Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Null

popey.com

Post reply on HN
Print view View original

131–140 of 196 posts

Re: Null

#131

Post by vient »

EdwardDiego wrote: post #101
Cyykratahk wrote: post #85

Earlier quoted context omitted.

Found some GitHub issues [1] with something similar: an enterprise firewall blocking a repo because it contained the string "arglebargleglopglyf" [2] in some tests. The text was flagged as malicious because of its presence in the repo github.com/wireghoul/htshells [3]. However, the whole point of the word in the htshells repo is that it's an invalid command that breaks Apache, so it could have been almost any random…

This one from link 3 caught my eye: "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() Looks to be a Python 2 specific way of trying to read a file in a sneaky way. I say Python 2 specific because Python 3 strings only have 2 supertypes now, so __mro__[2] is out of range, but __mro__[1] is 'object', and I'm guessing they were going for a file like class, but right now object.__subclasses__()[40] point…

Python 3 `system` example

  next(sub for c in "".__class__.__mro__ for sub in c.__subclasses__() if '__init__' in dir(sub) and '__globals__' in dir(sub.__init__) and 'system' in sub.__init__.__globals__).__init__.__globals__['system']('cat /etc/passwd')

Re: Null

#132

Post by gvb »

martijnvds wrote: post #37
msh wrote: post #28

Earlier quoted context omitted.

Why do you require software to be more resilient than other things? If I pour water in the gastank of my car, it will also fail to drive. Or gas in the sprinkler tank. So the car should somehow prevent the enduser putting the wrong thing in the tank?

Pumps for different types of fuel have differently shaped nozzles here, making it very hard/impossible to fill up with the wrong kind. Of course if you're trying to break it, everything is possible.

I don't know where your "here" is, but here in the USA, you cannot put diesel in a vehicle's gas tank, but you can put gas in a vehicle's diesel tank. Putting gas in a diesel vehicle is very bad.

Reason: The gas nozzles dispensing unleaded gas were made smaller to prevent people from putting leaded gas into a vehicle that required unleaded gas (which would poison the catalytic converter). The diesel nozzles remained unchanged and leaded gas (with the big nozzles) went away.

Re: Null

#133

Post by ygra »

pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

For a long time I've had my full name as user name on my machine, which meant that my user profile path contains both a space (evil) and a non-ASCII character (even more evil, although it's in Latin 1 at least). A lot of things break on one or both of those things and at times it's a bit annoying to deal with. Some bug reports have also been closed as "Won't fix, just don't do that. Who needs spaces in paths, anyway?". I haven't tried to use non-Latin Unicode in my user name and profile directory, which would break everything that uses the old ANSI APIs on Windows instead of the Unicode ones, and that's probably way too much breakage. But broken nonetheless, and that includes a lot of new, recent, and still-maintained software :-/

In a similar vein, I've also used U+2212 as minus sign in my regional settings. There's a lot of software that refuses to parse numbers it previously happily emitted.

I've given up on that too, by now, though. The only thing I still do is using English as UI language (so I don't have to deal with bad translations of software), but German as my regional settings (with ISO 8601 dates). There's a lot of software out there (I think GNU gettext is broken in that way on Windows) that assumes that the way I want my dates and numbers formatted has any bearing on the language I want to see in an application. Many others don't care about the regional settings and use the UI language to also format dates, times, and numbers. That's annoying, but at least nothing breaks, so that's the only deviation from the standard user I still use, to still be able to work.

Re: Null

#135

Post by imoverclocked »

gvb wrote: post #132
martijnvds wrote: post #37

Earlier quoted context omitted.

Pumps for different types of fuel have differently shaped nozzles here, making it very hard/impossible to fill up with the wrong kind. Of course if you're trying to break it, everything is possible.

I don't know where your "here" is, but here in the USA, you cannot put diesel in a vehicle's gas tank, but you can put gas in a vehicle's diesel tank. Putting gas in a diesel vehicle is very bad. Reason: The gas nozzles dispensing unleaded gas were made smaller to prevent people from putting leaded gas into a vehicle that required unleaded gas (which would poison the catalytic converter). The diesel nozzles remained…

Consumer diesel vehicles often have a mechanism to (try to) prevent the insertion of a gas nozzle.

Source: I had one of those “evil” Jetta’s

Re: Null

#136

Post by eloeffler »

I once named a fat32 USB pendrive ЯBK

This data must have corrupted some firmware section or so because the drive was gone afterwards.

Couldn't format, couldn't dd, anything.

Fits the category, I think. Only less funny :( Well, depends on the observer :)

Re: Null

#138

Post by vsareto »

pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

>In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

This is how try/catch alls get added :(

Re: Null

#139

Post by thih9 »

rkangel wrote: post #122
pixl97 wrote: post #7

>While I’m not a QA or security professional, I have developed a knack for doing “stupid” things with software which causes it to malfunction. A person after my own heart. I've had many a dev go "why would you do that" In which I answer "it doesn't matter, but if you accept my input it's your job to ensure the app doesn't crash"

We have an excellent (and big) QA department, but 13 years ago when I started at this company we were only just beginning to hire dedicated testers. We had a mature product which was a communication handset and it worked well and was stable. Our software engineers had pressed every button they could think of in every menu and there weren't any problems. Then we hired Kevin. Kevin had the handset for 40 minutes before…

> Good testers just think differently than software engineers.

I'm sure in some cases it's useful to detect all possible crashes, e.g. to make an app as secure as possible. In other cases I'd watch out for diminishing returns; perhaps instead of "think differently than software engineers" it would be enough to "think in the similar way as product users".

Re: Null

#140

Post by popey »

eloeffler wrote: post #136

I once named a fat32 USB pendrive ЯBK This data must have corrupted some firmware section or so because the drive was gone afterwards. Couldn't format, couldn't dd, anything. Fits the category, I think. Only less funny :( Well, depends on the observer :)

I like it :)
Post reply on HN