Hacker News Reader

Comment by IshKebab | Hacker News Reader

Very impressive. Maybe most impressive is that you got your 12 year old daughter to play this!

When can I expect the CHERI version? :-D

> When can I expect the CHERI version? :-D

"CHERI has three central design goals aimed at dramatically improving the security of contemporary C-language TCBs, through processor support for fine-grained memory protection and scalable software compartmentalization, whose (at times) conflicting requirements have required careful negotiation in our design."

:) I don't think so

The game is just a lot more difficult, you have to exploit everything as a UAF

If I understand CHERI correctly it would be UAF + only intended pointer operations on pointers.

Yeah, you get in-bounds access to the allocation so sub-allocation attacks/cross field is in the play. It's kinda a pain in the ass to turn that into a useful exploit primitive though, and anyways UAF is much easier because (at least with classic allocators) you can corrupt any allocation type. Hardened allocators make exploitable overlaps much harder though and so in practice CHERI's spatial safety might be enough to kill tons of bugs.

CHERI can provide heap temporal safety to protect against use-after-free (really, use-after-reallocation; use-after-free is harmless until the point at which the memory is being used for something else, and deferring lets you batch revocation sweeps), it's just not on by default yet as it's a bit too experimental, but we're working to stabilise it more for our next CheriBSD release.

Pretty sure that's the joke.

Yeah, I were programming 6502 assembly at 12. Not that easy to do for a 12 year old now with today's computers

They can in the browser like skildrick but turning it into a game is a great motivator.

https://skilldrick.github.io/easy6502/

It's not too hard on a Raspberry Pi or Microbit

There are seveal books on assembly language programming for various Raspberry Pi systems, such as:

https://blog.adafruit.com/2021/09/21/an-interview-with-steph...

If you restrict it to similar capabilities, for example target a contemporary computer with freedos, it's not that much different.

A typical age to get into computers back in the 8-bit days.

From time to time I watch Jim Butterfield's Commodore 64 tape: https://www.youtube.com/watch?v=J9WnHuGjZ38 and I think just things were much easier

computers now are more like magic, nobody knows where your files are, or which programs you own or where they are even running.

It's not an unusual age to get into computers now. It's an unusual subject though! Back in the 8 bit days you didn't have the option of writing 3D games and websites and apps and so on.

We had very crude 3D, Elite and Starglider style, and BBS instead.

Dylan Cuthbert once argued that machine code is easier for younger minds because each instruction is less abstract.

https://www.gamesindustry.biz/machine-code-is-for-kids-artic...

I agree, though I don't think that core x86 (especially in real mode) is as bad as he seems to think - it started out as a 16-bit extension to the 8080 after all, and can be used that way.

Low-level computing is even more amazing when you learn how to decode and execute simple instructions with a few logic gates.

Beyond that is in many ways a matter of interfacing and scale (at which point abstraction layers can be very useful.)

Reply on news.ycombinator.com