zwp

I have another that I sometimes use: overriding getenv(3). (I typically just printf() the variable name and return NULL).

Most of the time you can spot environment variable usage in binaries using strings(1) (folks still like to use upper case env vars in non-system applications even though this goes against POSIX).

But by using LD_PRELOAD you can easily see if the program is actually hitting the codepath reads that variable without debuggers or grovelling about in the assembly.

So does gcc: https://gcc.gnu.org/onlinedocs/gcc/Diagnostic-Pragmas.html

(TIL - thanks!)

> reaching out to the old developers to see if they have a copy

I think you mean "older devs that are still with the company" but I was once contacted by a former employer for exactly this: they had lost source code for the billing system. I didn't have the source code so that was easy to answer. Developers that have stolen intellectual property from former employers may want to consider carefully how they answer such questions...

Also, I was never supposed to have had access to this code whilst I was employed so I did wonder if there was more to it than just "oops we lost it can you help?". Perhaps they were trying to chase down a leak or something? I never heard back though (they survived).

> 2^56 is trivially brute-force-able today

Youch, this broke my intuition.

https://crack.sh/

"we’ve built a system with 48 Virtex-6 LX240Ts which can exhaust the keyspace in around 26 hours"

I did this job for a couple of months over a summer when I was in college, (via a temping agency). I did actually kind of enjoy it. The sweet smell of putrefaction from the truck made me retch for the first week and then became kind of homely. Brutally early starts (4am?) but done and home by midday. My crew ran everywhere. They teased me for wearing gloves (broken glass, nappies, tampons... I'll take the teasing, thanks).

Pay for regular employees was okay, by which I mean it was not as bad as you might expect (and considerably more for the driver, for an easier job). There was notable attention from the public, somewhere between condescending and touching, who perhaps didn't know that: the old lady who saved me a pair of jeans ("These were my son's, and I noticed yours are ripped"); the old guy that wanted us to come in for coffee; free lunch from an independent fast food place on Wednesdays.

The size of the operation marked me: the number of 14-ton capacity trucks snorting at the depot at dawn, the scale of the dump, the size of the crane fingers. The amount of garbage. Houses. Businesses. Farms.

Winter months and middle age would probably make the job less attractive but it certainly wasn't a dreadful experience.

> writing code that can be deleted is an important skill

Are you saying "I can easily delete this code from the project" is a metric for modularity? That's really interesting, is it your own thought?

> I have no idea who he's talking about

This comment buried below: https://news.ycombinator.com/item?id=20467750

points to this repo "A javascript client for libra": https://github.com/perfectmak/libra-core

@perfectmak is in Lagos.

"just"? From where I'm sitting that's a pretty large chunk of IT.

This has knock-on effects: authors that want to deploy scripts/apps with the minimum fuss will avoid adding deps to whatever /opt-based repo RH ships Python 2.recent (and the hoops you have to jump through to install and activate that). So they remain compatible with 2.6.

All of the other applications and 3rd-party modules shipping with RH 6 are also chained to Py2.6.

Many conservative shops (industry verticals) will refuse to upgrade _anything_ until they absolutely have to. I suspect we live in slightly different IT worlds (lucky you!). This is a problem I see frequently and that's why I'm suggesting Python needs more strict impetus for timely upgrades, not more decade-long opportunities for balkanization and incompatibility.

> “what code has been reviewed and which reviewers do I trust?”

Thank you for putting this so succinctly. There are other supply-chain problems in decentralizing control of the modules though:

Modules might only have a few people or one person responsible for them. Consequently suspect commits by a malfeasant or compromised (hacked) team member might not be noticed. Maybe this is a variant of the old saw "with enough eyes all bugs are shallow" but my gut feeling is that commits to Python core will get more inspection than those to a small 3rd party module. Today, modules get some review for free, just by being part of stdlib. Even if I know and trust @jdoe I have less assurances that they didn't get phished and their repo tweaked.

Also trusted team members/organizations may change over time. The browser extensions world is the poster child for this, where we've seen not only similarly-named malicious extensions posted to stores but also once-legitimate extensions quietly purchased and subsequently subverted by bad actors.

This is one example (adware: could've been much worse): https://www.bleepingcomputer.com/news/security/-particle-chr...

I like the idea of a review process but I have a hard time imagining a crowd-sourced system that wouldn't get gamed. We have a "dissolution of responsibility" problem: millions of companies rely on these components but have no explicit responsibility of care. Perhaps that needs to change, somehow.

Red Hat 6 is supported for another 18 months and still ships with Py 2.6.

Python's slow-moving gently gently approach to breaking changes has not been good for the ecosystem. I'll be glad when 2.x is dead. 7 months 8 days 14 hours... https://pythonclock.org/

I've not used ag but just a small shout out for ack: it's a single Perl file (easy to install, v1.x will work with even antique Perl), it works on weird hardware/OS (no compilation required), it contains its own man-page (ack -man) and is fast enough for typical sysadmin tasks and moderate size codebases.

(Ack also supports the full PCRE syntax but that's less of an issue now rg has -P).

If your work takes you to minority platforms ack is certainly worth keeping in your toolbox.

> ad hoc syntaxes like JIRA's

Gak, yeah, I empathize. JIRA was a pain point for me too.

I take comprehensive notes using org-mode (including all of my false turns, dead ends and "explore this later"s) and when I need to paste something into a ticket I export via ox-jira.el and copy/paste what I need. It works much better than the author's modest README might lead you to believe, and of course it's hackable.

https://github.com/stig/ox-jira.el

The problem is that Python is the exception here. Those of us that learnt other languages first already have a mental model and find this explicit self parameter weird. And it's more typing.

Yegge thinks that "self" is a wart and I agree. The article is a fun read but it's showing its age. I suspect Python might just have beaten Perl by now.

https://sites.google.com/site/steveyegge2/tour-de-babel#TOC-...

I suppose Python's way there's one less reserved word. Are there any other advantages?

>> You can’t send file handles

> Actually that's exactly how piping works

Also SCM_RIGHTS, which exists exactly for this purpose (see cmsg(3), unix(7) or https://blog.cloudflare.com/know-your-scm_rights/ for a gentler introduction and application).

That's been around since BSD 4.3, which predates the Hater's Handbook 1ed by 4 years or so.

In the B2B world there is a perhaps surprising amount of ad hoc data transfer (transactions, statements) between separate entities using scp/sftp from a cron'ed ksh script written by a junior sysadmin 8 years ago.

Throw a Tectia server in the DMZ, fix the firewall, manage some keys (never change them) and you're good to go! Data at rest security via Zip or PGP for the ambitious.

Occasionally a big enough entity will mandate "everyone will use our data xfer spec" (and it's typically some gnarly XML-infested SOAPy animal). But there's a whole lot of automated business processes doing CSV-over-scp both intra- and inter-company.

Don't even get me started on FTP.

I built something just for fun a couple of weeks back. I used the Sphinx Open Source Speech Recognition Toolkit from CMU https://cmusphinx.github.io/ Look for the sphinxbase and pocketsphinx packages under Ubuntu.

It'd be simple enough to hook this up to Philips Hue or whatever to do what you want.

There are numerous Sphinx language bindings. I went for Ruby via Isabella https://github.com/chrisvfritz/isabella. I used this because it provided a framework for what I wanted: define a simple grammar (JSGF, Java Speech Grammar Format) and call specified script(s) with the parsed results. The hardest part was probably mapping out the phonemes for the grammar atoms. (If your target language isn't English, you may be out of luck).

This worked really well for what I needed (directing band-in-a-box from the other side of the room) but still needs a little tuning. Even with a leading activation token ("Hey Isabella...") she sometimes gets confused and thinks she's been summoned when it's just some random song playing. Choosing a concise, simple, unambiguous grammar was helpful, along with sensitivity adjustment. There are other knobs to twiddle -- as evidenced by the academic mailing list activity -- but I didn't need to look closer for my simple use case.

It was a fun little project and the kids liked it, especially paired with a text-to-speech module (tts gem under Ruby): "Hey Isabella, am I <adjective>?" (or "Is <sibling> <adjective>?"), and a randomly generated response :)

But presumably the transparent keylogger window must know which is the supposedly-active window (in order to be able to pass on keystrokes to it), so the transparent window could emulate the supposedly-active window's title?

"Isn't this table just sorted by the PP adjustment factor"

No, it isn't, but I do think you're right in that I should have used the nominal wages. I found the original article and that does not appear to be purchasing-power adjusted:

https://www.daxx.com/article/it-salaries-software-developer-...

Using the nominal wages gives the below, with France now in the middle of the list:

    Country       Ratio dev:avg
    Australia     0.81
    Netherlands   0.85
    Canada        0.90
    New Zealand   0.92
    Finland       0.92
    France        0.92
    Switzerland   0.93
    Norway        1.02
    Denmark       1.05
    Germany       1.12
    UK            1.15
    Sweden        1.15
    USA           1.49
    Israel        1.53

Whether or not this is a "meaningful result" is still debatable but I'd like to think it gives us something approaching a "developer appreciation metric".

That's an interesting picture. I took those numbers and compared them to Wikipedia's purchasing-power adjusted average wage figures for 2017 at https://en.wikipedia.org/wiki/List_of_countries_by_average_w.... Here are the results sorted by ratio of average developer salary to average salary in each country. You get the best bang for your buck in .il and .fr doesn't (quite) get the wooden spoon.

    Country       Ratio dev:avg	        
    Netherlands   0.851031639465174	
    France        0.891326705519369	
    Canada        0.944941413632355	
    Finland       1.00083791080905	
    Australia     1.01779098644302	
    Germany       1.05075128717033	
    New Zealand   1.07384561596284	
    UK            1.18906064209275	
    Sweden        1.29738400207581	
    Norway        1.3082871202062         
    Switzerland   1.31657113498065	
    Denmark       1.34069094159251	
    USA           1.48617853958189	
    Israel        1.85359454758035

> Online newspapers are the worst

Oracle. Here's July's Critical Patch Update page:

http://www.oracle.com/technetwork/security-advisory/cpujul20...

On my my domestic ADSL line the cookie pop-up takes almost 10s to load. It presents 67 checkboxes to select from. There is no default selection, so this requires at least 3 more clicks (at least the non-obligatory cookies are grouped). Submitting the form takes another ~4s -- it even has a progress bar. (Thankfully they aren't using TLS so it's not quite as slow as it could be).

Earlier this summer this component was broken and I just couldn't use oracle.com.

> string compare with some url decoding

Perhaps page body edit-distance would work better?

Being kidnapped for ransom?

Nice, thanks.

What are those cute little axes that he's running? And what's going on with them at 10m50 - is that a foldout pinky rest?

https://www.youtube.com/watch?v=7eVBrMcflDE&t=650

This appears to be an artifact of dtruss(1). Syscalls that aren't special-cased are assumed to have 3 arguments: https://github.com/joyent/dtruss-osx/blob/c3b23e279187056e76...

There are special cases for 0..6 arguments (including one for close(2)) so I guess getpid(2) slipped through the cracks.

Ruby isn't that bad.

The "attack" (meh) is similar to weev's AT&T hack https://en.wikipedia.org/wiki/Weev#AT&T_data_breach but crucially, I think, OP can demonstrate good intent. (Or at least it doesn't seem that OP demonstrated bad intent. Weev downloaded lots of information and called journalists).

OTOH Sentinel Chain might have obligations regarding data breach (depending on where they are based) and they look Real Dumb right now. This might explain some of their aggressive response.

One of the reddit comments makes the (reasonable) point that OP (u/notarealhacker, presumably not a security pro) could have validated insecure access to just their own data from within some pristine sandbox environment. That's fair enough but when I see reports from actual security folks that IMHO go too far in this respect (the DJI bounty mess http://www.digitalmunition.com/WhyIWalkedFrom3k.pdf comes to mind) it seems hard to make that argument against a non-expert who appears to have acted in good faith.

It's not clear to me what jurisdiction @narh is in but here's to hoping a lawyer can mount a Good Samaritan defense if it comes to that.

And not really exponential. Something interesting happened 2003-2004 though. We can perhaps observe lead up to dot-bomb (1996-1999 growth) and the 2008 financial crisis.

http://hpics.li/2e78909

    1994,3153191
    1995,4813587
    1996,7539137
    1997,13755958
    1998,16107028
    1999,15935643
    2000,17548021
    2001,16873202
    2002,18904001
    2003,27723307
    2004,47116841
    2005,47982675
    2006,50672891
    2007,51322342
    2008,49635521
    2009,45312542
    2010,45384720
    2011,46455461
    2012,46733150
    2013,45842099
    2014,47065954
    2015,48112988
    2016,46636963
    2017,47037415

Sure, it could be used elsewhere. OTOH 7763 calls out email as a use case three times and in section 5 Examples "email attachment" is the only example.

Huh, looks like text/markdown email is coming slowly:

https://stackoverflow.com/a/25812177

https://tools.ietf.org/html/rfc7763

https://tools.ietf.org/html/rfc7764

(March 2016)

Previous HN discussion: https://news.ycombinator.com/item?id=13176743

You might like "Recursive Make Considered Harmful", Miller.

http://aegis.sourceforge.net/auug97.pdf

Although I suspect the main complaint (slow, due to checking directories where nothing has changed) has mostly been swept under the rug by increased CPU speeds some of the other items (managing dependencies, ordering, ...) are still worth considering today.