Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Rule of 2

chromium.googlesource.com

Post reply on HN
Print view View original

51–59 of 59 posts

Re: The Rule of 2

#51

Post by dtech »

eikenberry wrote: post #49
est31 wrote: post #20

Earlier quoted context omitted.

https://gs.statcounter.com/browser-market-share/desktop/worl... https://data.firefox.com/dashboard/user-activity If you check where Firefox was 10 years ago to where it's now you can see the trend. It still continues. In the last year, Firefox lost more than 10% of its market share. A component of this is probably Firefox not being able to capture growth of the entire market, but the trend also holds for the absolute…

Neither of those charts go back far enough because if they did you'd see this has all happened before, and even worse at one point. When IE was taking over the world FF fell to <5% of the market, yet it survived. It's not dead until its dead and with Chrome killing off ad-blockers I bet we'll see some reversal of the current trends when that ships.

When IE had taken over the world (~2002) Firefox did not exist yet, unless you include Netscape or Mozilla Suite

Re: The Rule of 2

#52

Post by jandrese »

chubot wrote: post #34
tyingq wrote: post #9

"If you can be sure that the input comes from a trustworthy source" Perl's "taint" [1] capability is pretty interesting in this space. Do other languages have something similar? [1] https://perldoc.perl.org/perlsec.html#Taint-mode "You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale i…

Wow that's interesting. I've never heard of this in Perl or Ruby, and I always thought of taint analysis as static rather than dynamic. Though I don't have experience with it, maybe one reason it isn't used is because of false positives? For efficiency reasons, Perl takes a conservative view of whether data is tainted. If an expression contains tainted data, any subexpression may be considered tainted, even if the va…

IIRC all CGI scripts were run with the taint checker on some systems.

Re: The Rule of 2

#55

Post by rectang »

est31 wrote: post #20
rectang wrote: post #17

Earlier quoted context omitted.

No-thank-you to the gratuitous Firefox FUD.

https://gs.statcounter.com/browser-market-share/desktop/worl... https://data.firefox.com/dashboard/user-activity If you check where Firefox was 10 years ago to where it's now you can see the trend. It still continues. In the last year, Firefox lost more than 10% of its market share. A component of this is probably Firefox not being able to capture growth of the entire market, but the trend also holds for the absolute…

So what? Is it your mission to threadjack every story and turn it into a conversation about Firefox market share?

When you observe someone using Firefox do you interject, "You know that Firefox is dying, right?"

When you participate in meetings, do you open with "I'd like to state for the record that Firefox is doomed, doomed I say"?

At the coffee shop in the morning, do you order "Grande Mocha, hold the Firefox because all hope is lost"?

Re: The Rule of 2

#56

Post by UncleMeat »

chubot wrote: post #34
tyingq wrote: post #9

"If you can be sure that the input comes from a trustworthy source" Perl's "taint" [1] capability is pretty interesting in this space. Do other languages have something similar? [1] https://perldoc.perl.org/perlsec.html#Taint-mode "You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale i…

Wow that's interesting. I've never heard of this in Perl or Ruby, and I always thought of taint analysis as static rather than dynamic. Though I don't have experience with it, maybe one reason it isn't used is because of false positives? For efficiency reasons, Perl takes a conservative view of whether data is tainted. If an expression contains tainted data, any subexpression may be considered tainted, even if the va…

Dynamic taint analysis is a really common technique in academic work, but largely has unacceptable performance costs for interesting applications. Typical costs range from 10% to 100% overhead or more. The other problem is that the entire system needs to track it. If you just own part of a system, instrumenting to add dynamic taint tracking can be really difficult.

Re: The Rule of 2

#57

Post by jillesvangurp »

tyingq wrote: post #12
amoitnga wrote: post #11

Earlier quoted context omitted.

Is Ruby memory-safe?

No (direct) pointers or malloc, and garbage collected, so yeah.

Lots of native extensions though. So indirectly plenty of possibility for abuse. Some implementations are better at this than others.

Re: The Rule of 2

#58

Post by jillesvangurp »

est31 wrote: post #20
rectang wrote: post #17

Earlier quoted context omitted.

No-thank-you to the gratuitous Firefox FUD.

https://gs.statcounter.com/browser-market-share/desktop/worl... https://data.firefox.com/dashboard/user-activity If you check where Firefox was 10 years ago to where it's now you can see the trend. It still continues. In the last year, Firefox lost more than 10% of its market share. A component of this is probably Firefox not being able to capture growth of the entire market, but the trend also holds for the absolute…

By the same reasoning, Internet Explorer should have killed off Firefox ages ago. Except that never happened and instead it is IE that died. Firefox has plenty of supporters and a rich development community; it won't go away any time soon.

There are enough of them to keep Mozilla going indefinitely and they are doing some truly amazing stuff like using Rust to get massive performance boosts. Mozilla and Firefox have set the agenda technically for close to two decades. Everybody does tabs now. I remember when that was a Mozilla only thing. Extensions were a Mozilla only thing for a long time now. Even Safari has extensions now. The new focus on security and privacy started at Mozilla and is now being copied by others (Brave, Edge, Safari) while Google is moving to kill ad blockers and continues to sell users out to their advertisers.

Re: The Rule of 2

#59

Post by heavenlyblue »

realharo wrote: post #18
tyingq wrote: post #9

"If you can be sure that the input comes from a trustworthy source" Perl's "taint" [1] capability is pretty interesting in this space. Do other languages have something similar? [1] https://perldoc.perl.org/perlsec.html#Taint-mode "You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale i…

I'm not aware of a similar feature built into other languages, but most of it could be easily achieved with almost any type system. Just have two separate types, e.g. UnsafeString and regular String, and some kind of `convert` function that takes a validation function as an argument. You'd get compile-time checking that way. People don't tend to use such things in practice though, and you would also have to ban a por…

You could use an import hook in python, then create a whitelist of APIs that will be mapped to UnsafeString and then will receive SafeString as an argument.
Post reply on HN