• 0 Posts
  • 23 Comments
Joined 3 years ago
cake
Cake day: July 2nd, 2023

help-circle
  • Back when I was in college I took a computer engineering class around 2010 I think with a professor who had done CPU design at one of the big chip manufacturers. He had a story about how no human knows how they work anymore because they’ll do the designs, then feed them through some optimization algorithm thing before the fabrication. Then when they would evaluate the chip they’d find that it was behaving in completely unexpected ways due to the optimization finding crazy efficient but unintuitive (to a human) ways of performing different operations.

    I wish I could remember the details of what he talked about better, but that was a long time ago.





  • There are a couple that come to mind.

    Definitely the worst, a C# .net mvc application with multiple controllers that were 10s of thousands of lines long. I ran sonarqube on this at one point and it reported over 70% code duplication.

    This code base actively ignored features in the framework that would have made things easier and instead opted to do things in ways that were both worse, and harder to do. For example, all SQL queries were done using antiquated methods that, as an added benefit, also made them all injectable.

    Reading the code itself was like looking at old school PHP, but c#. I know that statement probably doesn’t make sense, but neither did the code.

    Lastly, there was no auth on any of the endpoints. None. There was a login, but you could supply whatever data you wanted on any call and the system would just accept it.

    At the time I was running an internal penetration test team and this app was from a recent acquisition. After two weeks I had to tell my team to stop testing so we could just write up what we had already and schedule another test a couple months down the line.







  • It’s pretty hard to overstate just how many addresses are in the ipv6 address space vs ipv4.

    One of my favorite descriptions comes from Beej’s guide to network programming, something I first read probably in the early to mid 2000s. https://beej.us/guide/bgnet/html/#ip-addresses-versions-4-and-6

    3.1 IP Addresses, versions 4 and 6 In the good old days back when Ben Kenobi was still called Obi Wan Kenobi, there was a wonderful network routing system called The Internet Protocol Version 4, also called IPv4. It had addresses made up of four bytes (A.K.A. four “octets”), and was commonly written in “dots and numbers” form, like so: 192.0.2.111.

    You’ve probably seen it around.

    In fact, as of this writing, virtually every site on the Internet uses IPv4.

    Everyone, including Obi Wan, was happy. Things were great, until some naysayer by the name of Vint Cerf warned everyone that we were about to run out of IPv4 addresses!

    (Besides warning everyone of the Coming IPv4 Apocalypse Of Doom And Gloom, Vint Cerf14 is also well-known for being The Father Of The Internet. So I really am in no position to second-guess his judgment.)

    Run out of addresses? How could this be? I mean, there are like billions of IP addresses in a 32-bit IPv4 address. Do we really have billions of computers out there?

    Yes.

    Also, in the beginning, when there were only a few computers and everyone thought a billion was an impossibly large number, some big organizations were generously allocated millions of IP addresses for their own use. (Such as Xerox, MIT, Ford, HP, IBM, GE, AT&T, and some little company called Apple, to name a few.)

    In fact, if it weren’t for several stopgap measures, we would have run out a long time ago.

    But now we’re living in an era where we’re talking about every human having an IP address, every computer, every calculator, every phone, every parking meter, and (why not) every puppy dog, as well.

    And so, IPv6 was born. Since Vint Cerf is probably immortal (even if his physical form should pass on, heaven forbid, he is probably already existing as some kind of hyper-intelligent ELIZA15 program out in the depths of the Internet2), no one wants to have to hear him say again “I told you so” if we don’t have enough addresses in the next version of the Internet Protocol.

    What does this suggest to you?

    That we need a lot more addresses. That we need not just twice as many addresses, not a billion times as many, not a thousand trillion times as many, but 79 MILLION BILLION TRILLION times as many possible addresses! That’ll show ’em!

    You’re saying, “Beej, is that true? I have every reason to disbelieve large numbers.” Well, the difference between 32 bits and 128 bits might not sound like a lot; it’s only 96 more bits, right? But remember, we’re talking powers here: 32 bits represents some 4 billion numbers (232), while 128 bits represents about 340 trillion trillion trillion numbers (for real, 2128). That’s like a million IPv4 Internets for every single star in the Universe.