Follow Slashdot stories on Twitter


Forgot your password?
DEAL: For $25 - Add A Second Phone Number To Your Smartphone for life! Use promo code SLASHDOT25. Also, Slashdot's Facebook page has a chat bot now. Message it for stories and more. Check out the new SourceForge HTML5 internet speed test! ×

Comment Re:Do these programs compile (Score 4, Informative) 48


In the winning entry there is no cast or "conversion" per se. It has one C file that calls a function and another C file that implements the function, with a mismatch between the types of the call and the implementation. Neither file by itself is performing any conversion or doing something wrong that can be caught by static analysis; the bug is caused by a mismatch between the code in two object files. This would only be caught by a tool that would examine the two files together, but it would not be caught by the compilation of either part.

We've actually seen a number of past entries that used this same basic trick to mismatch a call and an implementation. A previous winning entry managed to redefine the time() function as time_t time(void) instead of time_t time(time_t *ptr), avoiding a compiler warning by using the extern keyword. That's a neat trick because barely anyone uses the argument to time(), and after writing t=time(NULL) hundreds of times, it's easy to completely miss a call like t=time(). This caused a call to time() with the wrong number of arguments, so that another variable on the stack was used to hilarious effect.

Submission + - Winner of the 2015 Underhanded C Contest announced (

Xcott Craver writes: The Underhanded C contest results have now been announced. This time the contest challenge was to cause a false match in a nuclear inspection scenario, allowing a country to remove fissile material from a warhead without being noticed. The winner receives $1000 from the Nuclear Threat Initiative.

Submission + - The 2015 Underhanded C Contest has begun (

Xcott Craver writes: The 8th Underhanded C Contest is now underway. The goal of the Underhanded C Contest is to write C code that is as readable, clear, innocent and straightforward as possible, but which performs some malicious function that is not obvious from looking at the source code. This year's challenge is based on a real problem in joint development for nuclear treaty verification, and the prize is $1000.

Submission + - 2014 Underhanded C Contest Winners Announced

Rei writes: It's that time of year again — the results of the 2014 Underhanded C Contest have been announced. Techniques used for secretly alerting a user to a NSA request include (among others) misleadingly long loop execution, replacing user #defines with system ones, K&R style function declarations to avoid type checking, and using system #includes to covertly change structure packing. The winning entry exploits a system-provided function that is implemented as a poorly protected macro, tricking it into executing a piece of code given as an argument multiple times.

Comment BeOS used to do that with CDs (Score 1) 41

They added a feature to the filesystem that let you insert a music CD and see the tracks as WAV files, so you could rip the CD simply by dragging them to your desktop.

I remember that because I tried to play a CD by selecting all the tracks in the folder and double-clicking, only to hear the OS play all the CD tracks at the same time.

Comment Re:The previous entry page leads to 404 (Score 4, Funny) 41

That's not a defunct link to previous entries, but a defunct link to a previous version of the contest site. I've un-defuncteded it to more recent previous version of the contest site, but soon that will also be defunctitated or defunctified, or defunctored.

You can see the previous entries by scrolling down, or by selecting "past years" from the menu bar on the web page.

Submission + - The 7th Underhanded C Contest is Online (

Xcott Craver writes: The 7th Underhanded C Contest is now open. The goal of the contest is to write code that is as readable, clear, innocent and straightforward as possible, and yet somehow exhibits evil behavior that cannot be seen even when staring at the source code.

The winners from 2013 are also online, and their clever and insightful submissions make for fun reading.

Comment I used BeOS for audio analysis (Score 2) 226

I mostly used BeOS in grad school because I liked alternative operating systems, but several times I'd try to port my work to Windows or Windows NT and find myself astonished at how impossible my this stuff was to do on other computers at the time (late 1990s.) NT's architecture and event processing often prohibited the sort of real-time audio and video apps I was writing, and the API standing between me and the data was much more restrictive.

In retrospect, I think a number of my research successes were accidentally due to using an OS that would let me implement some really nutty ideas.

Comment Jesus, Java? Why not COBOL? (Score 1) 245

Java is an OK language, but it's kind of bureaucratic and boring. I can't think of a better way to suck all the magic out of a fantasy game than to have the spells written in Java---except maybe having the kids produce an ER diagram and a set of tables in Boyce-Codd normal form.

At the very least, they could do without the pointless punctuation. Does a spell really have to have semicolons and empty parentheses to denote that the spell is imperative?

Comment I think it's more fundamental than that: (Score 5, Insightful) 489

Baby boomers or not, the number of PhD graduates far exceeds the number of professors due to the simple logistics of teaching. Suppose you start a professorship at 30, and retire at 70. How many PhD students do you advise per year? Let's say 1.5 just to be on the low side. And suppose they each take 5 years to graduate. You just cranked out a dozen PhDs, and created one faculty opening by retiring. One should expect an advanced degree to increase one's job prospects, but it's numerically silly to expect, specifically, a faculty position. This is why every university hires people with degrees from an even better university---not because NIU frowns on NIU grads, but because the market for the teacher's job is so competitive that only the best CVs get in.

Comment This won't last (Score 1) 253

No matter how sophisticated the algorithm, the set of strings that get graded an A is bound to contain some weird and illegible elements. They probably won't be too hard to find by inspection of the algorithm and its training data. It will only take a few widely publicized examples of meaningless essays with a high auto-grade to cast doubts on this method of grading, no matter how effective it is in the common case.

Slashdot Top Deals

I've noticed several design suggestions in your code.