31–40 of 42 posts
Earlier quoted context omitted.
So basically: click-bait / vote-bait works, even with audiences that I expect to have a larger degree of technical literacy overall than the general populace. Sometimes I worry about humanity!
Upvote is commonly used to mean "read it later" by this audience. It is by no means a vote on quality.
I'm not sure this is one of those times, though.
This was posted 9 hours ago with the paper title as the name, and got 3 upvotes: https://news.ycombinator.com/item?id=16566587 I thought it was interesting and relevant for this audience, so I put a more sensational (but arguably accurate - you can argue the semantics of vulnerable all day) headline in the title to grab HN reader's attention. Now it is top of the front page with 40 votes in 25 minutes. If you want to…
Earlier quoted context omitted.
Further on: > 18,924 of all 51,627 call sites are found to be statically safe (36.66%) > The templates for the vast majority of call sites have at most one hole, and very few templates contain more than five. If you've got a dependency that calls eval or exec, those aren't great odds that they're doing it safely.
That still requires you to know whether either is being called with user-provided values before you can say it's unsafe. If, for example, someone had a utility which resized user-uploaded images you couldn't say simply calling exec to run something like ImageMagick was unsafe before checking whether it used the user's filename.
Earlier quoted context omitted.
That still requires you to know whether either is being called with user-provided values before you can say it's unsafe. If, for example, someone had a utility which resized user-uploaded images you couldn't say simply calling exec to run something like ImageMagick was unsafe before checking whether it used the user's filename.
I think that's what they're saying in those quoted lines though. That 36% appeared to be statically-safe (i.e. the string sent to eval or exec was generated using only strings defined in the code) and the others were not.
This headline is entirely false - 20% of Node modules use 'eval' or 'exec'. While these are certainly less secure and a strong secure coding standard would probably ban them or at least reduce their use, it's entirely possible to use both in safe ways.
There are more legitimate uses of 'exec', of course, but one still needs to be very careful with it. If there really are Node modules that pass their input to 'exec', that strikes me as very poor design.
This was posted 9 hours ago with the paper title as the name, and got 3 upvotes: https://news.ycombinator.com/item?id=16566587 I thought it was interesting and relevant for this audience, so I put a more sensational (but arguably accurate - you can argue the semantics of vulnerable all day) headline in the title to grab HN reader's attention. Now it is top of the front page with 40 votes in 25 minutes. If you want to…
That's against the site guidelines. Would you please read them and follow them when posting here? https://news.ycombinator.com/newsguidelines.html
Earlier quoted context omitted.
That's against the site guidelines. Would you please read them and follow them when posting here? https://news.ycombinator.com/newsguidelines.html
Hi Dan — along with rebuking the poster, I wish you had also fixed the title. There are substantive issues here worth discussing.
Edit: it's on the front page now.
Earlier quoted context omitted.
So basically: click-bait / vote-bait works, even with audiences that I expect to have a larger degree of technical literacy overall than the general populace. Sometimes I worry about humanity!
Upvote is commonly used to mean "read it later" by this audience. It is by no means a vote on quality.
Earlier quoted context omitted.
I think that's what they're saying in those quoted lines though. That 36% appeared to be statically-safe (i.e. the string sent to eval or exec was generated using only strings defined in the code) and the others were not.
True — it wasn't clear to me whether e.g. a random temporary filename would be considered static or only actual fixed strings in the code. (Similar questions would arise if e.g. a web app saved things using a database primary key so it's technically not static but the attacker doesn't control it even if they control the file contents)
Who knows how elaborate their static analyzer actually is in practice? I wrote a Python analyzer in grad school, and the results were both pretty interesting (type inference tracing through function calls) and pretty mediocre. It was also fiddly-as-hell to get working. Plus... the first rule of statically-analyzing dynamic languages is that the results get weird after the first eval()--anything could happen!
Earlier quoted context omitted.
True — it wasn't clear to me whether e.g. a random temporary filename would be considered static or only actual fixed strings in the code. (Similar questions would arise if e.g. a web app saved things using a database primary key so it's technically not static but the attacker doesn't control it even if they control the file contents)
Ahhhhh nice, I hadn't considered the "random temporary filename" or "db primary key" aspect either. That's something that gives me a small chill, but it's not the end of the world compared to "arbitrary user input piped to exec()" Who knows how elaborate their static analyzer actually is in practice? I wrote a Python analyzer in grad school, and the results were both pretty interesting (type inference tracing through…