Null • Hacker News Board

Re: Null

#161

Post by toast0 » Thu, Jan 14, 2021, 5:46 PM UTC

gvb wrote: post #132

martijnvds wrote: post #37

Earlier quoted context omitted.

Pumps for different types of fuel have differently shaped nozzles here, making it very hard/impossible to fill up with the wrong kind. Of course if you're trying to break it, everything is possible.

I don't know where your "here" is, but here in the USA, you cannot put diesel in a vehicle's gas tank, but you can put gas in a vehicle's diesel tank. Putting gas in a diesel vehicle is very bad. Reason: The gas nozzles dispensing unleaded gas were made smaller to prevent people from putting leaded gas into a vehicle that required unleaded gas (which would poison the catalytic converter). The diesel nozzles remained…

As imoverclocked mentioned, some vehicles (VWs mostly AFAIK) have contraptions in the filler tube to attempt to prevent filling with unleaded gas. Of course, they don't quite work (at least the retrofit ones don't), which I know because some of the diesel pumps have the unleaded size nozzle, and I've filled with those, it just takes a lot longer.

Re: Null

#162

Post by munificent » Thu, Jan 14, 2021, 5:59 PM UTC

> I went through a phase a while back of holding down keys to see what they did.

Back when I was a gamedev at EA, one of the things QA would do is button-mash test the games. Just smash as many buttons as they could at the same time at all sorts of random points in the game. This was a constant source of bugs. It was surprisingly easy to get the game into a state where it was totally hung because of this.

One of the main culprits was transitions between screens in the UI. So much of the UI code assumed that the initial state of a screen is that no buttons are currently pressed. But if you mash a bunch down in the middle of a transition, the screen can end up receiving a button up event that did not precede any button down event. If the screen's code assumed every up has a preceding down, it could get into a broken state.

I never did see any clean systematic solution to this problem. I still think about it a lot when I do UI programming. In the back of my head, I'm always wondering, "what will happen if the user presses X in the middle of this animation?"

Programmers are particularly prone to these bugs because we have unconsciously trained ourselves to baby our own software. We're careful to wait for transitions to complete and only send input when the app is in a known state.

Re: Null

#163

Post by metabagel » Thu, Jan 14, 2021, 6:01 PM UTC

kristaps wrote: post #103

Breaking things is far easier than making things. While this type of poking around might feel fun, it will mostly result in low value work to fix something very few (if any) actual users would experience.

Unless they have cats.

Re: Null

#164

Post by Turing_Machine » Thu, Jan 14, 2021, 6:03 PM UTC

xyst wrote: post #11

People like that is the reason why this list was created https://github.com/minimaxir/big-list-of-naughty-strings/blo... My personal favorite is this one though "If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.",

+++ATH0

That one normally only worked reliably if you could figure out some way of introducing a short delay between the +++ and the ATH. There may have been some crap modems that didn't require the delay, but that wasn't the spec.

(the 0 was not necessary, btw, as 0 is the default for the ATH command)

Re: Null

#165

Post by kevin_thibedeau » Thu, Jan 14, 2021, 6:10 PM UTC

uncomputation wrote: post #157

slim wrote: post #107

Earlier quoted context omitted.

that was unexpected. but I guess I should have expected it given how much islam is iconoclastic. it's probably muslims protesting the use of the name of allah in email addresses that caused it (alternate explanation: the word was raising too much false positives in Xkeyscore)

1. That’s not what iconoclastic means. If you actually care about iconoclasm in Islam, the Saudi government has unfortunately destroyed almost 90% of Muslim holy sites without a word from other countries. 2. The Second Commandment Christians follow is “Thou shalt not take the name of the Lord thy God in vain” and I can tell you a lot of Christians follow that. 3. You have it backwards. It’s not Muslims’ fear of the n…

It's their fear of people constructing offensive names (-sucks, etc.) that will spark another Charlie Hebdo incident.

Re: Null

#166

Post by diamondo25 » Thu, Jan 14, 2021, 6:12 PM UTC

munificent wrote: post #162

> I went through a phase a while back of holding down keys to see what they did. Back when I was a gamedev at EA, one of the things QA would do is button-mash test the games. Just smash as many buttons as they could at the same time at all sorts of random points in the game. This was a constant source of bugs. It was surprisingly easy to get the game into a state where it was totally hung because of this. One of the…

If it was up to me, there were no transitions. I am happy I can disable them on Android... Everything that does or manipulates animation is terrible. Scroll hijackers, image carousels, icon transitions, they are all wasting cpu cycles to please UX/designers!

Re: Null

#167

Post by masklinn » Thu, Jan 14, 2021, 6:32 PM UTC

tryauuum wrote: post #156

masklinn wrote: post #128

Earlier quoted context omitted.

FWIW it’s looking for the `file` class which does not exist anymore an was a direct subclass of object: `open` now creates a TextIOWrapper >. You can still reach TextIO though _IOBase, in python 3.9 it’s object’s 101st subclass, then 0, then 0. In 3.8 it’s 99, 0, 0.

This is pretty fascinating! It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string. Someone in this thread posted a solution with next() that iterates over subclasses to find the correct one. But an injection with spaces won't work as well when injected in jinja2 (something that original injection accomplishes in python2).

> It's a shame subclass numbers do change from version to version, so there is no "one-size-catch-all" injection string.

Yeah going through subclasses is not trivial, but that's the way exploits work really. And usually once you find a target the version is going to be reliable.

An other big injection sources in Python is when modules are available in the evaluation context, that's way more risky than exposing classes, functions, and objects due to Python's transitive import nature: anything you import becomes an attribute of your module, meaning if your module is visible so are its module. And very often there's a point at which `sys` is imported somewhere within transitive reach. Once `sys` is available they're out of the interpreter.

Re: Null

#168

Post by voldacar » Thu, Jan 14, 2021, 6:50 PM UTC

munificent wrote: post #162

> I went through a phase a while back of holding down keys to see what they did. Back when I was a gamedev at EA, one of the things QA would do is button-mash test the games. Just smash as many buttons as they could at the same time at all sorts of random points in the game. This was a constant source of bugs. It was surprisingly easy to get the game into a state where it was totally hung because of this. One of the…

Couldn't you just stop receiving keypresses when a UI transition begins and then re-enable input once the new UI state has been established?

Re: Null

#169

Post by essayist » Thu, Jan 14, 2021, 6:56 PM UTC

Kids, a story from the Old Days, c.1981.

DRI (since absorbed into McGraw Hill) had EPS, an advanced economic/financial analysis scripting language, provided via timesharing (mainframes on the East Coast of the USA). I was a customer support programmer in San Francisco the day that they rolled out a powerful arrays feature on the testing mainframe (no clients, but lots of real work going on).

One could put anything as an element inside an array. So I tried:

    X=array(123, "abc")
    Y=Array(X)

and it worked. You know where this is going, right?

    i=loop from 1 to 1000
    x(i+1) = array (xi)

It crashed the mainframe at i=67, if memory serves.

So far, so good, excusable as "clever programmer tests the limits". And then I ran it again.

Same result, plus, 2 minutes later, a call for me from my friend Kevin, who was a lead developer on EPS in DRI HQ: "Chris, what the ^&^&^!@@ are you doing?"

Re: Null

#170

Post by parliament32 » Thu, Jan 14, 2021, 7:14 PM UTC

voldacar wrote: post #168

munificent wrote: post #162

> I went through a phase a while back of holding down keys to see what they did. Back when I was a gamedev at EA, one of the things QA would do is button-mash test the games. Just smash as many buttons as they could at the same time at all sorts of random points in the game. This was a constant source of bugs. It was surprisingly easy to get the game into a state where it was totally hung because of this. One of the…

Couldn't you just stop receiving keypresses when a UI transition begins and then re-enable input once the new UI state has been established?

The problem is "key down" and "key up" are usually separate events. If you write software in a way that you always expect a "key up" to be preceded by a "key down", you'll have problems like the above mentioned.