Viewing profile — SnowflakeOnIce

I worked on a system a couple years ago with a BERT-based model (64M parameters) used for classification. The rest of the system could process data at gigabytes per second, and so …

It's not just cosmic radiation or improperly built computers that result in bit flips. Row hammer is a thing :)

Logout functionality is not the only use case for token invalidation. Another significant one is to revoke a token that has been exposed, like inadvertently pushed to GitHub. In th…

Your general point here is reasonable. But to provide some domain knowledge context: secrets are leaked _very_ often! In public data (source code on GitHub, etc.) you can expect a …

Suppose you have access to certain memory. If you repeatedly read from that memory, can't you still corrupt/alter the physically adjacent memory you don't have access to? Does it r…

Example: A workstation or consumer GPU used both for rendering the desktop and running some GPGPU thing (like a deep neural network)

How is it a write-only attack vector?

> Lexing, parsing and even type checking are interleaved in most C++ compilers due to the ambiguous nature of many construct in the language. > > It is very hard to profile only on…

A simple hello world in C++ can pull in dozens of megabytes of header files. Years back I worked at a C++ shop with a big codebase (hundreds of millions of LOC when you included ve…

https://en.m.wikipedia.org/wiki/Simultaneous_localization_an...

> Well, the current generation of LLMs blow away that Turing Test Maybe a weak version of Turing's test? Passing the stronger one (from Turing's paper "Computing Machinery and Inte…

A lot of AI-based PDF processing renders the PDF as images and then works directly with that, rather than extracting text from the PDF programmatically. In such systems, text that …

"String interning" is discussed in the Java Language Spec, going back to the 1990s, and wasn't novel there. It goes back at least to Lisp implementations from the 1970s. Probably e…

Yes, this was my own experience! When looking at universities, when I saw a high sticker price, I ignored that university, even if in hindsight I had a good chance of being accepte…

Nosey Parker Explorer is an interactive TUI tool for reviewing possible exposed secrets detected by Nosey Parker [1], a fast secrets detector designed for offensive security (e.g.,…

About a dozen OSes / configurations were supported, and the entire test suite would take a few days to run on each such configuration. This was native desktop+server software, not …

At a previous job, with a huge C++ codebase and ~100 developers over 20 years, many platforms supported, a build could take hours, and the test suite took so long to run that it wo…

When doing appsec review in C or C++, yes!

> you can get 100% GPU utilization by just reading/writing to memory while doing 0 computations Indeed! Utilization is a proxy for what you actually want (which is good use of avai…

The common crawl only pulls documents less than a small limit (1MiB last I checked). Without special handling in this project, bigger documents than that would be missing. So indee…

'git clone --mirror' seems to pull down lots of additional content also.

There seems to be no such thing as a "private fork" on GitHub in 2024 [1]: > A fork is a new repository that shares code and visibility settings with the upstream repository. All f…

If your ranges end up sparsely distributed, using roaring bitmaps can speed things up a lot. https://roaringbitmap.org/

The classical synthesis approaches seem to have much more emphasis on correctness and specification than modern LLM-based synthesis though — things like deriving provably correct l…