Greetings, laddingtons. I have clickbaited you. How does this make you feel? Comment below. On my part it feels absolutely great mate. Now, okay, I haven't really clickbaited you because it's accurate enough what I wrote in the title and I do it I only ever clickbait you to share important teachings and this is Perhaps the most important teaching I can share. So why am I frustrated or why was I frustrated?  So basically I said to myself for this fine year. It's a good year. I can feel it. I said to myself that I need to optimize my German. Now I actually read German in school because it got to choose between German, French, Spanish, usually. Then of course English was mandatory. So anyway, I'm no stranger to German at all I've spent quite a bit of time in Germany as well. I have You know for the last one and a half years I've responded to emails in German, but I wasn't confident enough in it And I also need to optimize it so I can communicate with a spirit of Wolfram von Eschenbach More on that in another video or podcast episode Then also Germany is the heart of Europe. It's the main nation of Europe despite everything and There is there are so many Cultural treasures in terms of music and literature and for me This is a way to get closer to that a bit closer at least then of course if I want to stay updated on the Political situation in Germany. It's easier to read in German. So that's my Purpose for deciding upon this and again, I'm no stranger to German. So this is not me just Learning a new language. This is just me getting more comfortable in our language. I have some experience in So anyway on to the main thing the main topic at hand here And that is habits because you can apply this teaching to anything and if you are a true disciple of mine If I may be so bold as to refer to my dear supporters as disciples Feels great if I can do that Anyway do implement this teaching. I promise you you will not regret it You will thank me later when you have gotten into the mindset. So habits. It's all about habits I've said it before I'll say it many times Again such an important thing habits. So I said to myself What to do? Yes habit number one Boom, I use my magical Artifact here. It's a notebook does wonders for the productivity. I write down 20 minutes five days a week or 30 minutes or whatever a Routine a habit of doing of training German Every day every other day whatever it is as long as you make it consistent And as long as you have a plan as long as you make a habit out of it. So I got bubble I'm not affiliated. I just picked one and yeah, it's a good product. I can recommend So I do that five times a week roughly 20 to 30 minutes each time That is my routine and it feels good routine habit number one Habit number two I started following a few German speaking telegram channels So I have my routine, of course I follow a few different telegram channels, which you all know since I share stuff every once in a while Then I just added to my habit I have a habit of going through the telegram channels that I find interesting then I added in some German-speaking ones, so I constantly bombard my mind with The German language, that's the way to learn by the way So if you want to learn anything is bombard your mind and eventually it will sink in and you will learn So that is habit number two. So anyway, that was my teaching for the day and for you if you Are tired of being fat perhaps yes implement a routine which enables you to lose weight and This is also something a completely different topic that I might make a video on if you talk about diets, etc Get that out of your mind only think in terms of habits. What are the habits? I can stick with for a long period of time if you want to feel a bit more Secure perhaps in a rough environment Yeah implement the habit of training MMA every day or whatever it might be I'm just giving some options so that you can implement the the template. I've given you here implement habits into your life So anyway, I'm sure you get the point. I just wanted to say that so to conclude habits habits habits Good stuff good stuff. No, thank you for watching and if you haven't done so do yourself a favor read don't less and implement All habits that are described there in Link in the description box below now. Thanks for watching XXO boom


Going on everyone, Sam here with late in sports cards. We're ripping 22 penning spectra football hobby, four box half case break, number seven. Pick your team style. Can we have a list of our names and teams? Andrew AP with the Falcons Bills, Andrew AR Vikings, Armando B Chargers, Brad K. Lyons, Bradley C. Jags Rams, Daniel G. Cardinals, Daniel C. Panthers, Edward P. Cowboys Broncos, Eric A. Saints, Harper B. Chiefs, Henrik J. Colts Brown, take it Henrik. Ian W. Packers, James H. Giants, Jeff G. with the Eagles, Jeremy H. Ravens, Joseph T. with the Dolphins, Justin W. Raiders, Kenneth L. Steelers, Kenny T. with the Niners, Luke O. Seahawks, Mitch M. with the Buccaneers, Mohammed A. Patriots, that's Regina A. with the Titans, Sean T. Football team, Thomas M. Bears, Tim V. with the Texans, William S. Bangles, and William B. with the Jets. So good luck here, everybody, see what we've got. Thank you, Regina, taking the Colton 10. We've got number eight, we got to fill up next. Got six teams to go on that one. Got the link, go tweet that. Good luck, everybody. We're up some more spectra. Pick it, pick it, or pretty. Just pretty have autographs and patches and stuff. I think so, I think you just got autos in this. Which is pretty cool, honestly. Here we go, box one. Turkey has put a $500,000 bounty on NS Freedom's head. Who did? The Turkish government. James Robinson's the 99. Yeah, they're like, he's like really scary on that. 40 out of 50, Chris Olave. Like they're like targeting his family in Turkey and stuff. 71 out of 75, Derek Henry. What did he do? It's like speaking out against the government. That's it. Pretty much, yeah. But he's like, maybe he's a very like. Outspoken guy. Like outspoken, he's got like a big following. Big following, yeah, exactly. And full spectrum, 40 out of 99, Leighton Van Der Resch for the Cowboys. He was on the Celtics when he changed his name from the cancer. Freedom, yeah. Is he still there? Yeah. Going to the Rams, Cooper Cup. That is 12 out of 30, nice one there. Grats on that one is that, who is that? Bradley, there you go Bradley. Josh Jacobs. 15 out of 75 is going to be a Barry Sanders. What up CJ? Going well man, how are you? What's up CJ? And 36 out of 75, Desmond Ritter, three colored RPA. Nice one there. This is Hobby Brandon. There's Trey McBride Celestial to 99. Derek Johnson, hurry yourself. There's Danny Gray, 24 out of 25 for the Niners. On the meta, jumbo patch. Monumental memorabilia. And 28 out of 35, Danny Gray, green scope, RPA again for the Niners, congrats San Fran. Nice one there. Nice Marble, rookie two of four, Hassan Haskins for the Titans. Grats on that Tennessee. Yeah, they are, this is definitely better. Trey McBride, rookie. 24 out of 25, Kyle Pitts, two-color patch for the Falcons. Yeah, I've had some pretty good stuff. Hit a Micah Parsons 101 patch. Who else, we had like a Purdy to 60, Breeze Hulp, RPA to eight. Some other cool stuff too, Zappy to 10. 10 out of 99, Pierre Strong Jr. Look at that patch on that thing dude. Four color with seven breaks. With seven breaks. Got T Higgins, that is 250. Nice one there for the Bengals. Not that I'm aware of, Steven. I would be surprised, I would be surprised. Demonte Adams, got 42 of 60. That's going to be Eli Mitchell. Ooh, nice one here. Bradley, Bradley C. This is sick. We've got Tori Holt on the Super Bowl auto for the Rams. Nice one there, buddy. Absolute legend, one of the most underrated receivers of all time, underappreciated. Congrats on that, on-card auto of Tori Holt. That's sweet, dude. Six to go on number eight, guys. Breaking right after this. Yeah, there's a lot of them in spectra. I have no idea of Gucci, to be honest. I just look up comps on eBay for that. Pierre Strong Jr. to 75. Daily Zappy rookie. 15 of 15, Zamir White. This is so sick, dude. This team is killing it right now. We've got champion signatures, Kurt Warner. Going to the Rams. Holy cow, man. 20 of 25. Congrats on that, Bradley. Getting a Holt and a Warner. What's up, Bronx? Bronx in the building. Nice one there for the Rams. Bradley killing it, man, with that Rams spot. What are you at, Pierre Strong Jr. I was saying, dude, there's seven breaks on that patch. Four-collar. David Montgomery, Celestial to 99. Yeah, greatest show on turf boxes, right? There's a 18 of 25, Netta, Brian Robinson Jr. Rookie Spectress. Pretty good, Bronx, how are you, man? We've got two 99, that is Michael Parsons. Nice one here, that's not going to be a random. 10 of 10, Jahan Dotson and Brian Robinson Jr. on the black neon light. Nice one there, congrats on that. BTS for the business, there you go, man, nice, Bronx. Christian Watson to 20. I think that's sick. That thing is awesome. This is one of the super short prints this year. I think this is a debut. It is the Spectraverse of Jamar Chase. That is awesome, dude, that is so clean. I don't think this is a case hit. I think this is just a super short print. 22 of 60 is Justin Fields for the Bears. And one of five, Marble RPA, Skymore, going to the Chiefs, another patch with a ton of breaks, dude. That's what one, two, three, four, five, six breaks on that one. Again, guys, let me shoot you the link to number eight's breaking right after this. It seems left. We've got the Cardinals, Panthers, Browns, Colts, Patriots, and Buccaneers. So a lot of good teams still left on the board there for, like, top tier rookie hits. Plus, you're always chasing Brady Culler out of Buccaneers, and I guess for the Patriots. Probably got a Patriots card in there somewhere. Daniel Jones to 99. Celestial. Here's Dobbin Cook to, wow, three of four. Nice one there. I don't know off the top of my head. Washington was 100 bucks, 100 bucks for Washington. Later, buddy. We've got 49 of 99. That is Ed Reid for the Ravens. Epic legends. And 20 out of 60, Brent Selick for the Eagles. Eagles, kind of an actual legend for the Eagles. Not the ironic legend. Nice one there. Me and Forrest is in here. Me and Forrest both block the same guy. Clown. There's Snoop Connor rookie. That's six of 10 for the Jags. Tyler Linderbaum for the Ravens rookie. That is 25 of 25. Brett Farr of Championship Gear. 41 of 99. Christian Watson, Celestial RPA. Nice one there for the Packers. Grats, Greenbeck. K-9, Interstellar to 60 for the Seahawks. Cool one there. Ray Lewis. There's 47 of 60 is, Tony O'Gibson on the Catalyst. The two of 30, Carson Strong, Purple RPA for the Eagles. Grats, Philly. MD, this is break number seven. This is break seven. So we still got a few more. Frank Gore, Hyper to 75. Chris Godwin. Nice one here. Three of 35, Tyquan Thornton on the dual jersey. I appreciate that, MD. Thank you, buddy. What's up, Ev? And 36 out of 50, Romeo Dobbs RPA. I think it was Steven T, I believe, out of the Commanders. Steven, it was Steven something. Let me take a look. Or maybe not, maybe not Steven. Sean T, Sean T. Not like one Corral RPA, a couple Corral numbered. Nothing super crazy at Corral yet. Got another Super Bowl auto. I love those, dude. Joe Burrow, Hyper to 75. Four of 75. Alec Pierce-Rookie. Two of four, Cam Acres championship gear on the marble. Nice one there. And Super Bowl auto is John Taylor for the Niners on card. Nice one there. Those Super Bowl autos are so cool. There's the link again, guys, to number eight. 2,500. That's a lot of points right there, actually. I think it equals like. Ow. Dollar value. There's Evan Neal. We'll put in you how much. Two 15. Orange. There's James Cook, nice one there. Four-color patch, 64 out of 99. I've been told I look like Matt Stafford before, which I'll take that, that's a compliment to me, dude. That is a compliment to me right there. Sam Howell rookie. Of course, just like, I like actually not joking because that's probably worth over $100. DeMonte Adams to 99. This is David Bell, 86 of 99. What's like the normal amount of points you get, like the base points usually, how much? What's up? How much is like the, how many points do you get like on the normal, like the average amount you say? 400, between 400 and 600, I would say. I think 400 is like 20 bucks. Yeah. All right, we've got Micah Parsons. Nice one there. 16 of 60. Exactly, Jordan. Got six of 10, Marcus Allen, full spectrum. That's gonna be a random between the chiefs and the raiders. Let me just double-check, make sure the, I think Harper's got the chiefs and raiders is Justin W. Yeah, so that'll be a random as well. That's packed, good luck everybody. Michael Pittman Jr. to 40, Pittman Jr. There's a eight of 50, Aaron Rodgers, nice one there. Championship here. Yeah, they just put new rewards in I think today actually. All right. And 69 of 75, Bailey Zappie, four colored RPA for the Patriots, nice one there, a New England. Congrats on that. All right guys, got a couple of randoms to do. Can I have the, oh there, sorry about that. There's a Marcus Allen, and then 2,500. No, Sean is not here, Sean is not here. It's Blake. Let me get this set up really quick. So we're doing the random for the Marcus Allen duel. Raiders, raiders, chiefs, chiefs. And then a random for the 2,500 points, which is actually a good amount right there. Hey, let's go, congrats Bradley, no problem dude. Let's roll the dice. We're gonna go seven times on both. So start off with the Marcus Allen. One, two, three, four, five, six, seven. Going to the Raiders. And then seven times on the points, good luck guys. One, two, three, four, five, six, and seven. Going to the Chargers. 15,000. Going to the Chargers. Just hit that. That's actually not bad, right? It's the most I've ever pulled. Yeah, 15,000 is the most I've ever seen. 15,000. That's insane. How much, I mean who is this? Chargers. That's probably like a 200. That's what it said, 200 bucks. Yeah. Micah Parsons for the Cowboys. This one was a nasty. That's James Cook for the Bills. Cam Acres, Rammus. Antonio Gibson, Commanders. Tyquan Thorin, Patriots. Ed Reed, Ravens. That's Brett Farr for the Packers. Justin Fields-Bears. Zamir White, Raiders. Micah Parsons Cowboys. That is Danny Gray for the 49ers. Thank you, thank you. Aaron Rodgers for the Packers. Kyle Pitts, Falcons. Eli Mitchell Niners. Barry Sanders, Lions. And Derek Henry for the Titans. We got our Autos now. Bailey Zappi, Patriots. John Taylor Niners, Carson Strong Eagles. Christian Watson, Packers. Romeo Dobbs, Packers. Brent Selick Eagles. Skymore Chiefs. Jahan Dotson and Brian Robinson Jr. Dual for the Commanders. Kurt Warner for the Rams. Desmond Ritter, Falcons. Danny Gray Niners. Tori Holt-Rams. Pierre Strong Jr., Patriots. And Leighton Van Der Esch for the Cowboys. I'll do it for the break. Thank you guys again for the fill. Next up, number eight.


Hello and welcome to the chart of the week video with me David Madden. Today's date is Thursday the 28th of February 2019 and the time has just gone 1155 GMT. This week's chart of the week is platinum and we start off by looking at it on a longer data chart, a weekly chart. As we can see here the market had a very large sell-off between January 2018 and August 2018 and since then the market has been bouncing back. If you look at the price action in the last few weeks, we can see that the market has been pushing higher. In fact, we recently reached a three-month high of platinum, so it gives an indication of how bullish sentiment is. If you take a look at the MACD histogram, the MACD indicator, we can see that as the market is pushing higher, we can see that the steady increase in positive momentum. So the upward move in the actually underlying palladium market is being confirmed by the steady increase in positive momentum. Essentially, the time being, there's an increase in momentum and the bulls are in control. If you look at this level that we're currently at, some of the region of 875, where you can see that 875 proved to be resistance back in November, but also active resistance in January, but all the previous that it acted as support in May 2018 and also in December 2017, so we're coming up to a fairly significant level. Now, could this be the level whereby the market breaks above it and that previous support resistance becomes new support and the market pushes out higher? Or could this be the point where the market runs into resistance at it again and looks to move lower? I'll take a look now at a daily chart to give you a better view of the price action. Actually, I do want to point out one thing on the weekly chart. We can see here, this blue line here is the 50 week moving average. It acted as resistance back in November 2017. It acted as support in March 2018. It acted as resistance again in April 2018. So in the last while, it has acted as it has been a significant metric. So there's a possibility that it could act as a significant metric in the near term. As we can see here, we're trading firmly above the 50 week moving average. It currently comes into play at 844 and today is Thursday, so we haven't actually finished a week just yet. But it would appear that we're going to finish, we're going to close this week well above the 50 week moving average, which would be significant in itself and it's a possibility that that area might act as support going forward. Take a look now at the daily chart and you can see the price action more close up. So as you can see here, we've seen a steady rise in palladium in the last few sessions. Like I said, we're at a three month high on the daily chart. There's a clear increase in positive momentum on the MACD indicator. So the market is pushing higher if you can drive higher from here and if you can take out the 875, 878 region, we could be looking at targeting the 900 area, it's a big psychological number. And then beyond that, we could be looking at targeting this price here, 912. It was the highest of around June 2018 and that region acts as a resistance and a complication. So it might be significant in the future. Move to the downside may find some support in around the 840 area. We can see the 840 acted as a consolidation area in the last five or six months. And if you move below that, support might come into play at this red line here, the 208 moving average, which comes to play at 826. Notice how the 200 moving average acted at resistance in November 2018. An ultra active resistance in April 2018, but they managed to act as a support on a few occasions in March 2018. So once again, the metric has been significant in the past, be it for support and our resistance, it may be significant again in the near term. So but for the time being, what we hold above the 30 moving average, it's likely we could see further gains being made in platinum. If you are going to be training platinum, keep an eye out for what's going on in South Africa in relation to industrial action. There's talk of strikes in South Africa. And that has been one of the reasons why both platinum and palladium have been pushing higher in recent weeks. And finally, before I finish up, if you have any comments to make on this video or any of the other videos we've made here at CMC Markets, please feel free to leave a review on good reviews. Thank you very much.


What is going on guys welcome back to channel critical overlord here's until my halloween ends again in this video here today Gonna be talking about John Carpenter's recent comments on the goal being for this film to end the franchise At least for David Gordon Green's iteration in my opinion and then also talking about Jason Blum's recent comments with entertainment weekly Where he stated that the first draft of this film that's coming out later this year should be ready in the next coming months So Jason Blum had a sit-down with entertainment weekly talking about the upcoming slate of films I think I think this was mostly for fire starter. Honestly this is interview I'll leave a link to it in the description and He got asked a question about halloween and he's he expressed that he had dinner recently with John Carpenter The exact words that he decided to use there in this interview was that I had dinner with the great John Carpenter last night And he was very happy and I'm so excited. We're getting to make a third halloween movie Says Blum so far the shooting is going very well knock on wood and we'll have a cut to look at in two or three months So again with the film coming out in october as the slate at release date still it's not shocking Again, this is very reminiscent of what happened when halloween 2018 is shot earlier in the year It had a smooth post-production process Had a fantastic debut at the toronto film festival Then had an even more successful debut at the worldwide box office when it grossed or outperformed what it was expected to do So now we need to talk about what John Carpenter said in the interview with comic book He said let me explain how the movie business let me explain the movie business to you If you take a dollar sign and attach it to anything there will be somebody who wants to do a sequel it will live if the dollar is not big enough no matter what it will not live and I don't know man. I don't know this time. I don't know they really want to end. They're going to shut it off End it. It's what david has in mind That's fine so again Recently in the past i'm certain we've been told That this is what the plan is in regards to david gordon green and danie mc brides iteration of this timeline within this franchise, but jason blum in the past has expressed interest in Returning to previous timelines. I believe as well and just Giving updates on what could be happening in other timelines if they were to make future movies I don't think that halloween ends will of course be the final nail in the coffin for this franchise Would I like it to be in my honest opinion? Yes, I would I am a big supporter of franchises going out in a blaze of glory and just leaving them untouched But again what john carpenter stated was about the dollar and that's really all it comes down to at the end of the day There's a section of us that care about quality over quantity But within the industry when it comes to making money off of movies I really do feel that it is quantity over quality that is favorite when you are bringing in so much money That a character like michael mires is able to do and still able to do 40 years later The way he has been doing for the past couple of years with the return of halloween with 2018 and how it outperformed Everyone's expectations and then led to us getting a green light of two more Movies within the iteration that david gordon green has in mind Which will be coming to a close with halloween ends later this october So as far as what I could see happening next in the franchise I do think that they will explore future timelines in in the future Or old timelines in the future like going back to the uh, jamey not the jamey, but the uh jamey loyge narrative With daniel harris perhaps or maybe doing a sequel to resurrection Even though I think for a resurrection sequel to happen You might be tampering into or tapping into movies that are A little bit before the time periods that we're in now Because I think that a resurrection sequel set so many years later is kind of pointless I think you should just set it like a year or two after the events of that movie So if we're we're still in the 2000s for a resurrection sequel Then I think that's fitting then just Making random sequels to some of these timelines and then pushing us out Into the modern time that we're in right now just for the sake of you know saying it's in our current modern era When you can still put out movies today and set them in older older settings Like if they do a sequel to halloween 4 And it's a grown-up jamey jamey loyge, then I would be more accepting of that But resurrection if you go back to that timeline The halloween h2o timeline i'll say then I think you should only set it a couple years after resurrection It shouldn't be jumping all the way into the 2020s if we're even at that stage if they were to get to that point again It should just be set a couple years after resurrection And as far as like what jason blum said about the first draft being ready in a couple of months again Uh, I've seen people say they think that's a little rushed. I don't think it's rushed at all If this is rushed in halloween 2018 was rushed and I mean that turned out quite fine So if they're about to rush out a well-made movie that is going to be much better than halloween kills Then i'm all for it. I feel like this movie is going to be a lot more character driven I feel like this movie will be tapping into more of us coming And spending time with these characters that we didn't really get to spend too much time with with halloween kill Since it was so fast-paced and so much fun and but still with halloween kills It was a step in the wrong direction I said that in my my review for the movie still a fan of the movie still enjoyed it still liked it Still will defend it But it still has a lot of a lot more problems compared to the 2018 film which feels a lot more complete And just a lot more on the right side of the fence versus halloween kills Which kind of gets I would say lost in its title that the narrative that it's trying to portray Suffers it's not as subtle It's very forceful at times And i'm off their social commentary in horror movies is nothing new It's just that I would like to see a more subtle approach happen in halloween ends because I know I've seen stuff about the About what's going on today Being factored into the movie from david gordon green and comments he made about Factoring in our world In the current crisis we have factored into the movie. I don't think it's going to be directly about that This could be a case where hat and field goes into isolation On halloween every year now because it's supposed to be four years later So who knows what type of protocols they have in place in that in that section of illinois as it relates to halloween because of michael mires But of course michael mires won't be abiding by those protocols And we still don't know how the radio tower will be factoring factoring in So hopefully if they do wrap this up with halloween ends the franchise stays gone for at least another Five years at best. I want at least a five-year break from michael mires I think that'll be a good time away for the character And then if you want to re-explore other things you can but then at the same time I can see them just hot shotting more movies out there if this movie coming out this october Again exceeds expectations if they are making as much money as they did with 2018 That I think you'll get another michael mires movie in the next year or two or even the next three years It won't be a long hiatus away from him Uh, I hear what john carpenter saying he's he's correct, but I think michael mires is here to stay This won't be the last time we see him It'll just be the last of this iteration for this timeline and I probably will prefer this timeline over anything else But let me know what you guys think about this down in the comments section below if you have already Of course, make sure you subscribe turn on post notifications video in the description I have links in my social media accounts on facebook twitter and instagram you can message me there Of course, remember there's any movies news or reviews you want me to cover in the future and with all that in mind guys I will see you in the next video


So, C++ programmers kind of use typecasting like we just go for a beer at a bar, and they don't really seem to enforce the types very, very carefully, at least the compilers don't, and memory access is also a bit of a problem. This leads to all sorts of issues like specifically type confusion and other vulnerabilities. Matias Paya has come to us all the way from Purdue University via other places, but just recently from Purdue University to tell us all about a compiler-based extension that he's been working on that should be able to detect and avert some of these bugs. And with that, it's over to Matias. Matias, introduction. Matias, introduction. Matias, introduction. And different forms of type safety vulnerabilities that can be exploited by attackers to gain some form of code execution. And we've worked for quite a bit on looking at the type hierarchy of C++ and different forms of vulnerabilities that can arise that can then be exploited in different forms. And it's just a quick show of hands. Who here is a C++ programmer? Wow, pretty much every one of you. Who has written more than, let's say, 10,000 lines of C++ code? A lot of you. Okay. So, that's a good setting. For C++ programmers, you're likely used to the different forms of type costing that you have.  And amazingly, C++ has no form of type safety whatsoever. So this talk could also be described as cloudy with a chance of calculators, as we'll see in a bit. There's a lot of opportunity that an attacker can get to exploit these different forms of type confusion. And type confusion leads to remote code execution, which an adversary can abuse the different forms of type confusion and the different settings in the type hierarchy to pretty much execute arbitrary code on your system. And especially browsers and hypervisors and kernels are great targets to find different forms of type confusion and then exploit them, as was recently shown on the point to own competition. And we've seen a couple of these type confusions that are used to spawn calculators all over the place, which are fun. So a calculator pretty much shows you that you get arbitrary code execution, if you can spawn that. And as we see, if you think about it, the attack surface that we face on our systems is pretty much huge. We are no longer working with systems of a couple of thousand lines of code, but with millions and millions of lines of code. The abstraction is immense. And if you look at Google Chrome, for example, we have more than 100 million lines of code, which is an immense code base that we are facing. And it's very hard to protect against vulnerabilities in this large code base. And even though the folks at Google are doing an awesome job at code reviews, figuring out test cases, checking all the different conditions, there's still a large opportunity for different forms of type confusion in this large source base. And it's not just Google Chrome with 76 million lines of code, but also a bunch of other systems on top of that. There's your window managers, there's your standard library, there's the Linux kernel, there's a hypervisor and so on. And this easily clocks into more than 100 million lines of code. And there's easily, there's a lot of opportunities for different forms of type confusion. We will explore these different opportunities of type confusion. We will see how we can find type confusion vulnerabilities, how we can automate the search for type confusion vulnerabilities, and also we'll discuss what kind of capabilities an adversary can get through different forms of type confusion. So how can you exploit it? What is the underlying attack vector? What are the attack primitives? How can you build attack primitives? And then in the end how you can automate it to figure out exploitability. Now the attacker model is as follows. We start off with an external user, for example, without any form of code execution capabilities. You have to imagine on one end you have a program that is answering to different forms of requests. You're sending in a request, you're getting a reply. This defines some form of computational capabilities that you get on the other end. So you can send in a request, you get a reply, and it conforms to some form of computation that you're allowed to execute.  So for example, if you're interacting with a web server, you're sending in a request and you're supposed to get an HTML file as a response that you can then render and then look at. An adversary tries to craft a request that is being sent in so that instead of a HTML document, you get a shell in return. And among several steps, you're extending your capabilities from an external user that is issuing requests to retrieve documents to a local user and then to an administrator account. And these steps are being followed to extend the capabilities of an adversary step by step. And the nice thing is that an external adversary can easily trigger these attacks through very simple means by simple requests that is being sent on. On current software, we're mostly focusing on control flow high-check attacks. And as software security community over the last 20 plus years, we have worked on a large amount of mitigations. These are forms of mitigations that try to detect an exploit condition or some form of vulnerability that is being used. So given the attacks that I've shown before, it is highly likely that the large amount of code that we have will contain vulnerabilities. So we are working on mechanisms that protect the integrity and availability of our systems even in the presence of vulnerabilities. So as a very first step, we have to accept the fact that there will be bugs in our code. So all the defenses that we have, all the mitigations that we have focus on detecting this exploit condition and stopping an adversary from actually running a full exploit. And over the last 20 plus years, we've developed a set of different mitigations and defenses that make it harder and harder for adversaries to gain full code execution capabilities. So if you want to high-check the control flow on a current system, you need to jump through a set of hoops to actually get code execution, which then allows you to spawn a calculator or execute arbitrary other commands. So for a control flow high-check attack, what an adversary does is it influences the address space of an application of a process to readjust the different forms of code pointers, pointers, and the data of the application so that it executes something different. So imagine originally the code is just the web server, but instead of serving a web document, you want it to open a shell for you that gives you full computational capabilities on that system so that you can interact with the system and then further escalate your privileges to an administrator. Now, with all the different mitigations that we have in our systems, we've severely restricted the set of capabilities that an adversary can have, even if there are vulnerabilities, memory safety vulnerabilities or type safety vulnerabilities in the code. And the slide here shows the address space of the program in an abstract form. So we see that the code section is read-only and execute-only. So an adversary, and this is the only section that is readable and executable. So an adversary can no longer inject new code. And this is one of the defenses we came up with. In addition to that, there's the heap and the stack which are readable and writable but not executable. So the only way an adversary can influence the program is by modifying the data and then reusing the existing code. So what we have here is we have a large amount of code pointers on the heap and on the stack which then point to the code region. To get code execution or to hijack the control flow, an adversary can simply override these code pointers and redirect them to some alternate location. And this is precisely what is being done for a control flow hijack attack. And this can either be for direct code pointers that point from the heap or the stack into the code region itself. Or we can also go through v-tables, which is a way for C++ to handle inheritance and virtual functions. So if you have a virtual function, you are allowing it to be overwritten depending on the class hierarchy. And if you are dispatching based on a virtual function, you're following the code pointer to a specific class-based implementation. And we can influence all these different pointers as an attacker. And then redirect and stitch together the existing code parts in alternate ways. Now, as the show of hand showed before, all of you are already C++ programmers, but it'll still quickly go through the different forms of casting behavior. And even if you've been using C++ for a while, you may not be aware of how the different casting operators actually boil down to the underlying code, how they are being compiled down into an actual application. So there's two main casting operations that we have. They're static casts and they're dynamic casts. A static cast allows you to cast an object or a pointer to an object into a different cast. The advantage is a static cast is very, very fast. The disadvantage is it doesn't do anything, except for doing a feasibility check at compile time. So what a static cast actually is, it tells the compiler, please check if there is a pass from the current type to the other type, to the target type. And if there's any pass in the class hierarchy that goes from the source type to the target type, then the cast is actually allowed. And it doesn't need any runtime information. It doesn't introduce any overhead, which is great for performance, but it doesn't give you any security guarantees. A dynamic cast, on the other hand, executes an actual runtime check. So a dynamic cast is somewhat comparable to a cast in another programming language, like for example in Java or so on, when you're doing a type cast, it is actually enforced that the type that you're casting into, or the objects that you're casting into a different type, actually is of that other type, so that the cast is allowed. And in C++, the dynamic cast leads to a runtime check. Now, to actually execute a runtime check, you need the runtime type information to be able to decide, hey, what is the actual type of the object? What is the type of the memory area that we are looking at? You need to identify the underlying type of the memory object in some form. And this is where we see some of the drawbacks of C++. C++ is an extension of C, pretty much. And in C, everything boils down to untyped memory. Everything boils down to bytes in memory. You have some car array that can be interpreted in different ways. And without an actual identification of the underlying car array, you don't know what the type is. And with a dynamic cast, you are using a unique identifier for an object to actually decide what type it is. And this is where the vtable pointer is actually being used. This allows you to have a unique identifier for the actual object that allows you to decide, hey, this is the runtime type of this object. So it's a unique way to distinguish between the different object types. So let's look at the different casting behavior in a little bit more detail. So if you have a static cast, we cast an object B into a pointer greeter. And this is being compiled down into a load of the pointer B into the RAX register and then a store into this other target area. So there's no real type check happening there. And the compiler only does a feasibility check at compile time when it goes from B to A to make sure that it is of the right type. Now, if you have a dynamic cast, if you compile it with O0 without optimization, you see that there's actually a lot of code being generated. Again, we load the pointer, we do a null check. And in addition to that, we load the pointer to the greeter class and we load the pointer to the base class, and then we execute a full dynamic cast. This allows us to do this actual check and make sure that the type of the runtime object that we have conforms to the actual type that we expect. So we do a full runtime enforcement check. Now, if we optimize this, we do a dynamic cast. We load the two pointers, the two base pointers. We check what the current base pointer is of the current object. And depending on the result of the cast, we do allow it or we terminate the program at runtime with a type safety violation. Let's look what a static cast is optimized. It ends up in zero instructions because we reuse the other register. So a static cast does not incur any runtime overhead and does not incur any runtime check. Use this as a take-home message. Static casts do not result in any instructions being executed at runtime. So no performance overhead and no security guarantees. So now with this knowledge, what actually is type confusion? Type confusion arises through illegal downcasts. Assume we have the following type hierarchy. We have a parent class and two dependent classes, child1 and child2. Now, if we allocate an object of type child1 and we store it in the C pointer, we can cast it to a parent type. So we can cast from the child object, child1 object to parent object. And as these two classes are dependent, this is a valid cast. And we can store the pointer to P in the P pointer and we can use the parent objects or the fields of the parent objects. Now, as a second step, we can cast it a parent object into a child object. And if the child2 object, if the underlying object has been allocated as a child2 object, then this cast would be allowed. But the static cast does not do any checks. So at runtime, this would lead to type confusion. And this is exactly where the exploitable behavior comes in. So with this static cast, which is not being checked, the static cast could be abused to reinterpret the underlying memory as a different type. Let me get you a little bit more detail and background on that on the type confusion. We have the parent class and we have the child class. And I'll break it down to just parent and child to make it a little bit easier. Now, the parent object only has a single variable inside it called of an int type. And the child class has a second int type and a virtual function called print. Now, if we allocate a P object, we only allocate the four bytes that are being used for the integer. If we allocate a C type object, we have the vtable pointer that points to the actual location that contains all the code pointers. We have the x integer and we have the y integer that can all be used. Now, let's assume we allocate a P object, a parent object, and we have a pointer to it. If we do a static cast into a C pointer, the C pointer ends up pointing above the actual object. And the underlying object or the underlying data that is at that location would be reinterpreted as a vtable pointer along with the y object or y integer that could then be read and written which would expose the underlying memory. So this leads to a memory safety violation and control flow hijacking after a type confusion. And if you look at the chain of violations, the type confusion is the first thing that happens that violates the integrity of the underlying application. And this is the initial entry vector for an attacker to abuse this underlying bug, this type confusion bug. And this can then be used as a memory safety violation or then for control flow hijacking. Now, how do we use this vulnerability type to build an exploit primitive? So imagine that when you're using type confusion or when you're exploiting type confusion in your programs, you're trying to control two pointers of different type that both point to the same memory area. But the two pointers of different type allow you to reinterpret the different fields of the object in two different ways. So you have a certain memory area that is of one original type that has been allocated as one original type, but you have two pointers of different types to that same memory area. And for example, in the first type, the parameter is the first entry is interpreted as a V-table pointer, while in the second type it is interpreted as a long, right? And if you use a setter for this long value, you can use it to override the V-table pointer in the other view. So imagine that you're using the first view to set the V-table pointer and then you're using the second pointer that you control as well of different type to dispatch on that pointer. As a simple example, just to show you the power of this exploit primitive, again, imagine that we have a base class that just implements some basic functionality and we have two subclasses of it, two descent classes. We have a greeter class that just says hello and we have a great executor as a service. So both of those are implemented as virtual function because we may want to build our fancy framework on top of that with additional functionality so we want to be able to override these functionalities. So the executor service implements one virtual function called exec that takes a string that is then being passed to system to execute it as an additional service and the greeter function just prints the string to standard out. So that sounds pretty reasonable, right? There's no way that a programmer would confuse exec and say hi because the functions have different names and there's no way for us to confuse it, right? Now, if we allocate two base objects, B1 and B2 of type, the first one of type greeter and the second type, the second object of type exec, we can actually dispatch on those objects. So we allocate these two objects, one object of type greeter, the second object of type exec and then we cast the first object B1 into greeter and we call greeter say hi and then greeter says hi. And then with the second object, we again cast it into greeter, so from the base class to greeter class and the compiler does a compile time check and sees, oh yes, the greeter type is dependent or a descendant of the base type so this static cast is actually allowed. And then we can call say hi with this weird string user bin XCALC and it works perfectly fine, the compiler doesn't complain and this is actually really fun. If you look into this, we see this is exactly the code that I've just shown. We've got the static cast into greeter here and we've got the static cast into greeter here and we call say hi twice. So we make the object, we allocate two objects of type base of type greeter and type exec but we call the say hi method two times. And if we execute it, we once, the first call to say hi, this greeter says hi and the second call to say hi opens a calculator which is not what we want. If you look at how this is actually implemented, so why does this bug happen? First off, the initial or the underlying bug is that the type hierarchy or the compiler cannot stop us from casting a base class into a greeter class even though it is an exec class. We've got these two v-tables from B1 and B2 and the first v-table points to the v-table of the greeter type and the second base B2 pointer points to the exec type. And we can easily cast between the two of you without the type system in C++ actually complaining against it. And if you look at the actual implementation if you drill down in the source code what it actually ends up with is we dereference the first field of the greeter class which is the v-table pointer and then we dereference the first v-table pointer. So even though we are executing say hi or we have written say hi in the source code it boils down to executing the exec function in the exec class instead of the greeter class leading to the actual type confusion. Now this is a fun way to exploit software now. The hard question is how do we find these types of vulnerabilities? How can we find such issues in our software? And the classic approach that people have been using for the last couple of years especially to find vulnerabilities in large browsers has been fuzzing and fuzzing is great, right? But what it ended up being is you are fuzzing and you're trying to find these type confusion vulnerabilities but as I've just shown it's really hard to find or to actually trigger the type confusion vulnerabilities because there's no way for you to enforce the actual check, right? So the only way that you will discover that something is amiss is if you run into a memory corruption if you run into segmentation fault if you don't run into segmentation fault there's no way for you to detect the actual type confusion and you may be missing a large amount of type confusions, right? So you're only, if you're running a fuzzer you're only detecting the subset of type confusion that results in a direct memory corruption and a segmentation fault. There may be a large amount of type confusion that could be abused that you're missing and what we wanted to look at is can we discover the missing set of type confusion? So can we bring type safety to C++ or at least some form of type system and typing so that we can be aware of when an illegal cost is being happening, right? So the underlying problem that we have here is in C++ aesthetic cost is checked only at compile time which is fast but does not give us any form of runtime guarantees. On the other hand, we have dynamic costs that are checked at runtime which result in high overhead and are limited to polymorphic classes. Polymorphic classes are the classes that have virtual functions in them. Why are dynamic costs limited to polymorphic classes? Well, we need to have some way to identify individual objects or the type of an individual object and the vTable pointer is such an identifying field and this goes back to the design of C++ and in C++, a struct is a class and a class is a struct and if you allocate a struct in C you have no idea what the underlying type is, right? There's no way that C remembers that you have allocated a foo struct, it could be any arbitrary type. Only if you have an identifying field, a type ID, only then you can actually identify the underlying type. Safe, object-oriented languages like Java, C sharp and so on. Whenever you allocate an object, they have an object ID, an object type ID that clearly identifies the underlying type. This is missing in C++, this is why we cannot explicitly check all the costs between any objects, but only for polymorphic objects with virtual classes. So what we figured is, there's something missing here, we need to be able to do an actual type check for any of these objects. So according to the motto of the 34, 3C, we figured we would 2WAT and bring type safety to C++. And our underlying idea is that we would check every single type costs. So we do a dynamic check for every single type cost, and then aggressively remove as many costs that we can as part of our design and as part of our implementation. So we are making type checks explicit. So we enforce an explicit runtime check at all cost sites for dynamic costs, static costs, reinterpret costs and also C-style casting. Now, this sounds like a contradiction, right? I've just told you that this is not possible for in the existing framework that C++ has because we have no way to identify the underlying type of an object. How do we solve this problem? Whenever you allocate an object, whenever you execute its constructors or if you simply go through the allocator, we remember that this memory area over here is of that particular type. And we keep some form of metadata table somewhere in the background that allows us to query and look up for any byte in memory. What type does this piece of memory have? And we can then use this information in any of the costs. So we can replace a static cost with an actual runtime check and make sure that we detect a type confusion problem right when it happens right at the cost site and not much later than an actual memory corruption happens. So we build a global type hierarchy during the compilation of the software and we keep track of the allocation type of each object. So we instrument all forms of allocation and we keep this in our disjoint metadata table. And then in a second step, we can execute for every single type cost that happens at runtime, we can execute this check and make sure that it actually matches. So we've built this large system based on LLVM where we instrument source code on top of Clang with additional explicit type checks during the compilation. We do object tracing as part of additional LLVM process and track the type hierarchy. And then at runtime, you can check if something fails or not. And then we have a hardened binary that does all the explicit type checks. Compared to some prior work, you may know UBXAN, which does the checking for polymorphic types only. This allows us to check every single type cost that is out there for static costs and for dynamic costs to do this fine grain checking. We cover new object allocations, we cover placement new, we cover reinterpret costs and a bunch of other things, right? So we've worked very hard to compile real software including Chrome, Firefox and other systems. Now the problem is, as soon as you enforce full type checks for every single cost, you run into impressive overheads, right? So our main task was to reduce the overhead to make it more useful. So on one hand, we limit tracing to unsafe objects. If an object is only used in a safe context, so for example, if it is never being used for costing, we don't need to instrument it. We don't need to remember the type of the underlying object. If an object is never used in costing, we don't need to worry about it, right? So we can remove tracing for types that are never cost in the program. We limit checking to unsafe costs. So we do some static verification inside the scope of a function to figure out what parts of the code are actually used in a safe way. And this also allows us to remove some of the costs. We also replace all the dynamic costs with our special form of costing. As it turns out, our cost that we have developed using our metadata information is much faster than any cost done through the RTTI information that the original C++ dynamic cost does. As it turns out, dynamic cost has never been optimized. People don't really use dynamic costs due to the performance overhead, therefore it's not been optimized, therefore it's not being used. So it's this endless circle. If you replace all the dynamic costs with our type costs, we can actually improve the performance a little bit. Interestingly, by just doing this base system, we already found four new vulnerabilities in Apache Circuses, which is a large XML processing library. And there were costs from a DOM text implementation node to a DOM element implementation node, which allowed us to reinterpret these types in different ways. And we've also found type confusion in the QT base library, going from the node base to the map node itself. And those were easy low-hanging fruits that we found by simply compiling software and running it in a day-to-day use. So by simply compiling your C++ software with our type checker, you can already find vulnerabilities and bugs in the software by just running them in your day-to-day settings. This was step one, and we found a bunch of different vulnerabilities, but we wanted to go further. So a couple of weeks before the Congress, we started to fuzz all the things. As it turns out, you can combine our type safety mechanism with AFL. So you can compile any arbitrary C++ software with our hex type LLVM-based instrumentation, and you then run the software on top of LLVM, and you fuzz it to find different forms of type confusion. You simply let AFL do its magic, and you have to invest some time into triaging all the type confusion reports, and you'll figure out different forms of vulnerabilities. And at this point in time, I would like to give a huge shout-out to the students that actually did all the work and invested a lot of time into developing these systems and triaging the vulnerabilities, building the system and playing with it for such a time. So we spent some time fuzzing on our ghetto fuzzing cluster that we have under the desk of one of the students. So you see, this is a very low power setting. We only have five machines that were running different pieces of software, but nevertheless, we found quite a couple of interesting cases. So after two weeks of fuzzing, we found two new type confusion bugs in Qt Core, unfortunately not exploitable, but they've already been fixed and acknowledged by the developers. We found one more bug in Circus, and we found seven issues or reports in LibsAs, where we're still looking if they are exploitable or not. As it turns out, pretty much every software you throw at it will generate a couple of reports. And some of these reports are due to the underlying problems with C++, as there's no explicit type information. Developers are abusing the type system in many odd ways, which leads to some spurious reports. So actually triaging and figuring out if it is an actual bug or not adds additional overhead to it. So you have to spend some time to look into it, as for example, this LibsAs. Now, we focused most of our time on small software to test the scalability of our approach and to find some reasonable bugs, but we also looked at Firefox for a while. Also to test the performance overhead, for example. So these are the results for Firefox that we currently have. And they're fairly impressive, right? So based on a specific set of benchmarks, we found, let's just say some type confusion reports. And we are still figuring out on how we can handle these large amount of type confusion reports. Many of them will be duplicates, and even more of them will be false positives. And we are working hard on triaging and trying to reduce them to a smaller set of actual bugs that we can then report to the Firefox people. The big problem that we are facing for Firefox and also for Chrome is, but much more so for Firefox, that the code is really, really messy. A hard problem that we have here is that Firefox has several allocators. So there's different forms or different locations in the code that handle different parts of the heaps. There are different heaps that move data back and forth, that share data. And there's very odd allocators that are messing with different parts. So there's not seven billion type confusion bugs in Firefox, or at least we hope so. We guess that the number will be much lower. But it's a first step and we are working on reducing them. So Firefox is ongoing work and we'll see how we can get there and make it more useful. If you end up after five or six days of fuzzing with seven billion reports, that's clearly too many. So we have to figure out how to reduce them to see which ones can be interesting. So as concluding remarks, what did we do? What are steps forwards? How can we improve from here? On one hand, we want to fuzz all the things. So we want to go deeper. We want to find more software. We want to find better test cases, better fuzzing inputs, and get deeper coverage for the overall systems. And especially looking at Firefox, one thing we want to do is we want to do selective fuzzing. So instead of just blindly fuzzing a large software system, which may result in a large amount of false positives due to the way that the software is architected, think about the Firefox example again. You allocate an object. It may be reused in different times without being freed. This would, so, or let me take a step back, right? So one of the problems we've seen with Firefox that led to a large amount of reports is that you often allocate an object. You return this object to a pool. You know the developer knows that there's no more life reference to that object, but is then being reinterpreted and reused as a different type of object, which leads to type confusion report. But this is not an actual exploitable bug. It's just a quirk of the lack of a type system that C++ has. So we want to move towards a more selective form of fuzzing where we can say, hey, we're only interested in this subset of the type hierarchy. So we want to do explicit type checks for this subset of the type hierarchy, but we're not interested in anything else. So focusing on, for example, just a DOM or just a JavaScript object or something like that. In addition to that, we are also looking into an always on check for polymorphic objects. Think back to the control flow high-checking defense that I talked about in the beginning of the talk. One option is that you check the type of the object whenever you do a virtual dispatch. So this would protect against the type confusion from before, right? And as an example, if you are looking at the code here, before when I compiled it, it made two versions that you may have observed. The second version is with the type safety mechanism. And if I run it with this type safety protection instead of opening up a calculator, it actually reports type safety or type confusion. So we want to extend this into a bigger and larger system so that we can run it partially. We can build it on top of Firefox in a selective part. But you can also use it for your software to specifically protect against these dispatch vulnerabilities as we just saw here. As to say, hi, wanted to dispatch, we stopped the execution and terminated the program. So to actually conclude, type confusion is fundamental in today's exploit. There's a set of existing solutions that are incomplete, partial and slow, and make it very hard for us to protect these systems. And especially in large software systems like Chrome, Firefox, and other large mechanisms, we need to develop new ways to protect and enforce type safety at runtime. I presented HexType, which is an LLVM-based extension that allows you to trap upon type confusion. So you can compile your software with these type confusion protection, which allows you to track the true type of every object that you allocate, and then upon type costs or dispatches, allows you to do an actual type check. So we can trap at the type confusion and not at the later memory safety violation. I showed you one application of this approach where we've combined our HexType mechanism that does the type checking with a fuzzing approach, and we found a nice set of bugs that are now being fixed or were fixed. Overall, this has reasonable overhead. So for Firefox, depending on the benchmark, we have between zero and 50% overhead, and you can integrate it with EFL for broad bug discovery. And as always with our research, it's all open source, so you can download the system, you can play with it. It takes about 15 minutes to build it on your machine, and you can then compile your software with LLVM and full type checking. And with that, I would like to thank you for your attention, and I'm happy to take any questions. Thanks. Awesome, awesome. So we have four microphones here, one, two, three, four, where you can ask questions ad. And just to be clear, a question is like one or two sentences with a question mark behind it. And with that, I'm gonna go to microphone two. Thank you for the presentation. Oops, this is loud. Would it also be possible to have a compiler plugin that prevents you from misusing static cast at compile time? Like, could you build something that only allows you to use, does not allow you to use static cast combined with dynamic dispatch? Let me think about your question. Would you want to detect the type confusion statically, or would you just forbid the programmer from using static cast for any object that has a virtual function? Second one, I just want to prevent bugs. Like usually in C++, we try to load as much checking as possible at compile time, so we do not have the runtime overhead, so it would be nice to disallow dynamic cast for anything that is virtual or something. Right, disallow static cast, yeah. Yeah, so Ubisan followed a similar approach. They convert and make all the static casts for polymorphic objects into dynamic casts, and they simply replace them. Unfortunately, as the Greeter example showed, the base class is not necessarily polymorphic. So you run into weird runtime behavior with auth. Like the base class is not polymorphic, and if you turn a static cast into dynamic cast, you fail, right? So there's, C++ code is really, really messy, and it's very hard for you to actually simply replace them. You can report it as a warning as part of the compile process, but in the end you need to support non-polymorphic base classes, which are surprisingly frequent, especially for browsers, as we found. So there are several base classes that are non-polymorphic. Thank you. Thanks. Microphone three. Hey, thank you for your great talk. You mentioned that in Firefox, you had the problem that some objects were freed and then reused, so I was wondering, could you build on top of temporal memory safety analysis and take that information to account to make your analysis more precise? Sure, temporal memory safety usually clocks in at like two, three X overhead, so this is actually more expensive than what we are doing. But it wouldn't be an obstacle to fuzzing, right? Like if you only use it for fuzzing, not in production. Right. Sure, well, ideally you would combine it with additional sanitizers as well, so you would use our type sanitizer, combined with a like spatial and a temporal memory safety sanitizer as well, so you can use it with ASAN as well in addition to that. I, you asked about if the additional data that you have from the type safety system, sorry, from the memory safety system would be useful in our analysis. I would answer you that the temporal memory safety sanitizer will run into the same problem, right? So this is C or C++. We have a lot of untyped memory and Firefox simply reuses the memory, even though there are still references to it and then just changes the type under it. And this is allowed according to C++ semantics. So they're not doing something illegal. It's just that it's really, really messy and we'll have to work around these quirks that they have there. Thanks. Thanks. Question from four? Yeah, to be frank, I'm a bit puzzled by your terminology because just because the type system is not checked dynamically, it doesn't mean that it doesn't exist. So wouldn't it be better to have some static solution like preventing, yeah, forbidding downcasts that are static and forcing developers to use dynamic downcasts only? It would be much faster than having a fuzzer fuzzing the entire application because the result and the problem is spotted at compile time and not throwing some fuzzing step. Sure, this would be a great solution. Unfortunately, it doesn't scale. Try to do this for 75 million lines of code where you have 200,000 violations. Right, so rewriting the whole software stack is always a solution. You may run into time constraints. Right, this is just a source base that we have to live with. It's a great solution, so your approach would actually work really well to protect against these downcasts or illegal downcasts or confused downcasts. You may have a hard time rewriting all the software and there are non-polymorphic objects where you cannot enforce dynamic costs, right? So you can only do dynamic costs for polymorphic objects and you may have an illegal downcasts for non-polymorphic objects as well. You can take it offline. It sounds a little bit more complicated. Microphone two. Thank you for the talk. Well, you gave an example counter to it. At the very beginning you made a claim that static casts don't introduce any code. This isn't exactly correct as everything is implementation defined at this point, but it can shift especially when you're going from a type that has multiple inheritance and it needs to shift around to get to the correct thunks. This introduces a very specific type of type confusion bug where if one casts to a void pointer and then from the void pointer to the different type in the chain, it won't do the shifting properly. It also is a very specific one that might be hard for you to catch. How do you attempt to catch those ones? You mean for our system? Yes. At one point in time you allocate a slab of memory. You allocate a piece of memory according to a specific type. If you do a new foo type, we record this is now of type foo, this memory is of type foo. Then you can do anything you want with your pointer. The memory slab will still be tagged as type foo. Whenever you cast back into some other type, we look up what is the base type of this object. If it is foo and you're casting into foo, everything is fine, otherwise report an error. And you do this when you're casting from void pointer. We do this when you're casting from anything. Cool. Thank you. Which actually brings me to a nice topic that I didn't really talk about. So this is a nice observation that you had here. C-style costs are one of the ugliest features that C++ has. And I just want to call out this ugly feature which pretty much there's a... So if a C-style cost, if you do just the parentheses and the target type, this is pretty much a hammer that hammers this object into this other type. It says, make this underlying memory area now of this other type. So this is the pretty much the ugliest thing you can do. If you're programming in C++, never ever under any circumstances use the C-style cost because this really messes up the underlying type system. Thanks. Microphone three. I was wondering if you tried your tool with Chakra or Safari and what happened? We did not. We ran it with Firefox mostly. We tried a little bit with Chrome. Again, one of our future works is to port it to more software and larger software. So for this presentation here, we focus mostly on smaller libraries. Yeah, if anybody wants to offer more resources, feel free. If you want to run it on Safari, it's open source. Download it, build it on your system, run it on Safari and report the results. Yeah, just my thought here is I think you might have even more of those Firefox type issues with the way that they do casting. Though I think the difference we found between Firefox and Chrome, so I don't know about Safari, but I can tell you an anecdote about the differences between Firefox and Chrome. So Firefox has a very old code base. So there's a lot of ugliness hidden in there. So we found things that do direct dispatches or indirect dispatches in assembly code and they are doing weird stuff to Vtable pointers in inline assembly just due to the legacy nature of Firefox while in Chrome, Chrome is a much more recent code base and it uses a much more recent C++ standards. It's much nicer and much less likely that we find bugs in there. So just the age of the code base is bad for Firefox or may lead to a large amount of potential vulnerabilities. So some refactoring is needed. Microphone 4. Yeah, what you did is like super cool and son, but I'm just, my question is like the concept of downcasting is a code smell, right? And isn't your tool kind of allowing like people to keep code smell and keep writing smelly code basically? And I just didn't like the reason saying, well, we already have a code base. Wouldn't it be better to have like something that would help people to write non-smelly code? Sure, let's rewrite everything in Rust. I'm all up for it, right? Yes. Sure, there's just this 100 plus million lines of code that are lying around and we cannot easily port it. And the job that we try to do is we try to make it as secure as possible. And we try to find potential vulnerabilities in the existing code base. If you have unlimited resources, let's just stop right now and rewrite everything we have in a safe language. Sure, I'm all up for it. It's just the fact that we have this large amount of code that is out there and we are using it, right? So we have to do the best that we can to bump up the protection for this code as much as possible. Microphone 2. Thanks for a great work. Do you have any similar idea for C code? Yes. Okay, is this work already done? Can I read something about it? Some of it is in progress. We can talk offline about it. Yeah, cool. Okay, microphone 3. Thank you for the talk. I would like to know why did you take the types during allocation and not inside constructor which would feel more natural to me and it would also be as we solved the problem of false positives. Not every type has a constructor. Okay. So what we do pretty much is when you allocate a new type, we don't run it in the allocator, but as part of Clang, we know where the allocators are and we can then tag it and add the metadata as additional code. So as part of our Clang pass, we detect wherever data is being allocated or where the individual allocators are and we tag it and then instrument it in a later step. This allows us to tag all the locations and not just the ones that have constructors. So it allows us to extend the coverage further to not just classes with constructors but all the object allocations. So imagine, and this is something we found in some older software as well, you allocate, you call malloc on a struct and then you use it as a class, right? So you would never be able to detect it as part of a instrumenting or constructor and this actually happens in software like Firefox and other older code bases. You call malloc instead of new and use a struct instead of a class. So I said the code is really, really ugly and here you see the similarity between C and C++. In the end, the class is just a struct and if you allocate objects as structs, you may end up missing a large amount of objects. Shouldn't static cast then fail in compile time if you cast a struct to class? It's still like a class can be a struct, right? So they are equivalent. If it's the same type, you can use the struct as a base type and then you can have a class that is a descendant of that struct. Ah, right, I understand that, thank you. All right, C++ is ugly. Tell me about it. With that, we're at the end of our questions. I'd like to thank our speaker Matias again for this wonderful talk and contribution to the C++ mess. We are trying to fix it. Yeah, okay, thank you very much. Thanks.