Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Try Objective-C

tryobjectivec.codeschool.com

Post reply on HN
Print view View original

51–60 of 68 posts

Re: Try Objective-C

#51

Post by lmz »

joshschreuder wrote: post #50
eridius wrote: post #46

Earlier quoted context omitted.

If the variable's value contains any format args, e.g. %s, then NSLog (or printf, or whatever string formatting function you're using) will look for another argument, which you didn't actually pass, so it starts looking at garbage stack values. Besides causing incorrect output, this may crash your program, or potentially be a vector for an exploit.

Is there any reason NSLog doesn't filter input to escape these format args?

Because it's the format string, which the programmer is supposed to control?

NSLog(untrusted); bad. NSLog("The user entered %s", untrusted); OK.

Re: Try Objective-C

#53

Post by greenranger »

kristopher wrote: post #52

The Super Mario World theme is cool, although super ironic since Objective-C/iPhone is helping to displace the Nintendo Empire.

Which is a little ridiculous considering nintendo likely stands to make a kabillion dollars if it begins releasing mario titles for iOS devices.

Re: Try Objective-C

#54

Post by eridius »

joshschreuder wrote: post #50
eridius wrote: post #46

Earlier quoted context omitted.

If the variable's value contains any format args, e.g. %s, then NSLog (or printf, or whatever string formatting function you're using) will look for another argument, which you didn't actually pass, so it starts looking at garbage stack values. Besides causing incorrect output, this may crash your program, or potentially be a vector for an exploit.

Is there any reason NSLog doesn't filter input to escape these format args?

Because that would defeat the entire purpose of NSLog.

Re: Try Objective-C

#55

Post by Someone »

joshschreuder wrote: post #50
eridius wrote: post #46

Earlier quoted context omitted.

If the variable's value contains any format args, e.g. %s, then NSLog (or printf, or whatever string formatting function you're using) will look for another argument, which you didn't actually pass, so it starts looking at garbage stack values. Besides causing incorrect output, this may crash your program, or potentially be a vector for an exploit.

Is there any reason NSLog doesn't filter input to escape these format args?

It can't. http://en.wikipedia.org/wiki/Uncontrolled_format_string:

"In particular, the varargs mechanism allows functions to accept any number of arguments (e.g. printf) by "popping" as many arguments off the call stack as they wish, trusting the early arguments to indicate how many additional arguments are to be popped, and of what types."

NSLog is similar; it has to trust its first argument to be consistent with the number and types of arguments actually passed to it.

If you call NSLog(x), but do not have complete control over the value of x, you cannot guarantee that.

Re: Try Objective-C

#56

Post by Rafert »

Very interesting. I started with Try iOS but getting an actual app together in Xcode proved more difficult than I thought, partly because Obj-C still felt so weird after only learning Java/C# during university.

I ended up buying the Big Nerd Ranch book (it's great!) on iOS programming, which also covered Objective C in more detail.

Re: Try Objective-C

#57

Post by josteink »

Good stuff... I guess?

I still fail to see the appeal of learning a language with such extremely limited value (only works, has tools and adaptation on a certain lawsuit-happy gadget-vendor's OS).

Anyone? And what about principles? What about giving back to the community? Shouldn't hackers hacking away on the next big thing be using open technologies as open technologies was what enabled them to get hacking in the first place?

Re: Try Objective-C

#58

Post by canttestthis »

josteink wrote: post #57

Good stuff... I guess? I still fail to see the appeal of learning a language with such extremely limited value (only works, has tools and adaptation on a certain lawsuit-happy gadget-vendor's OS). Anyone? And what about principles? What about giving back to the community? Shouldn't hackers hacking away on the next big thing be using open technologies as open technologies was what enabled them to get hacking in the fi…

So creating apps for an OS that controls 40% of the market share is limited value?

Open source is good, but I don't condemn software that's closed source. I use OSX and dualboot Windows, for one.

Re: Try Objective-C

#59

Post by 38leinad »

UmOkThatsCool wrote: post #18
dreen wrote: post #15

Earlier quoted context omitted.

nothing at all. but it scared me off. like in highschool i had this german teacher who scared me off german because she was a massive bitch. not the language's fault, but i hate german now.

You hate X because of a completely-unrelated-thing-Y? Try acting like an adult.

sometimes I really get annoyed over here because of stupid comments like yours. keep it to yourself!

Re: Try Objective-C

#60

Post by yarrel »

josteink wrote: post #57

Good stuff... I guess? I still fail to see the appeal of learning a language with such extremely limited value (only works, has tools and adaptation on a certain lawsuit-happy gadget-vendor's OS). Anyone? And what about principles? What about giving back to the community? Shouldn't hackers hacking away on the next big thing be using open technologies as open technologies was what enabled them to get hacking in the fi…

Politically I agree, but Objective-C is a better language than C++ or Java, and Cocoa is a better framework than the STL or the Java core libraries. That's before we get to the GUI experience. Learning it will make you a better programmer.
Post reply on HN