"Let's suppose that down in the bowels of some particular version of some particular toolkit library, there lurks a bug. Let's suppose that the nature of this bug is something relatively obscure: say that it's something like, if you hold down 5 keys on the keyboard for 10 seconds then drag the middle mouse button, the text entry widget gets a SEGV. (In fact, I'm not making this up: I saw this very bug once, years ago.)
Now, that's the sort of bug that is not likely to be noticed or fixed, because it's the sort of thing that people "never" do. If that bug was reported against, say, a web browser, nobody would much care: User: "I can crash my web browser by doing this crazy thing!" Developer: "Uh, don't do that then." And that's not a totally unreasonable response.
However, in the context of security software, it matters, because then it's not merely a cute trick that crashes the program: now it's a backdoor password that unlocks the screen."
The strange thing is that it does work for me if I copy-paste the link (as opposed to ctrl-clicking it). There really shouldn't be much that's different between those two requests except for the referrer header.
From a personal email, jwz said I could quote: "Every time [Hacker News drops by] someone launches a DDoS. This time it's a SYN flood. Pretty much like clockwork." This looks like a response to that.
Appears to be one of those bizarre people who gets offended when people link to them. They were more common back when bandwidth was as precious as diamonds, and I see this article dates from that era. On the modern Web, I've never been sure if they don't quite understand what the internet is for, or what.
Anyone who actually gets angry when they're linked to (that image seems calculated to offend, not merely deflect bandwidth usage) has some kind of fundamental disconnect with how the internet is used on a day-to-day basis. It may be a social/emotional disconnect rather than a technical one, but it's still a disconnect.
I suppose I should acknowledge the possibility that he's just kind of a dick and likes trolling people for lulz. That's not really better, though.
It's his server. He gets to decide how it responds when people send it requests. If there's a disconnect, I think it's the people telling jwz how he needs to configure his server.
Sending drastically different content based on where your URL was clicked from, should indeed count as one definition of "not understanding how the hypertext web works." It's also something you're free to do, and the rest of the web is free to stop linking to you in response.
This sounds like a job for Erlang, not JWZ staring at C code until he's convinced it won't segfault. A small monitor process could do something reasonable when the big GUI codebase fails, and then everyone wins.
The design of X screen lockers makes that kind of difficult. Exclusive keyboard control is exclusive, meaning the secure locking process and the pretty crashing process aren't going to share very well.
Also from that article is a good advice in general:
Bugs like that will exist in GUI libraries; it's inevitable. The libraries are big, and do many different things. So one way to protect against that problem is to keep the number of libraries used by the xscreensaver daemon to an absolute minimum.
If you want to make less buggy software, you should aim to reduce complexity as much as possible, and not just hide that complexity with a library. The coordination of multiple processes as exampled therein is a good demonstration of how splitting functionality into multiple pieces may mean adding complexity overall because of the need to coordinate how the pieces interact.
My cat got my gf locked out of Gmail for 15 minutes once, since it was sitting on the F5 (refresh) key while the Gmail tab was open. Turns out Gmail thought there was a suspicious activity on the account and she got locked out for up to 24 hours.
Awesome. I find that simply lowering the screen when you get up works, except for when your cat is trying to express her affection to you or your screen while you're trying to get some work done.
Fun times... at one point I managed to render a computer unresponsive by dropping a notebook on the PrintScreen key. The key-repeat was pretty fast and so many gnome-screenshot windows popped up...
This reminds me of a bug I had to fix while working on the AIX version of a SCSI-failover driver (ATF) for Clariion disk arrays. It turned out that sometimes, telnet'ing in to a system with ATF active would hang the system. (FWIW, ssh would have had the same problem. That's just not what actually happened, and ssh on AIX wasn't much of a thing back in those days.) It turned out that the telnet daemon and an ATF daemon together were triggering a classic lock-inversion kind of deadlock in the AIX kernel's generic ioctl code. The details and the fix aren't all that relevant, but it was an important lesson in how these absolutely crazy-seeming kinds of interactions can and do occur in real systems. If your code even runs "alongside" some other code, they can interact in strange and unpleasant ways.
A long time ago back in the era of the Sega Genesis...
My siblings and I were playing Sonic 3D Blast. My brother was screwing around and put a blanket over his face and started to press totally random buttons on the Genesis controller saying "Tell me where to go! Tell me where to go!" and my sis and I were like "Stop screwing around."
All of the sudden the screen glitched out. The graphics were all screwed up, totally glitched out. We started exploring the level.
In this game you could go to either Tails or Knuckles to get to a bonus game. We were like "oh I wonder what the bonus would look like." We went to Knuckles and all of the sudden a level select screen came up.
Years and years later I looked it up on the web and apparently from what I remember the level select screen is some kind of error handler that gets triggered when the game is about to crash. People are on Youtube triggering it by tapping on the cartridge when the game is running.
Are there other games that crash with a congratulatory message and a level selector? It seems like such a beneficial way to handle unexpected situations that it should have been used more.
In my experience, this sort of unusual bug is a symptom of underlying design problems, often caused by chronically convoluted and over-layered architecture - there's no real reason why input events at a high rate should cause behaviour different from a lower rate. If a system can't process events as quickly as they come, then some of them should just get ignored.
It'd be interesting to see the cause of this bug, but more importantly how they decide to fix it.
41 comments
[ 0.17 ms ] story [ 86.6 ms ] thread"Let's suppose that down in the bowels of some particular version of some particular toolkit library, there lurks a bug. Let's suppose that the nature of this bug is something relatively obscure: say that it's something like, if you hold down 5 keys on the keyboard for 10 seconds then drag the middle mouse button, the text entry widget gets a SEGV. (In fact, I'm not making this up: I saw this very bug once, years ago.)
Now, that's the sort of bug that is not likely to be noticed or fixed, because it's the sort of thing that people "never" do. If that bug was reported against, say, a web browser, nobody would much care: User: "I can crash my web browser by doing this crazy thing!" Developer: "Uh, don't do that then." And that's not a totally unreasonable response.
However, in the context of security software, it matters, because then it's not merely a cute trick that crashes the program: now it's a backdoor password that unlocks the screen."
Edit: it works if I copy-paste the URL.
There must be something somewhat unusual about your browser or maybe something is mangling HTTP requests on their way to his server.
Does the link work as expected for you?
The strange thing is that it does work for me if I copy-paste the link (as opposed to ctrl-clicking it). There really shouldn't be much that's different between those two requests except for the referrer header.
> There really shouldn't be much that's different between those two requests except for the referrer header.
I don't know the details, but I gather that that's a big component of the anti-hotlinking system.
Wait. Does running Firefox in Incognito Mode not send along a referrer?
I suppose I should acknowledge the possibility that he's just kind of a dick and likes trolling people for lulz. That's not really better, though.
I don't understand why you think this contradicts anything I said.
Or perhaps that he's just kind of a troll and likes dicking people.
Bugs like that will exist in GUI libraries; it's inevitable. The libraries are big, and do many different things. So one way to protect against that problem is to keep the number of libraries used by the xscreensaver daemon to an absolute minimum.
If you want to make less buggy software, you should aim to reduce complexity as much as possible, and not just hide that complexity with a library. The coordination of multiple processes as exampled therein is a good demonstration of how splitting functionality into multiple pieces may mean adding complexity overall because of the need to coordinate how the pieces interact.
Possible solution: http://i.stack.imgur.com/i1A5X.jpg
However, that particular key combination ([Alt]+[SysRq]+[C]rash) works as designed. The old adage about security and physical access comes to mind.
My siblings and I were playing Sonic 3D Blast. My brother was screwing around and put a blanket over his face and started to press totally random buttons on the Genesis controller saying "Tell me where to go! Tell me where to go!" and my sis and I were like "Stop screwing around."
All of the sudden the screen glitched out. The graphics were all screwed up, totally glitched out. We started exploring the level.
In this game you could go to either Tails or Knuckles to get to a bonus game. We were like "oh I wonder what the bonus would look like." We went to Knuckles and all of the sudden a level select screen came up.
Years and years later I looked it up on the web and apparently from what I remember the level select screen is some kind of error handler that gets triggered when the game is about to crash. People are on Youtube triggering it by tapping on the cartridge when the game is running.
I wonder if a buffer overflowed or something.
Are there other games that crash with a congratulatory message and a level selector? It seems like such a beneficial way to handle unexpected situations that it should have been used more.
(Remember, we were kids)
It'd be interesting to see the cause of this bug, but more importantly how they decide to fix it.