582 karma · joined July 25, 2011
I built Farseer Physics Engine 3.0, SimpleS3 and about 25 other open source projects. Check them out over at https://github.com/genbox
I am also the founder and director of Chronos, a platform for investigating large-scale security incidents using forensics techniques.
The obfuscation might prevent the intern from figuring out what is going on, but there are plenty of barcode-scanning apps for phones that show you the data stored in a barcode.
I mean of course Microsoft Recall. This delightful AI addition to the next generation of Windows PCs would have taken regular snapshots of everything you do on your computer.
Security and privacy are not the same thing. I get the frustration about Microsoft's security practices, but equating those two is a mistake.
I was handling security incidents on a large scale with tools that attackers would purposely circumvent with special filenames/inputs. Instead of fighting against the grain, I decided to build a platform with a heavy focus on correctness. Any deviation from the data specification would stick out as a sore thumb and immediately detect anti-forensics and other tricks.
Today, I have a vast compendium of anti-forensics tricks, such as commands not getting written to history, files that cannot be deleted or copied, and much more.
Suffice to say that if you are parsing the output of any tool, you are vulnerable to a whole slew of adversarial techniques.
If a small change to the seed mixing (literally moving a line from the end to the beginning of the function) increases the security with no penalty to performance, then we might as well make the change.
One can easily obtain the recovery key on a system by doing "manage-bde -protectors -get c:" in an admin command prompt. This is not a vulnerability, it is by design.
But underneath the covers, there is an extremely powerful compiler (Roslyn) and build-system (msbuild). Combine that with the flexibility of C# and you can develop pretty much anything.
C# once had Code Contracts[1]; a simple yet powerful way to make formal specifications. The contracts was checked at compile time using the Z3 SMT solver[2]. It was unfortunately deprecated after a few years[3] and once removed from the .NET Runtime it was declared dead.
The closest thing C# now have is probably Dafny[4] while the C# dev guys still try to figure out how to implement it directly in the language[5].
[1] https://www.microsoft.com/en-us/research/project/code-contra...
[2] https://github.com/Z3Prover/z3
[3] https://github.com/microsoft/CodeContracts
I've built a scripting language with a full lexer and parser. It is capable of giving errors in both stages. It does not make it compiled or even interpreted. It is first when you execute the instructions of the language it becomes an interpreted language.
It is a good point that "compiled" is not a boolean property. A language like C# can be interpreted, JIT compiled and AOT compiled - it all depends on the toolchain used.
However, usually developers refer to compiled languages as those that gets translated down to machine instructions, and to my knowledge, CPython does not do that.
The hash function[1] takes an arbitrary input and generate (in this case) a 32bit integer. This is nessecary to index values that are not integers (such as byte arrays or strings). It also doubles as a way to deterministically randomize values across the keyspace for better distribution of keys.
[1] https://github.com/mkirchner/hamt/blob/main/src/hamt.c#L377
You are right that there is an expecation or assumption of such (from the users), which makes it even more interesting when it breaks.
Locking a thread for every allocation of a string is very likely cost-prohibitive and not a great trade-off for the common case. It would make more sense to add something like StringFactory.CreateString(char[]) and instruct developers in using it if thread safety is nessecary.
In recent days, as the Earth has reached its highest average temperatures in recorded history, scientists have made a bolder claim: It may well be warmer than any time in the last 125,000 years.
It is almost like 130,000 years ago it was even higher than now[1]. It is not that the article is factually wrong, but it removes legitimacy from the Climate Change debate if we use biased or skewed datasets.
[1] https://upload.wikimedia.org/wikipedia/commons/thumb/c/ca/EP...
I can however find official documentation that backs up what the admins are saying. The new Data API terms says they no long allow commercial use of their APIs and might implement a cost pr. request. It links to the Data API docs that says 60 req. pr. minute are free as long as it is non-commercial. I would think unofficial reddit apps goes under the non-commercial clause.
To me it looks to be a complete overreaction by the Reddit community because of a miscommunication on parts of a single developer and the Reddit orgs too slow reaction to stop it from spreading.
With more than 500 forensics cases with my name on it, and a substantial amount of them being RCE based, I'd say it is more than just guessing.
There is no need to spend time on developing a exploit when you can find hundreds new ones every month on GitHub. DEP and ASLR are also not used in embedded devices where memory management in the firmware is atrocious.
I would say that breaches often are related to RCE that ultimately derives from buffer exploitation. They are notoriously difficult to detect with forensics techniques, so they might not be discovered and tracked.