Readit News logoReadit News
tadbit commented on OpenSSL bug exposed up to 255 bytes of client heap and existed since 2011   jbp.io/2024/06/27/cve-202... · Posted by u/belter
hannob · 2 years ago
An interesting aspect of this is that it's a bug in NPN, which is more or less a historic artifact.

When SPDY, the precursor of HTTP/2, got introduced, it needed a mechanism to signal that within TLS, a different protocol (SPDY instead of HTTP/1.1) was spoken. That mechanism was originally NPN. I don't know the exact details and motivation, but eventually people seem to have decided that NPN wasn't exactly what they wanted, and they invented a new mechanism called ALPN.

Now, that was a decade ago (the ALPN RFC is from 2014), so the question is: why do we still have NPN code in OpenSSL? I don't think anyone uses it any more. Shouldn't it have been removed long ago?

To put this in a larger context: it appears to me that OpenSSL still has a strong tendency to bloat. Heartbleed was essentially a "we added this feature, although noone knows why we need it" kind of bug, but it doesn't look to me they've changed. I still get the feeling that OpenSSL adds many features that they probably just should ignore (e.g. obscure "not invented here"-type algorithms), and they don't remove features that are obsolete.

tadbit · 2 years ago
LibreSSL removed NPN support seven years ago.

https://marc.info/?l=openbsd-announce&m=150996307120987&w=2

I wonder how many memory leaks it'll take for OpenSSL to finally get their act together or for major projects to drop it entirely.

tadbit commented on OpenSSL bug exposed up to 255 bytes of client heap and existed since 2011   jbp.io/2024/06/27/cve-202... · Posted by u/belter
anthk · 2 years ago
Does this happen with LibreSSL?
tadbit · 2 years ago
No. They removed NPN support seven years ago.

https://marc.info/?l=openbsd-announce&m=150996307120987&w=2

tadbit commented on Ask HN: Best way to learn robotics with a 10 year old?    · Posted by u/hersko
JoblessWonder · 2 years ago
I know that you said you don't want a premade kit and following instructions and this is *close* to that... but I think it might still be a great fit.

Mark Rober has a new product where they ship a new robot every 2 months. They give you the basic instructions on how to build/program it but the idea is that you take that knowledge and then expand on it yourself by adding features. My daughter is still a little too young for it so I haven't used it personally. The biggest issue is that it is a subscription and not a one time purchase.

Here is the link: https://www.crunchlabs.com/products/hack-pack-subscription

And here is a brief video explaining how it expands beyond the normal "premade robot kit." https://www.youtube.com/watch?v=TtdOdUi9b_s

tadbit · 2 years ago
> NOTE: The IDE works only on Mac or Windows (if you want to code)

Boo! hiss

tadbit commented on Wide angle lens distortion correction from lines   hh409.user.srcf.net/blog/... · Posted by u/hugohadfield
emtel · 2 years ago
This is cool, but couldn't you generate the correction transformation simply from knowing the lens geometry? I assume this is what my phone is doing when I take wide-angle pictures (which don't have any visible distortion)
tadbit · 2 years ago
Yes. Most professional photo editing and management software has built-in functionality or an add-on for lens distortion correction. However it either requires having the original photo, or at least a non-cropped version with the exif data, or some knowledge of what body and lens and focal length was used.

This utility doesn't require the original non-cropped area nor any other information about the picture that was taken. You could scrape a bunch of pictures from Instagram or Facebook and batch process away.

tadbit commented on Kawaii – A Keychain-Sized Nintendo Wii   bitbuilt.net/forums/index... · Posted by u/realslimjd
mejutoco · 2 years ago
I remember kids with the game gear. Hardly ever saw them playing because of the batteries. For a portable console I think it was a choice on battery life.
tadbit · 2 years ago
The game gear was extremely lousy to use. Too small of a screen, ate through batteries incredibly quickly, the original, external battery pack (not included) was poorly made and didn't help that much either.

And the game selection early on was pretty lousy too. Sonic was only fun for a while.

People are doing amazing things with game gear hardware as of late, though. All of that addressed spectacularly.

tadbit commented on FCC votes to limit prison telecom charges   worthrises.org/pressrelea... · Posted by u/Avshalom
NoMoreNicksLeft · 2 years ago
> We'll never figure out how to do it until we actually start trying to rehabilitate people.

We'll never figure out how to do it because it's unethical to experiment on humans. But even more damning than that, we don't have a good theory of mind that explains criminality. It's all half-assed woowoo nonsense meant to bolster this or that political ideology.

tadbit · 2 years ago
> We'll never figure out how to do it because it's unethical to experiment on humans.

Ah, yes, we never do that. All of our advancements in medical and psychological sciences just pop into existence out of no where!

> It's all half-assed woowoo nonsense meant to bolster this or that political ideology

Right. And your comments here aren't pushing an agenda at all. Definitely not a bigoted, inhumane agenda.

tadbit commented on FCC votes to limit prison telecom charges   worthrises.org/pressrelea... · Posted by u/Avshalom
NoMoreNicksLeft · 2 years ago
> It would greatly benefit society to have prisoners be rehabilitated.

It would. If only we knew how to do that.

There are places in this country where attitudes develop for many years, decades even, before that person is ever incarcerated. By the time that happens, these attitudes are quite immutable, and they see any gentleness as vulnerability. They're adept at lying, exploitation, and have no qualms about hurting others. What sort of rehabilitation do you even think is possible? Where do you expect this million person army of rehabilitators to come from exactly, to be hired in these prisons? When they start getting raped and killed, will you just double down? Under what principles, exactly, do you expect the rehabilitations to operate? Do you ever remember seeing some study or research that concluded "If steps A, B, and C are performed on convicts who meet the empirical criteria of X, Y, and Z" then they will become upstanding members of society"?

tadbit · 2 years ago
> If only we knew how to do that.

We'll never figure out how to do it until we actually start trying to rehabilitate people.

> There are places in this country where attitudes develop for many years, decades even, before that person is ever incarcerated.

This is text book bigotry.

tadbit commented on FCC votes to limit prison telecom charges   worthrises.org/pressrelea... · Posted by u/Avshalom
ilikehurdles · 2 years ago
Prisons serve many purposes and rehabilitation should be lowest priority of them, after incapacitation, deterrence, and retribution. Prisons are for society’s benefit, not for prisoners. If inmates can be rehabilitated, great, but all those other things are more important.
tadbit · 2 years ago
> Prisons are for society’s benefit, not for prisoners

It would greatly benefit society to have prisoners be rehabilitated. It's currently just a vicious cycle that produces hardened, repeat offenders that prison companies can make money off, money that comes from tax payers.

Dead Comment

u/tadbit

KarmaCake day245August 2, 2021View Original