Hacker News Reader

DCoderon PHP: The Right Way

There's an easier-to-read version for those who don't like PDF: http://jeena.net/images/2012/php-the-good-parts.jpeg :-)

DCoderon A Quiz About Integers in C

The intro text explicitly defines those datatype sizes:

In other words, please answer each question in the context of a C compiler whose implementation-defined characteristics include two's complement signed integers, 8-bit chars, 16-bit shorts, and 32-bit ints. The long type is 32 bits on x86, but 64 bits on x86-64 (this is LP64, for those who care about such things).

DCoderon Linus Torvalds won't do github pull requests

Reddit[1] found the "Joseph" in question, his comments are still visible in his public activity stream: https://github.com/pirtlj

[1] http://www.reddit.com/r/programming/comments/tionj/linus_tor...

DCoderon All April Fools' Day Jokes on the Web Are Here (so they don't clutter HN)

Leave Stack Overflow open in the background for some time to get a special message from a Unicorn Clippy.

DCoderon A Better Javascript Date Picker/Calendar

Currently I'm using a heavily hacked third party time picker that was patched onto jquery ui datepicker, and half of the advanced datepicker functions don't work or work badly. It took me a day of research and at least two days of hacking to make this work well: http://imgur.com/87e9g.png , I'd love to see a replacement that just works without any hacking needed :)

DCoderon A Better Javascript Date Picker/Calendar

Looks nice. Any plans to integrate a time picker?

DCoderon Why Every Professional Should Consider Blogging

If you're hosting your own WordPress (or any other solution, actually), you really should be keeping an eye for any updates. WP is a popular hacker target, even waiting a day after an announcement can be enough to get hacked. Thanks to Muprhy's law, such an announcement will definitely come when you're on vacation somewhere.

That's, of course, assuming that such an announcement is made in the first place. Last year the timthumb bug was being exploited and not all theme download sites bothered to alert the users that the themes were vulnerable.

DCoderon WebGL Liquid Surface

> I was kinda looking forward to see the "water surface" in 3d with lighting and reflection

http://madebyevan.com/webgl-water/ might be more interesting then.

DCoderon Michael Moritz on Klarna's $155M Round

I implemented Klarna as a payment option in one e-shop recently. Said e-shop operates in Denmark, Sweden and (as of this week) Norway, but the Klarna option is only available in Sweden. The owner said that without this option it wasn't worth even opening the Swedish version.

Klarna also requires your Social Security Number, in those countries which use it, as well as other information: http://integration.klarna.com/en/testing/test-persons .

DCoderon Reading local files in JavaScript (HTML5)

I have used this for a few things. One of them that was the most interesting to code, even though very narrowly useful, was a way to compare two memory dumps from a C++ game to find the objects that don't match (after the game detects a checksum mismatch between online players, the players are asked to make these dumps, and then submit them to us; We drag'n'drop two dumps into a webpage and get a printout of objects that don't match). Admittedly a C++ app would have been a lot faster, but Chrome still managed to read the dumps and extract the relevant info in several seconds.

DCoderon Securing PHP

Sometimes you really need to invoke external commands through exec(). In those cases, make sure to use escapeshellcmd() and escapeshellarg().

DCoderon Serving at the Pleasure of the King

You're probably referring to http://www.readwriteweb.com/archives/open_thread_the_interne... .

DCoderon From C to C++: A quick reference for aging programmers

x86 assembler doesn't.

I mentioned C+++ Templates: The Complete Guide - it demonstrates a similar template (15.2.4) to add two values, and even with simple addition it points out a flaw similar to this one (and admittedly more likely to come up in the real world) - determining the return type for, say, int + char. Their solution is a traits class with a specialization for each pair of types. Sounds complicated, but then again, so is writing a template function to perform simple multiplication.

DCoderon From C to C++: A quick reference for aging programmers

  template <class ttype>
  ttype multiply(ttype a, ttype b)
  {
    return a * b;
  }

int * int doesn't always fit in an int. C++ Templates: The Definitive Guide suggests using a traits class to solve problems like this. Templates are a complex subject in general, and I wouldn't recommend using them without having read the aforementioned book.

DCoderon Time-zone database used by Unix shut down due to IP litigation

You could also use 13 months of 28 days each - that totals 364 days as well.

DCoderon We built a cloud platform for PHP. Wait… what?

In my experience, writing PHP on one platform and deploying it on another doesn't always work out. Your developers have to be aware of where their app will be deployed and the specifics of that OS.

> I think PHP support on Windows is as good as on any other OS.

I have seen several things fail in that environment - escaping shell commands and arguments is problematic, invoking external executables is only reliable when full path is used [1], realpath() (used to, at least) chokes on / as a directory separator... Autoloading classes based on classname => filename can produce funny results. File uploads can work differently (case sensitive filenames - foo.jpg and foo.JPG can coexist in Linux, but not in Windows).

On the other hand, there are things like the new MSSQL PDO driver that only exist in the Windows world.

---

[1] Windows 2003 Server was running our app, which invoked Imagick similar to `convert $input.jpg $output.jpg`.

Worked just great for half a year.

Deployed to a second machine, Windows 2008 Server.

Command execution fails silently.

Change %PATH% to be identical to the old server's one.

Restart.

Still fails.

Compare phpinfo().

$_ENV['PATH'] in new server doesn't match %PATH% (it appears to be re-sorted with windows folders first), $_ENV['PATH'] in old server matches %PATH%.

Messing around with new %PATH% changes nothing, new server keeps giving PHP the silently-reordered %PATH%.

Nothing helps, short of specifying full path to `convert`.

A very fun thing to debug.

DCoderon Microsoft security tools nuking Chrome browser

Anecdote: one side-project I'm working on is a simple DLL injector that can insert arbitrary DLLs into other processes at launch time. It's been used out in the open for over three years, but only one security suite (Comodo) blocks it from running. Is modifying other processes' memory not as suspicious as Chrome's behaviour?

DCoderon Why not just use an IDE if you want IDE features?

PyCharm is produced by the same guys who created Resharper and a lot of other great tools like PHPStorm and TeamCity. Been using PHPStorm for nearly a year now, and I still find new things it can do.

DCoderon Showing impossible to understand Javascript: Obfuscated Quine

Nice trick!

  var f = []['concat']; // Array.prototype.concat
  f()[0]; // returns the global window

The rest of the script appears to mostly be old tricks - convert stuff to strings, combine characters in strings to compose expressions, pass them to eval...

DCoderon Showing impossible to understand Javascript: Obfuscated Quine

1. Function to String conversion produces different results in different browsers.

  var f = []['concat']; (f + ''); 
  // Chrome
  "function concat() { [native code] }"
  // IE (9)
  "
  function concat() {
    [native code]
  }
  "

This script tries to extract letters from that string representation, which fails if the string is different. (This is also used as an anti-debugging measure in some JS malware, to prevent researchers from replacing document.write with alert() or similar.)

2. Iterating over the window object doesn't work the same way in IE: http://blogs.msdn.com/b/ericlippert/archive/2005/05/04/41468...

In particular, this script tries to extract strings 'sessionStorage', 'getComputedStyle', 'onchange' by iterating over the window object, all of whom fail in IE.

DCoderon Is learning Assembly Language worth the effort?

- If you want to reverse-engineer existing code (security checking, malware analysis, unofficial bug fixing [1]), then of course yes.

[1] http://www.hexblog.com/?p=21 - The author of IDA Pro disassembler wrote a hotfix for the WMF vulnerability in Windows about a week before MS released a fix. From what I've heard, his site completely tanked due to all the downloads.

DCoderon Windows 8: Improving our file management basics: copy, move, rename, and delete

Am I the only one who still uses Total Commander instead of Windows Explorer whenever possible? I'd love to see this multiple-jobs-in-movecopy-queue functionality in it, but in all other situations it suits me so much better.

DCoderon C++ 11 Approved

VC++ 2010 supports a lot of them: http://blogs.msdn.com/b/vcblog/archive/2010/04/06/c-0x-core-...

I've gotten into the habit of auto'ing most variables nowadays, it's quite convenient not having to type

     LongTemplateName<ClassName> variable = LongTemplateName<ClassName>::StaticCollection.Find(something);

DCoderon C++ 11 Approved

In MSVC, this warning's off by default: http://msdn.microsoft.com/en-us/library/wzxffy8c(v=VS.100).a...

DCoderon Synchronous RTS Engines 2: Sync Harder

Part 1 of the post: http://news.ycombinator.com/item?id=2747344

----

Small clarification: I shared some info on the internal workings of Command&Conquer in the comments of the last post. The author of this post took that to mean that I was one of the developers. That's not true - I'm just a bored coder with a disassembler and (not so much lately) free time on my hands. Some friends of mine and I reverse engineered large amounts of code in those games to add new functionality or fix bugs, which there were plenty of...

DCoderon How 38 Monks Took on the Funeral Cartel and Won

There has grown in the minds of certain groups in this country the idea that just because a man or corporation has made a profit out of the public for a number of years, the government and the courts are charged with guaranteeing such a profit in the future, even in the face of changing circumstances and contrary to public interest. This strange doctrine is supported by neither statute or common law. Neither corporations or individuals have the right to come into court and ask that the clock of history be stopped, or turned back.

R. A. Heinlein, "Life-Line", 1939

DCoderon Synchronous RTS Engines and a Tale of Desyncs

C&C series, at least the older pre-Generals ones, work the same way - hashing the full state in each frame and sending it over. When a desync is detected, it dumps checksums of the last 256 frames along with current frame's checksums of each object into a log file, these can be compared. The logs also contain brief printouts of most objects on the map, and we actually found an uninitialized field and a few more serious bugs thanks to these printouts.

The cheaters also found a small loophole in the hashing, because only specific fields are hashed and not entire objects, one important field was missed that gave cheaters an unfair advantage of seeing the current targets of their opponents' units. It is easy enough to fix when you know about it, fortunately.

DCoderon TrueCrypt Discrepancy

Sorry for double posting, but those additional resources are boot loaders for Rescue Disks. Why and how do they differ from normal loaders, I don't know.

DCoderon TrueCrypt Discrepancy

Yes, that's what I said... but this is the resource section of the installer, not of the extracted executable. The extracted executable is the same and doesn't, as far as I can see, make any references to those resources.

It is possible they recompiled it with the new license and the installer project was configured to carry all resources it found in specific folders, while the executable was configured to only include specific resource files... I used Extract instead of Install because my system disk is already truecrypt'ed, but if you can provide the files the installation creates, I could compare those too.

DCoderon TrueCrypt Discrepancy

I downloaded the setups from the links, and used the "Extract" option in the installers. It appears that only the license was changed: http://pastebin.com/G3H78tSt

Edit: However, the installer binaries' sizes differ by 113280 bytes, while the extracted files' size totals differ only by 925 bytes.

Edit 2: the majority of the size difference is in the .rsrc section, the newer version contains several additional binary resources, some of which appear to be boot loaders. And the text resources are different... is it possible the installed versions are different and the extracted ones are not?