ekiru

> If you read the notes you'll see scary terms like "buffer overflow" but "probably wont work on windows because windows uses /GS."

That's not true of the one issue which mentions Windows using /GS. For that issue (814), the bug actually says "Exploitation is likely still possible on Windows, but may be more difficult as they do use /GS on that platform."

Of the other eight bugs linked, four in the link were confirmed to allow code exec as NT AUTHORITY\SYSTEM on Windows. One more is "trivially exploitable" and allows reliable control of the instruction pointer but didn't specify as what user the code is running.

I think he was working on the start page for Mozilla 1.0 in 2002. The credits page [0] for the 1.5 start page lists him among the contributors to 1.0's.

I couldn't find any remarks from him in 2002 about Mozilla's chances, but in 2001 he said "I think not. In a world of free browsers, the flavour of the month can change like that." [1] in response to a mailing list message saying that Mozilla would not be viable competition on Windows due to bugs, which is somewhat less optimistic than the "pretty good" odds in hindsight, but it's much more so than "very long odds against us retaking any browser market share".

[0]: http://www-archive.mozilla.org/start/1.5/credits.html [1]: http://marc.info/?l=mozilla-ui&m=100168107415632&q=raw

But there's also no reason why the most widely used HTTP fetcher in embedded software should be the same piece of software as the most widely used command line HTTP fetcher on workstations and servers, most of which do not care much about shaving kilobytes.

char is also allowed to be a signed type, in which case overflow is undefined behavior.

Assuming you are in fact the other newly created account with the random-looking username above, then you explicitly stated that Signal "forces you to send messages over Google servers".

This is straightforwardly false: the user does not send anything over Google servers in the course of using Signal. Signal sends an empty push notification over GCM to users who have received a message; while technically true, to, in a discussion of a messaging platform, refer to empty push notifications as sending "messages over Google servers" is prone to misinterpretation as false statements that the "messages" going over Google servers contain any information about the messages being sent over the messaging platform.

Additionally, the use of GCM only allows Google to extract metadata about when a user receives messages; GCM messages aren't necessary to notify you when you've sent a message, so I'm not sure how you propose that Google can infer when a user sends a message and who that user is messaging. Could you elaborate on this?

The _prettyPrint [1] and _getPasswordTemplate [2] functions they use to get from the HMAC to the actual password seem to have a lot of issues:

- _prettyPrint calls into _getPasswordChar which will then take the character code modulo the length of the array of possible characters [3], which is usually going to be biased if the character code is not uniformly distributed between 0 (inclusive) and a multiple of the length (exclusive).

- It's even worse because the input to _prettyPrint is the HMAC encoded as a hexadecimal string. The impact of this depends on the size of the possible character array, but in several cases, some of the options can never be chosen and others will be chosen twice as often as others that can be chosen.

- Using the hex encoding also drastically reduces the number of possibilities for a given length even if that input was then used in a less flawed fashion.

- _getPasswordTemplate appears to treat a password with lowercase/uppercase letters as a series of alternating vowels and consonants (by appending 'vc' or 'VC' to the password template).

- It also generally seems to define "password containing X and Y char types" as "password containing X char type, then Y char type, then X, then Y, and so on".

[1]: https://github.com/lesspass/core/blob/master/lib/index.js#L8...

[2]: https://github.com/lesspass/core/blob/master/lib/index.js#L6...

[3]: https://github.com/lesspass/core/blob/master/lib/index.js#L1...

It is not true that the ruling says that "this only applies to those who willingly and intentionally link to content they _know_ is illegal, _and_ do so for monetary gain." The ruling explicitly states that the first condition is sufficient to constitute a 'communication to the public' and that, when determining whether posting a link to such content constitutes a 'communication to the public', we must assume that the second condition implies the first condition. This last bit is in the ruling itself. In its consideration of the questions referred, the court qualifies a similar statement with "in so far as that rebuttable presumption is not rebutted", which may at least help those who can disprove that presumption.

Two relevant portions of the court's judgment (my emphasis added to the latter):

> In contrast, where it is established that such a person knew or ought to have known that the hyperlink he posted provides access to a work illegally placed on the internet, for example owing to the fact that he was notified thereof by the copyright holders, it is necessary to consider that the provision of that link constitutes a ‘communication to the public’ within the meaning of Article 3(1) of Directive 2001/29.

> or whether, on the contrary, those links are provided for such a purpose, _a situation in which that knowledge must be presumed_.

What the decision said is much closer to "or" than "and".

Such linking is, as your quote says, not infringement if it is done without pursuit of financial gain and is done by someone who does not or cannot reasonably know the illegality of the linked material. In other words, they decided that linking to illegally published material is copyright infringement if it was done for commercial purposes or by someone who knew that the linked material was illegally published.

The court also concluded that, if the linking was done for commercial purposes, it must be presumed that the person publishing the links knew that the linked material was illegally published.

It also means that someone else can sue him personally and force him to flee judgement and live amongst the penguins.

Ah, that makes a lot more sense. Without that detail, it sounded like you were effectively blackmailing the scammer's parents rather than just getting paid the agreed amount.

Why did the scammer's mother pay you "far more than the card is worth"?

The first quote you've referenced doesn't make mention of the fairness of the justice system.

So, there were two quoted judges bemoaning its effects on the fairness of the justice system, two talking about how their jobs are boring without trials (the quotes included below), and four that do not clearly talk about either of those.

---

> “We’d love to have more trials; most of us enjoy trials,” said Judge Alvin K. Hellerstein, who joined the bench in 1998.

---

> In April, when Judge Shira A. Scheindlin resigned from the bench after more than two decades, she said the decrease in trials was one consideration for her departure. “Trials are way, way down,” she said. “The building’s quite dead.”

According to GnuPG (more specifically "gpg (GnuPG/MacGPG2) 2.0.28"), that key does not contain any valid user IDs. Is there some widely used PGP implementation that does accept that? Have you found any other similarly weak keys that GPG will consider valid? If so, I'd find it very interesting as a PGP user, but if it is limited to keys that GPG, at least, recognizes as invalid, I'm not sure what impact it has for me.

I think that was a retweet of https://twitter.com/dyn___/status/738079794689019904 , which was tweeted by someone at NCC.

I'm confused and am not sure if you're thinking of something else or if I'm quite misinformed about Lojban. I don't think lojban has suffixes at all (prefixes, on the other hand). For -j specifically, the only words in lojban which are permitted to end in j are names, but there it's not obligatory. Names are required to end in a consonant, but there are at least a few that are more common than j, I think.

I haven't been using Perl 6 lately, but, as of a few years ago when I did, some of the more notably unusual features or planned features were:

* Grapheme-level string processing, even when there's no pre-composed Unicode codepoint for the grapheme. I think Swift is now doing this, too, but I'm not sure if anyone else is.

* Perl 6's grammars are to an extension of parsing expression grammars what the regular expressions in Perl 5/Ruby/JavaScript/etc. are to an extension of regular expressions. One can use PEGs (or other grammar formalisms) in any language with a library or code generator, but, with a few exceptions like Parsec, it's usually not nearly as convenient.

* Roles, similar to the traits concept developed by Nathanael Schärli, Stéphane Ducasse, Oscar Nierstrasz, and Andrew P. Black (and present under that name in e.g. Squeak Smalltalk and PHP since 5.4). Roles/traits are similar to mixin-style multiple inheritance, except that, when including multiple traits with conflicting methods, the including class must explicitly resolve the conflict. Mixin-style systems use an implicit linearized method-resolution order, which is more fragile because newly added methods in earlier mixins can silently override methods of the same name from another mixin that the caller was actually intending to call.

* Multiple dispatch is not unique to Perl 6, but it's not especially common, and it's very convenient.

* Configurable object representations. For example, a class can be defined to use the default P6opaque representation, which is I think usually implemented as a pretty standard struct-like representation with properties at fixed offsets. Other possibilities might be a hash table representation, where an object is represented by a hash table and attribute access is done by accessing the values of appropriate keys in the hash table. If one wants to forgo the optimizations allowed by fixed representations, one can even define a class with `is repr(*)` to allow individual objects of the class to be created with different representations.

The article you linked to does not say that the Griffiths claims caffeine dependence is "purely psychological" in the sense that you appear to be using it as an opposite of physical dependence. The article states that Griffiths thinks that caffeine dependence should be considered a psychological disorder, like other substance addictions.

If you look at the sources the Wikipedia articles cites for its mentions of Griffiths, the National Geographic article compares caffeine addiction to heroin addiction and attributes to Griffiths a claim that as little as half a cup of coffee a day can produce physical dependence. The paper appears to agree, from the information in the abstract.

10 base-36 digits is only around 52 bits, compared to the 112 random bits in a UUIDv4. 2^52 might be enough for particular use-cases, but it's nowhere near a UUID in terms of randomness. Even 10 base-64 digits is only 60 bits.

Although I don't agree with any of those premises, that debate is not one-sidedly poorly supported. A lot of the opposing arguments prove too much.

For example, a common remark in discussions on relevant topics are paraphrases of that "those who would give up essential liberty" quote. Yet, those comments appear much less frequently of discussions of other sacrifices of liberty for the sake of security.

I don't know, but your previous comment implied that they weren't adjusting for inflation at all.

It's possible that they are failing to adjust for inflation sufficiently, but that claim needs support. How much inflation was there between 1990 and 2015? Why does it differ from their calculation?

The World Bank periodically adjusts the threshold upwards for this reason. In 1990, they used $1/day. In 2008, they adjusted it to $1.25/day. Now they are adjusting it to $1.90/day.

Although "<name in other thread>, looks like you've been hellbanned by the evil mods!" comments are bad, I'm not sure I've seen them. I have seen comments like "<name in other thread, you appear to have been hellbanned", but I think they were sometimes warranted. The moderators do sometimes make mistakes, and IIUC the normal way to resolve them is: user realizes they are hellbanned, mails the mods asking about it, and the mods, if they feel the user should not be hellbanned, unbans them. Alerting commenters that one thinks may have been banned by mistake of their ban can either speeds this process along or wastes comment space and moderator attention, depending on whether one is correct.

I agree that hopefully vouching will kill the "<name>, you appear to have been hellbanned" comments, though.

This is a bit tangential, but which are the credible open-source competitors to IDA and the arguably best currently-available assembler you're referring to?

dbus signals can be multicast. Specifically, dbus signals without a destination are routed to all connections with match rules (added with org.freedesktop.DBus.AddMatch on the message bus) which match the signal.

Neither the Wikimedia Foundation nor the Wikipedia editors participating in the linked discussion seem to think that domain name supplier is a community matter.

As far as I can tell, this was a decision of the Wikimedia Foundation, and the resulting action will be taken by the Wikimedia Foundation.

Smalltalk requires explicit labeling of all but the first argument (though they are ordered) for keyword messages. Good naming conventions can make this enjoyable (at least subjectively).

In a hashmap based lisp, I'd expect defun to look something like

(define-function: (foo-with-a: a b: b c: c) with-body: ...)

Of course, since you're using an unordered representation, one could instead say (with-body: ... define-function: (c: c b: b foo-with-a: a)), which is significantly more confusing. This also means you probably can't do implicit progn.

progn in general will probably be unpleasant, unfortunately, unless one includes syntactic sugar for ordered sequences, which might defeat the purpose of an associative-array-based Lisp.

The first thing I've noticed about a vector-based Lisp is that you actually need primitive integers so that you can do indexing, which isn't the case with cons-cell based Lisps.

It's non-terminating execution during compilation, similar to the example elsewhere in the comments using nonterminating macro definitions in Common Lisp.

A compilation process that involves executing and waiting for the termination of a program that doesn't terminate can't itself terminate.

It actually says "What you won't learn: Java."

> For example, in The Myth of the Rational Voter[1], Caplan describes how it's actually rational behavior for voters to vote irrationally: the benefit of the degree they can sway the election is far smaller than the cost of acquiring sufficient knowledge to determine what candidate would most benefit them.

This is a minor detail, given that that was just an example you were giving; but in case it piqued anyone's interest, I'll correct it. That's not actually the explanation Caplan gives for voters acting irrationally (indeed, there's nothing that even appears irrational about that; that's obviously rational behavior). What Caplan argues is that voters rationally vote irrationally because they have preferences over beliefs, giving voting in accordance with false but preferred beliefs psychological benefits, and that if these psychological benefits outweigh the negative effects of the irrational voting, discounted by the low probability of deciding the election, it is rational to vote irrationally.

Almost every Perl 6 implementation implements their parser using Perl 6 regexes(partly because it's much more difficult to properly support the extensible grammar otherwise), which are essentially PEGs.