Manuals are great if you know the API you want to call and need to know the details. They aren't good if you don't know the API, or even if one exists. Or if the problem you're debugging is more complex than just "passed the wrong parameter to this function".
Build what, exactly??
If we build it, then it will frictionlessly tell us what to build.
The PHP interpreter being exploited was written in C and C++.
And? As I said, the problem is not the language, C / C++, the problem is who wrote it: humans. If the C code is well written, the compiler makes a safe binary code.
This reminds me of a segment I saw about 15 or 20 years ago on a show called "How It's Made" that played on a channel like the Discovery Channel (before all cable became reality TV).
The segment was "How CRTs are Made". I was kind of surprised that CRTs were still being made, but I was especially surprised by the fact that they appeared to be American workers in the factory. They were doing everything pretty much by hand with no automation, and they were making some rather skinny looking CRTs. The show never elaborated on what the CRTs were for, but they sure didn't look like TVs.
I dug into it a bit after that using some clues I noticed in the show, and found out that these were cockpit displays for F15s or similar military aircraft. It's probably an item that you just don't go changing the specs on, and they understandably aren't going to farm out to TCL. I can't imagine how much each one cost, though. And I certainly wouldn't try to rack it up as a "win" for any of GWB's or Obama's trade policies.
It took that long to detect that it was successfully used.
It took that long just to find proof that the vulnerability had been successfully exploited. How many other systems had already been compromised before this one? We'll probably never know. (fixed that for me)
Systemd Rust components come out slightly larger than C with a test program being 32KB compared to 20KB for its C twin
Who's going to be able to scrounge up an extra 12KB of RAM in today's market?
It looks like if you can't beat 'em, join 'em.
Yeah, that activity was authorized. You're using "unauthorized" as if it means "unwelcome" I think, which puts you in confused banker territory.
You keep using that word in the narrow terms of a computer programmer who just finished a training course where they drilled in the technical meanings of "authorization" vs "authentication".
However, a news article for the general public is not constrained by that context. The dictionary says that "authorization" in general is permission to do something. If you prompt an AI to do one thing with your bank account, then you didn't give it permission to do something else entirely, even if it got the logon credentials to do so. It wasn't authorized by you to do the other thing.
Here's another example: It's wartime and you got drafted. Usually you're not allowed to kill people, but the government handed you a gun and you're now authorized to kill enemy soldiers. That doesn't mean that you can just shoot your comrade next to you in the trench. And you certainly can't make the claim "But I was authorized to shoot Corporal Smith. You gave me a gun, after all!"
If they're "operating inside" user's accounts, they're authorized. Does someone need to explain to banks what authorized means?
Consider a human analogy: In many cases, people give financial advisors access to one or more of their accounts so that the advisor can make trades or other transactions for the benefit of their clients. However, if an advisor suddenly starts making transactions that do not benefit the clients or are contrary to their agreed instructions, then that activity is unauthorized, even if they have login credentials.
A computer scientist is someone who fixes things that aren't broken.
