Blog

October in security
Pascal Cuoq on 30 October 2012

Today, the New York Times has an homage to Peter G. Neumann. Many people cite Albert Einstein’s aphorism “Everything should be made as simple as possible but no simpler.” Only a handful however have had the opportunity to discuss the concept with the physicist over breakfast. One of those is...

Read More

Exact Gap Computation for Code Coverage Metrics in ISO-C
Pascal Cuoq on 16 October 2012

Comparing static analysis tools is (still) difficult Earlier this year of 2012, some of my colleagues and I took the opportunity to point out that, as a research community, we are not doing a satisfactory job of comparing static analysis tools. This article and blog post were concerned with independent...

Read More

September in security
Pascal Cuoq on 8 October 2012

October is National Cyber Security Awareness Month (if you are in the United States; otherwise it is Another Country's Cyber Security Awareness Month). In celebration here is a short list of recent cyber-security failures: An iPhone user navigating to a malicious webpage can see eir personal information (address book browsing...

Read More

StackOverflow answers everything
Pascal Cuoq on 2 October 2012

One thing leading to another, I recently ended up wondering why, according to an individual close to the situation, the C snippet below is considered defined in C99. struct X { int a[5]; } f(); int *p = f().a; printf(\%p" p); The programming Q&A website StackOverflow had never failed me...

Read More

RERS 2012 competition: our solutions for problems 1-9
Pascal Cuoq on 2 October 2012

Previously on this blog Although it was so brief that you may have missed it, I previously mentioned here the 2012 RERS Grey Box Challenge an interesting competition where the questions involve programs in C syntax. I pointed out that some questions were about the reachability of assertions in the...

Read More