465 karma · joined June 25, 2015
In my experience, Debian's security team responds to new CVEs faster than Ubuntu's, but this is purely subjective.
Chrome has exactly the same feature. You can disable Google Instant, too, but it's actually a really useful feature.
Also, a nice experiment: http://xonsh.org/ (Bash-alike with embedded Python)
Bash/sh is a horrible programming language.
The problem is way worse than you think. Check out what this looks like when printed in hexadecimal: http://3v4l.org/XVTgS
Basically, what is going on is that PHP_INT_MAX is 2^63 - 1. mt_getrandmax() is 2^31 - 1. The way mt_rand() makes a random number when the limit is too large is that it makes a random number in the range [0,2^(31)), then it scales it to be a number in the range [0,MAX-MIN), and finally adds MIN.
So in your case, it scales everything by 2^32 and adds 1. Which is why the numbers are* extremely non-random. [See my other comment in this thread for a more detailed explanation and some more test scripts that prove this is what is happening.](https://www.reddit.com/r/lolphp/comments/3eaw98/mt_rand1_php...
While Spender's criticism isn't usually very diplomatic, he's often right.
Here's an example, this is QEMU's seccomp whitelist: http://git.qemu.org/?p=qemu.git;a=blob_plain;f=qemu-seccomp....
As you can see, it's mostly worthless since QEMU has to do lots of potentially-dangerous operations by design (even reading/writing to raw devices). A proper mandatory access control framework actually restricts which device files it can access, for example - as implemented in the AppArmor/SELinux sVirt drivers. Theo's approach is similarly flawed.
It has it's own code review workflow which is, in my opinion, superior to Github's.
A nice summary: