Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Null

popey.com

Post reply on HN
Print view View original

51–60 of 196 posts

Re: Null

#51

Post by steinuil »

josephg wrote: post #14
pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

Mine too. I write a lot of javascript and the string "null" is pretty harmless in most code. But there's all sorts of fun bugs (and often security vulnerabilities) you can find if you make an identifier "__proto__". (If code ever uses that as the key in an object, you're off to the races!)

Nice, I never thought of testing with "__proto__"! "constructor" is also a fun one.

Re: Null

#52

Post by lvturner »

martijnvds wrote: post #37
msh wrote: post #28

Earlier quoted context omitted.

Why do you require software to be more resilient than other things? If I pour water in the gastank of my car, it will also fail to drive. Or gas in the sprinkler tank. So the car should somehow prevent the enduser putting the wrong thing in the tank?

Pumps for different types of fuel have differently shaped nozzles here, making it very hard/impossible to fill up with the wrong kind. Of course if you're trying to break it, everything is possible.

Well.. it depends on the shape

https://www.autonews.com/article/20130521/RETAIL05/130529968...

Re: Null

#53

Post by popey »

farisjarrah wrote: post #27

Popey, I think I see you around these parts from time to time. If you're reading this: You and Martin Wimpress are constant sources of inspiration for me and many others, who want to keep on discovering the world of FOSS software. Thanks for the many hours of entertainment in your podcasts and the help you provide to people on the forums and mailing lists. Excellent work!

Thank you. That's very kind of you to say.

Re: Null

#54

Post by Tepix »

masklinn wrote: post #32
Tepix wrote: post #24

Perl 5 has a taint mode built into the language. If enabled, it forces the developer to untaint every bit of user-controllable data (by running it through a pattern match) before doing anything dangerous with it. I can't believe that this isn't a standard feature in all languages.

That’s because it’s both more annoying than warranted and completely insufficient, even ignoring that “running through pattern match” is not great (see: parse, don’t validate). * “untainting” is highly context-specific, that something was cleaned up for HTML does nothing for SQL * which also means that the boundary is incorrect, just because you’re getting something out of storage does not mean it’s safe for anything…

You are right, the programmer still has to think. But with builtin taint it's harder to overlook something because it forces you to consider everything.

I have a friend who is a long time C++ developer. Every time we discuss C++ he tells me that memory errors can be easily avoided in C++ if you have a certain level of competency. Someone still developed Rust because of this issue and it is popular.

Re: Null

#55

Post by tobyhinloopen »

masklinn wrote: post #42
deathanatos wrote: post #10

I worked on an API that regularly got requests from the mobile app for GET /users/(null). I think that's Swift, or Obj-C's way of to-string'ing a null? I have a generational suffix on my name. I often include it, and quite often as the proper Unicode character, e.g., "Ⅲ". (Assuming HN displays it after I post this, try to select it; that's one character.) That wreaks a fair bit of havoc. When I was in high-school, I…

> Every now and then a dev will make a branch with "BranchPrefix/" and the OS X machines all start having issues since OS X's file hierarchy isn't case sensitive. (We've also had issues w/ two files, same name different case. git supports it, but OS X can't cope.) FWIW macOS is perfectly fine with it. The FS (both HFS+ and APFS) can be configured to work in CI or CS modes. The default is CI. Since git uses the FS for…

A lot of software actually breaks running macOS in case sensitive mode, incl Adobe stuff

Re: Null

#56

Post by staticassertion »

Tepix wrote: post #24

Perl 5 has a taint mode built into the language. If enabled, it forces the developer to untaint every bit of user-controllable data (by running it through a pattern match) before doing anything dangerous with it. I can't believe that this isn't a standard feature in all languages.

You can do this with any language with a type system by wrapping reads with a 'Tainted' type.

ie:

fn safe_read(path: str) -> Tainted { Tainted(unsafe_read(path)) }

And then you can apply functions to Tainted or whatever type that convert it into something structured / validated.

So long as your functions only take in those validated types (ie: you do not write functions that take str) you can ensure that new reads will fail to typcheck without first parsing.

To be honest this is how most programs I see work anyways, at least in typed languages. Few work directly on strings. But they do it naturally, without enforcement - so like, a function might take a 'str', but the 'str' passed in was parsed into a wrapping structure already.

Re: Null

#57

Post by m463 »

xyst wrote: post #11

People like that is the reason why this list was created https://github.com/minimaxir/big-list-of-naughty-strings/blo... My personal favorite is this one though "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",

what a great github repo.

I enjoyed:

    #   Strings that may occur on IRC clients that make security products freak out
    DCC SEND STARTKEYLOGGER 0 0 0
and everything under:

    # Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem)

Re: Null

#58

Post by jannes »

jsrcout wrote: post #41
bhrgunatha wrote: post #23

Earlier quoted context omitted.

A favourite technique of one of my colleague's was just to mash the keyboard randomly to see if the app breaks. It's very crude and not at all foolproof. For the lack of sophistication it's shockingly effective at highlighting a huge amount of assumptions we make about how software is / can be used.

One of my professors back in college loved to do that. "Shockingly effective" is exactly the right term. Learned a lot from that little exercise.

This makes me wonder if there's a tool that can auto-generate random inputs and send them to the application. (maybe excluding Alt-Tab to avoid switching away from the application)

Fuzzing is a pretty popular testing technique for libraries, but GUI software has not seen the same attention.

Re: Null

#59

Post by popey »

tomcam wrote: post #46

> A year or so ago, at a company sprint I gave a lightning talk in which I wanted to make the tiniest possible snap What is a snap in this context?

Thanks for identifying this missing info. I've added a link to explain in the article.

Re: Null

#60

Post by popey »

JNRowe wrote: post #4
liquidify wrote: post #2

Somebody should write a book like the original "Programming Pearls" for weird hacks and anecdotes like the author's. Pretty fun stuff.

If I'm honest my reason for submitting this was a hope that any traction it received would be met with other odd stories in the comments. So yeah, there is some market for your book suggestion.

Thanks for submitting it!
Post reply on HN