1. 3
    jeffcarp avatar jeffcarp 13 days ago | link | on: What's the URL to your technical blog?

    Hi I’m Jeff and I have a couple posts about cryptography and engineering productivity (like pair programming). https://www.jeffcarp.com/

    1. 4
      MasonJar avatar MasonJar 2 months ago | link | on: Browsers are _big_.

      I don’t really understand the huge variety of languages in these things. Chromium is mostly C/C++, okay. And I suppose they need some JS around for internal UI stuff. I suppose it makes sense to have some Python in there too for build automation or something. But why do they need Python and Ruby and Perl and PHP? And Lisp and Go and Scheme and R and Powershell and Sed and so on? I have to wonder if there are good reasons for all that, or if these projects need some language synchronization.

      1. 20
        jeffcarp avatar jeffcarp edited 2 months ago | link

        But why do they need Python and Ruby and Perl and PHP?

        An attempt at an explanation:

        Python

        Most integration test running infrastructure inherited from WebKit was written in and continues to be written in Python. You can see this lineage comparing Chromium and WebKit’s source trees:

        All Python files: https://cs.chromium.org/search/?q=lang:%5Epython$&p=2&sq=package:chromium&type=cs

        Ruby

        One thing we used Ruby for was for a tiny utility for formatting patch files. We just replaced it (CL). There are some other random files.

        All Ruby files: https://cs.chromium.org/search/?q=lang:%5Eruby$&sq=package:chromium&type=cs

        Perl

        Chromium actually vendors in a copy of the Perl language.

        All Perl files: https://cs.chromium.org/search/?q=lang:%5Eperl$&sq=package:chromium&type=cs

        PHP

        Many manual tests are written in PHP since (for better or worse) it’s easy.

        All PHP files: https://cs.chromium.org/search/?q=lang:%5EPHP$&sq=package:chromium&type=cs

        Other languages

        or if these projects need some language synchronization

        Contributions welcome! :)

        (but seriously, if you are interested, I’m at jeffcarp@chromium.org for any questions)

        To try to answer the question more directly: code gets written in many languages and it takes SWE hours to rewrite it in a different language. If you’re choosing between investigating a P1 bug and rewriting something that already works in a different language, time usually gets spent on the P1 bug.

        (source: I work on the Chrome infrastructure team)

        1. 8
          Ameo avatar Ameo 2 months ago | link

          Those .cl files appear to be OpenCL code rather than common lisp.

          1. 5
            jeffcarp avatar jeffcarp 2 months ago | link

            Oo good catch, thx - updated my reply. I can find some Emacs Lisp in the codebase but I can’t find any Common Lisp 🤔.

          2. 5
            sanxiyn avatar sanxiyn 2 months ago | link

            On Scheme code in V8: V8 implements a fast floating point formatting algorithm which is relatiely recent (2010, IIRC) hence likely to be faster than system printf. As I understand, Scheme code is directly from the paper.

            1. 3
              yumaikas avatar yumaikas 2 months ago | link

              Looks like a lot of the perl is part of lcov. That was some interesting reading.

              1. 2
                MasonJar avatar MasonJar 2 months ago | link

                Interesting, thanks for finding all of that! Looks like Chromium has a lot more third-party libs and testing infrastructure than I thought.

                I may just take a look at some of the open-source infrastructure there, though I doubt I’ll have the time or energy to try and make contributions.

            1. 3
              jeffcarp avatar jeffcarp 2 months ago | link | on: libcsi - Crypto Simplified Interface

              Here’s the code if anyone wants to browse: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libcsi/

              1. 10
                jeffcarp avatar jeffcarp edited 3 months ago | link | on: How do you manage your passwords?

                1Password as the source of truth for everything (sans browser extension) and Chrome autofill for day-to-day usage.

                Edit: this thread is really great for telling people exactly how to spearfish you :0

                1. 2
                  jbert avatar jbert 4 months ago | link | on: Understanding the Security of Cryptographic Hash Functions

                  Is the birthday paradox correct in this case? We’re not looking for any two coins the same colour, we’re looking for a coin the same colour as the one we already have?

                  1. 2
                    jeffcarp avatar jeffcarp 4 months ago | link

                    I think you’re right. The current metaphor describes a second preimage attack. I’ll update the post. Thank you.

                  1. 1
                    Zamicol avatar Zamicol 4 months ago | link | on: Understanding the Security of Cryptographic Hash Functions

                    Nice post Jeff.

                    2^256 is about 10^77, which happens to be an estimate for the number of atoms in the universe.

                    I really like your blog layout. Have you published the code?

                    1. 1
                      jeffcarp avatar jeffcarp 4 months ago | link

                      Thanks! It’s using this Hugo theme https://github.com/htr3n/hyde-hyde with some tiny modifications.

                    1. 3
                      hanno avatar hanno 4 months ago | link | on: Understanding the Security of Cryptographic Hash Functions

                      The author seems to think that second preimage attack and collission attack are the same. They’re not.

                      Second preimage attack: Given a hash function H and an input X find Y so that H(X)=H(Y) and X!=Y.

                      Collission attack: Given only a hash function find X, Y so that H(X) = H(Y).

                      This is a major difference. There are plenty of hash functions that are vulnerable to the second, but not the first (most notably MD5, SHA1).

                      1. 1
                        jeffcarp avatar jeffcarp 4 months ago | link

                        My bad, thank you for pointing that out! I’ll update the post.

                      1. 7
                        jeffcarp avatar jeffcarp 5 months ago | link | on: Thwarting Return Oriented Programming (ROP) Attacks

                        ROP is a super ingenious (and scary) attack. If you’re looking to read more into it, check out this paper about automating the process of “blindly” finding ROP gadgets over the network to hijack control flow on a remote machine: http://www.scs.stanford.edu/brop/bittau-brop.pdf

                        1. 0
                          jeffcarp avatar jeffcarp 5 months ago | link | on: Open Source Maintainers Owe You Nothing

                          Yes, a thousand times yes 🙌