[a / b / c / d / e / f / g / gif / h / hr / k / m / o / p / r / s / t / u / v / vg / vm / vmg / vr / vrpg / vst / w / wg] [i / ic] [r9k / s4s / vip] [cm / hm / lgbt / y] [3 / aco / adv / an / bant / biz / cgl / ck / co / diy / fa / fit / gd / hc / his / int / jp / lit / mlp / mu / n / news / out / po / pol / pw / qst / sci / soc / sp / tg / toy / trv / tv / vp / vt / wsg / wsr / x / xs] [Settings] [Search] [Mobile] [Home]
Board
Settings Mobile Home
/g/ - Technology

Name
Options
Comment
Verification
4chan Pass users can bypass this verification. [Learn More] [Login]
File
  • Please read the Rules and FAQ before posting.
  • You may highlight syntax and preserve whitespace by using [code] tags.

08/21/20New boards added: /vrpg/, /vmg/, /vst/ and /vm/
05/04/17New trial board added: /bant/ - International/Random
10/04/16New board for 4chan Pass users: /vip/ - Very Important Posts
[Hide] [Show All]


[Advertise on 4chan]


File: 1757093226050.png (311 KB, 1187x459)
311 KB
311 KB PNG
The absolute state of CNiles ...
>>
>>106493379
a lot of zozin on here today
>>
>>106493394
>/g/ in 2020: DistroTube + Luke Smith
>/g/ in 2025: Tsoding + Drew Devault
>>
In the time that he wrote that comment he could have just added the bound checks.
Game devs are the worst.
>>
>>106493440
Ecelebs will forever be a cancer. Luke Smith was a bit of a pseud and Distrotube isn't much of a programmer, so Tsoding is at least a small improvement. I remember watching his content when he was a Haskellfag. That was also during the FP craze. Now the trend is low level programming and he's all about C and C replacements. Also a move in the right direction. Maybe 5 years from now people will start being obsessed with Lisp.
>>
>>106493379
you can also blame the retards who shoved a whole virtual machine in a font file
>>
// gcc -O2 -Wall -Wextra -Werror
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#define E_YOU_ARE_STUPID (-2)
typedef struct { uint64_t garbage; uint64_t more_garbage; } Result;

int UnsafeParse(uint64_t start, uint64_t end, Result* output);
int DoStuff(Result* a);

static inline int Parse(uint64_t start, uint64_t end, Result* output) {
if (start >= end) {
return E_YOU_ARE_STUPID;
}
if (output == 0) {
return E_YOU_ARE_STUPID;
}
return UnsafeParse(start, end, output);
}

int Run() {
Result* output = (Result*)malloc(sizeof(Result));
int code = Parse(0, 1024, output);
if (code == 0) {
DoStuff(output);
}
free(output);
return code;
}


Run():
pushq %rbp
movl $16, %edi
pushq %rbx
subq $8, %rsp
call malloc
movq %rax, %rbp
testq %rax, %rax
je .L5
movq %rax, %rdx
movl $1024, %esi
xorl %edi, %edi
call UnsafeParse(unsigned long, unsigned long, Result*)
movl %eax, %ebx
testl %eax, %eax
je .L8
.L2:
movq %rbp, %rdi
call free
addq $8, %rsp
movl %ebx, %eax
popq %rbx
popq %rbp
ret
.L8:
movq %rbp, %rdi
call DoStuff(Result*)
jmp .L2
.L5:
movl $-2, %ebx
jmp .L2
>>
yo i just watched the stream tooooo!
>>
>>106494013
>yo
N
>>
>>106493379
just throw away performance by wasting time bounds checking files that you know are the right size. The absolute state of rustrannies
>>
>>106494069
>that you know are the right size
Prove it.
>>
>>106494091
well if you want to use malicious font go ahead, we assume you know what you are doing
>>
I fail to see the issue. Maybe what people need is a define, IM_A_FUCKING_RETARD, which enables and duplicates security checks.
>>
>>106493379
Bozo took the time to write out this warning instead of adding a simple range check...
>>
>>106494216
almost like the lack of range check was intentional...
>>
>>106493634
C to Lisp would be a move in the wrong direction. Lispfags know the value of everything and the cost of nothing.
>>
>>106494228
This kind of attitude is why Firefox had to move font parsing to webassembly
>>
>>106494302
firefox parses fonts downloaded off the web. and also is made by retards, of course they chose to destroy performance instead of fixing their code, they have no clue how to do the latter
>>
>>106494302
False equivalency
>>
>>106494302
>>106494319
i didn't make the difference clear: one is deliberately not bounds checking for performance reasons, the other is trying to bounds check, but being too retarded to do it right
>>
>>106494069
turn on function inlining >>106494009
>>
>>106493634
Tsfdiig is just a perpetual nocoder fag
>>
>>106494339
the fact that the bounds check is unnecessary depends on the data file, so you would need to inline the entire file to pull that off. Besides being retarded in it's own right, no compiler today would manage to optimize out the bounds check even if you did that.
>>
>>106494091
I checked right before compiling.
>>
>>106494069
>throw away performance
You just know that this poster is a dumb low iq unemployed pseud
because obviously, to anyone with an IQ over 80, bounds check cost a couple of CPU cycles, while the processing of the glyph costs hundreds of thousands, maybe millions of such cycles. Therefore, to any rational person, this """cost""" is negligible.
>>
>>106494117
Malicious fonts won't call themselves malicious. It might not even malicious by intent, but by ignorance. Do you know what you're doing?
>>106494441
So you used software to bounds check the font? Are you going to bundle that with your software if you enable user font selection or expect the user to also check their fonts?
>>
Post 1 font actually used by the the average consumer that is maliciously reading arbitrary memory
>>
>>106494469
the code takes time to write and actively makes the code slower while providing zero benefit.
>>
>>106494518
you're as retarded as the people you're arguing against. if some software has an rce, then people will craft files to exploit that rce. Obviously the code is unlikely to be exploited by files that already exist in the wild.
>>
>>106494518
>I don't even know if it exists. Thus, it won't happen.
>>
>>106494522
It takes one hour to do bounds checks at most, and there is a benefit (ability to use the library on untrusted fonts without having RCEs in your program)
>>
>>106494469
even just 1 cycle is worth it because you people have been saying this same shit for years and made this "negligible cost" not so negligible.
>>
>>106494614
>you people have been saying this same shit for years and made this "negligible cost" not so negligible.
You are so retarded that it hurts. Implying that software is slow because of bounds checks instead of garbage collectors or just outright using python/js like 99% software today, it is so retarded that I don't even know what to say
>>
>>106494631
i dont believe you had trouble parsing my intent. i believe you are being intentionally obtuse for effect.
>>
>>106494585
>and there is a benefit (ability to use the library on untrusted fonts without having RCEs in your program)
use a library designed for that. not every library needs to be designed for every use case.
>>
>>106494488
Why do faggots like you need someone to hold your hand to do anything? You're the same as the Rust shills on here. The way you lot talk it would seem that at any given time you are 5 seconds away from doing some catastrophically stupid lest you have some sort of safety system in place in order to prevent you doing X stupid thing. I've been using computers my entire life and the only time I have downloaded malicious programs is when I have intentionally tried to get said program to play around with them. The solution to the problem here isn't putting in thousands of safety checks in every single code base, it's the user stopping for a second or two and thinking for themselves.
>>
>>106494631
anon when someone starts saying retarded shit like "checking the bounds would be too slow" that's your cue to leave the thread, the poster is hopelessly delusional. your /g/ experience will be better when you ignore all (You)'s that are stupid
>>
>>106494488
>if you enable user font selection
Why would I do that?
>>
>>106494974
>Doesn't explain xirself but instead makes some unrelated grandiose post about xir's head-cannon about the poster because you have no real argument against them but won't concede your position because you can't bear the thought of some cnile chud getting one up on you.
Embarrassing.



[Advertise on 4chan]

Delete Post: [File Only] Style:
[Disable Mobile View / Use Desktop Site]

[Enable Mobile View / Use Mobile Site]

All trademarks and copyrights on this page are owned by their respective parties. Images uploaded are the responsibility of the Poster. Comments are owned by the Poster.