Pencil-and-paper coding questions on computer science exams are unrealistic: real developers work at a keyboard with extensive resources at hand, rather than on paper with few or no notes. We address the challenge of administering a proctored exam in which students must write code that passes instructor-provided test cases as well as writing test cases of their own. The exam environment allows students broad access to Internet resources they would use for take-home programming assignments, while blocking their ability to use that facility for direct communication with colluders. Our system supports cumulative questions (in which later parts depend on correctly answering earlier parts) by allowing the test-taker to reveal one or more hints by sacrificing partial credit for the question. Autograders built into the exam environment provide immediate feedback to the student on their exam grade. In case of grade disputes, a virtual machine image reflecting all of the student's work is preserved for later inspection. While elements of our scheme have appeared in the literature (autograding, semi-locked-down computer environments for exam-taking, hint "purchasing"), we believe we are the first to combine them into a system that enables realistic in-class coding-based exams with broad Internet access. We report on lessons and experience creating and administering such an exam, including autograding-related pitfalls for high-stakes exams, and invite others to use and improve on our tools and methods.

While tremendously useful, automated techniques for tuning the precision of floating-point programs face important scalability challenges. We present Blame Analysis, a novel dynamic approach that speeds up precision tuning. Blame Analysis performs floating-point instructions using different levels of accuracy for their operands. The analysis determines the precision of all operands such that a given precision is achieved in the final result of the program. Our evaluation on ten scientific programs shows that Blame Analysis is successful in lowering operand precision. As it executes the program only once, the analysis is particularly useful when targeting reductions in execution time. In such case, the analysis needs to be combined with search-based tools such as Precimonious. Our experiments show that combining Blame Analysis with Precimonious leads to obtaining better results with significant reduction in analysis time: the optimized programs execute faster (in three cases, we observe as high as 39.9% program speedup) and the combined analysis time is 9x faster on average, and up to 38x faster than Precimonious alone.

Computer security has become a central focus in the information age. Though enormous effort has been expended on ensuring secure computation, software exploitation remains a serious threat. The software attack surface provides many avenues for hijacking; however, most exploits ultimately rely on the successful execution of a control-flow attack. This pervasive diversion of control flow is made possible by the pollution of control flow structure with attacker-injected runtime data. Many control-flow attacks persist because the root of the problem remains: runtime data is allowed to enter the program counter. In this paper, we propose a novel approach: Control-Data Isolation. Our approach provides protection by going to the root of the problem and removing all of the operations that inject runtime data into program control. While previous work relies on CFG edge checking and labeling, these techniques remain vulnerable to attacks such as heap spray, read, or GOT attacks and in some cases suffer high overheads. Rather than addressing control-flow attacks by layering additional complexity, our work takes a subtractive approach; subtracting the primary cause of contemporary control-flow attacks. We demonstrate that control-data isolation can assure the integrity of the programmer's CFG at runtime, while incurring average performance overheads of less than 7% for a wide range of benchmarks.