I saw this problem recently at work, with a Go program running on Kubernetes. You can work around it by setting GOMAXPROCS to the same value as cpu limit in the container spec.
(So be careful not to assume this problem is specific to Java, the JVM, Mesos, or Twitter's environment)
It's clear what the incentive is for Taylor (the ice cream machine maker), but I wonder what the incentive is for McDonalds.
There must be some cash-flow from Taylor to McDonalds, but something as simple as "pay McDonalds $X million to specify Taylor machines in their franchise contracts" seems like a kickback.
Maybe the key is that the video shows that this particular machine is "by Taylor and McDonalds" (the McDonalds logo is on the instruction manuals). Perhaps McDonalds therefore get royalties or something similar.
The dataflow analysis libraries in QL have significantly improved since 2015, and were used to find the ICMP vulnerability mentioned in the article. See the blog post for the query used. [1]
Dataflow analysis is a form of execution simulation that estimates the flow of control and data from one part of the program to another. Of course, there are many forms of simulation, and they vary in accuracy and the expense of computing them.
That's the interesting thing about the approach used to find this bug (automatic variant analysis): whilst there are no doubt more bugs to find in XNU, there aren't any more bugs like this.
The article says that the problem was found by codifying the mistake that led to a previous CVE as a query in a logic language called QL, and then running that query over XNU, so if there were any more they would have been found at the same time.
Semmle | Research/Software/Security Engineer | Oxford, UK | Onsite, Full-time
Semmle helps some of the biggest software and financial companies, such as Microsoft, Google, and Credit Suisse, develop more secure software, faster.
If you'd like to get a taste of our technology go to https://lgtm.com where we analyse over 70,000 of the most popular open source projects, or check out the vulnerabilities we've recently reported at https://lgtm.com/blog
We are looking for great engineers work on a mix of problems ranging from compiler work and program analysis to vulnerability finding to building solid 1000-node distributed systems.
Remove it at any time, no. The chip on the card is cryptographically signing the transaction, which includes the total. It can't sign it until the total is known.
In practice, I suspect the equipment is designed not to allow you to insert the card early so that you check the total first.
The 'unlock' operation, at least on most central locking systems I've used, is the perfect example of an idempotent unary operation.
It doesn't matter how many times you apply the 'unlock' operation, it has the same effect as applying it once[1]. However, the 'unlock' operation is not safe[2].
"If you ever want to git-bisect your code-base to track down when you introduced a bug then you'll be very thankful that every commit is functional and passes your test-suite"
I agree that this property is very useful, but I disagree that it it is necessarily implied by the workflow as described in the article. By using "git add -p", he is constructing a tree that probably never actually existed during development - hence there is no guarantee that it works and passes the tests.
I strongly agree with you that a clean logical progression of commits is a good thing (especially for code review). However, making sure that each stage works and passes the tests takes extra discipline.
"this difference is largely due to the differences in the size of the respective populations. The panel report notes that the U.S. has a population about five times the size of the UK, but there have been fewer than twice the number of people extradited to the U.S. than to the UK."
What? That seems extremely nonsensical to me.
Wouldn't one reasonably expect the number of extradition requests to a country to be proportional to the number of people in that country, not the number of people in the country doing the extraditing?
Back in the days of the BBC Micro, computing in schools involved some programming.
After that (probably in the early nineties), the subject split into two: Computer Science and IT. Then with the rise of the internet IT was renamed CIT (Communications and Information Techologies) and finally reordered to ICT. Computer Science was also renamed Computing at some stage.
ICT involves no or extremely minimal programming. Computing does, but it has proved the less popular option and died out in the majority of schools - partly due to an uninspiring syllabus and lack of teachers.
Those problem-set hours total almost a whole other working week laid on top of the other academic tasks of attending lectures and reading notes. In college as in grade school, where is the time for deliberate practice?
I can't help but think that this is a case of not seeing the wood for the trees. In a good university problem-sets obey most of the requirements of deliberate practice: they are designed, there is repetition, they are mentally demanding, and they gradually get harder so that you are working at the edge of your abilities.
The remaining requirements of deliberate practice are to do with meta-cognition - i.e. thinking about what you are doing - and that is down to you.
It reminds me of stories my mum (who's a teacher) tells about pupils complaining that they had no time for revision because of the practice exams she set. I mean, what do they think revision is?
I'm guessing that: a "document" on Twitter is a single tweet;
a "document" on Facebook is a wall-post or equivalent;
a "document" on GMail is an e-mail;
a "document" on Google Calendar is an appointment.
Therefore, the comparison with Google’s web-wide index in 2001 is a little misleading (in terms of the amount of data), given that the average size of a web-page is greater than all of these.
Of course average size of a file on Dropbox is likely to be larger than a webpage. I wonder what percentage of those 1.5 billion documents are files on Dropbox.
Given the growth reported recently, it's not that surprising that Android is now more popular than iOS, but what a ridiculous headline: Android is an OS not _a smartphone_, let alone the "most desired smartphone in the U.S."
What is the most popular Android smartphone? How many units has it sold in comparison to the iPhone? Is it a mid-range or a high-end phone? Now those are interesting questions.
Indeed: to reward quality over quantity you'd need to use a function such as x^2, or probably x^2/C for some constant C.
Interestingly, Oxford University used to mark final exams for Mathematics and associated schools (such as Computer Science) in this way. Questions would typically start with parts that were largely "book work" and move on to parts that required more careful thought. In addition, you could answer as many questions as you like. Therefore, to avoid people getting lots of marks by just answering all the book work, the papers were scored by squaring the scores for each question and then summing those squares.
That is: overall_score = sum(q in Questions | score(q)^2)
This practice stopped in ~2003 (now you can still answer as many as you like, but the mark for the paper is the sum of your top 3 marks for individual questions, so it's only really worth answering 3 as well as you can).
> This means you can only make online purchases easily and securely at home.
Fair point - I had this problem when wanting to use Internet banking at work, but these pin readers are compact (smaller than an iPhone, marginally thicker) so I just keep mine in my bag now.
> This doesn't solve the problem (which people may not care about) that the merchant could now have your pin.
Only if the reader itself is compromised (very unlikely with the small ones provided by banks for online banking, and pretty unlikely in a shop too). However, note that the PIN is useless without the card, because the crypto chip is on the card, and it can't be cloned by a reader.
> This seems like a huge burden. Physically typing in long cryptographic codes?
They are only 8 digits long. And yes, I don't want fraudulent use of my account so I don't mind.
A very similar system is already in use in the UK and other parts of Europe. It's called "chip & pin". You plug your card in to a card reader and check the LCD display and type in your PIN to authorise a transaction.
In a shop, the card reader is owned by the shop and is similar to point-of-sale card readers used in the USA. However, most banks now provide customers with a small reader (that looks like a calculator) for logging on to online banking, or authorising payments made via internet banking.
For example, to authorise a payment you: put your card into the reader, type in the account number you want to pay, type in the amount, and type in your pin. You then get an cryptographic authorisation code to type into online banking.
Crucially, the scheme works using cryptography, and the cryptography is performed within the chip on the bank card - it is not possible to read the PIN off the card.
(edit: and, in contrast to the scheme described in the parent post, stealing a card doesn't help much if you don't know the PIN, and the card will disable itself if the wrong PIN is used too many times)
(So be careful not to assume this problem is specific to Java, the JVM, Mesos, or Twitter's environment)