Aloraman · HackerTrans

il y a 7 ansdiscuss

Well, there is a difference. First, that certain argument (malformed certificate) was not randomly encountered, it was specifically constructed to trigger the vulnerability (Was reverse-engineering involved? I don't know). Second, this bug report not only discloses the fact that the vulnerability exists, but also provides a working example for any script-kiddie to use as an exploit. Third, the bug was not privately disclosed to software vendor, but was released to the public. From https://security.stackexchange.com/questions/22973/if-i-find... it seems that would be criminal in UK or Germany, no idea what could've happen in US. On one hand, you have First Amendment, on other hand, there is an EULA.

Aloraman

il y a 7 ansdiscuss

Yes, this is not simple description of a vulnerability, this is almost ready-to-use exploit. Ethics aside, what does it mean for Microsoft and ProjectZero from the legal standpoint? Does publishing of an active exploit make either ProjectZero or Microsoft criminally or civilly liable in some way?

Aloraman

il y a 9 ansdiscuss

I kinda guess this has something to do with System.__Canon type, which is a substitute type for open generic parameter type - there is no benefit in having different canon types per appdomain

Aloraman

il y a 9 ansdiscuss

Oh crap... yeah. I meant O(N^3) and O(6^M). If both are varied - O(N^M), if both are increasing with same order of magnitude, then complexity can be written as O(N^N) which is O(N! * e^N / sqrt(N))

Aloraman

il y a 9 ansdiscuss

This is CoreCLR, much younger version of CLR that does not support multiple AppDomains In different open-sourced CLR implementation aka SSCLI20 (aka Rotor) there are similar interactions for type's domain discovery and DynamicClassTable, but there are also some interactions about GCStatics. I'm not sure if fullblown .Net CLR implementation was released yet

Aloraman

il y a 9 ansdiscuss

Well, if you variate generic arity N, you are going to get N^3 which is exponential. If you variate nest level M, you are indeed going to get 6 ^ N which is 'just' polynomial. However, if you just look upon the code sample, in most case it is assumed that both N and M are variated, and if both of them are growing with same limiting behavior, then there is O(N^N) complexity. This complexity is even worse than factorial!

Aloraman

il y a 9 ansdiscuss

I've got three results (rover.ebay.*) from DuckDuckGo when I turned on region search. In every region, except "All Regions" and "United States". Yes, even in "United States (es)" there are 3 english results, but not in "United States"

Aloraman

il y a 9 ansdiscuss

You cannot forcibly hire someone who would prefer to work elsewhere (if that someone can really work elsewhere, e.g. not be worried with matters of survival and quality of life). This is probably a reason that in a lot of developing countries (e.g. India) gender gap in IT is much smaller than in developed ones (e.g. Norway, #1 gender equal country)- salary is choosen over comfort.

Now, imagine a situation: 100 persons (80 men, 20 women - ratio observed by actual HR) are looking for a job in Google, which has 10 open positions for them. Google wants to hire the best possible candidate - and hires 8 men and 2 women; both genders are choosed from top 10% of candidates of a same gender (Assuming their skill does not correlate with their gender). That hiring policy does not reduces observed gender gap between candidates at all. So let's introduce positive discrimination (so called affirmative action), and say, that Google wants to hire 5 men and 5 women (1:1 ratio, but even 7:3 will suffice to show worsening effect, albeit in weaker proportions). Now men are choosed from top 6.25%, and women - just from top 25%. The is no gender gap anymore, but now there is a considerable skill gap - top 6.25% men are having considerable advantage over 25% women. More to that: men are not happy because they think they have struggled much more for the same position than women; women are not happy because they think they were hired not for their skills, but for their gender. Also,both men and women being paid based on their performance alone will result if considerable wage gap.

The original memo stated the same, albeit in less transparent form: personal skills cannot be measured with 100% accuracy, so there is always a chance to hire underperforming person (false-positive) or not to hire well performing person (false-negative). Positive discrimination radically reduces false-negatives, which inevitabely magnifies number of false-positives (see Type I and Type II errors in statistics and Neyman-Pearson criterion). Author proposed not to fight on-enter gender gap with discrimination, which would result in negative effect for company's performance, but to make company's environment to be a more attractive (which may reduce on-enter gender gap, reduce number or women leaving industry permanently and won't compromise performance)

comments