2,160 reputation
2616
bio website github.com/CodesInChaos
location Frankfurt, Germany
age
visits member for 3 years, 4 months
seen 15 hours ago

May
11
comment idquantique .vs. rdrand
While the Intel PRNG has no software part, RdRand is a PRNG seeded by a TRNG. Only RdSeed is a TRNG.
May
11
awarded  Revival
May
11
revised idquantique .vs. rdrand
added 158 characters in body
May
11
answered idquantique .vs. rdrand
May
11
comment idquantique .vs. rdrand
@RobertHarvey Statistical analysis can only discover the most blatant flaws in a PRNG. There are plenty of flawed PRNGs that no statistical test will find.
May
11
comment idquantique .vs. rdrand
If you take a proper PRNG and seed it with about 256 bits of hardware entropy it'll produce unlimited amounts of pseudo-random data that's completely indistinguishable from real data by any known process.
May
11
comment MachineKey.Protect VS RijndaelManaged
On problem with RijndaelManaged (and the rest of the System.Cryptography classes) is that it's hard to use them correctly. Most users don't handle IVs correctly or miss adding a proper MAC making them vulnerable to padding oracle based attacks.
May
6
comment Web hosting deciding to pay for hosting or host your own?
Concerning the last paragraphy, there is colocation.
Apr
29
comment How did they debug segmentation faults before protected memory?
Even now many pointer mistakes don't cause a nice segfault.
Apr
28
comment Can an 81 digit number generator lead to copyright infringement?
Reusing existing collections might be problematic. A random puzzle matching some existing puzzle is certainly no problem.
Apr
25
comment How to reject a code review that you believe is unnecessary?
Just because you can't write a test doesn't mean it's not broken. Undefined behaviour which usually happens to work as expected (C and C++ are full of that), race conditions, potential reordering due to a weak memory model...
Apr
25
comment How to reject a code review that you believe is unnecessary?
C and C++ are full of things that appear to work but are actually undefined behaviour. UB is a real defect, even if you can't write a test that shows it doesn't work as it should. For example many compilers use UB as an optimization opportunity, by assuming that the case that's undefined never happens. For example if you used size > size+1 to check for overflow on a signed integer, the compiler may simply replace this expression with false, since overflow of signed integers is undefined. See blog.llvm.org/2011/05/…
Apr
7
comment NDIS Driver Filter VS API Hooking
That depends on context, and you didn't describe the context of your application. I'd prefer API hooking when I want to affect a single specific application, and a driver if I want to affect the whole system. But other considerations might apply.
Apr
7
comment How important is it to reduce the number of lines in code?
@Alnitak Since the expressions have no side effects the code is equivalent. The compiler may omit evaluation if it can guarantee that that change has no observable effect. I expect that modern c compilers can optimize out such a difference, not sure about the JVM.
Mar
29
comment Why can't a compiler avoid importing a header file twice by its own?
On the MS compiler there is #pragma once which tells the compiler to only include that file once.
Mar
28
comment How to find siblings of a tree?
@CoffeeAddict I did not say it is trivial. I explicitly said it is not, and I allowed for minor mistakes. But I think finding the main algorithm isn't very hard. Testing the code and ensuring that all corner cases work takes more than 5 mins, but writing the basic code down should be quite quick.
Mar
24
comment Test case design - do for all positive tests exist also negative ones?
There are two cases here 1) When you enter a number, no message is displayed 2) If you enter a non-number it displays an error. You should write a test case for both of these. It doesn't matter which of these you label "positive" or "negative", just that you test both of them.
Mar
23
comment Why does Cem Kaner consider a test not revealing a bug a waste of time?
IMO a caught regression counts as a caught bug. It's just not a bug that was present at the time the test was written.
Mar
22
comment Bridging the Gap from Amateur to Hirable
Write some small projects. It doesn't matter if they're noteworthy. I have produces a huge pile of small programs nobody is or will ever be interested in. Most of them even abandoned before completion.
Mar
22
comment Configuration file that can be modified by user in C#
One important question is where you want to store this file. Since you're talking about a service, you probably don't want unprivileged users to be able to change the file, else you get the risk of a privilege escalation vulnerability.