00:00:00 --- log: started forth/11.03.16 00:03:40 --- quit: ygrek (Remote host closed the connection) 00:44:20 i prefer time(0) 00:45:41 time isn't standard C :-) 00:45:46 i usually do, char *fn; if( asprintf( fn, "fn-%d-%x", getuid(), time(0)) fopen( fn, "W"); to get a output filename 00:45:58 a uniq filename 00:47:00 not really, and why not use tmpnam? 00:47:10 bc i want uid and time info in the fn 00:47:21 so you don't want a unique file. 00:47:34 besides, i read the caveats in those manpages and cringed 00:47:47 what cavates? 00:47:59 about filenames and uniqness 00:48:01 :) 00:48:04 just as you said 00:48:10 hm? 00:48:15 The tmpnam function generates a string that is a valid file name 00:48:15 and that is not the same as the name of an existing file./102/ 00:48:31 time plus a user's uid would combine to elevate uniqness of fn 00:48:32 what is "caveat" about that? 00:48:47 you really want me to remind you of them? 00:48:51 SunTzu: it doesn't, it is also easy to case race conditions, and security bugs. 00:49:05 how can fn + uid + time combine to be unsafe? 00:49:07 if you can do so briefly, yes please. 00:49:17 SunTzu: i can guess what that will be. 00:49:47 also, time(0) is not safe. 00:49:51 1. tmpnam is limited in fn string length 00:49:51 time can return -1 00:50:14 1a. hence tmpnam_r 00:50:25 actually, that is not the reason for tmpnam_r 00:50:33 2. tempnam is also length limited. 00:50:35 but your version is not safe in any shape 00:50:42 so is your version 00:51:24 -1 can be tested for. i agree i should do that, but my point was to show code, not be pedantic about the whole implementation that i write 00:51:54 well, youa re being pedantic about tmpnam :-) 00:51:59 k 00:52:01 it is safer than your version, in any form 00:52:17 ok; i'll look into it further 00:52:37 there have been numerous bugs and races that have been exploited by using predetermined file names like you are using 00:52:55 but the only static part is the leading string 00:53:50 take a classic example of tock-tock exploits.. 00:53:59 i dont know that one 00:54:16 ah, local jargon... sorry 00:54:19 k 00:54:30 toctou is the normal name, time of check, to time of use 00:54:38 k 00:54:45 acronym? 00:55:00 yes, for time of check, to time of use, toctou 00:55:03 https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/coding/861-BSI.html 00:55:03 k 00:55:08 semi decent article i suppose 00:55:17 so, what's the vuln? 00:55:33 note that tmpnam is also affected since there is no guarantee on the randomness of the names generated 00:55:39 only that no other such file shall exist 00:56:04 and the args to asprintf above are 3-part random 00:56:21 i use it in a tiny compiler that i have for temp /tmp fn's 00:56:22 not really, they are guessable 00:56:52 i deem it an acceptable risk since it's only me using the code 00:56:53 tock-tock attacks are basically race codnitions 00:57:09 you check the permissions, open the file... 00:57:25 the race is between checking the permission and opening the file where a malicious program can do something to the file. 00:57:29 how does gcc build a tmpname, such as i see in hex-dumps? 00:57:36 hm? 00:58:11 in .o files made by gcc in /tmp, the filename is part of the .o file; the length of name is quite long 00:58:35 lets look! 00:59:22 * ams taps his finger to music while he snatches the gcc source code 00:59:50 the attack that tmpnam is not affected by is guessing file names 01:00:07 which would be hard for my code 01:00:12 in your case, i (the attacker) could create a file name by the same format you are using, and you'd end up using that... 01:00:29 you'd have to guess 3 parts combined correctly 01:00:54 that is easy 01:00:58 i can just do a dump of your program. 01:01:23 well, the src will be foss 01:01:38 well, irrelevant for an attacker :-) 01:01:43 attacks are program directed... 01:01:44 so there is tht but still, the chances of you connecting all those dots in this scendario, i think, are low 01:02:06 or a blkhat doing that, still low 01:02:16 not really 01:02:26 as i said; this is so far, private code we're discusin 01:02:30 similar things have been done over the decades :-) 01:02:44 still, if you write safe code all the time, then youd on't have to worry 01:02:57 i could still come up with a better way to build a better tmpnam 01:03:05 true 01:03:14 true, not saying that tmpnam is good 01:03:22 k 01:03:22 but it is random 01:03:29 or pseudo random 01:03:30 and mine isnt? 01:03:33 nope 01:03:38 uid is guessable, so is time 01:03:55 well; i dont believe in random; it's all just undiscivered pattern :) 01:04:10 sure, but your code is calculatable easily :-) 01:04:15 and i can generate all the time stamps 01:04:17 k 01:04:21 brb, keep writing 01:04:34 ? 01:07:09 i do my best thinking on the loo :) here's my response: 01:07:20 1. i do not equate [uniq] to [random]; 01:07:35 true enough, even in the mathematical sense 01:07:41 2. i just need to build a fn that'll be uniq within the names in /tmp; 01:07:43 (kinda( 01:07:52 [/done] 01:07:54 SunTzu: tmpnam then :-) 01:08:02 not good enough given the caveat 01:08:07 standard, and guaranteed to be unique 01:08:30 more caveats regarding your version of tmpnam though 01:08:39 perhaps; i'll re-eval 01:10:26 and it saves code 01:10:39 what does? 01:10:50 tempnam over implementing your own functions over and over again 01:11:05 it's just 3-5 LOC dep on my mood 01:11:14 but it's simple and does what *i* need 01:11:18 with min fuss 01:11:24 with proper error checking, race condition cruft, etc, far more :-) 01:11:29 perhaps 01:11:32 tmpnam does the same though =) 01:11:42 gcc uses mkstemp for that matter 01:11:43 ... and on mt sys, i always know what's in /tmp 01:11:47 k 01:11:54 mt/my 01:12:16 from the looks 01:14:35 of what? 01:17:01 the /tmp/ccFOO.o 01:17:17 that's not the form of my string tho 01:17:24 what compiler are you using? 01:17:30 a little one i wrote 01:17:44 not public yet 01:18:00 you asked what gcc did 01:18:01 :-) 01:18:03 ya 01:18:11 it uses make_temp_file 01:18:16 k 01:18:29 which is part of libiberty 01:18:38 k 01:18:44 and a wrapper aruond mkstemps 01:18:47 [new zile version released] 01:19:39 old news = 01:19:40 ) 01:28:20 HP is stupid. 01:29:13 SunTzu: what kind of compiler is it anywho? 01:29:45 a translator of an abridge c syntax 01:29:50 abridged 01:30:23 SunTzu: looked at otcc/tinycc? 01:30:27 ya 01:30:45 and others too 01:30:49 naughty code in otcc... 01:30:56 lol; how so? 01:31:02 rofl 01:31:14 it abuses things quite alot :-) 01:31:23 ah 01:31:26 which is why it is cool 01:31:31 nods 01:32:25 i wish that tinycc was really meant to be tiny though *G* 01:32:40 compared to gcc, it is by far 01:32:58 gcc is quite tiny too, some parts are weird, but it isn't that tough of a cookie 01:33:14 one has to recall that gcc also does alot more 01:33:32 no one in their right mind can call gcc tiny 01:33:42 (like the fact that it supports a basillion front ends, back ends and middle layers) 01:33:48 hence i conclude by your own testimony, you are not sane :) 01:33:49 pff 01:33:52 figers 01:34:01 hah 01:34:14 well, it depends on what you mean with tiny 01:34:25 the code base is big, sure... most of it is the test suite 01:34:33 the core C stuff isn't that big 01:34:37 but you have many other layers 01:34:41 tiny in size; tiny in loading time; tiny in compilation-elapse-time required 01:34:47 gcc is not tiny by any of those 3 01:35:00 sure it is 01:35:03 pff 01:35:10 non-sense 01:35:17 you forget that gcc is calling other programs, like as/ld 01:35:27 while tinycc has them included 01:35:31 i know 01:35:37 which makes tinycc "bigger" in a sense 01:35:45 not critical 01:35:57 quite more critical, since gcc supports more output formats :-) 01:36:10 and arches 01:36:40 so if you strip away the test suite, all arches execpt one, and some of the hair optimisation layers, and all languages expect one, then gcc is infact tiny 01:37:52 note i'm not saying that it is _easy_ to understand :-) 01:37:57 completely different thhing that 01:38:17 lessee.... 01:38:47 -rwxr-xr-x 1 root root 105252 2010-12-31 10:39 /toast/pkg/tinycc/v2365d90138f5/1/src/tinycc-2365d90138f5/i386-tinycc 01:38:52 105kb 01:39:05 gcc-4.2.4: no input files 01:39:08 oops 01:39:10 you really can't count like that 01:39:14 -rwxr-xr-x 1 root root 181300 2008-09-04 18:21 /usr/bin/gcc-4.2.4 01:39:23 +60k bigger 01:39:35 you really cannot count like that 01:39:45 but, tinycc is one file; gcc calls others, so I count it as bigger in that sense. 01:39:53 it's a trivial comparison. 01:39:54 again, you cannot count like that. 01:40:04 first, that is not the compiler proper. 01:40:13 ya 01:40:13 second, it does far more than tinycc will ever do 01:40:22 secondly, it contains code for other front ends 01:40:46 thirdly, gcc includes fp crappola 01:40:51 and a bareish c library 01:41:03 fp? 01:41:05 so, no, youc annot compare the two in that form without frobbing gcc into something similar 01:41:07 float? 01:41:07 floating point 01:41:09 ah 01:41:19 well you wont, but i can :) 01:41:28 then your comparison is useless 01:41:32 it's trivial 01:41:46 sighs, no it isn't. 01:41:51 yes it is 01:41:52 it is like comparing emacs to ed 01:41:56 lol 01:42:01 no no no, emacs v. vi 01:42:05 emacs is immensly easy to understand code wise 01:42:13 it's a friggen OS!!! 01:42:20 if you say so 01:42:22 heh 01:42:29 (FIGHT!!! FIGHT!!!) 01:42:47 again, i can show you that vi in emacs is smaller than vi 01:43:19 emacs v. zile!!! zile is ~100kb according to its propaganda 01:43:45 -rw-r--r-- 1 root root 48624 Dec 11 18:06 vi.elc 01:43:58 -rwxr-xr-x 3 root root 372740 Jan 28 2010 /usr/bin/nvi 01:44:07 but vim includes the kitchen sink 01:44:11 LOLOL!!! vi in emacs is only 50k while real vi is 400!! LOL 01:44:12 ;-) 01:44:15 its own sink 01:44:24 i didn't pick vim, since it isn't vi 01:44:29 emacs has the whole manufacturing plant for sinks 01:44:34 heh 01:44:45 anyway, my point is you can't make comparisons lin this manner 01:44:54 trivialities are allowed 01:45:25 ayy, package at the postal office 01:45:31 my laundry has arrived. 01:45:34 yay 01:45:37 go use soap 01:46:01 i just buy new clothes 01:46:02 :-) 01:46:08 you mail your laundry? GEEK!!! GEEK!!! 01:46:13 hah 01:46:17 go clean your blatties 01:49:16 SunTzu: no, i buy new clothes :-) 01:49:22 vi in emacs is like McCarthy's lisp writ in Lisp; meta-circular and without any scaffolding. 01:49:26 and get it with mail *G* 01:49:26 so pfft 01:49:32 ah 01:49:58 so 40k is is not an honest cmp either 01:50:00 heh 01:58:47 SunTzu: yes, that was my point :-) 01:59:18 but you did it; i can excuse myself only. heh 01:59:57 not really, was trying to show you how your argument is pintless regarding simplicity 02:00:48 right, it's quarted :) 02:01:23 i think we can call this trollenge a tie? 02:01:24 hah 02:03:13 i can put you on ignore if you call me a names again 02:03:32 calling you not sane is not calling you names 02:03:59 but i'm bnot a user of ad hom tactics 02:04:03 which you know 02:04:20 for me, trolling means mental abuse. 02:04:25 heh 02:05:31 call it an argument 02:05:38 trolling is trying to instill someone to do rash things 02:05:47 not for me 02:05:59 you mean like `rm -rf /*'? 02:06:13 i have never suggested that to anyone. 02:06:16 i'm a white hat 02:06:33 that's just cruel; not my way. 02:07:13 no, that is not what i meant. 02:07:28 k what then? 02:08:19 SunTzu: figure it out 02:09:58 well, that's what trolling is to me. 02:10:32 then you do not know what it means. 02:10:53 trolling is joining a mailing list about GNU and asking why GNU's leave turds. 02:10:54 i know what it means to me. 02:10:58 not for me 02:11:04 or joining an openbsd and bitching about how the modified BSD license sucks 02:11:08 lol 02:11:19 those are jut teases 02:11:28 no, that is trolling. 02:11:47 but it's not what i do 02:11:48 look it up in a dictionary 02:11:52 did i say that? 02:12:02 i think i explicitly said the opposite 02:12:08 you recuse to accept my meaning 02:12:11 oops refuse 02:12:18 and found it insulting that you are calling a sensible discsion for trolling 02:13:02 who found it? 02:13:16 jesus fucking crhist, are you stupid? 02:13:19 I FOUND IT INSULTING 02:13:32 10:48 i can put you on ignore if you call me a names again 02:13:38 ams, i'm enjoying this chat. why are you being so serious? lighten up alittle pls? 02:13:53 you called me names, i dislike being called names 02:13:54 simple. 02:14:10 now youa re wasting my time 02:14:16 why are you so emotional on this? no one is sane. we're ALL nuts! 02:14:31 11:00 /ignore SunTzu 02:14:35 i asked you to stop calling me names. 02:14:39 kbaithx 02:14:57 fine; go be offended. i cant stop you. 02:15:02 if you found the discssion enjoyable, then it should have been easy to stop calling me names. 02:15:21 you accepted offense, no one told you to do that. 02:15:41 you're too serious and lack a sense of humor. 02:15:45 lighten up! 02:58:09 --- join: maht (~m@87.84.137.37) joined #forth 03:26:01 --- join: ygrek (debian-tor@gateway/tor-sasl/ygrek) joined #forth 03:28:48 SunTzu: i removed you from ignore now. 04:26:38 --- quit: ygrek (Ping timeout: 246 seconds) 05:40:26 --- quit: gogonkt (Ping timeout: 248 seconds) 05:41:33 --- join: gogonkt (~gogonkt@2001:5c0:1000:b::905d) joined #forth 06:19:54 --- join: Monevii (~Monevii@67.224.254.57) joined #forth 06:56:06 --- quit: maht (Read error: Connection reset by peer) 07:38:14 --- quit: gogonkt (Ping timeout: 248 seconds) 07:38:55 --- join: gogonkt (~gogonkt@2001:5c0:1000:b::8fe7) joined #forth 07:55:36 ams well; that dint last long but i'm afk now. 08:13:30 --- join: ygrek (debian-tor@gateway/tor-sasl/ygrek) joined #forth 09:08:57 pick: pop edi; push dword [edi+esp]; jmp next. 09:09:05 is that correct? 09:29:18 --- join: qFox (~C00K13S@5356B263.cm-6-7c.dynamic.ziggo.nl) joined #forth 09:29:39 depends. 09:30:20 5. on? 09:30:27 -5 09:56:50 --- quit: gogonkt (Ping timeout: 248 seconds) 10:03:36 --- join: gogonkt (~gogonkt@2001:5c0:1000:b::8c15) joined #forth 10:42:40 --- quit: TreyB (Ping timeout: 248 seconds) 10:55:11 re: vi in emacs vs. real vi - to be fair about it you have to count the emacs executable plus vi.elc against the vi binary by itself 11:00:31 oh pls, i killed in that trollenge :) 11:00:33 lol 11:00:46 several-for-one attempt :) 11:00:56 (two birds, one stone type of thing) 11:00:57 hah 11:13:39 DocPlatypus: you, and SunTzu must really have missed something... 11:13:53 DocPlatypus: it was my point, emacs is much larger than just vi.elc 11:13:59 DocPlatypus: not to mention that elc is bytecode 11:14:13 DocPlatypus: which is why you can't compare the gcc executale to tinycc 11:14:16 ams: that's my point exactly 11:14:40 that was my point, you're stealing it... theif! 11:15:07 (now that is trolling) 11:17:41 just run vim in a shell buffer, like normal people. 11:18:06 normal people don't use vim 11:18:45 maybe in 20 years, vim will be usable like emacs or vi... 11:18:57 they are doing a great job reimplementing teco in vim.. 11:21:42 I like vim now that I know how to use it 11:22:01 I'm not 100% up to speed on all the fancy shortcuts 11:24:00 i get really irked off when people compare emacs to vi, when they actually mean vim... 11:25:29 vi (real thing) is very BSDish, (can't really say UNIXy since go figure what that means) 11:25:44 vim isn't in any shape or from following BSD practises 11:26:04 on BSD you don't need more than one level of undo 11:33:37 --- join: TreyB (~Adium@99.165.169.124) joined #forth 12:05:19 multiple levels of undo is an enhancement expected on modern computer software 12:05:34 and it has saved my ass more than once 12:06:05 DocPlatypus: i'm trolling there.. 12:06:37 yes multiple undo comes in really handy when doing things like, erm, editing a BSD disklabel 12:06:53 though in all honesty I'm more likely to make a backup copy 12:07:04 god i hate disklabel... 12:07:04 screw whatever undo history is in the editor 12:07:10 I used to hate it 12:07:11 stop making me angry 12:07:21 you know what I hate? 12:07:24 what? 12:07:34 me? 12:07:40 cause i'm a hot son of a bitch? 12:07:47 * ams flexses his abs. 12:07:48 there's no $&#**@% way to shrink a BSD filesystem without doing a dump and restore somewhere 12:08:10 haha 12:08:13 use LVM =) 12:08:16 to grow you can growfs all day 12:08:32 don't you have to have free space at the end of the table? 12:08:35 to shrink, BZZT, sorry, time's up, the answer is dump, newfs, restore 12:08:39 yes 12:08:48 another huge pain in the ass 12:09:01 always wondered why... 12:09:08 should be easy enough to "link" partitions .. 12:09:38 no much difference in having a super nodes and what not that point to over other file systems.. 12:09:51 and you'd get means to shrink things 12:10:12 well free space at the end of the filesystem 12:10:13 and really, shrinking shoulnd't be that hard if you can reorder single inodes a bit and "inode compress" things 12:10:15 err 12:10:22 yeah I've wanted to write a shrinkfs 12:11:21 I also want to write a version of zerofree for BSD filesystems 12:11:30 zerofree? 12:11:31 a program that overwrites all the free space with zero bytes 12:11:36 ah 12:12:09 right now I have to make do with "dd if=/dev/zero of=deleteme bs=1m" 12:12:17 wait for it to fill the filesystem 12:12:19 nod 12:12:25 then "rm deleteme" 12:12:39 (not thats secure but whatever) 12:14:58 probably not against the NSA/CIA 12:15:27 but it certainly makes data recovery against standard forensics much more difficult if not practically impossible 12:15:49 i use shred 12:16:18 ya 12:16:19 actually... 12:16:52 if you are using an SSD... I've heard that pretty much if you just delete the file, the firmware will take care of overwriting it 12:17:04 if you trust the firmware 12:17:05 without any additional commands from the computer 12:17:17 or maybe it will take care of sending all the data to the NSA. 12:17:46 I do prefer to explicitly wipe data on a regular basis 12:17:48 however 12:17:57 it's difficult to find time to shut everything down 12:18:01 and do it right 12:18:20 You guys must have much more interesting data than I do. 12:18:38 =) 12:18:44 i have quite interesting data. 12:19:40 nothing wikileaks like.. but could actually do quite serious harm to quite alot of companies 12:20:28 and it annoys the fuck out of me that you cannot encrypt openbsd's root file system. 12:20:55 ideally, i'd like to have a small memory card 12:21:07 with the OS on, and then it would mount the drive which is encrypted. 12:21:14 --- join: RikusW (~RikusW@41.157.70.10) joined #forth 12:21:32 the small memory card would be on me all time, and require a password to boot/decrypt the file system 12:22:06 like dunno, bsd.rd on the card or something... 12:22:21 that then loads shit 12:23:21 anyone know if that is even possible? 12:26:13 guess not... 12:27:04 or maybe a small forth.. 12:27:06 hihihihihihihi 12:27:12 that has encrypted blocks 12:27:22 :-) 12:28:13 then you could encrypt each block using a different key... 12:28:20 and put the key on the stack pop it, do the decryption.. 12:28:21 haha 12:28:23 god lord 12:28:30 might as well huffman encode everything like moore 12:45:14 --- join: impomatic (~chatzilla@81.3.gr6.adsl.brightview.com) joined #forth 12:56:15 --- nick: Snoopy_1711 -> Snoopy_1611 12:56:19 --- quit: ygrek (Ping timeout: 246 seconds) 13:23:13 --- quit: RikusW (Ping timeout: 264 seconds) 13:37:52 --- quit: impomatic (Quit: ChatZilla 0.9.86 [Firefox 3.5.17/20110121150729]) 13:39:24