Hacker Newsnew | past | comments | ask | show | jobs | submit | Someone's commentslogin

> What return path could possibly lead to a RCE?

API protocol says “return value is either “OK” or “ERR””, attacker sends “Floccinaucinihilipilification”, overflowing the 3-byte response buffer allocated on the stack.


Right, so you have the first step of something, but then depending on everything else, this is either a DOS or a RCE.

I'm claiming if "everything else" does indeed lead to a RCE, you're again doing something very wrong here. It's not rocket science exactly.


> I'd appreciate if someone could dump the iOS "adult websites" list (which are blocked by default in the UK unless you submit government ID etc.) reply

> Edit: I'm reliably informed that it's enforced at the domain level via a bloom filter stored in /System/Library/…

If it is a Bloom filter (with a capital B, as it is named after Burton Howard Bloom; see https://en.wikipedia.org/wiki/Bloom_filter), there’s no way to get URLs out of that. It’s just a collection of bits.

The best you can possibly get is how iOS processes an URL to get the bits to check in the filter, but to get that, you need the code accessing the file.


There is an Endnote plugin. Google tells me it is developed by Apple, so the plug-in interface isn’t published, and it also may be limited to that single use case, but that’s a (probably tiny) lead towards writing one.

I am aware of Endnote plugin but my entire library is on Zotero. I have close to 20K papers there as of today and it's constantly expanding, so I can't move to Endnote. Besides that I am a lifelong supporter of Zotero.

Let me rephrase that: Pages has a door that allows an EndNote plugin to do things inside Pages. That door may be locked and it may not lead to (all) the stuff you want, but if you’re looking for a door, I would start there. Maybe, it is open or can be pried open.

I don’t find the article clear on how it fixes things, but I guess that, now

  a op1 b op2 c
is an error if op1 is unequal to op2 and they have the same precedence. Do I see that right?

Also, it seems each operator will have to have a associativity to handle a future operator for exponentiation or (also potential future) custom operators.

Finally, the “What you need to know” section doesn’t mention orelse. Where does that fit in?


The point is that there is no longer a global ‘precedence number’ where the operator with the higher precedence binds tighter. Instead, it is only valid to write your example for some combinations of op1 and op2; other combinations will require explicit parentheses.

Presumably orelse is not in the table because it requires parentheses for any other operator.


I would hope they implemented it with precedence numbers, as any other way is likely to be harder to write and lead to inconsistencies.

It’s harder to write because users will want to use expressions with more than one operator such as

   b * b - 4 * a * c
   a * b + c * d > e * f and g < h

The first expression is fine, as it uses extremely commonly known precedence rules. The second is more arguable.

However, the following expressions should be invalid in any language, and no one should write them even in languages where they are unfortunately allowed:

  a + b >> c & d && 0 % 9

  a >> 4 ? b : c & d ^ 7

Given strict left to right parsing I don't see the issue with either of those examples (setting aside that perhaps bool % int ought to trigger a type error). The second example in particular seems perfectly sensible when read this way.

Note that I view ? as a language construct rather than an operator. If for whatever reason someone insisted on including that in the strict left to right requirement the second example still works and is easy to read. I just don't like those semantics as much because the parenthesis in something like a ? ( b >> c ) : d are otherwise unnecessary. The implicit parenthesis of expr ? expr : expr seems preferable to me.


> is an error if op1 is unequal to op2 and they have the same precedence. Do I see that right?

It doesn't look like it works that way; only some operator classes are "unchainable".

An older PR description gives more information: https://github.com/ziglang/zig/pull/25275 (There's also a small mention of keyword operators, which I presume `orelse` is. There's a nice diagram showing the precedence classes here: https://codeberg.org/ziglang/zig/pulls/30160#issuecomment-20...)


FTA: “The new name, Tesla Assisted Driving (TAD), will appear on the in-car display, in the manual and in all other information for the driver”

Similarly, tweaking a cycle path with duct tape: https://youtube.com/watch?v=0ziqlGgc8_k.

A few days later, the city council made this change permanent.

That may be because this is a clearer win for everybody involved.


Not the OP, but serializing both nil and empty arrays to the same json string means round tripping will not work for all objects.

That seems like a bad default to me.


Can’t some of these easily be improved upon?

For example, for the 12.5°, 15° and 20° ones, replace the two blocks in the top layer by the construction used for the top two blocks in the 25° record.

Also, I think “A lone upright block tips over at 11.3° in its thin direction” doesn’t imply “no matter what you do to the base, you can’t stand blocks up vertically at high tilts.”

I would think you could sneak in cage-like structures like these (seen from the top)

   ABB   A
   A D   ABB
   CCD  CCD
          D
with blocks A and D taking most of the north-to-south loads and B and C taking most of the east-to-west loads.

Possibly that will only work near the base, where there is more pressure from above that prevents these blocks from falling over.

Possibly, such a construct with only three (at 120° angles) or two blocks could work, too.


Rearranging blocks at the top to make them taller shifts up the center of gravity for the entire structure, which can destabilize lower levels. So copying part of a more stable tower into a less stable one won't necessarily be an improvement.

> It's just that it makes sense in aggregate, but for that to make sense everybody must do their part.

I don’t understand that. The fewer people vote, the more impact your vote has, so the more sense it makes to vote (up to a limit, of course. If too few people vote, revolution gray be around the corner)


Well think about it: If nobody votes, what happens?

https://www.personregistrering.dk/hc/en-gb/articles/36002148...:

“If the first name you want for your child is not on the list of approved names, you can apply to have it approved. You do this when you complete the application, where you are asked to explain why you want a non-approved first name.”

I think that’s a bit clearer than getting a veto, as vetos without a whitelist can get applied inconsistently.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: