VBA Rubberducking

2:00 PM

@Hosch250 but the point is that in order for that to have been a problem, it had to allow arbitrary code execution from remote source in the first place. Why not simply disallow it OOB?

Mathieu Guindon

because help desks need VNC?

Comintern

@Hosch250 In Linux, I get a prominent update notification that there is a critical security patch. I need to be able to install those updates. Nobody else. When an automatic Windows update breaks my system, that is no different than any other malware.

this

@MathieuGuindon then make user's consent mandatory.

Mathieu Guindon

@Comintern and the Linux user will install them.. Windows users, not so sure.

should be opt-in anyway

this

@MathieuGuindon Probably because they're conditioned that an update will break their software.

Mathieu Guindon

2:04 PM

> Allow Windows to hijack this machine and update whenever the F it likes and reboot when you're in the middle of something? Y/N

Comintern

I want a single checkbox in the Windows installer that says "I am an IT professional and am capable of maintaining my system".

Mathieu Guindon

lol

this

@MathieuGuindon N => Ha ha, we were only kidding. Of course we are going to do whatever. Rebooting now

Mathieu Guindon

> That's good feedback, thank you.

Hosch250

@this No, not "from remote source".

ThunderFrame

2:07 PM

@this most people will click yes until the problem they're trying to solve is fixed. Facebook exploited the consent mechanisms. Alerts and opt-outs are likely to be ignored by most users

Hosch250

@MathieuGuindon Windows users don't even know how to close Excel, much less Vim...

this

@Hosch250 then from where? It must have had some access somehow.

Hosch250

@this From the local machine.

Malware was a thing before the internet.

this

@Hosch250 again that implies I allowed it to be downloaded or placed it there.

Hosch250

@this No it doesn't.

this

2:08 PM

@Hosch250 You're eating your cake and having it.

Hosch250

It implied something else put it there--like your malicious coworker, or the network.

this

@Hosch250 because I granted them access.

Don't grant access, no go. Simple as that.

Hosch250

@this Actually no, because they sat in the cubicle next to you and you were in the rest room.

this

Then I get what I deserve. In some places like banks, the rule is that they must lock the workstation before leaving.

ThunderFrame

@Hosch250 or you plugged in a malicious USB cable. It wasn't a USB drive, you thought, so how can it hurt me, but there was a microchip embedded in the connector.

Mathieu Guindon

2:10 PM

if you want a safe computer, buy a brick

ThunderFrame

@MathieuGuindon If you want a brick, buy my daughter's Lenovo

Mathieu Guindon

lol

ThunderFrame

worst piece of IT equipment I've ever experienced. And corporate types rave about them - I just don't get it. Even the Ctrl key isn't in the right place - that alone is enough to make me avoid them.

this

@ThunderFrame perhaps the "corporate types" are PHBs?

In which case, it's the best thing you can get them.

ThunderFrame

PHB? Philosopher?

this

2:14 PM

dilbert.com/strip/1995-04-03

2

Pointy-haired boss

Mathieu Guindon

bwahaha

ThunderFrame

I always find it sobering when I witness the lack of IT understanding of the average office worker/graduate, let alone the average person.

Mathieu Guindon

@ThunderFrame and this is why Windows updates, and why we can't have nice things :)

ThunderFrame

@MathieuGuindon that

Comintern

The auto industry mostly got it right. I have airbags, seat belts (opt-in BTW), and other safety features, but my car has yet to come to a screeching halt on its own because I didn't fill the windshield washer tank.

Mathieu Guindon

2:20 PM

careful what you wish for. soon it'll come to a screeching halt on its own because a frog is crossing the street

ThunderFrame

@Comintern that's yet to come

Comintern

This is why I don't drive a Tesla. (that and the fact that I'd be bankrupt afterwards)

this

@MathieuGuindon ironically, better that everyone's in a driverless car than driving themselves. At least here, they are awful drivers.

yakking on cell, drinking starbuck, screaming at the kids behind, riding the shoulder, and cursing at the jerk who cut them off (and the jerk is doing exactly the same things)

Nope, not safe.

ThunderFrame

@Comintern they did throw in some airbags to save your life, but they also included some shrapnel and arranged for it to target you head, in the event of usage. You didn't ask for that feature, but sometimes the bonuses are a nice surprise

Comintern

That reminds me - I need to check my recall status. LOL

Hosch250

2:24 PM

@this Yeah, until the car goes "Ooops, got an update" while driving on the freeway.

Comintern

...and that reminds me that I need to get the transmission software updated.

this

@Hosch250 Ha! At least it's not same thing as a general purpose OS, so it will have much less issues and more incentives from outside to get it right, so they don't get blamed for having assembled 100,000 metal murderers.

Comintern

@this LOL - I'll try to remember that when the Cyberdyne Motors dealership opens in my city.

Hosch250

@this "much less issues". You are setting records for the funniest thing I've heard all year.

General purpose OSes are as secure as you will get. Because billions of consumer dollars are at stake with general purpose attacks.

They've been under attack for decades.

this

@Comintern it's all right. They made a little boo-hoo the first time but came through with Arnie who indirectly saves the humanity, so it all evens out.

@Hosch250 I'm glad to hear that I'm funny. :)

@Hosch250 That's a non sequitur, though. The point still remains that it's vulnerable because it runs code from untrusted source. A device that runs without any internet connection or remote access is much more secure simply because there's no access.

Hosch250

2:37 PM

@this Are you F**** kidding me?

First of all, auto-driving cars DO have internet access.

this

@Hosch250 Big mistake.

Hosch250

Heck, most non-auto-driving cars have internet access now.

this

The point being, if you want to have a secured device, especially one that's going to be responsible for human lives, you better not connect it to internet.

Hosch250

The whole concept of auto-driving cars is that they share information with each other and a centralized DB.

this

@Hosch250 That's news. Last time I read, it was them working independently, watching the road.

Hosch250

2:40 PM

Second, let me know when random Joe slips a USB cable in there in the parking lot and connects to it to install something. Only evidence is a broken window, or maybe your door was unlocked or your window cracked....

@this Nope.

Also, look up the Fiat recall from a few years back. Someone hijacked the whole car, from brakes to gas to ignition to seatbelt. And found all other Fiat's on the road to by figuring out its network system.

The only safe car is one from the 90s or so or older.

Probably early 2000s too, but at this point, those are mostly junk.

(Of course, that kind of safe doesn't mean safe in accidents :P)

this

@Hosch250 While that is always a possibility, that's pretty small in comparison to hijacking a whole network of cars. If you want to avoid that, then you have to not allow access to the critical components, ever. You can't plug in all possible holes but you can disable the access entirely.

You cannot hack an unreachable system, right?

Hosch250

@this I just said, there's a broken window. Maybe they steal a trifle just to make it look like a theft rather than an attack.

There are far too many possibilities for me to be comfortable with this.

Heck, this would be totally awesome for kidnapping adults. Lock the doors, disable the locks, drive away.

When the cops come, get into a high-speed chase.

this

@Hosch250 if that's the only way to hack a car, then that's better than being able to hack a car by logging into a terminal 1000 miles away, right?

Of course it's not as good as one that has no computer to hack at all. :)

Vogel612

2:57 PM

bah. and how do you patch bugs in the software of the car then?

the issue is not that cars shouldn't be connected at all, the issue is that currently the incentives for securing access to cars is skewed and that even with cars, physical access is a one-hit KO for any and all security measures in place

Hosch250

FWIW, my car has far more physical access by strangers than my laptop.

I park outside both at home and at work.

this

@Vogel612 the same way you patch firmware for non-internet-connected devices; usb cables or usb drive. That requires physical access. The hard part is ensuring that you don't connect directly to a computer that might itself be compromised.

@Hosch250 True. If it's going to be a thing, people would have to be "trained" to suspect compromise of the software in event of a break-in.

Duga

3:12 PM

[rubberduck-vba/Rubberduck] bclothier created comment on issue #4085: AutoComplete - Exit Function bug

> Reopening the issue because I don't think it is fixed even in latest `next`...

Given this line:

```
Dim prop As DAO.Property|
```

Typing `enter` yields:

```
Dim prop As DAO.Property
|
End Property
```

[rubberduck-vba/Rubberduck] bclothier reopened issue #4085: AutoComplete - Exit Function bug

Comintern

@this An unreachable car does me no good what-so-ever.

Hosch250

3:43 PM

@this They don't even suspect compromise in the event of a breakin on their PC. What makes you think they well for a car?

They'll be "well, it starts, so I guess it is OK."...

Comintern

I always lock my PC out of habit, but for some reason I can never remember to shut my sunroof...

ThunderFrame

@Comintern if the Immediate Window has unrestricted access to private variables and members, and it also has its own project, and thereby a TypeLib and a GUID, I wonder whether it's possible to add a reference to the Immediate Window project using References.AddFromGuid, and then any VBA project can automate the unrestricted access, and perhaps other Immediate Windows goodies?

this

@ThunderFrame IIRC, VBA projects don't get a GUID. They're all Guid.Empty

ThunderFrame

3:58 PM

@this hmm, maybe it isn't exposed via the TypeLib, but I remember seeing a GUID in the binary offsets from the TV_ITEM lParams.

Comintern

@ThunderFrame O_O

FreeMan

@ThunderFrame 0_0 O_O !!

ThunderFrame

@this but then, it could have been any old GUID, and not necessarily a "Project" GUID

@FreeMan o_O 0-()!l|1 - hows' that fot a font fail?

Comintern

I really need to fire up the Immediate Window typelib and see if I can abuse it.

2

If it has an event source, you might hear me cheering when I find it...

FreeMan

@ThunderFrame indeed! ?

@Comintern You can abuse, but isn't it @ThunderFrame's job to weaponize?

ThunderFrame

4:07 PM

@Inarion by the way, the Source Code Pro font has a dotted 0, which I've always found a little irksome, but I just found a fork of Source Code Pro called Office Code Pro that uses a Slashed 0. I'm yet to install it, but it might become my new favorite.

Comintern

@FreeMan @ThunderFrame excels at weaponizing the VBA syntax.

2

FreeMan

Indeed!

Comintern

I particularly enjoy the ones where it breaks the VBE's syntax highlighter.

ThunderFrame

@FreeMan I hold no illusions of exclusivity on dangerous ideas. @Comintern comes up with some pretty spirited efforts.

@Comintern minor syntax highlighter bug, but On Error Goto -1 highlights the - as a keyword, but not the 1

Comintern

@ThunderFrame Does that function correctly with a negative line number?

ThunderFrame

4:11 PM

-1 is a feature

-1 is not a line number unless you enter it as hex

Sep 20 '16 at 0:05, by ThunderFrame

19

Q: Difference between 'on error goto 0' and 'on error goto -1' -- VBA

Can anyone find the difference between 'On error goto -1' and 'on error goto 0' in VBA? I've tried google and msdn, but I've had no luck.

spinjector

Bonjour/Good afternoon. So I thought I was losing my marbles lately, which is odd since I thought I had none left. But today I finally realized it's RD that's losing my breakpoints (F9) when I use Refactor to change variable names. Is there a way to prevent this?

Comintern

@ThunderFrame That's what I was referring to, but this doesn't work (unhandled error):

Sub Foo()
-1
    Debug.Print Erl
    If Erl = -1 Then
        Exit Sub
    End If
    On Error GoTo -1
    Debug.Print 1 / 0
End Sub

This one overflows Erl:

Sub Foo()
-1
    On Error Resume Next
    Debug.Print 1 / 0
    Debug.Print Erl '65535
End Sub

Hosch250

@spinjector Oooh, that's gonna be a #fun one.

spinjector

hehe

Comintern

#workingOnIt

#slowly

spinjector

4:21 PM

I haven't looked into the VBIDE about this topic yet to see if "breakpointed" lines are listed somewhere. If so, RD could remember them, and then "re-F9" them after refactoring. I'd happily take a stab at this myself, but I have yet to create the Visual Studio setup needed to start pulling and hacking. I code all day long and when I get home my brain hurts and I just want to eat, drink, and be merry, lol.

Mathieu Guindon

thing is, nothing in the VBIDE API lets us "re-F9"

or know whether there's a breakpoint anywhere for that matter

Comintern

...that we know of...

2

spinjector

Boo.

Mathieu Guindon

mind you, nothing in the VBIDE API was giving us an abstract syntax tree either..

Comintern

Hell, the VBIDE can't even tell you it's window handles.

spinjector

4:24 PM

Hrrmmm...what about API calls to the code window and read the text and color..? Maybe it's RTF or something..?

Yea its funny when you get into the the code module objects, and it's all just raw text and referred to by line numbers. One would think it would be a bit more complex than that.

Comintern

Problem with that is that the control for code panes is completely custom drawn. Check it out in spy++ sometime - there is simply nothing in the client area of the window.

spinjector

Blergh. It would figure.

Mathieu Guindon

"So we're going to give you an API to make add-ins for our wonderful IDE"

"Oh but you won't have any handle on anything remotely useful for anything"

that said, losing breakpoints is one thing - we're also losing member attributes for the same reason (i.e. because we rewrite the whole module at once), and that has me more worried - because it can turn working code into broken code

Comintern

RD 4 should offer an extended API. Something like "Rubberduck Visual Basic for Applications Extensibility Objects"

Mathieu Guindon

AUE API

"Actually Useful Extensibility API"

Comintern

4:29 PM

Or even better, "Rubberduck Visual Basic for Applications Sensibility Objects".

Hosch250

I wonder if anyone's ever done an *** OLE pun.

Mathieu Guindon

lol

spinjector

haha i like that one =-D

ThunderFrame

4:42 PM

@MathieuGuindon we could collect the bookmarks, by executing NextBookmark enough times that we iterate them all, and remember each line location, but that's intrusive for a large number of bookmarks. There's no equivalent for iterating breakpoints, but given the weird breaking on non-existent breakpoints behavior, it makes me wonder whether breakpoints become part of the p-code somehow. In which case, we might eventually be able to identify them.

Mathieu Guindon

idea: replace all breakpoints with Debug.Assert False

and now we know where they are!

</badidea>

ThunderFrame

Lol

@MathieuGuindon breakpoints != breakage points

Mathieu Guindon

#If IsDebugging Then
    Debug.Assert False
#End If

Transcript for