The Nineteenth Byte

12:00 AM

@Bubbler interesting, is that (n%d)**i or n%(d**i)

of course n%(d**i)

change 99 to n if you want to use it on cgcc

but it won't quite work if you're using it for prime factorization, unless you ensure d goes over all primes and nothing else

DialFrost

@Bubbler 1. it didnt work, 2. its longer than orginial XD

my code is basically the same as this

Bubbler

yes I expected it to not work

because destroying n as part of the loop is important in prime factorization

Jo King

otherwise non-primes start sneaking in

DialFrost

12:25 AM

@Steffan SBCS?

Radvylf Programs

@forest ?

forest

@RadvylfPrograms Web Assembly.

Radvylf Programs

Yeah, the "?" is for the "screw" part. What's bad about Wasm?

forest

It's insecure as hell.

Also, privacy browsers don't enable it by default.

Radvylf Programs

It uses the same VM as JS

forest

12:33 AM

The security issues come from mainly side-channel attacks.

With regular JS, you can turn off JIT to greatly improve security.

Radvylf Programs

I mean there's nothong making that impossible for Wasm either

If it's not supported by browsers now, that's probably just since it's something very few people care about and it's not a very mature technology. It'll probably be there eventually.

Bubbler

@forest Didn't they handle that?

forest

@Bubbler That's only one of the many side-channel issues.

SharedArrayBuffer is absolutely one of the serious ones, but it's far from the only high-res timing source.

Bubbler

@forest What are the other timing source(s)?

forest

A tight JITted loop works.

At least, that's the most simple.

Bubbler

12:44 AM

How does that work in a single thread?

forest

It's a cross-thread side-channel.

The same thing can be done with regular x86 assembly.

DialFrost

@Steffan hint for the 2pi 1000 places challenge? :3

Bubbler

Well then it's not an issue specific to wasm I guess?

forest

Example of how it can be done:

3

A: Reducing resolution of timers as mitigation against Meltdown and Spectre

The reason it is only applied to browsers is because there is no way to fully eliminate high-resolution timing information from code being natively executed. For example, the RDTSC instruction provides precise, sub-nanosecond resolution timing information to any process. While it is possible to d...

This is not in JS of course, but it shows the general idea.

@Bubbler It's an issue with wasm because, unlike regular JS, you can't disable JIT to reduce the resolution.

DialFrost

I have the most strange welcome on dc

forest

12:49 AM

@Bubbler gruss.cc/files/fantastictimers.pdf for more

Bubbler

If you're worried about all this then how are you using the internet :/

forest

I work in infosec so it's my job to worry about it. :P

While it may not impact me, it can impact my clients, and others at risk.

Bubbler

Oh that makes some sense.

forest

And remember, attacks only get better, not worse. Nipping this in the bud now will reduce the damage of a hypothetical future attack building on these techniques that allows trivially obtaining secrets simply by visiting a website.

Which has happened before!

Radvylf Programs

1:16 AM

Seems like what really needs to be fixed should be at a much lower level than what scripting language some browser is running

forest

Agreed. We need to fix it in hardware, but that won't be possible for quite some time, so software stop-gap mitigations are needed. But it's not just side-channel attacks. It's much easier to do heap spraying (a technique to make a browser's memory layout more exploitable) with JITed JS or wasm than it is with anything else.

Radvylf Programs

yeah, but hating Wasm just because it makes performance improvements it should be perfectly fine to make, seems like it's a bit misplaced

Basic arithmetic and memory accesses shouldn't be capable of stealing secret information, full stop, the hate should be for the CPU and/or OS

forest

It's the performance improvements that can't be disabled that are the issue.

I don't mind a JIT engine for JS because I can turn it off without breaking websites.

Radvylf Programs

That's still not Wasm though, right?

You could still interpret Wasm traditionally, browsers just don't have an option for that yet

There's probably even extensions for that

forest

I suppose, although such a thing would just increase attack surface area even more.

I'm sure there's a way to make it work, but right now, such things are an afterthought to the developers.

Radvylf Programs

1:23 AM

@forest Wait how?

If it ran in the same VM as traditionally interpreted JS, which it probably would since why go through the extra work, I'd imagine it'd be pretty solid

It could probably even be transpiled to JS, killing both stones with one bird

forest

You mean with asm.js?

Looking it up, it doesn't seem like it uses any part of the JS engine.

Radvylf Programs

I guess, idk. Not referring to any specific libs/interpretations

I think Wasm as a platform for the web is a good thing and will probably be a net positive for security in the long run (wayyy less attack surface than a language as complex as JS)

forest

I mean, as long as browsers can still work fairly well without wasm, it'll be all good.

Radvylf Programs

Hating it because of poor quality implementations seems like the wrong approach

forest

I hate it because implementations are being rolled out too fast.

I have nothing against low-level bytecode. I love BPF! But even BPF took a long time to become popular, and even it is being accepted too quickly imo (for eBPF at least).

Oh huh, it looks like wasm does use JIT.

Radvylf Programs

1:32 AM

I guess that makes sense. I guess I just interpreted "screw WASM" as referring to the language itself rather than the circumstances it's being implemented in.

forest

Oh, no I have no qualms with the language itself. I'm not very familiar with textual wasm, but even if it was made by two and a half mentally-ill koala bears, it'd still be a better language than JS.

Radvylf Programs

In that case I agree with you. Wasm good, but rushing to have the best performance at the cost of subtle but potentially huge security flaws, definitely bad.

@forest I don't think anyone really uses text Wasm, it's more just the ability to use languages other than JS on the web without just transpiling to JS that's exciting

forest

Ah

Aiden Chow

2:14 AM

guys i just realized i have exactly 99^2 = 9801 rep

pretty cool

Radvylf Programs

Oh wow, you're close to 10k

I don't think I've ever even opened the 10k mod tools since I first got access to them :p

Aiden Chow

2:54 AM

@RadvylfPrograms yep, super close!

r the 10k mod tools really that boring

ok nvm im not at 9801 rep anymore

Radvylf Programs

Yeah:

(that screen has nothing you couldn't find in SEDE, they're pretty much all like that)

lyxal

@AidenChow interesting

Aiden Chow

@lyxal O_O yep, very interesting

Radvylf Programs

I wonder what the odds are of such a coincidence :p

Aiden Chow

suddenly getting a lot of upvotes, almost have a feeling like deja vu

:P

lyxal

3:00 AM

@AidenChow very interesting

I wonder who's doing that

Aiden Chow

yeah, super strange, i wonder who it can be

Radvylf Programs

Well I think I have the parser for RRS (my regexlike) done, minus the new ! syntax

lyxal

Hopefully this person is also upvoting other answers on the questions where yours got upvoted to bury the votes in a sea of many

Aiden Chow

@lyxal oh yep obviously, that sounds smart

not suspicious at all

Radvylf Programs

(and also because there're lots of good answers on those questions anyway, which otherwise may not have gotten attention)

Aiden Chow

3:04 AM

yea also true

Radvylf Programs

One issue with the new ! syntax is I was kinda relying on it as a good syntax for inverting \s/\d/\w and character classes

But now you'd need to do (!\w) or something, which is pretty annoying

lyxal

How's it being implemented?

Radvylf Programs

I could always keep the /S/\W/\D thing and change \N and \A, which are normal non-inverted escapes right now, but not really a fan of that

lyxal

Is RRS transliterated to normal regex or are you making a custom interpreter?

Radvylf Programs

@lyxal Since RRS will be TC, no NFA/DFA fun. Instead, I'll just iterate through character by character, creating a list of all possible states within the RRS program that the string could be at

so custom interpreter

E.g., for the program a?ab, if the first character is a there would now be two possible patterns left: ab or b

Bubbler

3:07 AM

> regexlike

> turing-complete

lyxal

@RadvylfPrograms And is there a restriction to just ascii?

Radvylf Programs

@Bubbler Not like modern regexes aren't pretty close anyway

Bubbler

well yeah :P

Radvylf Programs

@lyxal In the syntax? Yes, since it's for practical use. In the string matches? Also yes, since I'm too lazy to do Unicode support rn.

Bubbler

just found the combination of those words a bit funny

Radvylf Programs

3:09 AM

@RadvylfPrograms Well, technically it supports Unicode, but all of the built-in classes are ASCII-only (so \s doesn't include NBSPs, for example)

Bubbler

how about running on a raw byte sequence :P

Radvylf Programs

@RadvylfPrograms My goal with RRS (I forgot what it stood for) is to extend and modernize regular expression syntax, to make it much much more capable without weird hacks like \1 and \k

lyxal

@RadvylfPrograms that's a shame. Still, digraphs for things like !\w could work

Radvylf Programs

Ooh...\!w maybe?

Wait no, \! would be needed for escaping !s

Bubbler

@RadvylfPrograms Obviously RRS stands for ⎕R ⎕R ⎕S :P

Radvylf Programs

3:13 AM

Instead of the BUT NOT syntax, one option would be !{...}

So "match a string of word characters which isn't 'cat' or 'dog'" would be (cat|dog)!{\w+}

Not a huge fan of that tho

For inverted character classes I could always do something like \Nw

Where \N is a custom escape sequence that is followed by any other character class shorthand

It could even work for [] ones, but it'd be a little ugly

\N[0-7.], for example

I could do it regex-style and have [!0-7.] be how you do that

But I like having everything in character class literals (aside from -s) be itself

Bubbler

[^chars] exists

Radvylf Programs

Yeah but ^ never really made sense in that role to me

It doesn't really convey "anything but these", and it's already used somewhere else for something totally different in regex

Bubbler

true

Radvylf Programs

I think [!] might be my best option. It's not my favorite, but I think since ^ exists there's some precedent for that sort of thing

Bubbler

sounds reasonable

Radvylf Programs

3:20 AM

So that just leaves the \W gang. [!\w] or (!\w) both already work for that, \Nw would too, and I guess it's still an option to keep the "uppercase is inverted" thing even though it would mean renaming some things (e.g., \A is currently "uppercase alphabet", it'd probably need to be moved to \z or something)

I think I'll go with [!] and \N

Radvylf Programs

3:34 AM

LDQ: Is it reasonable for the alphabet to be \z instead of \a, so that \a can be ASCII bell (like in Python string literals)?