Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samsung's Tizen is riddled with security flaws, amateurishly written

arstechnica.com

Post reply on HN
Print view View original

31–40 of 69 posts

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#31

Post by ungzd »

demarq wrote: post #19

Is it that big industrial corporations are bad at creating code? Toyota, samsung, synaptic. I'm really beggining to think that code should be left to smaller and medium sized outfits. i.e samsung should buy or hire a small startup to independently develop and grow their next ecosystem. Large enterprises just seem too clumsy pull pull it off unless they wholly dedicate themselves to developing that one piece of techno…

Samsung is primarily home appliances corporation. Maybe their management treats TVs as "devices that display TV broadcasts" and phones as "devices for talking over distance". In this worldview there are no things like "bugs", "vulnerabilities", "software updates". Software inside these devices is at the same concern as prints on cardboard box. These devices, including phones, are sold at home appliance stores where "shop assistants" say you things like "That's Ultra Mega HD Super", "8 Cores and water resistant case" and once appliance is sold it is sold and no more problem of company. If it turns on and display pictures then it works.

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#32

Post by coldtea »

graton wrote: post #24
coldtea wrote: post #14

Earlier quoted context omitted.

> https://what.thedailywtf.com/topic/15001/enlightened Actually it's the author of the rant that comes of as totally uninformed and with unwarranted snark to boot. https://what.thedailywtf.com/topic/15001/enlightened/242

Not when I read the replies to that reply. @Carsten_Haitzler said: as for the "you bitch" comment. that does not appear anywhere inside efl at asll. i can only assume you are full of bullshit here as with a lot of the prior "facts" you have disclosed, as a grep through our codebase for efl and elementary shows no such string: core/efl.git - EFL core libraries evas - change error out from bitch to complain - cosmetic…

>Not when I read the replies to that reply.

Even more so after one reads the replies.

Perhaps we didn't read the same reply?

Because the response you've posted:

1) only addresses one of the tens of points in the reply -- the others still being valid.

2) while true, it is still irrelevant from a technical standpoint (not to mention softened in the subsequent version anyway).

3) At worst, the Evas author failed to grep the right version for it. Whereas the ranter, at best, fails to understand C coding, failed to consult documentation that was right there, complaints for valid behavior, cites several wrong facts about the behavior of the code (like the supposed "512" object limit), and closes with the BS "it will take man-years" to build a sample simplistic media player with the lib (using a ready made codecs/media player widget component).

Evas/Eve etc have some questionable design decisions, and not the best documentation. But the original post is full of crap in almost every aspect, and with unwarranted language to boot.

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#33

Post by alimbada »

I'm very tempted to buy a Samsung TV (primarily for the the low input lag times which makes them good for gaming) and I plan to keep it offline (no WiFi or Ethernet connection), using a Chromecast and a HTPC+Kodi instead for streaming. With that in mind, should I be worried about security flaws?

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#34

Post by [deleted] »

coldtea wrote: post #32
graton wrote: post #24

Earlier quoted context omitted.

Not when I read the replies to that reply. @Carsten_Haitzler said: as for the "you bitch" comment. that does not appear anywhere inside efl at asll. i can only assume you are full of bullshit here as with a lot of the prior "facts" you have disclosed, as a grep through our codebase for efl and elementary shows no such string: core/efl.git - EFL core libraries evas - change error out from bitch to complain - cosmetic…

> Not when I read the replies to that reply. Even more so after one reads the replies. Perhaps we didn't read the same reply? Because the response you've posted: 1) only addresses one of the tens of points in the reply -- the others still being valid. 2) while true, it is still irrelevant from a technical standpoint (not to mention softened in the subsequent version anyway). 3) At worst, the Evas author failed to gre…

[deleted]

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#35

Post by coldtea »

lfowles wrote: post #30
graton wrote: post #24

Earlier quoted context omitted.

Not when I read the replies to that reply. @Carsten_Haitzler said: as for the "you bitch" comment. that does not appear anywhere inside efl at asll. i can only assume you are full of bullshit here as with a lot of the prior "facts" you have disclosed, as a grep through our codebase for efl and elementary shows no such string: core/efl.git - EFL core libraries evas - change error out from bitch to complain - cosmetic…

A little bit more context I had to go look up: the response is also dated 11 Mar 2015

And as the author of the code writes 2-4 times, he looked for the literally mentioned quote and didn't find it -- he even posted the grep results.

He only found that it was "bitch" (single word) later from a later corrected comment and fixed it (out in the open, in the the public code repository in any way).

In any case, again, not technical, not a WTF, and not pertaining to the actual code/implementation.

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#37

Post by [deleted] »

throw81001 wrote: post #28
throw81001 wrote: post #16

Tizen was/is mostly built out of a Samsung subsidiary in Warsaw, Poland. (Several thousand software engineers in total.) I worked with Polish software engineers for a western company that used the same outsourcing method during the same time that Tizen was being built. We had hires from Samsung and they had hires from us. I think that what I witnessed at our company (which I won't name) is representative for what Sam…

My assessment after having a few years perspective: - There's quite a big span between the average level to high level to top level when it comes to polish devs. Specifically, it goes a lot lever than what I'm used to. It goes high too, though, but those individuals are not necessarily cheaper than a western european employee of the same calibre (probably similar). - (Engineering) Management culture is totally whacko…

[deleted]

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#38

Post by newsat13 »

I can't believe there are still string overflow bugs. Might be a good idea to invest sometime in Rust. On a side note, I have been looking for a good doc on how I can slowly migrate my existing code base step-by-step to Rust. A total rewrite is out of question, we would rather ship our product step by step. Does anyone know of such a doc?

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#39

Post by steveklabnik »

newsat13 wrote: post #38

I can't believe there are still string overflow bugs. Might be a good idea to invest sometime in Rust. On a side note, I have been looking for a good doc on how I can slowly migrate my existing code base step-by-step to Rust. A total rewrite is out of question, we would rather ship our product step by step. Does anyone know of such a doc?

https://github.com/carols10cents/rust-out-your-c-talk

http://blog.adamperry.me/rust/2016/06/11/baby-steps-porting-...

Re: Samsung's Tizen is riddled with security flaws, amateurishly written

#40

Post by demarq »

itcmcgrath wrote: post #29
demarq wrote: post #19

Is it that big industrial corporations are bad at creating code? Toyota, samsung, synaptic. I'm really beggining to think that code should be left to smaller and medium sized outfits. i.e samsung should buy or hire a small startup to independently develop and grow their next ecosystem. Large enterprises just seem too clumsy pull pull it off unless they wholly dedicate themselves to developing that one piece of techno…

The counter arguments include Google, Apple, Microsoft, etc. I think the big vs small comparison is flawed. I've seen some atrocious code produced by small/medium sized outfits. My fondest memory including auditing code from a 3 person outfit who's code quite literally setup an RPC on the server that executed any string it was sent, verbatim, against a database that handled money.

Those counter examples were all software startups. And have very very different cultures to other corporations their size due to their roots.
Post reply on HN