Hacker Newsnew | past | comments | ask | show | jobs | submit | more ck45's commentslogin

My first thought is, how many BitTorrent clients have vulnerable parsing code? Could a malicious actor register the domain and infect clients?


I'm thinking of the Jon Evans novel "Invisible Armies" and the "bug" / backdoor in the P2P software that it's author users to pwm machines.


I don't really think so. The tracker is just a tiny part of the whole Bittorrent setup, and it's only really used by clients to get a list of peers. It's basically just an HTTP call to the tracker, returning a response. The only thing that I can quickly think of is returning some malformed bencode which could cause a memory exhaustion a client written by a novice.

The peer protocol (and variants, like uTP) are much more interesting to attack, and you don't need to host a tracker for that, you can just get peer IPs from trackers or DHT, connect, and do your magic.


utorrent v2.1 is still widely used by too many people, and it certainly is exploitable.


Seen (and fixed): A function returns some “struct” (as a dict), with a couple of fields, mostly stringly typed, and one field for accumulating error messages called “errors”. The dict was created as a defaultdict(list) (probably) to make it easier to append messages.


Double pro tip for naming identifiers: Overwrite built ins; dir, list, len, file, those are all beautiful identifiers and debugging the resulting bugs is twice the fun



Wow: “xrandr doesn't work anymore on xorg-git” “I do not think this should be specifically on you, it is not unreasonable to expect that the author of a change tries their change before even submitting it upstream.” does not give a warm fuzzy feeling about the author of the at-fault patch leading a fork.


It happens. No one writes bug free code.

e.g.

https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests...


I think it's not the one to blame who broke this but those who implemented everything all the time without adding any tests. Xorg has quite a large codebase but almost no automated tests.


So we agree that the maintainer is at fault: he wanted to change things and not have to thoroughly test his changes by doing the boring work of adding test coverage to the modified area.


There is no arguing about that, the maintainer made a mistake. (Among other people, and it was insignificant anyway.)

So now that we agree on this, what now? How exactly does

  > does not give a warm fuzzy feeling about the author of the at-fault patch leading a fork.
follow? E.g. do you think that none of the Wayland developers ever made any mistakes?


An excerpt:

>> I'm a aware that some people from Xorg development team think that @metux changes are not useful enough for various reasons

> Apologies for being blunt, but I'm afraid it's more like "everyone except you" by now. He's managed to fall out with pretty much every other active project member.

>> Xorg is dead anyway

> That's not a reason for me though. I actually feel bad for Xorg users, Enrico's churn is causing pain for them for no clear benefit.

There are evidently both technical and social issues at play.

Later in that thread, Encrico/metux offers a defence, an explanation with detail that this is part of a mission to “make X11 great again”. Don’t read too much into the comparison (please don’t!), but one similarity with the American politician who has been using a similar phrase for the last dedcade is that they don’t make an omelette without breaking eggs. In both cases, some think the broken eggs are acceptable collateral damage toward a worthy goal, and others don’t. In this case, other X11 maintainers aren’t interested in making X11 great again, but would prefer to let it rest obsolete and minimally maintained; and so, taking the best interpretations I can imagine, it’s necessary for this Enrico to fork the project and go it alone. But he’s going to be swimming upstream against a raging torrent. And he seems to be making various mistakes in some changes that weren’t supposed to change behaviour, due to inadequate testing (he offers explanations that at least some consider reasonable; so the errors may not indicate a broader pattern).


Those systems are not new, the SR-71 used the same principle, see e.g. https://www.iancollmceachern.com/single-post/unveiling-the-s...


It is exactly what I mean. That "early" (cold war era and maybe later) spy planes, strategic bombers, cruise missiles and even ICBMs used stars to navigate.

And, oh, yes, all ships before last century, too, of course. So it is more spiral than circle :)


and post WWII landrovers, the ships of the desert, pre GPS, used star fixes to layout grid roads for the world's largest test range*.

https://www.beadelltours.com.au/lb_survey.html

* "the largest land-based test range in the western world"

https://en.wikipedia.org/wiki/RAAF_Woomera_Range_Complex


Neat, this latest implementation seems a little more compact than the SR-71's, but it's hard to tell.

https://timeandnavigation.si.edu/multimedia-asset/nortronics...


I’ve discussed this topic quite a lot of times in the past years, taking both sides eventually. Usually the conclusion is with a human driver you (usually) have a responsible and liable person. It’s not that clear for FSD, and that’s what scares people.


It's very clear for FSD - it's a level 2 driver assist system and by definition that means the driver is legally responsible for everything that happens. That's the single biggest reason I would never use FSD. I'm not going to put myself in a position of being held legally liable for the actions of somebody else's software.


The human driver is responsible and liable, that is why the interior camera monitors the person’s eyes to remind them to watch the road, and I think disabled driver assist software after 3 strikes.

https://www.tesla.com/ownersmanual/models/en_us/GUID-E5FF5E8...

> WARNING Full Self-Driving (Supervised) is a hands-on feature. Keep your hands on the steering yoke (or steering wheel) at all times, be mindful of road conditions and surrounding traffic, and always be prepared to take immediate action. Failure to follow these instructions could cause damage, serious injury or death. It is your responsibility to familiarize yourself with the limitations of Full Self-Driving (Supervised) and the situations in which it may not work as expected.


> It’s not that clear for FSD, and that’s what scares people.

It is crystal clear, the liability and responsibility is on the human behind the wheel. The 'person driving' is some engineer thousands of miles away with no incentive not to crash the vehicle, and that is what scares me.


Can Russia be sure that there are no more sleeper containers? Probably not. This might bind a lot of resources and create paranoia. That’s a good secondary effect of the attack.


But a greater effect will be the fertilization of a Russian drone program based on individualized assassination.


I imagine Ukraine will try similar again, though with a variation to make it harder to catch.


Denmark just raised the bar to 70 (by 2040), https://www.independent.co.uk/news/world/europe/denmark-reti...



I really like your articles. Zig has some pitfalls and the official documentation can be a bit sparse.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: