Hacker News Reader

adr_on Asahi Linux Progress Report: January/February 2021

For my part, I loved the long form, in-depth post, and I learned a lot. I'll admit breaking it up visually with some diagrams or photos is tempting (maybe a photo of your serial setup?) but I felt the explanations were all clear without it.

adr_on Clang-11.0.0 Miscompiled SQLite

Clang 11 hasn't been released yet, right?

adr_on Magnet doubles hydrogen yield from water splitting

Hydrolysis is chemical breakdown via reaction with water. This is electrolysis. But it's a popsci article, so they put that in the subtitle. "Splitting" makes sense to people who don't use terms like hydrolysis and electrolysis frequently.

adr_on Google discloses three severe vulnerabilities in Apple OS X

https://code.google.com/p/google-security-research/issues/li...

They haven't published Cisco bugs, but they do have a pretty broad scope.

adr_on Reflected File Download: A New Web Attack Vector

This sounds basically the same as:

http://lcamtuf.blogspot.com.au/2014/03/messing-around-with-d...

adr_on Brainfuck beware: JavaScript is after you (2012)

It is a fun mental exercise. I love this stuff, and that's the motivation.

I once wrote an emulator for a 4 bit microprocessor in Befunge (a 2D esoteric programming language). Then, I was definitely showing off something that really does not matter. 100% useless.

This is a little different. The motivation is the same, but it also proves that you cannot sanitise Javascript by removing letters or words. It's very easy to assume that such sanitisation works, and such an assumption can be a security-critical mistake. I've actually read this article before because I needed to solve such a problem.

adr_on Optimizing Big Number Arithmetic Without SSE

Unsigned integer overflow is defined.

I agree that the carry flag shouldn't be exposed directly, but the ability to express "add and check for overflow" would be useful and allow for these optimisations where the architecture supports it.

Edit: But if you want to exploit the processor to its fullest, go with assembly. The compiler is good, but proving optimisations is a hard problem, and complex, single-instruction-specific optimisations aren't going to take off any time soon.

adr_on Intel In Bed with NSA?

If the NSA is working with Intel, they're not going to bother with an RNG... The processor is the most trusted part of the computer security model - why would you choose bad random numbers as your attack vector?

Relevant talk: Hardware Backdooring is Practical - Jonathan Brossard https://www.youtube.com/watch?v=j9Fw8jwG07g

adr_on Some decompiling, reverse engineering, and keygen tutorials

Absolutely agreed, I just thought it was a bit of an expensive suggestion for someone thinking about getting back into the hobby.

adr_on Introduction to x64 Assembly

I wouldn't call it more verbose.

AT&T:

    sub    $0x8,%rbx
    callq  *%rax
    mov    (%rbx),%rax

Intel:

    sub    rbx, 0x8
    call   rax
    mov    rax, [rbx]

Intel can be written with:

    mov    rax, QWORD PTR [rbx]

But it's redundant and assemblers don't expect it. It's only necessary in a handful of places to avoid ambiguity, as opposed to the incessant size suffixes and $/% prefixes, which make AT&T feel more verbose to me. Definitely a matter of familiarity, though.

adr_on Some decompiling, reverse engineering, and keygen tutorials

For a mere US$1129...

adr_on Some decompiling, reverse engineering, and keygen tutorials

This is a bad answer, but when I'm on Linux, I use objdump and gdb for most of my reversing. They don't really compare to IDA, though. xxd is fine for hex editing, especially in the context of simple conditional jump changing, although there are much better open source hex editors.

adr_on Hello from a libc-free world

I wrote an actual libc-free "Hello World" program for Linux: http://codepad.org/rUckf7jR

It should work as 32-bit or 64-bit and compile with clang or gcc. It compiles to about 11 assembly instructions.

To produce a fairly small file:

    $ clang -nostdlib -O3 -o helloworld -m32 helloworld.c
    $ strip helloworld
    $ strip -R .note.gnu.build-id ./helloworld
    $ wc -c helloworld
    428 helloworld

adr_on Poll: How many programmers don't know about bit-wise operations?

I've forgotten when I learned this stuff. Recently, I've been teaching people who have been programming for years how to reverse engineer. It's surprising how much trouble they have grasping trivial operations like "a & a" or "b ^ b", and understanding arithmetic equivalents, like using "a << 2" to multiply by four. Two's complement also seems to challenge a lot of people - I suppose an intuitive understanding comes with time, but I'd expect people to pick that up if they've been writing C for a while.

I do feel that this poll is biased, because people prefer to declare their knowledge than admit their ignorance.

adr_on How To Write A Calculator in 70 Python Lines

  try:print(lambda x:eval(x)if all(i in'0123456789.*/+-'for i in x)else'syntax error')(raw_input())
  except:print'error'

adr_on USSD code to factory data reset a Galaxy S3 can be trigged from a HTML page

The approach of prompting the user "Do you want to call this number?" is far simpler and safer. After all, you could probably use tel: links or tel: redirects or something if the frame didn't work.

adr_on It's 2012, HTML5 is awesome, and I'm surfing a PDF

I just went on a journey through the remains of gopherspace. Thank you :)

adr_on We Who Value Simplicity Have Built Incomprehensible Machines

BCD is not a bad idea... It's not great, you can pack arbitrary precision values more tightly, and you rarely need to display them (even when you do, the screen is slower than the maths), but it's useful for a bunch of things and it's nice to think about.

But does it really need an instruction on every modern computer's processor to make it that tiny bit faster?

When was the last time you used a program that used that instruction? I've never run in to it (and I spend a decent amount of time looking at x86 assembly). Nonetheless, it shows up at the top of every instruction reference - you need to implement it if you want to simulate x86 correctly.

But at least I can run some old 8086 code on my computer... Right?

adr_on Hewlett-Packard to Cut About 30,000 Jobs (9% of workforce)

They really are decimating their workforce. Ouch.

adr_on Octogit - Giving git more tentacles

Would you mind using getpass if the "octogit login" command is only given one argument? It'd be cool to be able to use it with other people in the room and without leaving it in the shell history. It would also be nice to know where my password is being stored and to have a logout command that securely erases it.

http://docs.python.org/library/getpass.html

adr_on Single-block collision for MD5

If the salts are different, it will definitely change.

On the other hand, using the same salt twice will change the hash if it's put before the data, but not if it's put after the data.

Given an MD5 collision, you can apply a common suffix and still have a hash collision. Applying a common prefix changes the state the hash process is in when it reaches the colliding data and this breaks the collision.

adr_on Xkcd Password Generator

Using shuf, my favourite, rarely used gnu textutil.

    shuf /usr/share/dict/words|head -4|tr '\n' ' ';echo

adr_on Can we believe our eyes? Misleading people with Unicode.

I've had a Fасевоок Offіcіal account lying around for a year or so.

adr_on Ask HN: The most useful equations/instructions in the event of an Apocalypse

"DON'T PANIC"

adr_on Google Instant cannot be turned off..

Is this a security concern or a usability annoyance?