NSA Helped British Spies Find Security Holes in Juniper Firewalls - <AUTHOR> https://theintercept.com/2015/12/23/juniper-firewalls-successfully-targeted-by-nsa-and-gchq/ <comment><USER2> I have a feeling that this is how these agencies skirt the law: agency X is not allowed to do "A", so it helps agency B do it, and share the findings with X. And vice versa. So the GCHQ spies on Americans willy-nilly, and the Americans spy on Brits, with full knowledge of each other.

<comment><USER3> That's how British government "doesn't use drons". They tell US to use drons to automatically bomb a target and kill hundreds of people, whole attack is organised by UK, but technically, it was done by US. In such case UK says in report they didn't kill anyone and US say they rented weapons.

<comment><USER4> Our government does use drones? Has done for years.

</comment></comment></comment><comment><USER5> Worth considering: every serious SIGINT agency probably had this capability against Netscreen VPNs. If you do a lot of network infiltration, these boxes are among the most useful targets; unlike routers running JunOS, the VPN concentrators have a large outside-the-packet-filter attack surface, and everyone runs them.

It'd be surprising if NSA and GCHQ didn't have similarly powerful capabilities against all the current VPN products.

<comment><USER6> While I don't doubt that's true for closed-source products, would it also be true for open source products? I've heard that some methods of IPSec key exchange are compromised, but don't know details. Would it also be good to suspect OpenVPN's method of key exchange?

<comment><USER7> Since it's now clear that "many eyes makes all bugs shallow" is patently false, the MO for said agencies to compromise OSS projects is to play the long game of making numerous benign commits, becoming trusted, then committing subtly compromised code.

This would be much easier than compromising specific algorithms or KE protocols. Cheap, too. All it takes is plenty of patience.

<comment><USER8> > Since it's now clear that "many eyes makes all bugs shallow" is patently > false

"patently false". Proof needed, please, we have enough FUD.

<comment><USER9> On contrary, the person making that claim needs to prove it's true or else we reject it as FUD against proprietary software. For a long time, the only software to resist prolonged pentesting by NSA were proprietary products certified to B3/A1 and Type 1 respectively. If NSA could hack them, they couldn't pass. Likewise, in safety, we've seen a number of high assurance systems fielded where every state (including failure) it could be in was known ahead of time. Some setups, like mainframes, hit 17-30 year uptime. All proprietary.

Meanwhile, in OSS land, we have a steady stream of easily-prevented or detected defects that compromise security. Just like in most proprietary shops. Like proprietary, those OSS projects producing highly-secure stuff are done by great designers/coders with careful review and testing processes. The community-developed OSS hasn't reached the assurance of aforementioned proprietary systems or some in academia. Yet, highly correct or secure stuff seems equally rare in both types of development with proprietary having a bit more just because there were people paying professionals to build those. In theory, with free/cheap labor, OSS could eventually produce more but there's not enough interest.

So, the endless stream of bugs in both closed and OSS software that are often really old disproves many eyes argument. It didn't work for even shallowest bugs consistently, much less deep ones. Software quality comes from people taking responsibility and putting time into QA, esp design/code review. OSS, shared-source proprietary, closed-source... always same requirement that gives quality.

<comment><USER10> Maybe a new OSS license is needed where the price of using the software is reviewing some code once in a while.

<comment><USER9> I broke it down from a security or auditing angle for all sides here:

[https://www.schneier.com/blog/archives/2014/05/friday_squid_...](https://www.schneier.com/blog/archives/2014/05/friday_squid_bl_424.html#c6051639)

Review was fundamental. It would be costly and take talent. So, like you, I proposed something that was open source but not quite free. Not many in OSS want to discuss proprietary OSS options but I think it's a critical conversation as it could get better stuff on the market. Prior conversations here at least showed the term, open source, was highly loaded with the expectation of free distribution due to its history. So, I'll modify the essay and next discussion to use shared source.

Elaborated more on my concept for a hybrid here:

[https://news.ycombinator.com/item?id=10500298](https://news.ycombinator.com/item?id=10500298)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> > ...it does make clear that, like the unidentified parties behind those > hacks, the agencies found ways to penetrate the "NetScreen" line of security > products...

It does? Sounds like this is a rather normal, expected, analysis. They're just reviewing products; probably they already had similar capabilities on IOS and wanted to make sure they could handle other targets or a shift in the market. This does not sound like getting backdoors placed, at all.

I hate to be suspicious or cynical here, but is this just The Intercept being opportunistic? Is there any reason to relate this to the recent "unauthorized code" issues?

<comment><USER12> You are completely correct. There isn't any correlation indicating that a security agency was behind the backdoors setup in their OS. Granted this could still be the case but there isn't any evidence, known to the public at least, that any security agency had a hand in creating the backdoors.

The timing of this article is obviously done in order to capitalize on the recent Juniper news. I would suspect all security agencies to be looking at the security of al networking products that they can get a hand on.

<comment><USER13> > There isn't any correlation indicating that a security agency was behind the > backdoors setup in their OS.

I am not so sure. There are strong indications pointing[1] at state actors.

[1] [http://securityaffairs.co/wordpress/42971/hacking/juniper- sc...](http://securityaffairs.co/wordpress/42971/hacking/juniper-screenos- authentication-backdoor.html)

</comment></comment></comment><comment><USER5> Did The Intercept just publish a document about Juniper insecurity that they've had since 2013, or had they already published this?

If they hadn't already published it, why not? It could have done some good before, but does no good now.

<comment><USER14> To me, it almost seems like they haven't gotten to reading through all of the content of the archives that they have. But when there's a serious 0-day on the loose, it's not too difficult to Ctrl-F the archives to check if the NSA has anything to do with it.

<comment><USER3> > the archives

[https://search.edwardsnowden.com/](https://search.edwardsnowden.com/) [https://search.wikileaks.org](https://search.wikileaks.org)

what more you have?

<comment><USER12> It's my understanding that Snowden released the documents to two journalists (Glenn being one of them) on the grounds that they release "responsibly" meaning redact or don't publish names of under cover agents, etc. So unless I missed it the entire archive has never been released.

Instead it's released in tiny bits and pieces by Glenn when it seems most appropriate.

I'm assuming this archive is updated as pieces come in. For example I did not see this content within the archive.

That's my understanding anyway; if I'm wrong please let me know :)

<comment><USER3> Yes, you're right, but what does it have to do with the link I posted?

<comment><USER12> Hmm I thought you were implying that was everything. Oops.

<comment><USER3> No, I'm just looking for more places like the ones I linked ;)

Searchable database of leaked documents that can be linked in flamewars ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Seems like a prime opportunity for a class action lawsuit. Juniper was selling a class of products that categorically did not do what it claimed. What would be interesting is their method of defense. As was pointed out to me in an earlier thread, companies have legal immunity when assuring the intelligence community with their work.[1] But Juniper already claims that they do not assist third parties to compromise their products. So they would either need to change their statements or be ineligible for this defense.

<comment><USER16> There is no indication that Juniper cooperated with the NSA or acted intentionally to compromise its products.

All software has defects, and if bugs entitled customers to civil damages there would be 0 technology companies left alive. The standard is negligence, but the NSA is sophisticated enough to compromise designs that were not negligent.

<comment><USER17> [http://blog.cryptographyengineering.com/2015/12/on- juniper-b...](http://blog.cryptographyengineering.com/2015/12/on-juniper- backdoor.html)

</comment></comment></comment><comment><USER9> Not sure about whether it's subversion or basic hacking. You should assume, though, that they might have hacks in any common product that can be used for a security bypass. Here's why: IT markets usually become oligopolies where a few players products are all over the place. Firewalls, routers, VPN's, OS's on desktop, OS's on mobile, net configuration, build systems... handfuls of implementations in each dominate in market share. So, rather than beating everything, you can focus on 0-days in a tiny few to beat almost everyone [that matters to a TLA].

Another side of this coin is that they'll add to their hitlist whatever they encounter the most. They probably run into Juniper firewalls all the time. So, it's higher priority. Using high-quality, but lower-priority-to-them, components reduces you risk of being hit by them. So, one of my recommendations is to build/use strong systems, use diverse components of good quality, and obscure the workings of both at the interface. They'll trip your alarms trying to figure out what you're using before they hack you.

</comment><comment><USER18> So how long has Glen Greenwald and others with access to the Snowden cache known about this?

There was only one Snowden cache. If the document was provided by Snowden, did we hear about it earlier?

Who has access to the Snowden cache now? Do we know?

</comment><comment><USER19> So the US isn't supposed to gather intel now? IS that what you're saying Glenn?

</comment><comment><USER20> Interesting that Juniper merely claims that putting in a backdoor or working with others to do the same is against their policy. They seem to be avoiding saying a very simple, clear statement: "We never have and never will intentionally compromise the security of or put backdoors into our products, whether for ourselves or on behalf of a third party". That they can't come out and say that makes their claims suspect.

<comment><USER21> From TFA:

> _" As we've stated previously … it is against established Juniper policy to > intentionally include 'backdoors' that would potentially compromise our > products or put our customers at risk. Moreover, it is Juniper policy not to > work with others to introduce vulnerabilities into our products."_

\-- Juniper

<comment><USER17> Seems they were lying when they said that:

[http://blog.cryptographyengineering.com/2015/12/on- juniper-b...](http://blog.cryptographyengineering.com/2015/12/on-juniper- backdoor.html)

<comment><USER22> Well, or they are spectacularly incompetent. We don't know which.</comment></comment></comment></comment>


Show HN: 400-Line Binance CryptoCurrency Bot - <AUTHOR> https://github.com/khstangherlin/monker <comment><AUTHOR> The Money Maker Machine - <USER2>

This was a hobby project of myself to create the simplest Cryptocurrency bot possible. It was written in Python, operates on Binance, and stores all logging and trading information into a MongoDB database. The trading strategy is extremely simple:

\- Assume that crypto prices will fluctuate, but eventually be restored to its original quote \- Buy small quantities every time the price falls below a threshold, keeping track of the amount purchased and the price payed \- Sell those exact quantities when the price is above what was payed for it

It was a lot of fun developing it, and I guess I made something around 3 dollars before shutting it down. It is my first contribution to opensource world, and I hope others can benefit from it :)

<comment><USER3> Hi

So first of all, thank you for sharing your work, I'm sure it was a lot of fun building it and making it work!

If you'll indulge me, I'll point out a few thoughts about application logic that handles money.

First of all, money related logic should be using fixed point mathematics in all places. In the case of EUR/USD fixed to 2 points behind the decimal point and in case of BTC and others, somewhere around 9-16 (can't be bothered to look it up atm). There is a cumulative error that is produced when using floating point variables. I'll be happy to share a link to a discussion, if you want!

The second thought I had was about using MongoDB for this use case. While it is great for getting started and MongoDB has made great strides at improving safety, it is still a suboptimal choice for handling financial transactions (logs or otherwise). I will also be happy to clarify why, if someone wants to discuss the matter further.

<comment><USER4> Bitcoin has exactly 8 decimal places. The terminology is 0.00000001 BTC = 1 satoshi.

<comment><USER3> Right you are, consider me corrected.

</comment></comment></comment></comment><comment><USER5> Nice! It's very simple, but has a few interesting qualities, like not using any third-party library to interact with Binance, giving the bot more flexibility to make use of Binance-specific features in a future extension of this work. For example: Binance's margin trading works a little different from other exchanges.

I would use order book data instead of ticker data, though, since you have more control of your risks regarding the exchange's liquidity.

Well done!

<comment><USER6> Orderbook can be tricky. Also third party libraries are dangerous.

If all you need is ticker data, but you want separate bid/ask, and do not want 3rd party library, you can augment your results with market average from [http://cmplot.com/api.json](http://cmplot.com/api.json)

It also come with all the fiat pairs. No TOS, no login, no nothing, it lives on XMR donation.

<comment><USER7> This site's FAQ is a charming and a delightful read! Thanks for sharing

<comment><USER6> Share the goodness!

</comment></comment></comment></comment><comment><USER8> I have a feeling that the vast majority of transactions are from bots like this, from the naive "moneymakers" (like this one with a $3 return) to ones with extreme sophistication.

The naivete here is that it only makes money if the market is rising long term. If it is falling over the long term then you'll get stuck with a bunch of losses.

The results it generates are no different than buying at random times and selling random bets at random times.

<comment><USER6> I think you are mistaken- the bots is based on means reverting. Rising or failing will not work. Oscillations will work.

</comment></comment><comment><USER9> If you like crypto bots, check out our project called [https://quadency.com](https://quadency.com) We have common strategies you can deploy to all major exchanges. You can also code your own real-time strategy in python using [https://support.quadency.com/en/articles/3459678-strategy- co...](https://support.quadency.com/en/articles/3459678-strategy-coder)

<comment><USER10> Very cool. I'll have to check this out.

Do you know of any stock trading sites that have bots?

<comment><USER9> Crypto is a little different as you have direct access to exchanges whereas in stocks typically you're trading with a broker. This opens up a lot of opportunities for individual traders that traditionally are only available to institutions, such as strategies based on order book (market making, arbitrage etc)

</comment></comment></comment><comment><USER11> I think there should be a big (maybe red?) disclaimer at the very top explaining that this should only be used for fun, experimental and learning purposes. No real money should be invested into it too.

Just in case somebody thinks it's real and go full retard with it.

<comment><USER12> > and go full retard with it.

Please don't use language like this.

<comment><USER13> That is the accepted terminology for wallstreetbets style trading, is it not?

<comment><USER14> wallstreetbets would say "full autist"

</comment></comment></comment></comment><comment><USER15> Very cool! I might try to pick this up later and test some stuff out. Why did you choose to stop it? Did you find a more profitable algorithm ;)

I wonder how much of the volume on cryptocurrency exchanges are due to bots.

<comment><AUTHOR> A lot is due to bots.

I stoped mainly because I need to work on my PhD. But the code there was very solid on my tests. I hope I can get back at it early next year :)

<comment><USER16> Your code doesn't seem to have any tests?

<comment><USER17> I assumed he was talking about his manual tests.

</comment></comment></comment></comment><comment><USER18> Looks pretty cool! I'm always unsure of separating my buy and sell side logic. Was there a deliberate decision to separate those functions, rather than passing the side as an argument?

</comment><comment><USER19> How much did you put in the bot initially and how long have you kept it running before shutting it down?

</comment><comment><USER20> Great idea. Thank you for sharing! I've had this same thought with Tesla's stock</comment>


Team's are Non-Linear Force Multipliers - <AUTHOR> http://www.victusspiritus.com/2010/01/17/teams-are-non-linear-force-multipliers/ <comment><USER2> I am always horribly annoyed by misused apostrophes.

<comment><USER3> Me too, but I don't think it does any good to complain about it unfortunately.

<comment><AUTHOR> Damnit I did it again. Thanks for pointing it out at least.

</comment></comment></comment><comment><USER4> team's what?</comment>


Pinterest gets visitor retargeting and other new ad targeting tools - <AUTHOR> https://techcrunch.com/2016/06/14/pinterest-gets-visitor-retargeting-and-other-new-ad-targeting-tools/amp/ <comment><AUTHOR> HN don't seem to care overmuch about Pinterest, but it's a crying shame - <USER2> scandal - that they would follow Facebook in undermining our privacy like this.

I've since deleted my cookies and given up using the platform, even though it was a great pastime. Guess self-hosting is the only way to do things these days.</comment>


Unsealed Warrant and Forfeiture Complaint Seek Seizure of Oil Tanker "Grace 1" - <AUTHOR> https://www.justice.gov/opa/pr/unsealed-warrant-and-forfeiture-complaint-seek-seizure-oil-tanker-grace-1-unlawful-use-us <comment><USER2> This seems a bit late? Although the event wasn't emphasized by the war media (in order to pretend that Iran's retaliatory seizure of a British tanker was unprovoked), this boat was seized over a month ago. It will be transferred to American custody immediately after Assange is. That is, never.

<comment><USER3> Calling them "the war media" is almost as inflammatory as what you're accusing them off.

FWIW, I just checked two articles at the New York Times on recent Iranian tanker seizures. Both mention the previous British seizure. One even begins with a different (but IMO even better) legitimization of Iran's actions:

 _BEIRUT, Lebanon — Iran seized a foreign oil tanker in the Persian Gulf, state television reported on Sunday, the third time Tehran has reported detaining a tanker in the last month as the United States applies its campaign of "maximum pressure," sanctions and diplomatic isolation against the country._

<comment><USER4> I would agree with the original poster to refer to them as "war media". He is likely referring to the vast majority of MSM that is covering the news with a pro war agenda for the military industrial complex and the fossil fuel companies.

<comment><USER5> We could also call it the Journalism Industtial Complex that exists to promote its own agenda instead of to merely inform.</comment></comment></comment></comment>


Show HN: Layer – Get a dozen staging servers per developer - <AUTHOR> https://layerci.com <comment><AUTHOR> Hey HN,

We're Lyn & Colin and we built Layer - It creates a unique staging server for every commit.

Before Layer, I was CTO of a startup with a 10-person developer team, and dealing with staging servers (and end-to-end tests) was one of the most annoying parts of our workflow.

Layer lets you define staging servers the same way you define Docker containers, and get a unique one for every commit going back a week. We run them in the cloud, so there's no need to pay for AWS servers you're not using.

Also, if you're running a webserver, you get a unique URL for each unique server automatically so that you can post it to a slack channel and get feedback immediately.

When we're setting up the staging server, we use the same sort of cache as Docker so that you can skip repetitive tasks like setting up a database or running database migrations if they haven't changed.

Would love to get your feedback, it only takes five minutes to do the onboarding tutorial.

<comment><USER2> How is this even possible for $35?

50 staging servers per seat ($1450 Value) 11GB RAM per server 8 CPUs per server

<comment><AUTHOR> We spent six months developing a hypervisor that lets us treat any linux VM as a lambda - We pass on the efficiency to our users as a value add.

<comment><USER2> You should probably be selling that if it works well. That is something I have not seen.

<comment><USER3> <mostly sarcastic>

Bakevm with tooling > create userdata script for cloud init to copy payload to server > create systemd oneshot service to run payload && shutdown

<comment><AUTHOR> You should try it! Our baking interface looks more like Docker than a traditional VM provision (ala Packer)

Also, we keep the baked images around for a week and trigger them whenever they are requested (with, say, HTTP, or terminal access)

</comment></comment></comment></comment></comment></comment><comment><USER4> I also feel like this is the "wrong" vertical. You should be competing with Amazon and Google in the general cloud business if you've achieved breakthrough efficiency. This doesn't necessarily help because often the issue isn't server efficiency, it's that people haven't properly setup 1 button builds or there's unmocked dependencies with shared state

<comment><AUTHOR> We think it's important to find a profitable path to beating Google or Amazon - even the best tech in the world will not convince someone to use your cloud service if they are afraid of counterparty risk.

Our goal is actually to help teams that have unmocked, difficult to test codebases. You can make multiple Layerfiles and share the setup time between them, so that you can run destructive tests with a real database if you want to test that, say, signing up via API works.

</comment></comment><comment><USER5> So i'm a new dev and we have a system like this at work, I had kind of assumed it was standard in the industry but clearly, considering the replies that is not the case. You can check it out here:

[http://runbot.odoo.com](http://runbot.odoo.com)

(it's an internal tool, don't look for a pricing page)

</comment><comment><USER6> Shameless plug - my co-founder and I are working on a somewhat similar tool called [Foundry]([https://foundryapp.co](https://foundryapp.co)). It automatically creates a development environment for you that is a copy of your production environment. You also get access to a copy of your production data and real-time feedback through our REPL tool - we evaluate your code every time you save a file and send you back the output.

So far we support Firebase and their Firestore, RealtimeDB, and Cloud Functions. In action, the development with Foundry looks like this:

\- (1) Start Foundry session in your terminal

\- (2) Specify a slice of your production Firestore/RealtimeDB we should copy for you

\- (3) Specify what Cloud Functions we should trigger for you and with what data

\- (4) Every time you save your code we trigger those functions as you specified and send you back the output

Every development environment is created for each developer separately on the fly (it takes less than 30seconds to have your environment ready). You don't have to wait minutes for your Cloud Functions to get deployed. You get a response usually in just a few seconds.

We are also working on a new feature that will make it possible to have one "master" always-online environment that is publicly accessible.

<comment><USER7> Release (YC W20), a similar product to Foundry: [https://news.ycombinator.com/item?id=22486031](https://news.ycombinator.com/item?id=22486031)

</comment></comment><comment><USER8> Looks really cool! "Get a dozen staging servers per developer" is a great pitch, it immediately caught my attention.

<comment><AUTHOR> Thank you! It took a lot of refining to find a pitch that resonated.

Let us know if you have a chance to try out the tool and have any other feedback. :)

</comment></comment><comment><USER9> Very cool! At my previous position we spent a lot of time creating staging environments for QA and UX to use. I love the idea of having an "environment per feature" which can exist for a week while the release candidate gets checked by UX and QA.

The "spin-down" feature sounds like the killer -- the only reason we didn't have an environment per build already is because it would be cost prohibitive. Instead, we tried to time-slice with a static set of staging servers... very frustrating with a 50 person team.

<comment><AUTHOR> Glad we're solving something that you empathize with. I'll never turn down a warm intro, so let me know if you think we'd be useful to any folks at your previous company.

</comment></comment><comment><USER10> Okteto does something very similar - but uses kubernetes. [https://okteto.com/](https://okteto.com/)

</comment><comment><USER11> Hey Lyn and Colin,

Cool stuff! I worked on a very similar project for a small chunk of my life. I was a PM whose life was made a lot harder by not having a tool like this and when I joined a startup that had built a similar tool internally, I realized that it would be a great business. I want to provide some free (and unsolicited) advice:

Your number #1 challenge is going to be go to market strategy. There are actually a number of companies that have tried to solve this problem and either outright failed or seemingly hit some bumps. YC funded a few of them: Release, FeaturePeek, Dockup. There's also a company called Runnable that was acquihired by Mulesoft. Initially I was encouraged by the proliferation of companies in the space - we couldn't all be wrong. In hindsight I should have realized that it wasn't as rosy as I had thought since it doesn't seem like these companies have had gangbusters success.

In my experience, there are roughly three types of pushback you're going to get from potential customers:

1) We can build that better in a week. This one is very difficult to overcome because at the end of the day it's not really about the truth of the statement, it's more about the engineering skill of your prospect. Building this product is a unique and interesting engineering challenge, and I haven't met a DevOps person who wouldn't be excited to try to build it themselves. I tried a lot of different approaches but have never successfully convinced someone it would be a lot easier, faster and more efficient to buy an already existing solution from us. Your mileage may of course vary.

2) Our setup is too custom to work with any generic tool. This one is probably pretty frustrating to hear since you folks have clearly put in a lot of effort to make it work with a variety of build configurations. The interesting thing here is that this reason can often then turn into (1). Our solution required people to containerize their app if it was not already and most people replied that if they were going to do the work to containerize their app, they would just do a bit more work and build this internally.

3) My database is too big/too sensitive to work with this. Many startups have small databases that can easily be copied quickly. However, some have multihundred gigabyte ones that are too large to copy on demand. You either have to include that latency in the product which in my opinion makes it borderline useless, or figure out some way to work around it. You can use RDS snapshots but by our calculations those will be quite expensive. You can hope your customers have some test database (they don't) or you can try writing back to their shared staging (or more realistically) their production database. None of these options are realistically very attractive.

All of that said, it's clear you have some really cool technology here. One thing I'd suggest you'd look into is a related market: developer environments. Most companies I've worked at have software engineers putzing around for the few days/weeks getting their dev environment set up. This is a very expensive waste of time IMO. If you could provision a cloud development environment on demand, that doesn't require any scripts to set up or database migrations to run, that would be huge. The value of skipping that ~2 week setup time multiplied by the number of engineers a company hires really begins to add up. Just my 2c.

Happy to chat about this more if you're interested. I don't feel like sharing my contact info on HN but if you are determined enough I'm certain you can probably get in touch. Best of luck :)

<comment><USER12> > Most companies I've worked at have software engineers putzing around for the > few days/weeks getting their dev environment set up.

I'll second this as a real pain point. And I would absolutely love to be able to spin up a staging/test environment for myself[1] when needed instead of having to wait for someone else to refresh staging and not knowing what precise combination of commits are on there.

[1] I'm new and on a Mac, everyone else is here years and on Linux; my local dev experience has been somewhat challenging as a result due to their assumptions.

</comment></comment><comment><USER13> Staging was a bit of a nightmare where I worked. We even had this silly google calendar where PMs competed for time at our staging server.

Will give this a try.

<comment><AUTHOR> Let us know what you think, and we'd be happy to jump in a call to show you a demo or get you set up.

</comment></comment><comment><AUTHOR> We (the founders) are heading off for the night. If anyone wants to get in touch, my email is firstname.lastname@example.com</comment>


How MOS 6502 Illegal Opcodes Work (2008) - <AUTHOR> https://www.pagetable.com/?p=39 <comment><USER2> My understanding is that in the 6502 (NMOS) chip, those other opcodes had undefined behavior, and you might crash if you executed one. So you'd need to know who was the manufacturer to be certain that opcode X was available.

In the CMOS version (65C02), illegal opcodes are treated similarly to NOPs-- they don't crash, and don't do anything other than spend cycles--with the caveat that certain of these "illegal" opcodes have specific numbers of cycles and bytes that they consume which are different from other illegal opcodes. More confusingly, there is an actual proper NOP instruction (0xEA), which consumes the one opcode byte and two cycles, which exists in both the CMOS and NMOS version of the chip.

So some of the illegal opcodes are just like NOP, and eat one byte and two cycles; some eat two bytes, and 3 or more cycles; and there's at least one which not only eats 3 bytes, but eight ( _GASP!_ ) cycles.

Source: if it's possible for one to consider MOS emulation a hobby, then let's say it's a hobby of mine.

<comment><USER3> Can that be true? (I'm channelling 1985 here, so I could be well off, but...)

IIRC, some of the janky stuff I did on the Apple //e 6502 did run on the Apple IIc 65C02. I'm pretty sure they didn't fall of into NOP-land. (Again, I could be mis-representing this, but I was taking some shortcuts at one point to accelerate some graphics that ended up in a Broderbund game, so I don't think I am? (Time wastes all memories - I could well be wrong))

<comment><USER2> Ah-ha, well! There are actually two Apple IIe models. (Well, there was a third "platinum" one too, but let's not talk about that.) One would have shown "Apple ][" at boot time, and this was the original model with a 6502 NMOS- based chip. But they later released an "enhanced" model, which had a 65C02 CMOS chip. You could tell the difference because the later model would have instead shown "Apple //e" when booting.

It's quite possible (perhaps because you typed it as Apple //e!) that you were actually working with that 65C02 variant, and thus, your janky stuff was forgiven by the Gods of Early Personal Computing (blessed be).

(See: [https://en.wikipedia.org/wiki/Apple_IIe](https://en.wikipedia.org/wiki/Apple_IIe))

<comment><USER3> I did not know that! I think it said //e on the case and ][ when booting, but I'll have go dig it out of storage. (You'd think that after spending thousands of hours in front of the dang thing, that I'd remember...)

</comment></comment></comment></comment><comment><USER4> This article reminded me how long it's been since I saw the word 'disassembler' anywhere. (IIRC, it started disappearing from common use at about the time the 16-bitters became popular.)

<comment><USER5> I guess you're referring to the word's replacement with "debugger" or "ICE" in parts of the microcontroller world? In the desktop/mobile x86/ARM world both the word and the tools are still in quite common use in fields that rely on it like malware analysis and general RE - IDA and Radare both have "disassembler" front and center in their naming and UIs.

</comment></comment><comment><USER6> The article says, "While other CPUs from the same era used microcode to interpret the instruction, the 6502 had this 130×21 bit PLA."

The 8080 and Z80 did not use microcode; it was all ad-hoc random logic.

</comment><comment><USER7> I found the rearranged table of opcodes here [1] to help understand how instructions get decoded without getting in depth with the PLA dumps.

[1] [https://wiki.nesdev.com/w/index.php/CPU_unofficial_opcodes](https://wiki.nesdev.com/w/index.php/CPU_unofficial_opcodes)

</comment><comment><USER8> Somewhat similarly the various "chairs" generated by 7447 for 0xA-0xE are simply the outputs that lead to simplest random logic that implements the defined function.

</comment><comment><USER9> I don't understand how the PLA can be 21 bits wide. The diagram seems to show 8 ON bits, 8 OFF bits, and 6 timing bits, which adds up to 22 bits. Any clarification?

<comment><USER10> It's a simplified explanation.

[http://visual6502.org/wiki/index.php?title=6507_Decode_ROM](http://visual6502.org/wiki/index.php?title=6507_Decode_ROM)

> Note that the lower two bits are always XX - the decode ROM doesn't actually > check these, but check a cooked version of these bits instead.

</comment></comment><comment><USER11> Comments below the article are priceless (not the HN ones)

</comment><comment><USER12> Was this the same concept used against Pay-tv pirates that were running smart card emulators?</comment>


Buy Nothing Day - <AUTHOR> https://en.wikipedia.org/wiki/Buy_Nothing_Day <comment><USER2> Snopes claims Nov 25 is not the biggest shopping day of the year.

When I first moved away to college, I found a copy of Adbusters in a bookstore and I thought it was one of the most amazing things ever. Eventually I decided it was too smug even for me.

This author has a lot of the same thoughts I did:

[http://streetcarnage.com/blog/adbusters-landfill-of-the- ment...](http://streetcarnage.com/blog/adbusters-landfill-of-the-mental- environment/)

I think the magazines Vice and Colors were targeted at the same market as Adbusters, but had a much greater impact.

</comment><comment><USER3> I feel like this movement would be more noticeable and eventually disruptive if it were... I don't know? Any other day of the year!</comment>


Urbanspoon on iPhone spotted in the wild - <AUTHOR> http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=284708449&mt=8

<comment><AUTHOR> Disclaimer : I am the author. I posted about the Urbanspoon iPhone app a few weeks back and many of you were curious when it would ship.

Techcrunch likes it too:

[http://www.techcrunch.com/2008/07/10/iphone-application- over...](http://www.techcrunch.com/2008/07/10/iphone-application-overview-and- demo-videos/#more-19819)

and we were in the New York Times yesterday:

[http://www.nytimes.com/2008/07/09/technology/personaltech/09...](http://www.nytimes.com/2008/07/09/technology/personaltech/09pogue.html?_r=1&ref=technology&oref=slogin)</comment>


High-Density Housing Near Public Transit Is Aim of San Diego Code Change - <AUTHOR> https://timesofsandiego.com/politics/2019/07/29/high-density-housing-near-public-transit-is-aim-of-san-diego-code-change/ <comment><USER2> Amazing, a path opening for a west coast city to develop additional housing! We need more of this. I bet there are NIMBY heads exploding in San Diego, probably on Nextdoor.

<comment><USER3> San Diego still has lots of areas that are gentrifying from being really crappy, so the NIMBY's aren't up in arms yet. San Francisco has the problem that all those crappy areas got gentrified and now everybody is trying to protect their "investment".

In addition, downtown San Diego isn't really considered to be a place where the cool kids hang out (and still has a lot of industrial area around). So, there is less fighting going on there right now.

The problem is that the transit in San Diego is lousy. The trains are horrifically slow between downtown and Solana Beach. And the limited number of tracks means that Amtrak regularly has to wait for passenger trains, and, if someone jumps in front of a train, the system shuts down for 4 hours.

<comment><USER4> > _everybody is trying to protect their "investment"_

Nearby construction can decrease your property values, but upzoning and by- right permitting increase property values by making them more attractive to developers.

I think it's both more correct and more charitable to think that people arguing against things like SB50 are doing it because they don't want the density in their neighbourhoods, and not for financial reasons.

</comment></comment></comment><comment><USER5> Denver is taking the same approach, and, really, it's the only tool we have for preventing huge increases in traffic as population increases and actually getting people to rely on public transit. I live in a transit-oriented development zone near train+bus stop and love how easy it is to walk to anything I want.

Transit-oriented development is the only sensible approach I've seen to scaling a modern city.

</comment><comment><USER6> I am very much in favor of the _idea of_ building high density housing centered around public transit. It sounds like a perfect solution to a large set of related problems.

I am scared to see what the end result will be in US cities, however, because public transit for almost all of the US means poorly run busing routes that nobody wants to take.

Having lived in San Diego for many years (as well as Denver and MPLS which I think are relevant comparisons) I believe that what will happen is that existing (poorly run, poorly utilized) bus routes will be chosen by developers who will use the "blah blah transit blah blah" designation that was just gifted to them to build high end units for people that will drive their cars.

No _actual_ transit (the kind that runs on rails) will be built, some more car-centric housing units will exist at high end prices (they're not going to build garage-less buildings nor are they going to build low end units).

Oh, and the buses will still be empty.

I want this kind of policy regime to be pursued, but they need to _build the transit lines first_. And buses don't count.

<comment><USER7> Why do buses not count? Because you don't like them? Your definition of transit is not shared with most people.

I love buses as a transit option. They go directly to parking lots of places like grocery stores and ride smoother than a lot of trains/subways/etc I've been on. If the routes are useful then people will use them and they're as simple to scale as buying more buses and very easy to dynamically adjust, unlike train lines.

<comment><USER8> [I'm a bus proponent, but...]

It's turned out to be very politically difficult to establish and (just as importantly) enforce bus lanes in communities in the US. People get very upset at the prospect of giving up either street parking or travel lanes, and local politicians and the traffic enforcement bureaucracy has mostly sided with the people who complain. The result is either no bus lanes, or part-time bus lanes with no effective enforcement, which is basically the same as no bus lanes.

A bus that's able to use bus lanes (and possibly transit signal priority) to bypass traffic is a great thing, and would be appealing to people across the socioeconomic spectrum. A bus that's stuck in the same traffic as the cars has no benefit other than cost, and will only appeal to those who can't afford to maintain a car or are very ideologically committed to transit.

Buses would be amazing with bus lanes in congested areas and automated camera- based enforcement of those lanes. However, the inability of the political system to make that happen even in Manhattan makes me fairly pessimistic for that outcome in other places.

I still think it's worth investing in buses for those who need them, but if they can't bypass traffic they will be stuck at a low mode share almost everywhere.

<comment><USER9> The problem with bus lanes is that they require failure in order to operate. If you implement bus lanes and they succeed in relieving traffic congestion but the congestion was the only reason people weren't driving then people go back to driving and you go back to having congestion. There is no way for them to actually relieve the congestion because having congestion is the method by which they operate. But they can make it worse by wasting a travel lane during the times of day when there would have been enough road capacity if not for the bus lane.

If you want to make buses actually work, make them work like Uber. You go to the bus stop where there is a screen you can input your destination (or you use your phone), and the nearest minibus going in your direction stops to pick you up, which each carries eight passengers rather than forty. Then it drops you off at your actual destination instead of four blocks from there, and picks you up faster to begin with because there are five times as many buses of a fifth the size and they can be diverted from nearby routes to pick you up as soon as you summon them.

At that point they're almost as good as a car most of the time, only they cost a lot less and only take up an eighth of the space on the road per passenger. And you don't have to operate huge wasteful 40-passenger vehicles during off- peak hours just to carry 3 passengers.

<comment><USER10> If you paint a lane red and make it buses-only, that gives commuters an alternative to driving. Traffic might still be terrible and congested, but commuters have the option to skip the traffic and take the bus instead.

Uber-style minibuses don't work because the human bus driver is expensive. Once you're already paying for a driver, it makes sense to make the bus full- size so that you can maximize the number of riders per bus.

<comment><USER9> > If you paint a lane red and make it buses-only, that gives commuters an > alternative to driving. Traffic might still be terrible and congested, but > commuters have the option to skip the traffic and take the bus instead.

Except for all the ones who don't, because one of the endpoints isn't anywhere near the bus route even if part of the path between them goes along it.

> Uber-style minibuses don't work because the human bus driver is expensive.

Apparently they do, as demonstrated by all the people who use Uber in preference to buses.

> Once you're already paying for a driver, it makes sense to make the bus > full-size so that you can maximize the number of riders per bus.

Unless that requires you to have less frequent service that covers fewer areas, which in turn causes people to choose single passenger cars over your buses.

You can also eliminate the driver cost by doing what Uber was originally billed as -- ride sharing. You're going to drive your car from your home to your workplace and back, but if you get up fifteen minutes earlier you can make a few bucks by picking up some of your neighbors and dropping them off at work. That's a lot less than the cost of a full-time bus driver with benefits but at scale it still results in a fraction of the number of cars on the road during rush hour.

</comment></comment></comment></comment></comment></comment><comment><USER11> This is great, and I hope it spurs on more transit development in general down there. San Diego is one of those cities that I adore, so long as I don't have to drive anywhere. Right on the ocean, the weather is perfect, it has lots of great food and beers, and it's generally a pretty cool place. I also appreciate that a lot of the roads are not very wide, so areas like downtown feel great to walk around because it's not very busy. But it drives me nuts that if you want to go literally any other neighborhood it requires a car and sitting in traffic.

It's not super dense in terms of population now, but with proper infrastructure growth it could be one of the greats!

</comment><comment><USER12> The trolley extension to UTC will juice a lot of this kind of development.

Maybe this is where the city thinks the scooters will ultimately fit in.

</comment><comment><USER13> I was just in San Diego for GopherCon and, boy, what a beautiful place. This change will ensure San Diego can keep growing and prospering, meanwhile San Francisco continues to stand athwart history yelling STOP!

<comment><USER14> As much as I hate NIMBYs in SF, the City has built a lot of housing over the last decade, and I would say more than San Diego. The SF skyline is completely new, and places like SOMA, East cut, Mission Bay, Dog patch are entirely new neighborhoods. Sure, we need to build more on the West side and iPhone Sunset and Richmond, but we will definitely get more bang for our buck by up-zoning San Mateo, Palo Alto etc

<comment><USER15> "City has built a lot of housing over the last decade"

The city has build a lot less housing than office space over the course of the last decade, and that is the metric that counts (jobs-housing balance).

"The SF skyline is completely new" \- Salesforce tower (office space), 181 freemont (2/3s office space) etc etc.

"SOMA, East cut, Mission Bay, Dog patch are entirely new neighborhoods", and yet still 77% of the land in SF is zoned for single family homes.

SF recently passed the Central Soma rezoning plan which creates an amazon HQ2 worth of office space (space for about 50k workers) but only housing for about 7k people.

</comment></comment></comment><comment><USER16> I think this is awesome and the path forward. After reading a lot of the comments I think one thing that could help very much with the pain of this transition is encouraging a culture shift in how computer laborers are required to drive to a computer at work every day instead of just using the computer in their house... Seems obvious to me anyway.

</comment><comment><USER17> Too bad the public transit is poor and the city/county is very spread out.

</comment><comment><USER18> Every time I read something like this, I roll my eyes - most of these proposals are dead on arrival. By the time this will be in effect, public transit will have been transformed (if not removed) by private, automated transportation.

And then I always think it would be best to build a city from scratch. A great one. With good principles. Time-proofed. Collectively we should know how to do it, but it seems that it's incredibly hard to come up with the resources to do it properly. It's still only a dream.

<comment><USER19> > And then I always think it would be best to build a city from scratch

Waterfall projects don't work with cities any better than they work with code. While it's harder to be "agile" with cities, the idea of building a large project correctly in a go is misleading.

There are many future-centric planned city projects which either died before they ever took off, or were completed and are total ghost towns.

<comment><USER20> This is a blanket statement that can be easily refuted. The overhaul of Barcelona for the Olympics comes to mind, and same story with Torino in Italy. Both cities benefited greatly from a large planned investment in infrastructure. Same thing with Madrid and the doubling of the metro system now that I think about it.

</comment></comment></comment><comment><USER21> If"transit stop" includes bus stops, this is going to be terrible. Public transit in San Diego is God awful because everything is so spread out. Realistically, you need a car to get anywhere, so more people is going to mean more congested roads.

<comment><USER22> You stated that it's "because everything is so spread out". So the way to fix that is to build new stuff densely. It won't change overnight but you would need to start somewhere. You can't take the status quo as an inevitability.

</comment></comment><comment><USER21> I live in San Diego and just waited 30 minutes in bumper to bumper traffic to drive 7 miles. Until better traffic infrastructure is installed, more people sounds like a nightmare.

<comment><USER23> That's the entire point of this zoning change - moving the higher density housing near to public transportation, with integrated restaurants and stores so they're walkable. The current five zone types (explained in the article) separate commercial and residential, requiring people to drive to businesses and work. (also a San Diegan)

<comment><USER21> How often do you use public transportation in San Diego? I'm guessing you don't, because you'd know that it's nearly impossible to exist in San Diego and only use public transport. More people will invariably mean more cars. I know this might come as a shock, but this policy might not translate to the real world as intended.

<comment><USER24> Already in some places in Hillcrest you can walk to restraunts/shops. In UTC you can get around on busses (well, because UCSD spurred more public transport density).

Right now San Diego feels like an overgrown suburbia. If we transform into a real urban city I welcome it. The increased housing density will also presumably decrease housing prices, further making a more equitable city.

<comment><USER25> I remember 20 years ago when I was a UCSD student hearing a discussion on the local NPR station about extending the trolley to UCSD. I believe university leadership opposed it at that time. I recall one of the counterarguments was that it would bring more crime to campus. (I believe the term "rapists" was used by the person on-air representing that position. I don't recall if that person was a spokesperson for the university.)

In any event, classic Nimbyism. Memory still pisses me off. Glad to see at least the University has come around, even if I imagine most La Jolla residents haven't.

For reference, if I'm not mistaken, it was a La Jolla resident who invented that cheap clicker device that you can click to instantly report plane noise complaint to FTA. Cool little project but, well, yeah.

<comment><USER26> The clicker guy / plane noise guy was in real La Jolla, this is just going to affect UCSD area zip code La Jolla, and the rest of UTC.

There was a spike in UTC area visible homelessness last summer, making the area Starbuckses uninhabitable, and the transit line will certainly make quality of life even worse.</comment></comment></comment></comment></comment></comment>


CrowdSwitch (scalable wired meshbox) Proof of Concept Validated - <AUTHOR> http://isogrid.org/blog/2018/02/28/crowdswitch_proof_of_concept_validated/ <comment><AUTHOR> Hi there. I'm the dev behind the IsoGrid Foundation. Let me know if you have any questions!</comment>


Just tags, no folders. But everything at right place - <AUTHOR> https://grabduck.com/last <comment><USER2> The FAQ could use a cleanup by a native English writer. Meanwhile:

\- no mention of ability to import favorites from IE

\- no mention of ability to import from a plain text/csv file

\- no mention of ability to check current validity of URLs in old bookmarks and clean them out

\- I click on "favorites", having loaded none, and it instantly goes from 0 to 28, populating with spam favorites that I neither selected nor have ever visited

</comment><comment><AUTHOR> Don't waste your time with the folders! Let Grabduck do it for you!</comment>


Malware spread via Google Code - <AUTHOR> http://www.heise-online.co.uk/news/Malware-spread-via-Google-Code--/112390 <comment><USER2> Seems to be just a shiny wrapper around this blog post: [http://www.avertlabs.com/research/blog/index.php/2009/01/07/...](http://www.avertlabs.com/research/blog/index.php/2009/01/07/google- code-project-abused-by-spammers/)</comment>


Webcomics and animations: How to stand out from the crowd? - <AUTHOR>

I'm starting a comic site at doodleskull.com. It will not be your typical frame-frame-punchline comics, more like infographic-style drawings and doodles about problems, irony and other adventures I run into in my life. Let's say really colourful personal stories. That's one way of putting it.
But I don't want to make a comic site that 520372947 people have already made. You know that kind comic site you've already seen a dozen of times. I want to bring things up a notch and make something that people actually want to read and see. To do something different. That's why I wanted to turn to you and ask for ideas.
My "how-to-make-awesome-comic-site-like-no-other" ideas so far:
- Make animations. People are vlogging with a video camera, but no one is doing that with animations. Again, I would not do Pixar-quality animations, more like rage comics meets South Park meets Powerpoint. Very DIY, amateurish you could say but highly personal.
- Make comics with HTML animations, with tools like Hype or something else and keep the infographic style. SEO-wise this would be a suicide, because javascript doesn't offer much flexibility with SEO, but: it's the content that matters, not search engine optimization.
- Provide a new comic and a new video every single day. Most webcomics do new stuff a couple of times per week. By putting drawings out everyday, I would stand out from the majority and that schedule would keep me drawings and creating every single day. This would be very time-consuming, but I don't mind that.
- Mix and match infographic layout-style with the personal comics and doodles. I really like infographics, but I don't want collect data and publish one about how many people are jackasses on the workplace on average. I'll rather be inspired by infographics and use that inspiration to put out, hopefully something unique.
Any thoughts? I'd be really thankful for any ideas or thoughts. Any thoughts. Seriously guys, I'm desperate.
Seriously. <comment><USER2> This site, run by artist Daniel Davis (AKA Steam Crow): <http://www.webcomicmarketing.com/></comment>


Ask HN: What is your investment strategy? - <AUTHOR> I would like to learn how HNers invest their money.
To start the conversation, let me share my approach:
1. First and foremost, I am defensive, by nature. In many aspects of life, including investments.
2. ~75% of my savings goes to Gold.
3. There was a time when the rest would be invested in my side projects. High risk. Throw away pretty much.
4. I still plan to invest in my side projects, but age has made me extremely selective.
5. I dabbled in crypto in 2016-2018. Almost everybody I know did. I made modest profits but nothing close to the boom. Since then I have lost respect for crypto industry. I could write an essay why, but to keep it brief most projects are unrealistic. The only purpose is to get rich quick. Meanwhile the markets are heavily manipulated. And I don't have friends in the right places, so I stay out.
I'm still openly looking for investment strategies as my situations affords me the ability to take more risk. <comment><USER2> I've put my money in green energy. Preferable companies with a wide range of activities, the only exception being Vestas (danish windmill company) and they only made my list because every software developer I knew kept getting head- hunted by them.

It's been a decade of great news.

</comment><comment><USER3> Main: Buy and Hold.

ETFs:

80% Vanguard All World, 10% iShares Small Caps

\</comment><comment>--

10% Experimental, currently: P2P Credits and Crypto

Do you buy physical gold and how you keep it? Safe at home, bank, ... ?

<comment><AUTHOR> I use BullionVault to buy gold.

</comment></comment><comment><AUTHOR> PS: feel free to sharing tooling related to your investments in this thread </comment>


Ask HN: What to do if I know Python but love the idea of Rails? - <AUTHOR> Let me start by saying I am familiar with all of the options and am not looking for any recommendations to "just use django". I know all about django and, imo, it still falls really short of what rails provides. A solid system (rack::attack) for throttling, a built in jobs and storage system that doesn't rely on a 3rd party library, ERB > django template language, Capybara is amazing, built in asset pipeline, etc, etc.
Basically I love everything about the idea of rails and what it provides. I only care about web applications and it is basically as close as anyone can get to having so many bases covered all under one roof and humongous community support to boot.
My problem is: I know python. I think python. I cannot for the life of me grock ruby or rails and I just can't seem to stick with trying to understand it when I could just be trying to get stuff done with what I already know. But I'm not happy with the solutions on the what-i-know side of the fence so I'm conflicted to the point of stagnation here.
I think I just needed to vent a little but I'm really hoping someone out there has had a similar experience and could offer some insight.
Thanks for reading. <comment><USER2> Rails comes with many libraries, you might use some or you might not, is this just to play around or for an actual project?

I'd say if you know Django and python it shouldnt be hard at all to pick up ruby and Rails. I think learning rails would a great learning exercise, something you can already apply your Django knowledge

<comment><AUTHOR> actual project.

i think it boils down to how explicit python is. it is so immediately clear to me what is going on and where things are coming from and what they are doing that when i look at ruby/rails code it looks like a big empty void that is producing something fantastic and all i can thing is "...wtf?". i really really want to know how to speak in magic but i'm not sure my brain is equipped to process it.</comment></comment>


A re-introduction to JavaScript - <AUTHOR> https://developer.mozilla.org/en/JavaScript/A_re-introduction_to_JavaScript <comment><USER2> Sadly JavaScript's 16bit strings are broken. Unicode has more than 16bits worth of codes. Especially now that emoji have finally been added the 140million Japanese users of them can now finally take all their messages online......except JavaScript will choke on all of them

Welcome to tons of JS Unicode String libraries to work around this problem :-(

<comment><USER3> The tutorial is somewhat incorrect with respect to strings. JavaScript strings are UTF-16, which means that strings are represented as a sequence of 16-bit half-words, but a single character _could be_ spread over multiple half-words. For example, open up the Developer console on your browser and type

        alert("🐱"); // a cat face

and JavaScript will not have any problems processing the string (assuming you have the fonts to see that particular character.) Then try

        alert("🐱".length); // 2

and you will find that it prints 2, because that single character ("code point") requires two half-words to represent. This does mean that you cannot access this character except by slicing, because

        alert("🐱"[0]); // an unknown character

produces half of a character, which could be problematic and require libraries to work around if you're attempting to access individual characters. Other string operations still work fine, though

        alert("abc🐱de".indexOf("🐱")) // 3

so while a few operations will need special library support in some cases, JavaScript certainly won't "choke" on any of these strings.

<comment><USER4> Interestingly, the javascript scratchpad in firefox requires two deletes to fully delete that character. This is consistent with the fact that its length is 2. The first delete actually changes it to some other character.

From what I understand this is not a case of a unicode character with a second character applied as an accent. Although it's possible it may be behaving the same way.

In any case, it's interesting to see the delete key change a character to something else rather than fully delete it.

<comment><USER3> JavaScript's access to individual parts of a string works on _code units_ , which are distinct from _code points_ , which in turn are distinct from _characters_. A single (visible) character can be composed of multiple _code points_ , such as a character plus an accent. However, a single _code point_ can also be represented by multiple _code units_ , where a code unit is a fixed number of bits. UTF-16 is a variable-width encoding, so a given code point can be either one code unit or two; in this case, the cat face is a single character, composed of a single code point, composed of two code units.

(UTF-8 is another variable-width encoding where a code point can be anywhere from one to four 8-bit code units, and UTF-32 is a fixed-width encoding where every code point is exactly 32-bit one code unit. Because code points can be accents or modifiers, UTF-32 is still variable-width with respect to characters, because there's no guarantee that a given character is composed of a single code unit.)

Because UTF-16 is a variable-width encoding, and because JavaScript exposes UTF-16 code units (instead of code points or characters), it is possible to delete half of a code point and even end up with an invalid UTF-16 string in some cases (IIRC). As another comment mentions, some languages (e.g. Python 3) expose code points instead, which still isn't the same as characters.

</comment></comment></comment></comment><comment><USER5> This was actually an thorough overview for JavaScript newbies. My only complaint was that the author glossed over apply() and call() saying they were 'difficult to illustrate', two functions that were new to me.

Wisely, the author did link to [https://developer.mozilla.org/en/Introduction_to_Object- Orie...](https://developer.mozilla.org/en/Introduction_to_Object- Oriented_JavaScript) to fill in the gaps.

</comment><comment><USER6> This tutorial reminds me of Python reference by new riders from which I picked up and started coding fresh literate python in 2 days, writing code that worked and without bugs. I guess if you can show commonly used idioms and supply edge conditions such as "NaNs are toxic" - language learning happens in a snap. big thumbs up for the tutorial.

<comment><USER7> Do you remember the title of the Python book?

<comment><USER8> My total guess is Python Essential Reference.

<https://duckduckgo.com/?q=new+riders+python>

</comment></comment></comment><comment> jarek-foksa If you are looking to learn how OOP in JavaScript works, I would highly recommend you to read [http://killdream.github.com/blog/2011/10/understanding- javas...](http://killdream.github.com/blog/2011/10/understanding-javascript- oop/) instead of this MDN article.

</comment><comment><USER9> Wow that was good! I'm very happy to have found this. I've had very little luck finding good tutorials for experienced programmers who just want to pick up JavaScript. Most tutorials I found either assume very little prior knowledge and write dense paragraphs on what an object is, or they assume too much and explain too little. I love the focus on example-driven explanation as I somehow process code much faster than text, and I love that it is all on a single page (a surprisingly rare feature!).

</comment><comment><USER10> According to the article, the code below causes a memory leak in IE, though I fail to see how.

function addHandler() { var el = document.getElementById('el'); el.onclick = function() { this.style.backgroundColor = 'red'; } }

I'm assuming the author believes `this` is evaluated immediately and refers to the `el` variable instance, rather than being evaluated when the function is called.

Any ideas?

<comment><USER11> When addHandler is called, the anonymous function expression is evaluated and its result is assigned to el.onclick. Thus, el contains a reference to the newly created function. However, when the function is created, it captures the environment in which it is defined, including the variable el. Thus, el points to the function, and the function (closure) points to el. This is the circular reference that IE can't handle.

<comment><USER10> Maybe I'm missing something, but the function doesn't point to `el`. `el` just exists in a lower execution context on the stack. If a variable inside the anonymous function referenced `el` directly, then a closure would be formed over `el`. In this instance `this` is just assigned when the function is called.

<comment><USER12> I'm not sure whether you're saying the code is wrong or you can't understand how that code creates the circular reference. This problem was widely known and stopped being a problem in IE8 I believe. Maybe it was IE7. A while ago anyway. That code looks like the type of circular reference that would cause it. You used to be able to download tools to watch for the memory leak.

From what I remember the closure will keep a reference to el even though it will never use it, which means el won't be garbage collected when removed from the dom, which means the closure won't be removed from the onclick to free up el. Hence a circular reference. IE6's javascript garbage collector couldn't detect that.

The article is old. Here's an article from MS in 2005 describing the problem in more detail:

<http://msdn.microsoft.com/en-us/library/Bb250448>

Apologies if you understood that and were just saying the code is wrong, but it looks right to me. Not that I can be bothered to fire up IE6 to test it out.

EDIT: Some more detail about the definitely historical leak from SO, it also turns out it was only partially fixed in IE7:

[http://stackoverflow.com/questions/1999840/javascript- circul...](http://stackoverflow.com/questions/1999840/javascript-circular- references-and-memory-leaks)

<comment><USER13> Thanks for the info. So it was the dreaded IE 6 that would not release things when you reloaded or went to another page. I was wondering why the base article here said you had to restart the browser completely, as I could think of no reason to carry over objects between pages (outside of browser/external persistence). At least IE 7 implemented the obvious "clean up between pages" operation.

Die, Explorer, die! :-)

</comment></comment></comment></comment></comment><comment><USER14> Wonderfully written. A great lang that doesn't get enough credit. When people ask me things about JS, I'm sending them there.

</comment><comment><USER15> > Last Updated Date: March 7, 2006

<comment><USER16> Unless they can predict the future, it was updated as recently as 2009:

> The fourth edition was abandoned, due to political differences concerning > language complexity. Many parts of the fourth edition formed a basis of the > new ECMAScript edition 5, published in December of 2009.

EDIT: If you scroll to the bottom right it says: "Page last modified 21:08, 5 Jan 2012 by Janet Swisher"

<comment><USER17> Yea, that date is under "Original Document Information".

</comment></comment></comment><comment><USER18> Today I would recommend that anyone who plans to learn JS learns Lua first. It's similar enough, but simpler and you don't have to be concerned with all the browser-specific functions right away.</comment>


ScaleDB cloud storage engine for MySQL - <AUTHOR> http://www.scaledb.com/index.html

<comment><USER2> I really want to like this, but I think the description on the main page makes things more complicated than it needs to be. If that is the case, then I assume the product is more complicated than it needs to be.

'ScaleDB is a pluggable storage engine for MySQL. It turns your MySQL application into an enterprise-class, highly-available, clustered database that scales dynamically in a public cloud, private cloud, or on premise.'

Is this better put by saying 'ScaleDB is a simple way to make your MySQL database scale automatically'? or something like that?

You're giving lots of data and stuff, but why is your solution the easiest/best?</comment>


E3 - Most Anticipated Games - <AUTHOR> http://venturebeat.com/2008/07/12/deans-most-anticipated-games-of-e3/ <comment><USER2> Unfortunetaley I never got around to playing the first Fable but now I've decided to play nr 2 instead. Looking great, Resident Evil 5 is also interesting. I never liked the ones that were released to PlayStation but nr 4 was an amazing game.

</comment><comment><AUTHOR> Resistance 2.... can't wait.</comment>


Coronavirus revealed the unexpected strengths of Germany's model of government - <AUTHOR> https://www.newstatesman.com/2020/07/how-coronavirus-has-revealed-unexpected-strengths-germany-s-model-government <comment><USER2> Germany has more than three times more hospital beds per inhabitant than the UK: [https://ourworldindata.org/grapher/hospital-beds-vs- gdp?coun...](https://ourworldindata.org/grapher/hospital-beds-vs- gdp?country=DEU~GBR) It also has 70% more medical doctors per inhabitant: [https://ourworldindata.org/grapher/medical-doctors- per-1000-...](https://ourworldindata.org/grapher/medical-doctors- per-1000-people-vs-gdp-per-capita?country=DEU~GBR) All this comes in handy in case of a pandemic.

<comment><USER3> With an average utilization of 10% of ICU's during this flu season this argument is moot.

More likely is that they did better nursing homes protections, or just had less dangerous Virus variants than in the west. I don't see any other advantages of the German system affecting this year's flu pandemic. It's better of course. But mostly irrelevant.

</comment></comment><comment><USER4> Organized societies with high levels of trust backed by effective bureaucracies from a tradition of discipline and rigor are actually good at solving things, who would have known.

Whenever Libertarians claim that governments don't work, I point them to the success stories of the German state.

The issues generally never lie with private vs public initiatives (although the incentive structures count), but rather with effective vs ineffective institutions.

<comment><USER5> Libertarians are usually talking about markets when they refer to that and the people who disagree with them usually aren't economists. Germany is no more impressive than Singapore or Korea, you can accomplish a lot of impressive looking feats when you're operating at a miniscule scale and your culture is mostly homogenous. I'll be more impressed when they start surpassing modernized SEA region nations or when they manage the same feats under an atmosphere of diversity.

<comment><USER6> Thinking Germany is homogenous just makes it obvious you've never been there. Germans in Germany are barely homogenous between east and west Germany not to mention the influx of immigrants from different time periods.

<comment><USER7> Thinking Germany isn't homogenous (relative to the US) just makes it obvious you've never been to the US.

<comment><USER6> I'm American. Lol.</comment></comment></comment></comment></comment>


PHP 5.3.3 hangs on numeric value 2.2250738585072011e-308 - <AUTHOR> http://www.exploringbinary.com/php-hangs-on-numeric-value-2-2250738585072011e-308/ <comment><USER2> Follow-up: PROBLEM SOLVED.

This problem occurs due to IA-32's 80-bit floating point arithmetic. The simple fix: add a "-ffloat-store" flag to your CFLAGS.

The problematic function, zend_strtod, seems to parse the mantissa (2.225...011 part) and the exponent (-308 part) separately, calculate the _approximation_ of m*10^e and successively improve that approximation until the error becomes less than 0.5ulp. The problem is that this particular number causes the infinite loop (i.e. the iteration does not improve the error at all) in 80-bit FP, but does not in 64-bit FP. Since x86-64 in general uses the SSE2 instruction set (with 64-bit FP) instead of the deprecated x87 it does not have this problem.

<comment><USER3> A better fix would be to use "-mfpmath=sse" to disable x87 math - this also makes your program slightly faster, whereas -ffloat-store can make it much slower.

<comment><USER4> .. or not use an algorithm that depends on the hardware implementation of floating point math? How about just comparing the previous & current iteration values? If you're not making any progress, you're done.

<comment><USER5> You'd probably want to compare to an epsilon AND exact compare, otherwise you could oscillate between two values.

</comment></comment></comment></comment><comment><USER6> _If you have any thoughts on what the bug is, please let me (or PHP) know._

Here's what you do. Step 1: compile PHP with debugging symbols. Then run the test case in GDB:

        $ gdb `which php`
        (gdb) set args testcase.php
        (gdb) run
        <program hangs>

Then hit C-c, and see where the program is: ^C Program received signal SIGINT, Interrupt. 0x0000000000703898 in ?? ()

        #0  0x0000000000703898 in ?? ()
        #1  0x00000000006aae40 in execute ()
        #2  0x00007ffff4400116 in ?? () from /usr/lib/php5/20090626/suhosin.so
        #3  0x000000000068290d in zend_execute_scripts ()
        #4  0x000000000062e1a8 in php_execute_script ()
        #5  0x000000000071317a in ?? ()
        #6  0x00007ffff5475c4d in __libc_start_main (main=<value optimized out>, argc=<value optimized out>, ubp_av=<value optimized out>,
        init=<value optimized out>, fini=<value optimized out>, rtld_fini=<value optimized out>, stack_end=0x7fffffffe9c8)
        at libc-start.c:228
        #7  0x000000000042d4b9 in _start ()

Now you have some idea of where to look. (Note: this is not the actual bug, as I can't reproduce it on my machine. This is <?php while(1){} ?>, which is just as good for demonstration purposes. Also, no debugging symbols, so we don't really know what's going on.)

No offense, but this is like programming 101.

<comment><USER7> >No offense, but this is like programming 101.

It might be if you grew up in a C/C++ environment, many people these days start with scripting languages and don't venture out (myself included, but learning C is my new year's resolution).

<comment><USER8> You can do all this in any decent scripting language too. In ruby:

        require 'rubygems'
        require 'ruby-debug'

        Debugger.start
        Signal.trap('INT') { debugger } # this line makes the debugger run when you hit ctrl-c

        # YOUR CODE HERE INSTEAD!
        loop {}

Simply hit ctrl-C (sometimes twice) when your code is hung or whatever and then issue the `where` command to rdb. Just make sure you have the ruby-debug gem installed.

It's actually easier, as you obviously don't have to worry about debugging symbols. You can also attach rdb to running interpreter processes and all that good stuff.

<http://bashdb.sourceforge.net/ruby-debug.html>

EDIT: I've just realised that this will obviously only catch bugs in ruby code. For bugs in the _ruby interpreter itself,_ like the php bug under discussion, you will need to use gdb on the interpreter binary like jrockway showed. Still the point is that you shouldn't consider this stuff over your head just because you only hack dynamic languages :)

</comment></comment></comment><comment><USER9> As the author said, it does hang in zend_strtod.c, and it seems to happen in 32-bit only.

Debug trace:

        #0  0x0832257f in mult (a=0xe1931e82, b=0x8781590)
            at /usr/src/php-5.3.3/Zend/zend_strtod.c:720
        #1  0x08322757 in pow5mult (b=0x8781590, k=1)
            at /usr/src/php-5.3.3/Zend/zend_strtod.c:803
        #2  0x08324443 in zend_strtod (s00=0xb7a7d01d "e-308;\n?>\n", se=0x0)
            at /usr/src/php-5.3.3/Zend/zend_strtod.c:2352
        #3  0x082e03ce in lex_scan (zendlval=0xbf94dd34, tsrm_ls=0x8648050)
            at Zend/zend_language_scanner.l:1382
        #4  0x082fa849 in zendlex (zendlval=0xbf94dd30, tsrm_ls=0x8648050)
            at /usr/src/php-5.3.3/Zend/zend_compile.c:4942
        #5  0x082dcc47 in zendparse (tsrm_ls=0x8648050)
            at /usr/src/php-5.3.3/Zend/zend_language_parser.c:3280
        #6  0x082dd232 in compile_file (file_handle=0xbf9502d0, type=8,
            tsrm_ls=0x8648050) at Zend/zend_language_scanner.l:354
        #7  0x081ad3cc in phar_compile_file (file_handle=0xbf9502d0, type=8,
            tsrm_ls=0x8648050) at /usr/src/php-5.3.3/ext/phar/phar.c:3393
        #8  0x0830acc5 in zend_execute_scripts (type=8, tsrm_ls=0x8648050, retval=0x0,
            file_count=3) at /usr/src/php-5.3.3/Zend/zend.c:1186
        #9  0x082b660f in php_execute_script (primary_file=0xbf9502d0,
            tsrm_ls=0x8648050) at /usr/src/php-5.3.3/main/main.c:2260
        #10 0x08388893 in main (argc=2, argv=0xbf9503b4)
            at /usr/src/php-5.3.3/sapi/cli/php_cli.c:1192

<comment><USER10> Here's the source for that file if you want to look at it: [http://svn.php.net/viewvc/php/php- src/branches/PHP_5_3/Zend/...](http://svn.php.net/viewvc/php/php- src/branches/PHP_5_3/Zend/zend_strtod.c?revision=255174&view=markup&pathrev=260750)

</comment></comment><comment><USER11> Bug appearing at my Core 2 Duo / Win7 / PHP 5.3.0.

This is _really_ serious. In fact, I've just tested if the problem happens for GET passed values and it does. Not all the passed data to a website is treated as a number, so not all websites with the PHP versions and configuration that could fail with this bug will be vulnerable, but definitely there is going to be a huge amount of websites that will do. This is really scaring.

I hope the PHP team patch it soon.

Meanwhile, a possible workaround would be adding this line at the very top of the execution of php website:

if (strpos(str_replace('.', '', serialize($GLOBALS)), '22250738585072011')!==false) die();

This will stop execution if any decimal version of the number were passed as parameter. Note that 222.50738585072011e-310 cause problems too, and any of the other possibilities to write it.

Do you know if there are any other possible ways to write the number that causes trouble too?

<comment><USER12> Ugh, I managed to hang one of my websites by sticking that number in place of a normal integer parameter.

Apache2 (mod_php) spun at 100% cpu usage.

This suggested workaround works for me. Obviously, it's a limited bandaid, but thanks for suggesting it.

<comment><USER13> So basically you can hang (almost) _any_ website written in PHP which expose primary keys as GET parameters?

Does this just crash the local process for that request or will it also cause problems for other requests? Anyone able to test this?

<comment><USER14> It's going to be a very, very small subset of websites running PHP that could be hung...

\- Must be one of the PHP 5.3.3 versions with the bug, where very very few web hosts are running such a recent version (5.0, 5.1 and 5.2 branches are much more common)

\- Must be a 32-bit version, no bug in 64-bit

\- The PHP program must try to use the input as a number

<comment><USER15> It seems to me that not only the PHP versions 5.3.3 are vulnerable. I have successfully crashed an older version of PHP 5.0.3.

</comment></comment></comment></comment></comment><comment><USER2> Some of my friends verified the case. Highlights:

\- PHP 5.3.3-1ubuntu9.1 i686 build (built on Oct 15 2010 14:17:04) hits the bug.

\- PHP 5.3.3-1ubuntu9.1 x86_64 build (built on Oct 15 2010 14:00:18) doesn't have the bug.

In the i686 build ltrace shows the memcpy call repeating infinitely, suggesting the bug originates from 32-bit and 64-bit problems.

<comment><USER16> My experience matches yours: the bug occurs in i686 but not x86_64. I have a variety of boxes with different Linux distributions, and tried it on each.

Ubuntu 10.04, i686, "PHP 5.3.2-1ubuntu4.5 with Suhosin-Patch" has the bug.

Ubuntu 10.10, i686, "PHP 5.3.3-1ubuntu9.1 with Suhosin-Patch" has the bug.

Debian Lenny with 2.6.26-1-amd64 kernel, i686, "PHP 5.2.6-1+lenny9 with Suhosin-Patch" has the bug.

Debian Lenny with custom kernel build, x86_64, "PHP 5.3.3-5 with Suhosin- Patch" does not have the bug.

So the common thread seems to be 32- vs 64-bit: the bug occurs on all the 32-bit boxes I tested, but not on any of the 64-bit boxes.

<comment><USER17> So it's also in the 5.2.* branch? That can't be good.

</comment></comment></comment><comment><USER18> Though the author doesn't seem to be malicious in any way, he really should have reported it to the PHP core team as a security vulnerability before writing a blog post. This could easily lead to denial-of-service attacks.

<comment><USER19> Aren't a huge percentage of software bugs potential security vulnerabilities by this standard? I understand the wisdom of trying to get patches pushed out before publicly disclosing major exploits in mission critical software, but it seems unreasonable to expect users to not make statements of the form "program X crashes when I do such-and-such" in public discourse.

<comment><USER20> It just depends on how the crash is triggered. Most things that users run into in normal usage don't have very much potential to become a serious attack vector for lots of reasons -- many programs are not particularly network-aware or may not provide any service an attacker is interested in denying, the attack may require local access (which is still serious in some cases, but obviously less than something that can be exploited over the network by sending a malformed query), and so on.

I think that the vast majority of stuff doesn't qualify as something that should be reported to a security team first. However, from a brief glance at the article, it appears that a remote user of a web application may be able to crash PHP entirely if he can find the right place to drop the number, denying access to all programs that depend on that PHP installation. That is a very serious bug and one incident can theoretically take out hundreds or thousands of sites and cost a lot of people a lot of money, not to mention time or frustration. Definitely seems like it should have hit the security group first to me.

<comment><USER19> Yes, I understand that bugs in the "platform software" used by many internet services have the potential to rapidly affect a lot of users. However, I believe that it is unreasonable to expect users who experience a crash in php, or mysql, or any important application you can name, to not talk about the crash that happened. Software bugs are just too common to impose that restrictive a standard. In general, I believe statements of the form "this information is too dangerous to be shared publicly" are suspect, and we should maintain a strong presumption that as a general rule, it is OK to talk about problems publicly. When it comes to security issues, there is a difference between releasing deliberately crafted 0-day arbitrary remote code execution techniques and just making a public report of a crash you experienced.

Perhaps the real issue is that the growing reliance upon internet services makes fault-tolerant engineering and fallback plans for handling failures very important. We need to make sure that hospitals/police/everything aren't dependent on systems that might break down completely because of bugs like this.

</comment></comment></comment></comment><comment><USER21> This must be it then:

do { z = ( _x & 0xffff) _ y + ( _xc >> 16) + carry; carry = z >> 16; Storeinc(xc, z, z2); z2 = (_x++ >> 16) * y + (*xc & 0xffff) + carry; carry = z2 >> 16; } while(x < xae);

Hit up gdb and watch xae and x...

I'll try myself but I don't have 32bit.

</comment><comment><USER22> Rasmus Lerdorf just tweeted that it's a gcc optimizer issue:

      Works fine with -O0 but not -O2

<http://twitter.com/rasmus/statuses/22212610308964353>

<comment><USER23> When a problem is described as an optimizer issue, it usually means that the code is making some unsound assumptions that happen to be true when compiling without optimization. Of course it's easier on the programmer's ego to blame it on the compiler...

(I haven't looked at this particular issue; maybe it really _is_ a compiler bug. But the odds are against it.)

<comment><USER22> Might be true in general, but when the creator of PHP says it's a compiler issue it's hard to 2nd guess.

He also later added:

      We still need to fix the code to make it immune to compiler switches.

<comment><USER24> "I'm not a real programmer. I throw together things until it works then I move on. The real programmers will say "Yeah it works but you're leaking memory everywhere. Perhaps we should fix that."" -Rasmus Lerdorf

When you attempt to make an argument from authority, at least choose someone who has some credibility to use as an authority.

</comment></comment></comment></comment><comment><USER25> Doesn't hang for me:

      [1:26am:~/Downloads] RIDGELAND:root [0:16]# php -v
      PHP 5.3.3 (cli) (built: Aug 22 2010 19:41:55)
      Copyright (c) 1997-2010 The PHP Group
      Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies

</comment><comment><USER26> Can everybody who posts php -v (in as far as that is necessary...) also post uname -a, otherwise there's not much to go on...

</comment><comment><USER27>
        %php -r 'print(2.225073858502011e-308+0);print("\n");'
        2.225073858502E-308
        %uname -a
        FreeBSD unknown 8.1-RELEASE FreeBSD 8.1-RELEASE #0: Mon Jul 19 02:36:49 UTC 2010     email@example.com:/usr/obj/usr/src/sys/GENERIC  amd64
        %php -v
        PHP 5.3.3 with Suhosin-Patch (cli) (built: Oct 17 2010 13:41:11)
        Copyright (c) 1997-2009 The PHP Group
        Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
            with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH

</comment><comment><USER28> I've fixed this now in all the PHP branches.

[http://svn.php.net/viewvc/?view=revision&revision=307095](http://svn.php.net/viewvc/?view=revision&revision=307095)

<comment><USER26> Interesting. I've never used 'volatile', would you mind explaining how it works in this case?

<comment><USER28> The copying from the 80-bit register to the 64-bit memory cell is causing the result to be corrupted. When we use volatile it tells the compiler not to apply the optimisation which in this case was putting it in a register.

<comment><USER26> But doesn't that make it a compiler bug? If the root cause is that the compiler truncates data it shouldn't, does that mean the fundamental issue is a compiler bug?

<comment><USER28> It's a hardware issue with the x87 instruction set,

<http://gcc.gnu.org/ml/gcc/2003-08/msg01195.html> is a good explanation.

<comment><USER26> Ah I see, thank you. Hairy problem.

</comment></comment></comment></comment></comment></comment><comment><USER29> Check out the last lines for

      strace php p.php

      lstat64("/home/ubuntu/junk/p.php", {st_mode=S_IFREG|0644, st_size=59, ...}) = 0
      lstat64("/home/ubuntu/junk", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
      lstat64("/home/ubuntu", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
      lstat64("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
      ioctl(3, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfe51238) = -1  ENOTTY (Inappropriate ioctl for device)
      fstat64(3, {st_mode=S_IFREG|0644, st_size=59, ...}) = 0
      mmap2(NULL, 68, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb78d1000

The next thing that should be hapenning is munmap for that very same address, but something hangs...

<comment><USER29> And if anyone wondered, this number in double precision IEEE 754 is:

      S EE..E MM..M
      0 00000 11111

<comment><USER30> So this is the largest positive denormalized number? Does PHP hang for all denormalized numbers?

</comment></comment></comment><comment><USER31> I can't reproduce on CentOS:

      $ php -v
      PHP 5.2.6 (cli) (built: May  5 2008 10:32:59)
      Copyright (c) 1997-2008 The PHP Group
      Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies
          with eAccelerator v0.9.5.3, Copyright (c) 2004-2006 eAccelerator, by eAccelerator

      $ uname -a
      Linux hostname 2.6.18-128.1.10.el5 #1 SMP Thu May 7 10:39:21 EDT 2009 i686 i686 i386 GNU/Linux

</comment><comment><USER32> Awesome, this catches HostGator's PHP 5.3.3 (which isn't used by default, have to turn it on yourself) too. I knew there was yet another good reason for always casting expected-int input before doing anything with them... Something as simple as

        mysite.com/page/1 ===> $page = 1 ===> href="/page/' . $page + 1 . '">next page

could mess you up...

</comment><comment><USER33> I am confused. Does this only affect people with older cpus that do not support SSE2?

I am not affected by the bug, yet am on a 32 bit CPU and PHP 5.2.16 was compiled with -O2.

uname -a:

Linux www 2.6.9-67.0.22.ELsmp #1 SMP Fri Jul 11 10:38:12 EDT 2008 i686 i686 i386 GNU/Linux

Running the test script outlined above comes back immediately. No hang.

CPU is Intel(R) Xeon(R) CPU E5430 @ 2.66GHz which support SSE2.

Since my CPU supports SSE2, would I not be affected by this?

</comment><comment><USER29> And so, the race after affected websites starts...

</comment><comment><USER34> We have slapped together a quick workaround that can be found here:

<http://www.aircraft24.com/en/info/php-float-dos-quickfix.htm>

Its a quick+dirty fix for site-owners that cannot immediately upgrade php.

</comment><comment><USER35> I can't reproduce.

        ubuntu@ip-10-130-57-139:~$ php -v
        PHP 5.3.3-1ubuntu9.1 with Suhosin-Patch (cli) (built: Oct 15 2010 14:00:18)
        Copyright (c) 1997-2009 The PHP Group
        Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies

<comment><AUTHOR> It happens for me on nearly the exact same:

        PHP 5.3.3-1ubuntu9.1 with Suhosin-Patch (cli) (built: Oct 15 2010 14:17:04)
        Copyright (c) 1997-2009 The PHP Group
        Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies

The build time differs, for some reason.

<comment><USER36> The build time is different because you're running on different architectures with different packages.

</comment></comment></comment><comment><USER37> I can't reproduce under Debian:

      PHP 5.2.6-1+lenny9 with Suhosin-Patch 0.9.6.2 (cli) (built: Aug  4 2010 03:25:57)
      Copyright (c) 1997-2008 The PHP Group
      Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

<comment><USER38> It does hang on my debian:

      aquilax@zelda /tmp> php -v
      PHP Warning:  PHP Startup: Unable to load dynamic library   '/usr/lib/php5/20090626+lfs/adodb.so' -  /usr/lib/php5/20090626+lfs/adodb.so: cannot open shared object file: No such file or directory in Unknown on line 0
      PHP 5.3.3-6 with Suhosin-Patch (cli) (built: Dec  7 2010 18:23:49)
      Copyright (c) 1997-2009 The PHP Group
      Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
        with Xdebug v2.1.0, Copyright (c) 2002-2010, by Derick Rethans
        with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH

</comment></comment><comment><USER39> Hangs with the php version installed with xampp 1.7.3 on Windows 7.

PHP 5.3.1 (cli) (built: Nov 20 2009 17:26:32) Copyright (c) 1997-2009 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2009 Zend Technologies

</comment><comment><USER40> glaceon:~ $ php -r 'print(2.225073858502011e-308+0);print("\n");' 2.225073858502E-308

glaceon:~ $ php -v PHP 5.3.3 (cli) (built: Aug 22 2010 19:41:55) Copyright (c) 1997-2010 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies

glaceon:~ $ uname -a Darwin glaceon 10.5.0 Darwin Kernel Version 10.5.0: Fri Nov 5 23:20:39 PDT 2010; root:xnu-1504.9.17~1/RELEASE_I386 i386 i386

</comment><comment><USER41> It does hang on my Ubuntu desktop:

      PHP 5.3.2-1ubuntu4.5 with Suhosin-Patch (cli) (built: Sep 17 2010 13:41:55)

</comment><comment><USER42> PHP Version 5.3.0 via a default WAMP install on Windows 7 hangs as well

</comment><comment><USER12> Ouch, this hangs if PHP is run from the command line on Lucid Lynx.

<comment><USER43> Doesn't seem to hang on my desktop lucid install.

      booi@booi-desktop:~$ uname -a
      Linux booi-desktop 2.6.32-27-generic #49-Ubuntu SMP Thu Dec 2 00:51:09 UTC 2010 x86_64 GNU/Linux
      booi@booi-desktop:~$ php -a
      Interactive shell

      php > $a = 2.2250738585072011e-308;
      php > print $a;
      2.2250738585072E-308
      php > print $a/2;
      1.1125369292536E-308

</comment></comment><comment><USER44> Good advertisement in a way for more type safe languages, given I'm passing something as a string into JSON then using it as a string but PHP still converts it to a double which triggers this error.

<comment><USER45> This isn't really a bug that originates from PHP's handling of types. If any floating point variable containing this number crashes the process, it doesn't matter whether the type declaration was implicit or not. Also, since you're using JSON as an example (why?), it's worth noting that type-safe languages require some sort of mapping for JSON fields as well, any of which could be FLOAT or DOUBLE and would thus be vulnerable. Until today there was no reason to assume the floating point types weren't safe, either. Finally, it has already been pointed out that the problem is caused by a GCC optimization bug, so the implication is that any recent GCC-compiled executable may be vulnerable to erratic behavior upon encountering this number.

<comment><USER44> I was using JSON as an example because it's taking something in JSON specified as a string, using quotation marks, and automatically converting it to a double.

I wasn't referring to this being the cause, just in other languages if you pass a string through JSON it would never end up being decoded to a double, just because syntactically it is a double.

<comment><USER45> > _taking something in JSON specified as a string, using quotation marks, and > automatically converting it to a double._

I can't see anything wrong with this behavior. Double isn't supposed to be any less safe than any other type.

> _I wasn't referring to this being the cause, just in other languages if you > pass a string through JSON it would never end up being decoded to a double, > just because syntactically it is a double._

I believe there is a fundamental misunderstanding here. Other languages would indeed convert to double if so instructed, or if the value presented was a (high) floating point value. And once again, I can see no inherent problem with a JSON parser that looks at a floating point number and interprets it as a double. The only problem would be the memory space of a double vs that of a float or smaller type, but since PHP doesn't make that distinction the point is moot. I don't see the evilness of it, nor do I see how static typing would avoid bugs such as this.

More generally speaking, if one of the basic types of a language is defectively handled, there is no way this bug goes away if you declare that type beforehand. It has quite simply nothing to do with it. I guess an argument could be made that less code would be vulnerable on account of having less instances of doubles around, but it would still be a huge problem. And it's not like floating point numbers are somehow rarely used.</comment></comment></comment></comment>