Morphit

“abbabba”

“abbabba” doesn’t match the original regex but “abbaabba” does

It’s a proprietary enterprise security product so I think it’ll be difficult to get information until they give a proper post-mortem (if they do so). Here’s hoping someone can put it all together though.

From what we have from CrowdStrike so far, the Channel File 291 update was to combat some use of Named Pipes in Windows malware.

This seems to have triggered a null pointer exception in the Falcon kernel driver as it loaded this Channel File. CrowdStrike say this is not related to the large null sections of one of the files but haven’t really explained what did trigger it.

Regardless, the kernel driver ought to have been statically analysed to detect this kind of memory hazard, or written in a language that prevents this class of bugs altogether. This is a priority of the US government right now, but CrowdStrike doesn’t seem to have got the memo.

wouldn’t changing it just end up performative

Exactly. Sidereal time does get rid of time zones and leap years, but it’s still referenced to a single physical object and relies on a arbitrary choice of start point. So it doesn’t create some perfect cosmic time standard.

The international date line doesn’t help since that’s just 180° offset from Greenwich itself.

The point of standards is that they can be followed by everyone. The AD/BC epoch is fine. The Greenwich meridian is fine. UTC is fine. Changing them would cause so much disruption that it cannot be worth it.

Daylight savings can go die in a ditch though.

doesn’t change

Citation needed.

Do you use leap seconds to stay in sync with earth’s rotation? When would they be applied? How would spacefarers be notified of these updates?

Also, what meridian do you choose for this ‘universal’ time? Is it still Greenwich? Because that’s peak colonial baggage.

I can see that, but surely there wouldn’t be much difference matching the first 4bits (0x2XXX, 0xfXXX) vs the first 16 (0x0001)?
0:: is presumably all for loopback-type stuff, but I don’t see a reason not to use 1:: through 1fff:: and they would be much easier to type/remember/validate for public DNS servers which are needed before name resolution is available.

Why start at 0x2001 though? Why not 0x0001? Then we could have addresses like 1:1:1::1 or 1:2:3::4.

2606:4700:4700::1111

Hmm, maybe Google is easier:
2001:4860:4860::8888

Quad9 is 2620:fe::fe or 2620:fe::9

I don’t understand why they can’t get better addresses than that. Like surely 1::1 would be valid?

Edit: So IANA only control addresses 2001:: and up and there are quite a few IETF reservations within that. I don’t know why they picked such a high number to start at. Everything else seems IETF reserved with a little space allocated for special purposes (link-local, multicast, etc.).

Ah, come-on, why do you think Eliza could do that 60 years ago?

Does that question interest you?

They’re just like us.

Godbolt to the rescue! So gcc 13.2 certainly does produce the same code, though a lot of other versions and compilers do it slightly differently. Surprisingly, clang doesn’t optimise this and uses idiv for the modulo version.

The point being made is that it also depends how often the ‘true’ value gets used in the code. Tests might only evaluate it a few times per run, or they could cause billions of evaluations per run. You can’t know the probability of a test failure without knowing the occurrence rate of that expression.

There’s no place like ~.

The SCART squad of the PAL posse.

Stallman is fuming rn