Top all-time · #5516
kqueue.org
Personal blog · kqueue.org/blogsecuritysystems
kqueue.org is a personal blog at kqueue.org about security and systems. Since 2012, 14 different Hacker News readers have linked it 17 times, most often “More randomness or less ”. The last post was in 2020, but the archive is still widely read.
Most-linked posts?
- More randomness or less 4 people · 4 mentions · first linked 2012-06-25
- IDIV DoS (INT_MIN / -1)3 people · 3 mentions · first linked 2013-01-27
- /blog/2012/12/31/idiv-dos/2 people · 3 mentions · first linked 2022-01-02
- Fast integer overflow detection (2012)2 people · 2 mentions · first linked 2014-12-14
- The cltq story.2 people · 2 mentions · first linked 2013-09-18
What Hacker News says?
Found it: http://kqueue.org/blog/2013/09/17/cltq/
Comment linking /blog/2013/09/17/cltq/
on “Tell HN: C Experts Panel – Ask us anything about C”Submitted IDIV DoS (INT_MIN / -1) as a story · 111 points
HN discussionBit by HN formatting. $ echo $[2**63/-1] Floating point exception Bash crashes out entirely because it doesn't check the operands are safe. See also http://kqueue.org/blog/2012/12/31/idiv-dos/
Comment linking /blog/2012/12/31/idiv-dos/
on “Yes `yes no`”Submitted Fast integer overflow detection (2012) as a story · 64 points
HN discussionFor me, the main reason to prefer unsigned integers whenever possible is: less special cases. When a signed integer is used as an array index, the value can be in one of three ranges: the <0 range, the >=0 && <size range, and the >=size range. To validate the index, you need two comparisons. When an unsigned integer is used as an array index, there are only two ranges: the <size range, and the >=size range, and you…
Comment linking /blog/2012/12/31/idiv-dos/
on “Almost Always Unsigned”Submitted The cltq story. as a story · 4 points
HN discussionSigned integers may also have crazy high values so you're already on the hook for dealing with those. The case for unsigned values is that it frees you from having to think about negative inputs. We all know to check for divide by zero; how many remember to check for INT_MIN / -1? Regarding differences, in practice you usually want those differences to be non-negative. With uints, you compare first. Not: int length…
Comment linking /blog/2012/12/31/idiv-dos/
on “Almost Always Unsigned”Submitted Memory allocator security revisited (2012) as a story · 2 points
HN discussionSure. Can you name the relevant intrinsic in any pre-modern language? It's nice that Rust has overflowing_add, but what were you supposed to do in the 90s? GCC's __builtin_add_overflow only appeared in 2014. Before that, there was this: http://kqueue.org/blog/2012/03/16/fast-integer-overflow-dete... , where, hilariously: > GCC will optimize away the check (c < 0) ...and the suggested solution to this was to use spec…
Comment linking /blog/2012/03/16/fast-integer-overflow-detection/
on “Haskell and Rust”Submitted More randomness or less as a story · 2 points
HN discussionThe most dramatic example is the INT_MIN/-1 case, since that causes an outright crash. For example, Windows has the ScaleWindowExtEx function, which scales a window by some rational number, expressed as the ratio of two ints. Using signed arithmetic is already suspicious: what does it mean to scale a window by a negative fraction? But of course they forgot about the INT_MIN/-1 case, and the result is a BSOD. http://…
Comment linking /blog/2012/12/31/idiv-dos/
on “Should I Use Signed or Unsigned Ints?”Submitted Correctness of a compiler for arithmetic expressions in Lean as a story · 1 points
HN discussionThis is good general advice. A key difference is whether the type is meant to be an index (counting) or for arithmetic. Indexing with unsigned integers certainly has its pitfalls: while (idx >= 0) { foo(arr[idx]); idx--; } But this is outweighed by the enormous and under-appreciated dangers of signed arithmetic! Try writing C functions add, subtract, multiply, and divide, that do anything on overflow except UB. It's…
Comment linking /blog/2012/12/31/idiv-dos/
on “Should I Use Signed or Unsigned Ints?”Submitted More randomness or less (2012) as a story · 1 points
HN discussionReposting a comment of mine from another thread ( https://news.ycombinator.com/item?id=29770689 ): For me, the main reason to prefer unsigned integers whenever possible is: less special cases. When a signed integer is used as an array index, the value can be in one of three ranges: the <0 range, the >=0 && <size range, and the >=size range. To validate the index, you need two comparisons. When an unsigned integer is…
Comment linking /blog/2012/12/31/idiv-dos/
on “Using signed or unsigned int by default in C (2015)”The author quotes an article referring to using uninitialized memory for additional entropy and that article cites [10]. Let me just say: DON'T do that, ever. Uninitialized memory is rarely random. If you're lucky, it's quasi-constant because your own program always writes something else to it before. Worst case an attacker manages to write something to that memory before you read it, thereby controlling part of you…
Comment linking /blog/2012/06/25/more-randomness-or-less/
on “On C-optimizing compilers removing code that has undefined behavior”There was much gnawing of teeth when compilers started to take advantage of the “strict aliasing rule”: http://labs.qt.nokia.com/2011/06/10/type-punning-and-strict-... Programmers might think that it is okay to use uninitialized variables as a source of additional entropy (xoring with the real source of entropy), but it isn't, because the compiler will treat the uninitialized access as undefined behavior and elimina…
Comment linking /blog/2012/06/25/more-randomness-or-less/
on “On the redundancy of C99's restrict”
