom[1] is a joy to use, and lets you kind of effortlessly and fearlessly process random input from wherev
3.
by Mordak 6y ago
Something like the cxx crate[1]? You specify your shared objects between C++ and Rust, and it spits out code for both sides. The guy who maintains it said in the reddit thread[2] about this same topic that the Google people have been sendin
4.
by Mordak 6y ago
Nah. We built a new project in all "modern C++". It is 100% shared_ptr, unique_ptr, std::string, RAII, etc. It initially targeted C++17 specifically to get all the "modern C++" goodness. It segfaults. It segfaults all th
5.
by Mordak 6y ago
Sorry if you interpreted my comment as advocating for tossing out grep or ls - that certainly wasn't what I was getting at. As one of the OpenBSD people that happens to quite like Rust, I'm aware of some of the other devs who have
6.
by Mordak 6y ago
There are actually several of the OpenBSD devs that have been writing Rust lately. Some are doing it for work, some from personal interest. Opinions vary on how much people like it. Rust and OpenBSD share a lot of technical values though so
7.
by Mordak 7y ago
FlatBuffers are not self-describing. FlatBuffers, Protobuf, Cap'n Proto, etc., all require an external schema configuration that you compile into a code chunk that you include into your program. Without this it is impossible to make se
8.
by Mordak 7y ago
At my work we recently went through a large exercise to decide on a common data storage format. The contenders were JSON, MessagePack, and Avro. MessagePack won because: - Msgpack serialization and deserialization is very fast in many langu
9.
by Mordak 7y ago
Please, no. My experience with the scons build cache is that it exists solely to introduce mysterious compile failures when the cache is out of sync. Eventually you get so distrustful of it that you end up just blowing away the cache as a m
10.
by Mordak 7y ago
I have exactly the opposite experience: I do not want to write a program to compile my program. Having used both scons and waf, and also having used make, cmake and cargo, I would take any of the last three over scons or waf in a heartbeat.
11.
by Mordak 7y ago
pledge[1] allows a process to promise the kernel that it will restrict itself to a given subset of system calls. So you call pledge() with the set of syscalls you need, and then if your application does something else then it will be killed
12.
by Mordak 8y ago
Keep reading. The upgrade guide has two parts: the first part that assumes the common configuration (you have console access and are using the OpenBSD boot loader), and the second part[1] in the event that you do not. If you have console ac
13.
by Mordak 8y ago
It depends on the function. Many things will contribute. If your CPU can keep the cookie in cache then loading it repeatedly will relatively fast compared to hitting main memory. If your branch predictor can figure out the jmp over the int3
14.
by Mordak 8y ago
Hey PaXTeam, thanks for having a look! I wrote the implementation, so I can answer some of these. 1. We don't silently skip instrumentation. If we can't find a free register then we will force the frame setup code to the front of
15.
by Mordak 9y ago
Wow, that's some seriously selective quoting from the krackattacks link there. The one that is relevant to the question of whether or not OpenBSD patched early without permission is this: > As a compromise, I allowed them to silentl
16.
by Mordak 9y ago
And looking at the commit logs for NextBSD [0] it is dead now too. [0] https://github.com/NextBSD/NextBSD
17.
by Mordak 9y ago
Thanks! I see what you mean on getPassName - I missed it during revisions.
18.
by Mordak 9y ago
Ah, Return Flow Guard is cool - I did not know that MS had done that! I like SafeStack, but was disappointed to learn about the limitations with shared libraries. Some SafeStack is better than no SafeStack though, and it can probably be tur
19.
by Mordak 9y ago
Oh, yes. There are other ways to kick off ROP chains that do not involve stack corruption. For these attacks, Retguard will only pollute the gadget space by inserting these return-address permuting instructions before some fraction of the c
20.
by Mordak 9y ago
I think the LLVM CFI options only apply to C++ programs? Microsoft's CFG is cool, but works on the other end to this - by protecting CALL instructions instead of RET. Stack cookies are similar, yes. This mechanism combines two ASLR-ran
21.
by Mordak 9y ago
You have it - if a stack address can be leaked, and you can follow the control flow to figure out the difference between the address you leaked and the address you're going to be dumping your ROP chain into, then you can just xor the g
22.
by Mordak 10y ago
I use ruby's trailing conditionals exactly this way all the time - it makes me happy to see someone else using the same pattern. I also use it at the start of functions in order to sanity check arguments: def do_something(arg1, a
23.
by Mordak 10y ago
vultr takes paypal - it's the only way I've ever paid them.
24.
by Mordak 10y ago
I've been running on vultr $5/mo boxes for years now. No complaints - the boxes are snappy and the web UI/dashboard is nice. I originally picked them because they supported FreeBSD out of the box, and let you upload your own
25.
by Mordak 10y ago
Also vm-bhyve, which I've been happily using since 2015. Also amazing, also dead simple. https://github.com/churchers/vm-bhyve It is nice that there are multiple wrappers around bhyve - competition is good, and it
26.
by Mordak 10y ago
> When the military starts using meal replacement powders instead of MREs, then I will reconsider my position on this issue. The primary challenge with feeding soldiers in the field is not efficiently delivering nutritionally complete f
27.
by Mordak 10y ago
I use macports, but I had never switched away in the first place. My short list of reasons include macports keeping everything tucked neatly away under /opt by default, which means I can blow it away without having to worry about break
28.
by Mordak 10y ago
For what it is worth the project does provide regular binary updates for both the base system and ports for -current (snapshots). If I were to guess, I would guess that one of the reasons that the project does not provide binary updates for
29.
by Mordak 10y ago
> The Javascript monoculture that exemplifies the modern web is perhaps the greatest thing holding back good cross-platform development. I dunno, there was a time when javascript wasn't the only game in town, and it sucked. ActiveX
30.
by Mordak 10y ago
Ports receive security updates on the -stable branch in CVS, but the project does not provide updated binary packages for the -stable branch after the release. M:Tier provides updated binary packages, or you can always just update the -stab

More ›