Live data from Hacker News

Google broke a conditional statement that verifies passwords on Chrome OS

arstechnica.com

201–210 of 276 posts

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#201
post #57
post #5

If you've been in tech for a while, this is one of those things that makes you sigh and shake your fist at "move fast and break stuff" as a strategy.

Google's philosophy isn't "move fast and break stuff". It's probably the opposite - "move slow and be careful". These things happen.

"Product moved so slowly it ceased to be noticed by management, who accidentally moved resources elsewhere"

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#202
post #102

Earlier quoted context omitted.

C++ definitely hasn't a weaker type system than "newer" languages like Java - if any, it is much more richer and complex than most languages out there. What's happening here is a type conversion that has to be in place due to C not having a boolean type until 1999. C++ attempts to construct a boolean from the argument of an `if()`, and given that bool can be constructed from int, the conversion succeedes. You can def…

"Not as weak as Java" is not a very interesting benchmark, as Java also has a poor type system. C++'s type system is pitiable relative to those of Rust, Haskell, OCaml, and SML. Moreover, in addition to being less expressive than them, C++'s type system is also weak , in formal sense, by allowing many implicit type conversions - which is one of the issues that I was complaining about. The fact that it "has to be in p…

I don't think weak has a formal sense in any formal sense.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#204

Couldn't this be caused by a bad merge? Not sure how Google manages their merging and release process but there are conceivably several stages where a bad merge can occur and go unnoticed - possibly at a stage close to release and after testing.

Or maybe a big automated refactor going too far? I wonder whether they run all tests on those.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#205
post #102

Earlier quoted context omitted.

"Not as weak as Java" is not a very interesting benchmark, as Java also has a poor type system. C++'s type system is pitiable relative to those of Rust, Haskell, OCaml, and SML. Moreover, in addition to being less expressive than them, C++'s type system is also weak , in formal sense, by allowing many implicit type conversions - which is one of the issues that I was complaining about. The fact that it "has to be in p…

Which of "Rust, Haskell (core Haskell), OCaml, and SML" is able to parametrize types on values, à la template ?

Much more usefully, in C++ you can also parametrize over templates, which I think you still can't in rust.

You can't parametrize over namespaces (at least not directly) which is an annoying and arbitrary restriction.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#206

Here is the original article from Android Police: https://www.androidpolice.com/2021/07/20/a-new-chrome-os-91-... The reason for the failed "update" was another Chrome 0-day that relies on the Google's Javascript engine: https://www.androidpolice.com/2021/07/16/another-day-another... Curious whether they release the details of how this 0-day works after it is fixed, so we can see the mistake they made putting users a…

So what it means is that someone could potentially introduce another 0day while patching a 0day because the code reviewing of those escapes the scrutiny of a regular process.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#207
post #108

Earlier quoted context omitted.

I don't think the other poster was imagining a language that retained compatibility with C, but rather a new language altogether. Of course it would be impossible to change this aspect of the language if retaining compatibility with C was a requirement. > I honestly don't see why someone would do bitwise operations on boolean For example, you might want the behaviour shown here of not short-circuiting. Or you might w…

> you might want the behaviour shown here of not short-circuiting. Or you might want to create a bitwise function that also allows calling on single-bit (i.e. boolean) values. In both cases, I think the risk-benefit ratio is way too skewed towards the risk of creating ugly, hard to detect bugs. When I don't want short circuiting from happening, I just assign the RHS of the expression to a variable beforehand; if I wa…

You could make the opposite argument that short-circuiting is the surprising behavior [1] and you should make it explicit with an if.

[1] and in this very thread many people were actually surprised by it!

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#208
post #74

Earlier quoted context omitted.

Other than this particular edge case it's not obvious to me why bitwise operators shouldn't be applicable to boolean values. Aren't they just single-bit vectors? Of course it makes sense that logical operators wouldn't be applicable to numeric types, but why the reverse?

>> Other than this particular edge case it's not obvious to me why bitwise operators shouldn't be applicable to boolean values. That is a really good question. At some point they decided that true=1 and false=0 but I'm not sure how deep that goes. In particular what does ! actually do in this context?

In what context? Unless overloaded ! coerces its operand to bool and returns the negation.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#209
post #92

Earlier quoted context omitted.

This is a typo of missing an ampersand. If the author were writing Ada, it would have been a typo of missing a “then”. How is it different?

It's different because in C it changes a boolean comparison to a bitwise one. Is Ada's `and` a bitwise and?

For bool there is no difference between bitwise and and logical and.

There is a difference between short-circuiting and non short-circuiting and, hence the distinct operators.

Re: Google broke a conditional statement that verifies passwords on Chrome OS

#210

Earlier quoted context omitted.

Considering that most code get read by more than one person, I think hardcoding the author's preferences in how it should be read is strange and in some cases inaccessible.

This. Author chose two spaces per indent and proceeded to nest blocks 5 levels deep? Guess I have to run it through a code formatter now just to read it. Alternatively, author chose eight spaces per indent and proceeded to nest things? My tiled windows only have ~100 columns, thanks so much for breaking my workflow with your poor choices.

But why not? These days reformatting on the fly is fast and easy. Especially if you enforce formatting conventions on commit (so you can automatically reformat into a canonical version).
Post reply on HN