Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google broke a conditional statement that verifies passwords on Chrome OS

arstechnica.com

Post reply on HN
Print view View original

181–190 of 276 posts

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#181

Post by Akronymus »

jcelerier wrote: post #127
fouric wrote: post #102

Earlier quoted context omitted.

"Not as weak as Java" is not a very interesting benchmark, as Java also has a poor type system. C++'s type system is pitiable relative to those of Rust, Haskell, OCaml, and SML. Moreover, in addition to being less expressive than them, C++'s type system is also weak , in formal sense, by allowing many implicit type conversions - which is one of the issues that I was complaining about. The fact that it "has to be in p…

Which of "Rust, Haskell (core Haskell), OCaml, and SML" is able to parametrize types on values, à la template ?

For those languages, I don't really see a need to paremtrize types on values. Because of the AMAZING generics support.

But that may just be the blub paradox [1] in action

[1] https://wiki.c2.com/?BlubParadox

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#182

Post by ddalex »

dataflow wrote: post #83
xmprt wrote: post #76

Earlier quoted context omitted.

So instead of short circuiting like that code should when it uses &&, it instead makes an assumption about the first part of the boolean expression because otherwise the code would have undefined behavior?

Yeah. More specifically, it just inserts whatever behavior it likes for the undefined scenario, which in this case is "the same behavior as in the defined scenario".

I am utterly confused. How would the compiler know that has_value() guarantees that the ->label dereferencing work, since this is a bitwise operation ?

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#183

Post by inshadows »

formerly_proven wrote: post #44
secondcoming wrote: post #33

Edit: Someone has explained the issue below I don't understand how that broke anything? The C++ codegen for && and & is the same: bool good(bool a, bool b) { return a && b; } good(bool, bool): mov eax, edi and eax, esi ret bool bad(bool a, bool b) { return a & b; } bad(bool, bool): mov eax, edi and eax, esi ret [0] https://godbolt.org/z/84MMqTehs

The code is: key_data.has_value() && !key_data_->label().empty() key_data is probably something like an std::optional, so short-circuit evaluation guards the dereferencing of the optional. If you write this with a binary and, no short-circuit evaluation can happen, so undefined behavior ensues. I wanna point out that std::optional, in the typical C++ stance, has a "I know what I'm doing" API and a "Humans make mistak…

Where is the undefined behavior? AFAU, UB is a compile time concept. As other commenter has asked, how can the compiler infer that has_value() call has any relation to key_data_ non-NULL-ness?

EDIT:

> optional->... is UB if the optional is empty

I understand what you mean: dereferencing optional is undefined if has_value() is not checked for true in the same thread before. But that undefined behavior happens at runtime, i.e. compile time UB is not invoked, the statements are kept without any optimizations. Right? The terminology is confusing.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#184

Post by dataflow »

ddalex wrote: post #182
dataflow wrote: post #83

Earlier quoted context omitted.

Yeah. More specifically, it just inserts whatever behavior it likes for the undefined scenario, which in this case is "the same behavior as in the defined scenario".

I am utterly confused. How would the compiler know that has_value() guarantees that the ->label dereferencing work, since this is a bitwise operation ?

I would imagine has_value is checking to see if a pointer is NULL, and -> is dereferencing that same pointer. When the optimizer sees the two together it realizes the former is useless.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#185

Post by lispm »

d110af5ccf wrote: post #163
anyfoo wrote: post #120

Earlier quoted context omitted.

Tabs for indentation, spaces for alignment.

I used to feel very strongly about this. Then I started using Common Lisp and discovered the abomination that is tabstop. This archaic "feature" leads to tab width that varies across the line and seems to be hardcoded in every text editor out there. Worse, it's only useful if using tabs for alignment which is completely broken anyway! At some point I intend to patch the source for the editors I use to remove this non…

usually I turn off tabs for indentation in Lisp editors. On a Lisp Machine:

  (setq zwei:*indent-with-tabs* nil)

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#186

Post by mellavora »

nightfly wrote: post #42
nogridbag wrote: post #29

Earlier quoted context omitted.

I've seen the = instead of == in the wild with disastrous results: the assignment was on an ORM backed object, e.g. // accidentally mutates all names to Sam and persists to the DB myList.filter { myDomainObj.name = 'Sam' } But it makes me wonder why our programming languages would use characters which can often lead to this type of error.

I'm a fan of programming languages using := for assignment for this reason

I prefer <- myself :)

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#187

Post by qalmakka »

Akronymus wrote: post #181
jcelerier wrote: post #127

Earlier quoted context omitted.

Which of "Rust, Haskell (core Haskell), OCaml, and SML" is able to parametrize types on values, à la template ?

For those languages, I don't really see a need to paremtrize types on values. Because of the AMAZING generics support. But that may just be the blub paradox [1] in action [1] https://wiki.c2.com/?BlubParadox

Well the fact you couldn't reasonably use arrays without Generic Const hit stable in Rust 1.51 says otherwise.

Defining templates on values is very useful, especially in C++ where you can provide template specializations. You can do a whole lot of metaprogramming and compile-time stuff that way.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#188

Post by josefx »

inetknght wrote: post #105
gavinray wrote: post #65

Earlier quoted context omitted.

I was surprised to read that `and`, `and_eq`, `xor`, etc are all supported "secondary/alternative operators" Never seen them used, but I use them in my C++ code when I have to write it to accomplish something else: https://en.cppreference.com/w/cpp/language/operator_alternat...

I used to use them. Then I was burned by some Very Opinionated managers and coworkers who didn't like seeing new things. It wasn't a hill I was willing to die on; there's more important things to argue about in C++.

They have been around since the first standard and basically only exist as a hack around an ancient non ascii compatible encoding. So unless you got burned in 1995 nothing about them was new.

They also aren't very consistent between C derived languages. Mostly because C# inherited its versions from VisualBasic, where And is a bitwise operator instead of a short circuiting one.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#189

Post by GoblinSlayer »

fouric wrote: post #102
qalmakka wrote: post #99

Earlier quoted context omitted.

C++ definitely hasn't a weaker type system than "newer" languages like Java - if any, it is much more richer and complex than most languages out there. What's happening here is a type conversion that has to be in place due to C not having a boolean type until 1999. C++ attempts to construct a boolean from the argument of an `if()`, and given that bool can be constructed from int, the conversion succeedes. You can def…

"Not as weak as Java" is not a very interesting benchmark, as Java also has a poor type system. C++'s type system is pitiable relative to those of Rust, Haskell, OCaml, and SML. Moreover, in addition to being less expressive than them, C++'s type system is also weak , in formal sense, by allowing many implicit type conversions - which is one of the issues that I was complaining about. The fact that it "has to be in p…

Java has a poor type system, but not as poor as that of C++.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#190

Post by Cthulhu_ »

CobrastanJorji wrote: post #21
fouric wrote: post #17

From the article: > The line should read "if (key_data_.has_value() && !key_data_->label().empty()) {" but instead of "&&"—the C++ version of the "AND" operator—the bad update used a single ampersand, breaking the second half of the conditional statement. Someone correct me if I'm wrong, but this seems like it wouldn't be possible in a language that didn't conflate boolean values with bitvectors. Edit: I was wrong[1]…

Forgive my poor C++, but has_value() sounds like a bool, and empty() sounds like a bool. Why wouldn't "bool1 & bool2" work correctly?

In other languages, booleans are their own values (iirc in C/C++ they're aliases for 0/not-0) for which the `&` operand is simply not implemented.

There's also linters and other quality control analyzers that will warn on a bitwise operator on booleans.

Post reply on HN