Live data from Hacker News

‘Zero-click’ hacks are growing in popularity

bloombergquint.com

401–408 of 408 posts

Re: ‘Zero-click’ hacks are growing in popularity

#401

Earlier quoted context omitted.

so you agree with the comment then? you are both criticizing the government

I wrote "governments"... plural. And while both comments are critical of "governments", my comment clearly disagrees with the parent's assertion that governments do not fund whole rewrite projects "Mostly because it's not clear that from-scratch rewrites produce better results".

I don't dispute that governments do such things and I'm not sure how you can read that sentence to say that they do. I just said they don't generally get good results from it.

Re: ‘Zero-click’ hacks are growing in popularity

#402
post #397

Earlier quoted context omitted.

> [...] Oberon [...] Sure, and that would be a good argument, there are several interesting languages out there that do various things better than C. I'm not intimately familiar with the Wirth languages, but I thought Oberon provided garbage collection? > [...] misrepresentation [...] Fine, they never claimed it was only good for that, but I still find it weird to claim that "it's fine, it's great for X" where X is a…

> So your point that the Lisp evaluator doesn't even understand sequences of characters is true for any compiler, they all operate on the AST. Lisp does not really operate on an AST. It operates on nested token lists, without syntax representation. For example (postfix 1 2 +) can be legal in Lisp, because it does not (!) parse that code according to a syntax before handing it to the evaluator. Lisp code consists of n…

If (postfix 1 2+) is ready to be handed to the evaluator, it's because it has been parsed. That means it must be a parsed representation. "Parse tree" doesn't apply because parse trees record token-level details; ( and ) are tokens, yet don't appear to the evaluator. "Abstract syntax tree" is better, though doesn't meet some people's expectations if they have worked on compilers that had rich AST nodes with lots of semantic properties.

The constitutents of the list are not "tokens" in Common Lisp. ANSI CL makes it clear that the characters "postfix", in the default read table, are token constituents; they get gathered into a token until the space appears. That token is then converted into a symbol name, which is interned to produce a symbol. That symbol is no longer a "token".

Re: ‘Zero-click’ hacks are growing in popularity

#403
post #86

Earlier quoted context omitted.

Not sure who is "we" here, but yes I agree, a general purpose customer phone can't be considered secure against state-level hackers, there MUST be tradeoffs. As an example, I consider that a secure phone MUST have boot-time full disk encryption passphrase, which needs to be different from lockscreen. For obvious reasons (which is that the user will tend forget their password), you can't have this even as an option on…

> even though lately their focus is no longer security for business reasons. Context?

Their latest developments are about making GrapheneOS more usable, not more secure. Like they are working on a camera app, and our integrating Google apps. (Don't mistake me, I totally respect them for what they are doing)

Re: ‘Zero-click’ hacks are growing in popularity

#404
post #374

Earlier quoted context omitted.

There does actually exist such a thing as formally proven code, which is mathematically according to spec. https://www.sel4.systems/Info/FAQ/proof.pml

I don't even see the point you are making. Are you trying to claim that the above proof will never be invaldated? You're really just proving mt point here. You think thongs can be secure.

Yes, that's what I'm claiming.

That's of course only a part of the story, the spec or the hardware can still be broken.

Re: ‘Zero-click’ hacks are growing in popularity

#405
post #396

Earlier quoted context omitted.

Yes, Chrome pretty much single-handedly changed that, timed well with Vista. For about a decade we got a reprieve because: 1. Memory safety mitigations became much more common (Vista) 2. Browsers adopted sandboxing (thanks IE/Chrome) 3. Unsandboxed browser-reachable software like Flash and Java was moved into a sandbox and behind "Click to Play" before eventually being removed entirely. 4. Auto-updates became the nor…

And now you never know when your useful browser extension is going to auto update into malware!

If a browser extension requests new permissions it will be disabled upon its update.

Re: ‘Zero-click’ hacks are growing in popularity

#406

Earlier quoted context omitted.

Quoted post unavailable.

This tracks with your comment history https://news.ycombinator.com/item?id=567736

Please don't cross into personal attack.

https://news.ycombinator.com/newsguidelines.html

Re: ‘Zero-click’ hacks are growing in popularity

#407
post #396

Earlier quoted context omitted.

And now you never know when your useful browser extension is going to auto update into malware!

If a browser extension requests new permissions it will be disabled upon its update.

Not all malware requires new permissions.

Re: ‘Zero-click’ hacks are growing in popularity

#408
post #391

Earlier quoted context omitted.

From the linked ASAN paper: "...at the relatively low cost of 73% slowdown and 3.4x increased memory usage..." That's too big a performance hit for production use - much bigger than you would get with the approach I outlined. I don't agree that any nontrivial C program is nonconformant, at least if you're talking about nonconformance due to invalid memory references. Referencing invalid memory locations is not the so…

With all due respect, why do you assume that your “thought about it 3 mins straight” idea would perform better than one that has been in the works for a long time now by people working on similar topics all of their lives? Don’t get me wrong, I often fell into this as well, but I think programmers really should get a bit of an ego-check sometimes, because (not you) it often affect discussions in other fields as well…

I do this pretty often, and it's often a very valuable exercise, even though I'm almost always wrong. Interrogating the apparent contradiction between my beliefs and existing reality is a highly fruitful learning experience. There are several serious failure modes, though:

1. I can get my ego so wrapped up in my own idea that, even once I have the necessary information to see that it's wrong, I still don't abandon it. In fact, this always happens to some extent; when I change my mind it's always embarrassing in retrospect how blind I was. But the phenomenon can be more or less extreme.

2. In a context where posturing to appear smart and competent is demanded, such as marketing, advocating totally stupid ideas puts me at a disadvantage, even if I recant later. Maybe especially then, because it reminds people who might have forgotten.

3. People who know even less than I do about a subject may be misled by my wrong ideas.

4. This approach is most productive when people who know more than I do about a subject are kind enough to take the time to explain why my ideas are wrong. This happens surprisingly often, both because people are often kind and because the people who know the most about a subject are generally very interested in it, which means they like to talk about it. Still, attention of experts is a valuable, limited resource.

5. People who know more than I do about a subject can get angry and defensive when I question something they said about it, particularly if they're mediocre and insecure. The really top people never act this way, in my experience; if they pay attention at all, either they can explain immediately why I'm wrong, as AlotOfReading did here (though I may not understand!) or they go "Hmm, now that's interesting," before figuring out why I'm wrong. (Or, occasionally, not.) But people with a good working understanding of a field may know I'm wrong without knowing why. And there are always enormously more of those in any field than really top people.

So, I try to do as much of the process as possible in my own notebook rather than on permanently archived public message boards. The worst is when group #3 and #5 start arguing with each other, producing lots of heat but no light.

My theory about why the angry and defensive people in group #5 are never the top people is that they stopped learning when they reached a minimal level of competence, because their ego became so attached to their image of competence that they stopped being able to recognize when they were wrong about things, so they are limited by whatever mistaken beliefs they still had when they reached that level. But maybe I'm just projecting from my own past experience :)

Post reply on HN