gauravk92's comments

gauravk92 | 13 years ago | on: Vagrant core no longer tied to VirtualBox

They are right now in the stages of removing proprietary code towards a modular architecture. I think it's more likely they could implement libvert as a plugin. The focus isn't to make a pluggable architecture for vm emulators(libvert). But to make vagrant itself more robust, by removing it's ties to virtualbox with a plugin system.

gauravk92 | 13 years ago | on: Another year of Clojure

These language enthusiasts forget that the best language is the best one for the task at hand. They'll get it eventually IMHO.

gauravk92 | 13 years ago | on: Adobe Flash API ported to Dart

AS3 -> Dart -> JS, a bit much don't you think? I'm not sure who is trying to use a web stack three levels deep and dart based no less. I'm skeptical of how long dart is going to last at google, but this is definitely an impressive piece of work regardless. If it was AS3 -> JS and worked as well as it does now, i feel the web would collectively lose its shit. Unfortunately though this is tied to google, and i don't think many people want to be stuck being supported solely by google anymore.

gauravk92 | 13 years ago | on: Corrupt App Store binaries crashing on launch

Not possible without rejecting the binary unfortunately. If you submitted it a day ago or so, just reject it. It'll get dropped down in the queue but if the situation calls for it, might be necessary.

gauravk92 | 13 years ago | on: Debug UIWebView in your iOS app

So just infer the method name at runtime.

The static analyzer could alert a human of a dynamic performSelector call but they're still a myriad of ways to get around that as well. With just a tiny bit of obfuscation any human is simply going to dismiss analyzing the disassembly to figure out what's going on since performSelector is a valid API call. They can't remove you from being able to do things at runtime either or make only make static calls to objc_message.

Literally the only technical solution would be for them to run the app through some sort of dynamic analyze,r where it runs the code and figures out everything that's going on. There are obvious issues with such a system though even theoretically.

For example, let's say you have a variable x which has a value determined at runtime:

x = figureOutXBasedOnSomeRuntimeStuff()

if (x) { InferPrivateMethodNameAndPerform() } else { DoSomethingElse() }

The analyzer has to traverse all paths to actually know if a private method is being called but it can't just run the code once with x as true, and once with x as false. It's a dynamic environment so those actions may have radically different actions based on other variables or the user's preferences at runtime, etc. And if it simply runs the app then many code paths get missed. Maybe in the distant future the analyzer could actually play around with your app enough and possibly go through every code path that way. But by simply having it tied to a page on the Internet, you can just wait till its approved and then enable it.

So one obvious conclusion might be to have a human disassemble the app and figure out what's going on. But that's simply not economically feasible and even experienced security analysts can have a hard time figuring out what code is doing, even if you have the source code.

It's more likely overtime they will dull the sharp edges of objective c, especially for iOS. At which point the entire SDK will be structured in such a way as to not allow you to do things you aren't supposed to. But they can't prevent you from ripping llvm off of opensource.apple.com and compiling without the restrictions. In terms of a technical solution, it itself is not economically feasible. Definitely easier to just ban infringing people when they get caught, old fashioned way.

In summary it's more likely that they just don't care. Apple knows being on the app store is more valuable then using the minus button illegally (hah camera+). So they simply won't do anything about it, you can slip your app onto the app store taking full advantage of the private APIs with a bit of obfuscation and they'll most likely just let it through. They are smart enough to know realistically their efforts to enforce this rule is futile, so they probably just don't care and will simply ban you from the store (unless your app is making shit tons of money, then they'll just tell you to fix it).

I don't recommend it either but from a technical standpoint it's a very interesting puzzle of sorts.

gauravk92 | 13 years ago | on: A safer git checkout

Most developers learn by example. I've looked for resources on using vcs properly but the few that existed weren't very good. A great resource would be a showcase for a collection of great commits. It doesn't exist as far as I know unfortunately.

gauravk92 | 14 years ago | on: Android's Overblown Fragmentation Problem

Sure it's not an issue if you think you have to support android. When in reality you just have to support the iPhone, and it doesn't have these issues.

Android support is helpful but not neccesary, like supporting IE alongside Firefox a few years ago. Sure people use IE more than any other browser (now Chrome, yes!), but that doesn't mean a lot of IE users are going to use your website in the first place.

IMHO that applies to android today, iPhone users are way more likely to buy your service in the first place so you should focus on them. No need to leave android users hanging, but clearly the platform doesn't warrant anyone's sole focus so much as basic support.

gauravk92 | 14 years ago | on: Memristor RAM now cheap as chips

Their research labs have quantum computers, I'm sure they are well aware. As for pushing this to market, no hurry, they're in the business of selling silicone 8086 based processors, they'll probably keep doing that for as long as possible.

gauravk92 | 14 years ago | on: Starting to explain P vs NP - what do *you* find confusing?

When we discuss solving whether P=NP, are we talking about a theoretical shortcut that allows us to not have to calculate everything? Or is it quantum computing that simply allows us to efficiently just compute everything because no shortcut is likely to be discovered?
page 1