whizzter · HackerTrans

whizzter

2,824 karmajoined il y a 11 ans

https://whizzter.woorlic.org (yeah old https cert for the time being)

comments

il y a 13 heuresdiscuss

The encryption/hiding is done by the firmware, hence..

1: The drive more or less looks like any boring old usb-stick, it isn't even uncommon for cheap fake Amazon sellers to sell sticks with SD-card's as faked large drives (so even with X-ray inspection it doesn't look too much out of order).

2: To a computer, since the firmware presents a regular UMASS device, there isn't anything telling the computers over-the-wire protocol that anything is amiss (since the real size is hidden by the firmware and regular accessible blocks just behave normally).

So, short of an intrusive teardown of the device to read the true size of the SD-card and even knowing the presence of a hidden volume, the only over the wire that can help discerning this from a regular drive is timing attacks (And as you notice from this thread, people are jumping on to suggest solutions to minimize or even remove that).

il y a 13 heuresdiscuss

Where are we with modules, isn't pimpl there largely to avoid costs related to including the world?

I was pondering on why he was putting the defaulted methods in the cpp, any particular reasons?

I did realize that the indirect version is required to be in the cpp since the header won't know how to copy without knowing the definition of the impl class.

il y a 13 heuresdiscuss

The irony is that including/using many standard c++ headers is far far more expensive than including a lean windows.h these days.

To make hobby-coding fun, i use a mstdp.hpp that implements "naive" versions of unique,shared,function,etc that compiles faster than including just one of the std versions (and yes, MSVC versions of those libraries seem to be excessivly complex).

il y a 3 joursdiscuss

I think part of the entire design is that it's quite hard to detect.

1: Reads/Writes are just routed to a COTS SD-card. 2: Unless the (correct?) password is detected in the write-data that starts the disconnect procedure.

The only way to detect it from what I can see is to profile writes then append a "password:" string multiple times to measure the write-delay, only works if the CPU cost is large enough to overtake the SD-card measurably and some constant-time optimizations should make it more or less undetectable.

It's a clever design and I think it should be possible to optimize to become more or less unrecognizable.

il y a 11 joursdiscuss

Ah sorry for being coy, the G was meant to be a shorthand for gyr or am I misremembering?

il y a 11 joursdiscuss

Can't remember the exact featureset of the popular D one (because boy, was there many languages called D and E and so on over the years in the 80s/90s), I'd say to be a car it needs both temporal and bounds safety at the least but faintly I remember D being a bit of a kitchen sink? Wasn't there 2 standard libraries for a while? Were they even coherent in style/used language features?

il y a 11 joursdiscuss

You went by that g nickname back then right? Remedy 2003 in that cramped student apartment.

il y a 11 joursdiscuss

Ice skates with a rocket engine on your back?

il y a 12 joursdiscuss

For those that weren't around (or didn't do programming back in those days).

The GUS soundcard just filled a niche perfectly at point in time with a reasonable pricepoint.

It came out at the same time as the Sound Blaster 16, but while the SB16 required "expensive" software mixing for anything but prerecorded audio the GUS handled that in hardware meaning that users either traded for CPU performance or audio quality in games.

In the 486 era it was really a differentiator and also caught on in the demoscene, by the time Pentium processors rolled in the software mixing cost became far less pronounced.

Finally when Windows became the go-to for games (and CPU's got even faster, esp when MMX processors came into play) the API's made cheap hardware equally good since most developers just targetted the plain streaming API's (with software mixing) for broader compatibility.

The final holdout for GUS cards afaik was the demoscene, since the card had a built in mixer with frequency control it could play modules (.MOD, .XM,etc) with simple players that just uploaded the samples to ram and then just changed registers realtime (kinda like an Amiga but more powerful) instead of including a mixer, in the end however it was more about code-size than cpu performance, doing a 64kb intro you could shave off something like 3-10kb's compared to supporting a SoundBlaster card (depending on other tools) and those extra KB's was well suited for effects/art.

In the end though, people realized that the dosextender+GUS combo was as heavy in terms of code as just a mixer on Windows (since you didn't need a dosextender) and when better compressors arrived for Windows even the demoscene moved on.

il y a 12 joursdiscuss

It's the old craftsmen vs industry issue, Andrew comes from the craftsman tradition that prefers all other people developing to also be proud craftsmen.

What Java, JS, Python and C# all did to conquer the industry from a C++ dominance was to provide safety harnesses for less "perfectionist" workers to fumble around without causing a mess, to write C and C++ in an increasingly hostile world we realized you needed a lot of craftsmanship, the performance benefits outdid and kept the latter languages relevant for a long while.

Still, the performance/predictability penalty didn't give way so Rust (and Swift) came into play. They don't have as many unpredictable performance characteristics as the previously "safe" GC languages but still provided more or less the same guarantees (in some ways perhaps even better for Rust).

The brilliance of the Rust ideas did start a bit of a cambrian explosion of languages in that niche, most of them however targeting a bit more of a craftsman position than Rust (that came out of distinct industry needs).

The problem as the article illustrates, in car terms.

If Java,JS,etc are mostly "regular safe cars" and C/C++ a two wheel motorcycle.

Rust is perhaps a rally car (fast but still a car so occupants inside are well protected) whilst Zig really is a quadbike or open wheel cart, not as unsafe as a two wheel bike since you won't slide for the smallest oil/ice patch but flipping over is still dangerous as hell.

And that takes us to the crux, so many developers who love the craft and perfection (and don't live under- or perhaps care of- financial constraints) think that "good careful" developers is all that's needed and don't see dangerous language designs as a problem.

I'm an older developer, and given that I can write "good careful code", but 90% of the time it's also a matter of time and financial constraints so I wouldn't trust mine (or anyone elses for that matter) code written under those "industry" conditions.

I think Zig has a lot of nice perks, but it was obvious from day 1 that it's very much for people that love their hacking freedom over writing code for todays hostile world.

il y a 15 joursdiscuss

I think that's the issue in some cases though, while being totally absent is a major negative, the perception the kid has of the parent _while_ present is more improtant than when being absent if the absence is understandable, a kid in daycare will observe other parents leaving and picking up and normalize it.

il y a 17 joursdiscuss

RenderWare was quite a special case that made trust in third party engines go down significantly since EA closed it to external customers just as the PS3 hit (Renderware kind-of saved the PS2 since it was "complicated" in the same ways as the PS3 but having a middleware enabled many smaller developers to focus on their games).

Engines has been (And is to a large extent) bad business because unless you really do something _really special_ it's way expensive for little gains (especially if you're targeting realistic games since there is so much to focus on before even considering portability).

And I say this as someone who started out working on custom engines (but am out of the business outside of hobby stuff).

il y a 18 joursdiscuss

The pandemic and scalpers really destroyed peoples apetite for the "new thing" when this generation came out, and with that boost missing studios saw little point in going exclusive perpetuating the vicious cycle, it's just in the past few years that there's really been exclusives for this generation that didn't also support older consoles.

And even then, already the PS4/XbOne generation added stratification making it more "PC-like" with the XbOne-X having heftier hardware (not to mention it being PC-like compared to PS1/PS2/PS3/Xbox360), that then continued with the Xbox-series-X and Xbox-series-S.

Consoles aren't specialized hardware for "magic experiences" and everyone knows this, it's just another "device" that happens to be connected to a TV with a controller where people are gatekeeping software availability.

il y a 18 joursdiscuss

You mean in the sense that async methods return "awaitable" (Value)Task objects that contains the actual activation machinery that can be queried for liveness status?

It's funny that they're actually revamping the entire machinery for .NET 11 to defer allocations by default for non-waiting codepaths (Not sure, but iirc that machinery might require JIT compilation so would've perhaps not been possible to use for C++).

il y a 21 joursdiscuss

Iirc often the frameworks don't have worker affinity, anyhow environments like .NET has "AsyncLocal" to provide an aware alternative.

il y a 21 joursdiscuss

You're thinking of older early coroutines or in singlethreaded runtimes (JS).

It's M:N threading, most logical threads/tasks are more lightweight than full OS threads, the logical ones should preferably behave cooperatively but they can be scheduled onto any number of real worker threads (usually these systems picks something like 2x worker threads compared to real CPU/Core count to manage some codepaths not being as well behaved).

Erlang and .NET(with Task/async) uses this model, iirc modern Java does this also (but hides it) and I'd be surprised if the modern async Rust or C++ variations didn't do this as well.

il y a 22 joursdiscuss

Nah, coroutines/async/etc often lives in various threads (ie, the workers can schedule one of them on different threads during the lifetime and they live concurrently), so you still have all the issues of threading (+ new ones since things like thread-local variables aren't reliable if an async/coroutines moves threads between calls).

The main benefit is not having the cost of threads, f.ex. a default thread on Windows has something like 500k of stack iirc, scale that to 10000 concurrent requests and you're looking at 5gb of memory _just for stacks_, compared to a couroutine,etc that has perhaps a few kb's of usage (even if in deep stack-traces).

This is why we have stuff like io_uring these days, the bottleneck moved to the kernel calls (especially with Spectre style attacks) when concurrent costs in the applications went down.

il y a 22 joursdiscuss

The United States might be 85 times larger than Switzerland but it still has a higher population density than Sweden, and even in rural Sweden (similar population density to Wyoming) where my father lives he has a similar ability to pick providers at will as the Swiss.

il y a 24 joursdiscuss

Again, it's all still tied to that one device, the phone, if it's hacked it's really game over and with a big enough hole in the Android or iOS ecosystem that could be wormable a lot of people could be exploited en-masse.

Sure a 24h delay or SMS code are 2 way but they fully fall into the bandaid category.

In the past we used to have disconnected dongles for banking, the bank issued a one-time challange and you entered the response along with your username. Now there are disadvantages with those also but at least it was fully airgapped.

il y a 24 joursdiscuss

Well that is the point of this entire digital wallet thingy, there's going to be a transition period since everything here is more or less hardcoded to bankid not to mention tons of code with presumptions about Swedish identity semantics (that do differ from other countries).

But on the plus-side the Swedish state-eID solutions is planned to be delivered by end of year and hopefully most organizations will start migrating or at least dual-supporting them and in doing so also fix their services to support foreign eID's in the process.