activity asks you to drink responsibly
whatever that means
looks like we're nearly there it's all
about the I.T
yeah it is my fault to be honest all
right so over to mark
sorry for the being delayed uh
technology is not something that we
could be proud of I believe so let's
have a little talk about numbers
in the past years developers became so
freaking
I would say spoiled uh by the justworks
mentality that we really had to give
them kind of a squeeze I would say and
therefore I prepared this talk uh as no
one is actually able to escape the
introduction I would not Escape it
either my name is Mark moodley and I've
been creating breaking and fixing
systems around the world in the past oh
gosh
20 25 years I'm always as hell so yeah
in the past 25 years and I've gathered
some interesting stories during these
days and therefore I would like to share
one of the stories with you at least
so uh
I've been traveling in Europe quite a
lot is there anybody from this country
or is there anybody who could name which
country this is
it's Switzerland I kind of like this
place because it has a lot of nice lakes
and the trains are always on time
actually I was there during our
honeymoon and I had The Misfortune to
experience the only train in Switzerland
that was late in like the past 100 years
or something like that so on the train
station
we've seen an interesting thing a link
to a document
which
I wouldn't say that I was bored on my
honeymoon but I started to read is there
anyone who could speak German in the
audience raise your hand
okay uh I would not bore everyone to try
to decode uh what's over here but I
really love uh to understand the
following translation that I made feel
free to judge it so if you've got a
better translation just reach me out at
uh
mark.modly at hardcoreit.com so
why is this topic quite interesting to
us in the train building
what is this magic number that we've
highlighted over here
one bit
es Maybe
go ahead so uh this is exactly one byte
so if a train company or a railway
system could
basically tell the word that you know
what we are not going to put in the time
and effort to create a software where
you are able to to get around in train
the size that you want then I would say
we could look further into numbers and
take it serious
so if we take uh the number the 256 into
account then the legislation only
mentioned this number so if I want to
break around in Switzerland I will be
able to drive a train with the real
number of
button
that is forbidden I have to check it
what's the next number which would
be problematic in this area
all right
yes exactly I do not know I'm just
throwing in your general direction so uh
the 250
256 number is a problem it is it gets
displayed in the actual file that states
that well you are not allowed to do that
of course uh every trained conductor has
to check that uh you are not uh having
exactly 256 wheels or axles sorry on
your train but as good hackers we would
we would drive around in uh 512 extra
long of trains if you do not really
believe me that this is an actual
legislation in uh Switzerland just
follow the link by the way does it work
could you tell me
who's the first one who checked
so this is the actual link uh to the
document and now that I destroyed all my
credibility uh I could get forward and
tell you a little fake uh story uh that
is an old dad joke so uh
I didn't believe that one of my friend
who was working as a road construction
uh has been stealing from his workplace
Works place but when I arrived to their
home all the signs were there now so in
numerics also the signs are there and we
could have problems here as well not
just the uh horrible jokes that I'm
gonna tell for you so you are free to
live by the way no one is tying you down
there okay uh
developers tend to get comfortable and
spoiled and
uh tend to believe
that normal arithmetic operates in our
world as it does in computers
so is there anybody for a duck who could
tell me what the following statement
will print come on it's just like four
lines of C or C plus plus code
is there anybody who could tell me
it is not that big of a thing just
adding minus one zero and one together
quack quack the time is up
what would it be
pattern
we are going to arrive to that
but actually this is more than 4 billion
you are failing at basic mathematics
right now if you're gonna check this and
let me let me check if I could restart
my terminal for example because my
computer just crashed before
we arrived on the stage
and let me show you that this is not
just a fluke
so are here
let me
check it we've got a file called
example.c I believe
yes this is exactly the same four lines
of C code that we had
now if I compile uh this uh this uh
little application
and run this little snippet
that should be the only one who runs we
can see indeed that this is the 4
billion that we've seen on the slides
that is kind of strange what is
happening
in here so as you can see uh we are
using different types of numbers here
for example the minus one is a signed
integer the uh 0 U is an unsigned
integer and the one long is assigned
long value and therefore if you are
writing any C or C plus plus application
if you juggle around with the types you
could have these kind of errors and
these kind of problems so I would kindly
ask everyone if you write anything in C
or C plus plus try to use the same
number types or at least check it the
behavior is because the upcasting of
numbers if you take a look at the 0 U
that is messing up everything because we
are storing numbers in a two complements
format etc etc kind of an interesting
task if you would like to I will bore
you with the details after the talk but
let's go uh to the next uh point is
there any question by the way to this
not yet or I was able to steamroll
everyone so what does uh bubble do in an
empty room
of course it
flows let's see floats
uh if you are failing the basic
arithmetics for example adding together
1 and -1 uh now uh you could get ready
to fail in advanced mathematics as well
have you ever divided by zero
thank you
yes on the mechanical computer that
would cause quite a havoc and if you are
doing integer operation that would
result in an exception as well but
let me just check if I'm able to get
back to the example
dot slash should be example Java
yes
that should be example the Java I
believe we've got the same that's five
lines so uh
what is that like 25 increment to the C
code to get around uh
we've got this little Java snippet and
of course uh we have the same problem
here
that the expected value or or the
expected exception is not happening at
all that is quite a problem I would
believe and in
every languages that are uh using the
floating Point algorithm or the floating
point
uh standard then they are behaving the
same so as you can see we've got the
Infinity uh in floating point there are
other quite interesting stories as well
uh if you've ever developed a game or
try to break one they mostly use uh
floating Point numbers like doubles and
stuff
but they never do equation comparison
comparison so as you know we've got a
language which is quite used in the uh
web word and in the web word uh if you
use JavaScript to add together
0.1 and 0.2 what will be the result
for another duck
not
0.3 but 0.3
0004
this is because uh the floating Point
algorithm is just an approximation
meaning that you do not really have
exact
values in this case so uh let me
have a developer console for you and run
some stuff
maybe we will see over here
so
uh who could tell me what the result of
this uh spoiled something is what I've
stated let me check it because I lost my
credibility with the recalling
so as you can see indeed it is not 0.3
even though you add two seemingly
innocent number together then you get
something which is kind of strange but
we can go further in this environment or
word
0.3
is not 0.3 at all
so if you take a look at the 0.3 and we
print it to a greater
Precision like
54
then we can see that indeed 0.3 is
smaller than 0.3
and we have another interesting thing
all right all right everything uh with
the decimal point in in it could be
wrecked but there is more even numbers
which do not have had decimal points is
there anybody who could tell me what the
second example
uh would result in
for another doctor of course
could you expand that a little bit
we are getting to the right point so you
definitely deserve a duck what is
happening here in JavaScript this number
does not exist
at all
you're gonna attack them
okay uh I would not try to attempt to
destroy the uh
well that's perfect again thank you so
this number does not exist in JavaScript
if I try to get this number by adding
the
so this number exists right but if we
want to add one to it
it simply does not exist it Returns the
same number and we are able to create
scenarios in node environments for
example when we DDOS the whole system
with just one number which is never
incremented even though we are
incrementing it uh all the time
so
let me get back to the slides uh how is
this even possible
it was so bad or either nobody got it so
let's summarize everything uh
what the hell does this everything do
with hacking and uh with I.T security at
all so in the first case uh with the
examples of trains uh we know that it is
not just I.T security that we are
jeopardizing uh by using or creating
systems that use numbers that are so low
and small uh that we could override with
our train uh with 512 axles on the
tracks but we could have quite a lot of
other problems as well uh we could DDOS
for example systems uh with the above
mentioned example although it is a whole
number and also if someone is Old As I
Am they should remember the mark of the
beast error or bug their floating Point
algorithm weren't able to decide in a
really small number which one to choose
and they basically they were able to
DDOS everything uh we're just sending
one number and the pausing of that
number broke the whole system down also
integer overflows as the first example
under the floating Point problems could
arise uh
is there anybody who could
tell me what the following sequence is
or the result
of that
and we are arriving to the
not the number
guy
Batman I wanted to get a a Batman faced
duck but it was out of stock so sorry I
would have been better all right so
let's summarize everything uh
if we take a look at numbers and we
start to get comfortable with them a lot
of times we really do not know what we
are doing as developers and therefore if
you would like to break a system it is
always nice to try what the developer do
does not know so thank you very much for
listening uh questions and feedback is
always welcome uh you can reach me at
mar.mo DIY hardcoreity.com I do security
trainings for developers so I'm trying
to protect them from you
so far it is uh successful but if
someone is not attending a course like
this then they have no idea what is
going on in this world
okay is there any question that I should
answer with numbers
there are quite a lot of Deep
mockery going on in the number word as
well so feel free to dive in and take a
look at that uh and uh just signing off
uh I need to tell you that while writing
this presentation I got into the fight
uh with minus one and one uh so I could
say that the odds were against me
yeah
I could intend it any lower
then thank you very much Mark thank you
thank you very much
and you had a perfect number then
exactly 20.
2020 exactly 20 minutes perfect number