jamii

Despite being an 'easy problem' it has led to code execution on android/ios:

https://research.checkpoint.com/2019/select-code_execution-f...

> We established that simply querying a database may not be as safe as you expect. Using our innovative techniques of Query Hijacking and Query Oriented Programming, we proved that memory corruption issues in SQLite can now be reliably exploited. As our permissions hierarchies become more segmented than ever, it is clear that we must rethink the boundaries of trusted/untrusted SQL input. To demonstrate these concepts, we achieved remote code execution on a password stealer backend running PHP7 and gained persistency with higher privileges on iOS. We believe that these are just a couple of use cases in the endless landscape of SQLite.

Good idea. I'll figure out how to do that.

You're already there - https://scattered-thoughts.net

Also past HN conversation - https://news.ycombinator.com/from?site=scattered-thoughts.ne...

Judging by https://news.ycombinator.com/from?site=scattered-thoughts.ne... this would have been submitted anyway. But I will be more patient next time. Nervous energy, you know.

Express Entry also doesn't require an employer, although you do get an extra 100 points if you have a job offer from an employer with a Labor Market Impact Assessment. This was one of the big upsides for me - very few countries will give work visas to self-employed people, let alone jumping straight to permanent residency.

What do you usually want to happen with late data? In DD you have the option to ignore it at the source but not to update already-emitted results. Is the latter important for you?

Nah, materialize is basically interactive SQL bindings for DD. There is some loss of optimization potential compared to running everything through the rust compiler but it's still decent.

Ok. That sort of lines up with "lack of docs" and "missing features" but maybe the bigger thing is the general impression and expectations.

Having spent much of last year pointing kafka at differential dataflow and watching kafka fall over or fail to start, I definitely feel like I would trust differential dataflow more. But I agree that nothing about the presentation of the project gives that impression.

Do you think you would be using it if it had bindings to $WORK_LANGUAGE?

Figuring out how to manage memory without constant de/serialization would be tricky, and it's unfortunate that it's so hard to do fusion across FFI, but I'd still expect it to happily outperform eg spark sql.

This is a followup to https://news.ycombinator.com/item?id=25406541

I've been avoiding proprietary options because it's usually a big time investment to get them working on nixos, but I'm open to suggestions.

This is the best option I've tried so far. Thanks :)

I can't believe this comment ended up dead - that was the correct answer. I had more success with ddd this time around.

> Activate the "Load Executable" button in the toolbar.

There is not a "Load Executable" button in my toolbar.

https://imgur.com/a/qOTZgy3

I also mentioned that in the article. Maybe you read it in a rush.

> Paste in the location bar or in the file name field, or access the context menu of the location bar and activate the "Paste" menu entry.

The location bar does not accept text. It's just a dropdown. Pressing C-l doesn't replace it either, like it does in the gtk file selector.

https://imgur.com/a/wbuKniU

> Activate the "Run" button in the toolbar.

There is no "Run" button in my toolbar.

https://imgur.com/a/rUHMRam

> some bad combo of gnu with other tools, or a missing lib, or a side effect of system customization, or a beta distro, or something like that maybe?

Oh, I'm sure it is. Debugging it would probably be good practice. I'll just open my working debugger...

I'm using zig, but there is also a fair amount of c in this project and I step into it fairly often. Gdb itself works just fine crossing between zig and c.

I use rr pretty often. Most gdb frontends also work using rr, as long as they either have buttons for reverse-step or allow you to enter commands directly. That's why I was kind of bummed out that gede, which was the most functional debugger I tried so far, has neither.

Similar to C but less footguns, less error-prone error handling, better meta-programming, really good C interop. If you're writing C (or maybe even C++) on a platform that llvm supports, it's worth checking out.

Looks interesting. I'll add it to my list for the followup post.

> those are the tradeoff between flexibility and ease

It isn't a required tradeoff. Most of the gdb frontends I tried display the local variables at all time, but also allow writing arbitrary gdb expressions if I want to. Having both is clearly better.

This is true but note that:

* gdb works on zig code, so it isn't unreasonable to expect gdb frontends to also work * being on nixos might explain crashes or failing to start, but it's hard to imagine how it could be responsible for various gdb frontends not being able to set breakpoints, run to the correct line or render a pointer to an array of bytes, especially when those same features work fine in gdb * it also doesn't explain why the memory view in most frontends was buggy or didn't work at all * I also tried lldb, whose gui I couldn't operate at all, and code-lldb, whose breakage might actually be nix-related since I had to patch a binary (but the error message was complaining about invalid utf8...)

I'm also happy to try non-gdb/lldb debuggers if you have any suggestions.

It doesn't work very well for me - https://scattered-thoughts.net/writing/the-state-of-linux-de...

This is perhaps related to using zig, but it's frustrating that gdb itself works fine with zig but each gdb frontend manages to break in different ways.

Unfortunately ctrl-x-a also reproduces that crash for me - https://paste.sr.ht/~jamii/a1cd701eae0c2416eb9750d7c559e4b3b...

This is gold. Thank you.

I'll add it to my list for a followup post.

I guess Index could be implemented on some type for both u32 and usize and then upcasting a u32 would produce ambiguity.

Here's how I set up the cross-compile in zig - https://scattered-thoughts.net/writing/pinephone-first-steps...

That only covers gl/sdl but I think gtk worked with that method too.

> I've only heard of this approach for zig and Jonathan Blow's language

It's the same approach used by nix and guix. Nix is moderately successful. I'm typing this on a laptop running nixos :)

https://nixos.org/

https://guix.gnu.org/

If you're interested in this sort of thing, this is an excellent paper on build system design, although it focuses more on the properties of the build graph than on how the graph is constructed:

https://www.microsoft.com/en-us/research/uploads/prod/2018/0...

Testing is a good way to ensure that your program won't have UAF under most normal circumstances. But when it comes to security it's adversarial - your program will get pushed into parts of the state space that were never seen during testing.

Things like browsers and operating systems are all heavily tested and fuzzed using tools like asan. They still have security issues from UAF.