nyc_pizzadev

The point of the magic values are that these values are eventually checked. This should break out of these kinds of optimizations.

Edit note: allocators are user space libraries (stdlib) and not part of the C spec. Use-after-free is extremely unsafe, however its completely valid C.

2nd note: running all programs below give me the expected result, writes to pointers are live, regardless if they are freed. So please provide more concrete steps to reproduce your results.

> they can very easily fill in the magic numbers too

Right, recreating the magic does side step this defense.

The context for software security these days is defense in depth and not something like “total defense” anymore. In this case, the use of magics is more of a dev testing mechanism than a runtime protect, although it does provide great runtime protection. What this means is if you use magics with proper testing and load testing, errors should surface before you release.

The pointer is read by the allocator, which then performs its own set of writes and management. I think you guys might be confusing stack memory and dynamic memory here.

Interestingly enough, if you were to incorrectly use stack memory in this scenario, the magic checks should trigger, pointing out improper memory usage.

> I suspect most have a false sense of security as the compiler will elide all stores that are happening in a struct about to be freed

The magic field is reset before returning the pointer to the allocator, so it’s definitely a live write to a valid pointer.

A handful of C projects I have seen use magic numbers in allocated structs to prevent use-after-free and other memory bugs[0]. Basically, in this case, when the ref count hits zero and the struct is freed, the magic is zeroed and any further access will be stopped. The author makes no reference of this, so I guess this isn’t a widespread safety pattern?

[0] https://github.com/varnishcache/varnish-cache/blob/4ae73a5b1...

Every hash table implementation I have done I use an RB tree for each bucket. This way if the bucket is loaded with hundreds or thousands of elements, you aren’t penalized too badly.

Having worked in a few open source based commercial businesses, I think the donation model can be tough and unpredictable. The only time I have seen it work is when businesses have commercialized an open source project and then give you a decent recurring donation back in return for your support. So the obvious move would be to just commercialize it yourself. The author does mention this at the end.

If its a small product but with a lot of users, think about a small add on service in the few dollars a month range. If its a more sophisticated product that's a bit more framework oriented, maybe use it as the foundation for project based services and build a consultancy. If its a true product that can be sold, then make a commercial version and start selling it. A lot of times there is a vast vast market out there that doesn't know this is a free open source project, they just see a product which solves their problems and they buy it.

Isn’t there already a popular Magneto plugin for Varnish called Turpentine? Seems odd they chose the same name...?

https://www.nexcess.net/magento/plugins/turpentine/

This elevator crashed down the shaft crushing this poor guy in the door. So sad...

https://nypost.com/2019/08/22/video-shows-moment-man-crushed...

I am a bit familiar with Autonomy, but I don’t know the exact specifics. They were in the software license business, so if I were to speculate, they would get a new channel partner and then forward them 250 server licenses, book the full revenue during that quarter, and then the partner has to sell all the licenses. But that could possibly take years. Repeat with a handful of fresh partners and you could book a significant amount of revenue growth. Given Autonomy had access to huge amounts of credit, money could have been fronted and exchanged to make these transactions look very legitimate and this could have been lucrative for the partner.

The roundtripping is not very clear. Maybe the same thing thru one of their acquisition companies?

Some details here:

https://www.justice.gov/usao-ndca/pr/former-autonomy-cfo-sen...

> The evidence at trial demonstrated that for more than two years prior to the sale, Hussain, 55, a citizen and resident of the United Kingdom, used sophisticated accounting methods to falsely inflate Autonomy’s revenues to make it appear Autonomy was growing when it really was not. Specifically, Hussain used backdated contracts, roundtrips, channel stuffing, and other forms of accounting fraud to fraudulently inflate Autonomy’s publicly-reported revenues by as much as 14.6% in 2009, 17.9% in 2010, 21.5% in the first quarter of 2011, and 12.4% in the second quarter of 2011.

Well, we are currently in the computer age which looks like it will be equal if not bigger than the previous industrial age. I believe when this paper was written, the computer age was in its infancy and the world was post industrial. As long as humans continue to innovate and explore into new areas, new ages will emerge and accelerate us forward. Maybe there will be some kind of physics breakthru which gives us easier access to space or some kind of human breakthru where we can alter our bodies. Who knows. Right, if we do nothing new, things will stagnate and eventually collapse.

Had this problem myself, was never able to just fall asleep at night, it was always a struggle. Napping, never, that made no sense. I would usually fall asleep around 2AM, struggle to get up at 9AM, and would do catchup sleep until noon on the weekends. And this was with daily exercise, I was always very active.

About 10 years ago (mid 30s) I moved to a new city and pretty much had an empty apartment and nothing to do in the evening. Most importantly no TV or internet. I decided to just goto bed around ~9:30PM. I think because of the lack of stimuli or something, this stuck and I then found myself in a bedtime routine of falling asleep around 10PM and waking up around 6AM. I guess the key isn't to slip back into the old routine.

Fast forward many years and now I have a family. Not only am I passing out immediately at night, I also can take naps. Yes, im completely exhausted every night.

My first C intuition would be defining this value as a macro. If I was in C++, then a const would make sense.

Right, that would be war. My understanding is that the gov has more covert methods... We hunted enemies before in other nations with some success.

I seriously think one solution to this problem is for the US gov to start designating some of these gangs as something similar to enemies of the state and start taking military action against them. If there were serious repercussions for these actions, like serious jail time or even something more grave... then that changes the calculus for people running these gangs. At minimum, this shows the gov is taking this threat seriously.

EDIT: ok bad idea, lets take it easy on my poor account :)

I don't think Rust is the evolution of C. Its a nice thought, just like I like to think im the evolution of [famous well known person].

C++ was the evolution of C and so was Java, but they both turned out to be their own things and C kept on chugging. Rust is a big complicated language, there is nothing C like about it. I see more parallels between Rust and C++ than I do Rust and C.

Definitely a strong use case for a caching proxy like Varnish or Nginx. The post describes using Redis as an application cache which means your application needs custom logic. A cache lookup before going to S3, and then it needs to write back out to cache when done. Simple, but possibly a lot more work than necessary. A caching proxy does away with this, you make a single call to the proxy, which behaves identically to S3, and it does all the work for you. No application changes needed other than changing the S3 endpoint address. Also, much greater performance because you are potentially cutting out multiple costly round trips.

Wouldn’t this be akin to a military based government?

Agreed, came here to say the same thing. Would be interesting to see how they stack up against each other. Both are highly evolved modern languages that make pretty much the same claims.

Shouldn’t this be Rust vs C++? C++ has a lot more parallels to Rust. Both are big, complex, and safe languages that can tuned for high performance. Infact, I would like to see more comparisons of Rust and C++ in the future.

I have been house hunting lately and my agent works for Compass. The website experience kind of sucks. Horrible mobile experience, lots of UX glitches, it’s just annoying to use. In fact, half the time we are using StreetEasy to look at listings (they are a local competitor). Other than that, your buying experience is completely based on the quality of your agent and how well he can navigate your market. Not sure how Compass gets an edge there, but I will say my agent is great!

Take a look at vm.max_map_count. A lot of systems have that set artificially low and that will force a memory allocator to fail and return NULL. I can confirm this is the case for jemalloc.

Also, on Linux, only 48 of 64 bits are available for VM addressing. That leaves you with about 250TB of address space. Seems like a lot until you start using VM for disk mmaps. I have actually seen this limit hit.

Same is happening in NYC. Renewals are either no change or seeing an increase while move ins are seeing discounts. My advice is to move out. You will either get a nice discount somewhere else or force your current landlord to actually compete. When you straight renew you have very little negotiating leverage and landlords know this.

The RQ-170 is another big one, and very recent too.

https://en.m.wikipedia.org/wiki/Iran%E2%80%93U.S._RQ-170_inc...

The NYC subway system has me concerned. Not only is it filthy, but there is zero air circulation. This means that anything airborne will stay put, possibly in high concentration for a long time. Given the amount of people going thru these spaces, there is a high chance your going to be exposed to something. My concern is that I haven't heard anything on making the stations and cars cleaner or safer.

What about a headache and/or body aches? Been having mild symptoms of this for the last week+ and I'm in a corona hotspot (NYC). Smell seems to be ok, but I'm not sure of a good way to test other than smelling something strong.

I guess the other scenario here is that manufacturers of soaps, sanatizers, and masks/gloves are drasticly ramping up production to meet this demand. In hopefully short time, the market will be flooded, guys like this are washed out, and if corona is the new normal for the next 6, 12, or 24 months, then the public will be in much better shape to combat the threat and return to semi normal.

Those 17,700 bottles of hand sanitizer were better off staying in their respective stores and being sold off in their surrounding communities. Unless the gov steps in, I don't see needed supplies like this, masks, medicines, etc, being distributed fairly to everyone in the market. Rather profiteers will get their access and sell off to hoarders. The comfort of having access to some of these supplies, even if they are not effective, goes a long way.

Simplified version with graphic:

https://physics.aps.org/synopsis-for/10.1103/PhysRevLett.124...