Hot answers tagged

111

This hack has to be understood in context. It was published at a time and in a culture where Unix running on all kinds of different hardware was the dominant system. What made the attack so scary was that the C compiler was the central piece of software for these systems. Almost everything in the system went through the compiler when it was first installed (...


79

The purpose of that speech wasn't to highlight a vulnerability that needs to be addressed, or even to propose a theoretical vulnerability that we need to be aware of. The purpose was that, when it comes to security, we'd like to not have to trust anyone, but unfortunately that's impossible. You always have to trust someone (hence the title: "Reflections On ...


63

Developers just need to provide a package for a distribution. Each distribution then has a way to install this package. This way can be in a terminal (apt-get) or via a graphical interface, e.g. Ubuntu Software Center. The beauty is that developers just have to care about building a proper package; the distribution makers take care of the rest, and each ...


60

Today, most database management systems (e.g. PostGreSQL, MongoDB, etc...) internally keep their data inside OS files (in the past, some DBMSs used raw disk partitions directly). On recent computers still using spinning hard disks, the disk is so slow - relative to the CPU or the RAM - that adding a few software layers is not relevant. SSD technology might ...


54

No The attack, as originally described, was never a threat. While a compiler could theoretically do this, actually pulling off the attack would require programming the compiler to Recognize when the source code being compiled is of a compiler, and Figure out how to modify arbitrary source code to insert the hack into it. This entails figuring out how the ...


42

Because they don't need to. Linux distributions usually have working package management systems, unlike Windows, where every single application has to re-implement installation and updating over and over and over and over again.


35

£100/month? How much do you cost? How much is going to cost your training? If it's £100/month but you can get a .NET app up in a month, while you will need at least 3 to 6 months to get your node.js/C++ app running, go for the .NET. Seriously. Your time is way more expensive than these little £100/month. Ideally, yes, you're right in your analysis. What ...


28

A software is real time not when it is as fast as possible, but when it is guaranteed that a process completes within some determined time slot. In a soft real time system, it is good but not absolutely necessary that this is guaranteed. E.g. in a game, the calculations necessary for a frame should complete within the period of a frame, or the framerate will ...


27

I've done a fair amount of work supporting HFT groups in IB and Hedge Fund settings. I'm going to answer from the sysadmin view, but some of this is applicable to programming in such environments as well. There are a couple of things an employer is usually looking for when they refer to "Low Latency" support. Some of these are "raw speed" questions (do ...


26

First, my favorite writeup of this hack is called Strange Loops. This particular hack could certainly (*) be done today in any of the major open source OS projects, particularly Linux, *BSD, and the like. I would expect it would work almost identically. For example, you download a copy of FreeBSD that has an exploited compiler to modify openssh. From then ...


24

Although this is opinion-based, I think it's just another historical artifact. Early OSes used a simple file system design for performance that was reasonably strongly tied to the characteristics of the hardware available at the time, and it's been the same way ever since. It's difficult to change the old file read/write APIs for more transactional query/...


23

There are two different memory limits. The virtual memory limit and the physical memory limit. Virtual Memory The virtual memory is limited by size and layout of address space available. Usually at the very beginning is the executable code and static data and past that grows the heap, while at the end is area reserved by kernel, before it the shared ...


22

Most closed-source, non free-as-in-beer software for Linux does come with installation wizards. So does some closed-source, free-as-in-beer software, at least until most major distributions pick it up. For open source software, package managers are a clearly superior solution. So what about the early stages before open source software gets picked up by ...


19

File pointers are not the only way to access files on POSIX systems (which, obviously Linux is). As a matter of fact, the FILE struct exists to make it easier to work with files in a cross-platform manner (fopen() will work on both Linux, Mac OS X, any BSD and Windows) and to provide some facilities like transparent buffering (buffered I/O is way faster). ...


16

Basically, Apple's policy is that in order to develop for iOS, you need a Mac. They have all sorts of reasons for doing it that way: increased sales on the desktop market (which isn't exactly Apple's cash cow), controlling the development platform, better brand exposure, you name it. Now, there may be tools to develop iOS apps without a Mac, but these will ...


16

In addition to the excellent hardware/setup tuning answer from @jimwise, "low latency linux" is implying: C++ for reasons of determinism (no surprise delay while GC kicks in), access to low-level facilities (I/O, signals), language power (full use of TMP and STL, type safety). prefer speed-over-memory: >512 Gb of RAM is common; databases are in-memory, ...


16

Does this affect all languages? This attack primarily affects languages that are self-hosting. That is languages where the compiler is written in the language itself. C, Squeak Smalltalk, and the PyPy Python interpreter would be affected by this. Perl, JavaScript, and the CPython Python interpreter would not. How does this relate to just-in-time compilation? ...


15

Except OpenGL, I never used those libraries, but I'm going to try to guess, by reading wikipedia pages, like you did. You seem right about Mesa. Here is the additional info we have : "The X window system is a computer software system and network protocol that provides a basis GUIs for networked computers. It creates a hardware abstraction layer." "GLX ...


15

bash has been around since 1989, and its syntax is largely compatible with that of the much older Bourne shell, which was released in 1977. Huge swaths of core functionality in many operating systems (most Linux distros, OS X, and indeed most POSIX-compatible operating systems), and many real-world systems (make systems, automated tests, initialization ...


14

Frequently it is worth moving to an open source stack, but it's more likely to be driven by a combination of factors: Cost - yes, you will save some money on licensing and hosting. But it probably isn't enough to sway the decision in most cases. If you can't afford or raise a few thousand dollars, then are you really sure you should be doing a startup ...


14

There's a theoretical chance for this to happen. There is, however, a way of checking if a specific compiler (with available source code) has been compromised, through David A. Wheeler's Diverse double-compiling. Basically, use both the suspected compiler and another independently developed compiler to compile the source of the suspect compiler. This gives ...


14

Linux distributions (as well, I think, as BSD-flavoured Unices) have a user-friendly interface to program installation, via so-called package managers (or ports management in the BSD case): pacman for Arch, dpkg for Debian/Ubuntu, and so on. These package manager provide a way to install programs by means of uniform configuration files. Once the program you ...


13

You can also use libreOffice/open-office-spreadsheet-non-zip-xml-fileformat "*.fods" which is plain xml. @glenatron s comment applies to this format, too. The standard open ofice spreadsheet format "*.ods" is zipped xml and not so suitable for git (similar to @Egryan/@emuddudley answer).


13

I've often asked myself, and others this question, and I'd like to address a point I often see brought up before I get to why Linux sees fewer installers: Linux distributions provide package managers. However, I wouldn't say that a Linux distribution's package manager is a replacement for an installer for, in part, the following reasons: These package ...


13

Your understanding is wrong. Several Linux processes can write to the same file at once (and what happens then might be unspecified, except when the processes overwrite different segments of that file). And some other Linux process (e.g. your browser) can read a file which is written to. You could adopt a convention to avoid that. For example, you could use ...


12

Short Answer: You would definitely have less headaches with a single database. Otherwise, you may end-up with record synchronization issues, as well as with record duplicates, in all local databases that you might use. What would you need is just to create a DAL (data access layer) and make your client applications (desktop, wen, mobile, etc) access your ...


12

Linux in VM is the easiest option to learn UNIX. If you're running Ubuntu, you can open up terminal and type: sudo apt-get install gcc And you'll have your compiler. Debian-based distros in general will make development very easy because if you're missing library X, chances are it's already in the repositories and you can apt-get it with minimum fuss. For ...


12

Yes, even if you don't use them often, it's good to know how and why things work the way they do. Some environments may not support IDEs as such or the IDE for a new language might be immature or non-existent. You can also make a script that triggers a makefile, thereby allowing code that can autocompile without human intervention. Thus knowing how to make ...


Only top voted, non community-wiki answers of a minimum length are eligible