Regular Expression Matching Can Be Simple And Fast
Topic: Technology
5:50 pm EDT, Apr 27, 2009
Introduction
This is a tale of two approaches to regular expression matching. One of them is in widespread use in the standard interpreters for many languages, including Perl. The other is used only in a few places, notably most implementations of awk and grep. The two approaches have wildly different performance characteristics.
Notice that Perl requires over sixty seconds to match a 29-character string. The other approach, labeled Thompson NFA for reasons that will be explained later, requires twenty microseconds to match the string. That's not a typo.
It may be hard to believe the graphs: perhaps you've used Perl, and it never seemed like regular expression matching was particularly slow. Most of the time, in fact, regular expression matching in Perl is fast enough. As the graph shows, though, it is possible to write so-called “pathological” regular expressions that Perl matches very very slowly. In contrast, there are no regular expressions that are pathological for the Thompson NFA implementation. Seeing the two graphs side by side prompts the question, “why doesn't Perl use the Thompson NFA approach?” It can, it should, and that's what the rest of this article is about.
Today, regular expressions have also become a shining example of how ignoring good theory leads to bad programs. The regular expression implementations used by today's popular tools are significantly slower than the ones used in many of those thirty-year-old Unix tools.
People who advertise private alphas piss me off. Why the hell are you issuing announcements of a private goddamn alpha? Its *private* and an *alpha*! Worst is when someone announces that a private alpha will soon begin!
Why are you announcing anything? You don't have anything yet! You have an idea. Announcing to the world "I have an idea and I'm going to privately ask some people to look at my idea" is not something that needs to be announced. You don't even know if the idea is going to work or not. That's why its a damn alpha!
After months of hard work and late caffeine-fueled nights, HP’s Web Security Research Group is proud to release HP SWFScan.
HP SWFScan is a free security tool to help developers find and fix security vulnerabilities in applications developed with the Adobe Flash Platform. The tool is the first of its kind to decompile applications developed with the Flash platform and perform static analysis to understand their behaviors. This helps developers without security backgrounds identify vulnerabilities hidden within the application which cannot be detected with dynamic analysis methods.
Simply, point HP SWFScan at the SWF file for any Flash application and it will:
* Decompile the ActionScript 2 or ActionScript 3 bytecode back to the original source code. * Audit the code for over 60 vulnerabilities including exposure of confidential data, Cross-Site Scripting (XSS) and cross-domain privilege escalation. * Validate the Flash application adherence with Adobe's security best practices
AppleInsider | Steve Jobs taking leave from Apple due to complex health issues
Topic: Technology
5:32 pm EST, Jan 15, 2009
Team,
I am sure all of you saw my letter last week sharing something very personal with the Apple community. Unfortunately, the curiosity over my personal health continues to be a distraction not only for me and my family, but everyone else at Apple as well. In addition, during the past week I have learned that my health-related issues are more complex than I originally thought.
In order to take myself out of the limelight and focus on my health, and to allow everyone at Apple to focus on delivering extraordinary products, I have decided to take a medical leave of absence until the end of June.
I have asked Tim Cook to be responsible for Apple's day to day operations, and I know he and the rest of the executive management team will do a great job. As CEO, I plan to remain involved in major strategic decisions while I am out. Our board of directors fully supports this plan.
Nothing quite like dancing and singing this song at the top of your lungs to slip out of that post-holiday funk and start the New Year just right!
Sing it with me now! Ohhhhhhhhhhhhhhhhhhhhh wont you take me home tonight? Ohhhhhhhhhhhhhh down beside your red firelight! Ohhhhhhhhhhhhhhhhh you gonna let it all hang out! Fat bottomed girrrrrrrrrrrrrls You make the rockin world go rounnnnnnnnnnnnd!
A computer with scalable performance level components and selectable software and service options has a user interface that allows individual performance levels to be selected. The scalable performance level components may include a processor, memory, graphics controller, etc. Software and services may include word processing, email, browsing, database access, etc. To support a pay-per-use business model, each selectable item may have a cost associated with it, allowing a user to pay for the services actually selected and that presumably correspond to the task or tasks being performed. An administrator may use a similar user interface to set performance levels for each computer in a network, allowing performance and cost to be set according to a user's requirements.
A series of Paul Graham's articles has led me to something I'm calling the Innovation Problem. Essentially it started when I read his article After Credentials. I enjoyed it article, but found this part is odd:
Do they let energetic young people get paid market rate for the work they do? The young are the test, because when people aren't rewarded according to performance, they're invariably rewarded according to seniority instead. ... If people who are young but smart and driven can make more by starting their own companies than by working for existing ones, the existing companies are forced to pay more to keep them.
This statement about motives seemed out of sync with his essay Great Hackers:
Great programmers are sometimes said to be indifferent to money. This isn't quite true. It is true that all they really care about is doing interesting work. But if you make enough money, you get to work on whatever you want, and for that reason hackers are attracted by the idea of making really large amounts of money. But as long as they still have to show up for work every day, they care more about what they do there than how much they get paid for it.
Perhaps this is because Graham is talking about a general case of person in the first essary and a subset of people (Specifically great programmers) in the second.
Now, I don't consider myself a super hacker and nor would I ever compare myself to someone like RTM or others Graham has mentioned. Quite the contrary I've gone out of my way to deny unwarranted comparisons. I do however consider myself a hacker and I understand exactly what Graham means in his 2nd essay.
I think that performance metrics are one half of a two sided coin, depending on what drives you are a person: pay or project.
Let me explain. I work for a Fortune 15 technology corporation. They pay me very, very, very well. However in return I'm subjected to (with a fair bit of good things) unbelievablystupidbullshit. They don't seem to realize that I couldn't give 2 shits about their money otherwise I'd have alot less bullshit in my life.
Jay Chaudhry met with me twice in the spring of 2008 and asked me to join his new start up Zscalar. I turned him down for a couple reasons, the biggest being he kept appealing to the wrong side of me. He kept talking dollars, he never talked projects. How are you doing "in the cloud" security. Are you buying or building? ... [ Read More (0.4k in body) ]
Browser Rider - A hacking framework for browser exploitation
Topic: Technology
11:18 am EST, Dec 3, 2008
“Browser Rider” is a hacking framework to build payloads that exploit the browser. The project aims to provide a powerful, simple and flexible interface to any client side exploit.
Browser Rider is not a new concept. Similar tools such as BeEF or Backframe exploited the same concept. However most of the other existing tools out there are unmainted, not updated and not documented. Browser Rider wants to fill those gaps by providing a better alternative.
This is neat. Check out the video and the online demo. Also the source if available.
