81–90 of 122 posts
Earlier quoted context omitted.
Wow, that even crashes Safari on my Mac.
And if it get's in your history, it'll crash every time the character shows up again. I ended up having to delete the entry manually: $ sqlite3 ~/Library/Safari/History.db SQLite version 3.19.3 2017-06-27 16:40:08 Enter ".help" for usage hints. sqlite> delete from history_items where url = "https://pastebin.com/9Tr8ytTr";
Earlier quoted context omitted.
Option 1: * Have someone else send you a message * Click the notification and it'll open their message * Navigate back and delete the corrupting message Option 2: * Sign up for the ios beta program (free) https://beta.apple.com/sp/betaprogram/ and install the latest beta which isn't impacted.
tried option 1, did not work. app crashes when navigating back :(
What Apple, and Microsoft before them, are discovering is the tools and processes we use to create software simply doesn't scale. We're simply reaching the limits of what these giant software teams are able to produce and keep running. We can discuss solutions, but currently not everybody even agrees we have a problem. That's the first step we need to take.
I do think a lot of these issues could be easily caught before shipment by having a well paid adversarial QA department, but at the same time it is easy to see why this is not done, despite all the griping on tech websites about code quality going down all across the board everywhere, it's not like people will stop buying iphones etc. so it's an easy ROI decision to continue with the "users are QA" mindset.
I've never done any fuzzing personally, but wouldn't this be discoverable internally during testing? I would think that they would attempt sending all possible characters, especially because they've had issues with this in the past.
Well of course they could have done that. To be honest, though, if someone on my team suggested we implement an automated test that tries sending every Unicode character (and it would be applied to every interface of every app and API, right?) I would have objected that this was an over-complicated, over-engineered solution that will probably be too slow. I'd argue that a set of test data selected to cover a range of…
But I agree it would be unreasonable to do that for every app that uses the library.
What Apple, and Microsoft before them, are discovering is the tools and processes we use to create software simply doesn't scale. We're simply reaching the limits of what these giant software teams are able to produce and keep running. We can discuss solutions, but currently not everybody even agrees we have a problem. That's the first step we need to take.
I disagree that this is the product of scale. Looking at some of the bugs coming out of Apple lately and how they respond to them (assuming it's really a trend and not just a run of bad luck) it feels like they're slipping into a culture where individual feature teams are making emotional or schedule-based decisions about security without central guidance. A good example is the recent bug on MacOS where a low-privile…
Incorrect. A low-privileged user can kill their own processes, which is the expected behavior of kill(-1). The only issue is the fact that this can apparently also kernel panic the machine. But the fact that it kills all the processes belonging to the user is the expected behavior of this call.
This isn't the first time a weird sequence of Unicode characters has caused the text renderer to crash and create problems for iOS users. This is why we shouldn't be writing new code in C.
What causes this to be an issue in C but not in other languages?
But largely the issue is, when an error occurs, can the state change to [undefined]. In some languages, like C/C++, it is possible through bugs to enter an undefined state. In many higher level languages, all states are defined even if not all states are actually handled by the developer's code.
If all states are defined you can use tooling to look for states which aren't handled by any execution path, and ideally handle them. If they remain unhandled there is a documented way to handle the unhandled known state (e.g. global exception handlers).
In a language with undefined states that isn't possible, all you can do is look for areas likely to result in an undefined state, but even that is easier said than done.
Higher level languages save you from a few classes of bugs, and make it easier to find bugs because things are more narrowly defined.
What's the Unicode codepoint of the character? Is it a single Unicode codepoint or multiple? (I tried to search for info on the web, but Chrome kept crashing.) Supposedly it's a normal Telugu character, but how could that have gotten past even minimal testing in Hyderabad? Or is it some strange combining corner case? Telugu script is kind of unusual in Unicode, since it is syllabic but has separate codepoints for vow…
All Unicode characters map, one-to-one, to their code points. A code point being a numeric identifier. It's a grapheme that combines multiple characters to form a unit of writing.
More specifically, here's what the Unicode Consortium glossary defines for "Character":
> Character. (1) The smallest component of written language that has semantic value; refers to the abstract meaning and/or shape, rather than a specific shape (see also glyph), though in code tables some form of visual representation is essential for the reader’s understanding. (2) Synonym for abstract character. (3) The basic unit of encoding for the Unicode character encoding. (4) The English name for the ideographic written elements of Chinese origin. [See ideograph (2).]