4 ms·

Reminds me of Perl's taint mode. It is not the same in terms of implementation or the types of limits imposed, of course, but it has some of the same basic idea

Reminds me of Perl's taint mode. It is not the same in terms of implementation or the types of limits imposed, of course, but it has some of the same basic ideas...you have to work really hard to make some kinds of stupid mistakes when the code is tainted, and I think the same sort of idea is at play here. I really like it when tools do the work of preventing me from doing dumb stuff. Security, in particular, is such a difficult task with so much knowledge required (particularly in a language like C) that it's almost surprising that software has as few vulnerabilities as it does. I'm unlikely to ever start a new project in C again, but if I do find myself in a networked C project maintenance or patching situation, I certainly would consider pulling this in.

joosters 11y ago
Perl's taint checking really was ahead of its time (introduced in 1988, according to Wikipedia!) Are there other languages that have this feature? (wiki only mentions Ruby)
- pmarin 11y ago
  Tcl has a safe interpreter mode https://www.tcl.tk/man/tcl/TclCmd/safe.htm https://www.tcl.tk/man/tcl/TclCmd/safe.htm
- jameshart 11y ago
  Taint checking offers a false sense of safety. Sure, data that originates in a request is unsafe, but does that means data retrieved from storage is safe? The right thing to do is to move away from plain string concatenation/interpolation: don't build dynamic SQL, don't hack together strings into JavaScript or HTML - use smart, format-aware templating tools (like golang's HTML templates) and parameterization.
  - joosters 11y ago
    Data read from files is also tainted. I disagree with the 'false sense of security' as well - just like every other security feature from any system or technique you care to name, taint checking improves security but makes absolutely no claim that it magically makes your code completely secure.
- lmm 11y ago
  In a language with a modern type system it doesn't need to be a language-level feature. I use Scala and any use of unadorned String will be picked up in code review, because generally we prefer to use some specific type that says what it represents.
  - jfoutz 11y ago
    It's amusing the solution you present is code review. I'd bet naked strings never get that far, because your business libraries all expect CustomerName or whatever.
    - lmm 11y ago
      Sure, but occasionally new programmers will do a bunch of work with a String and and only wrap it as a CustomerName before making a library call.
- nightcracker 11y ago
  World of Warcraft's addon system uses a taint system to keep certain actions in the UI secure. It uses Lua, but I don't believe the taint system is available by default in Lua.
protomyth 11y ago
"I'm unlikely to ever start a new project in C again" I wonder what this would look like in other languages? It would be interesting to try this out in another language.
- SwellJoe 11y ago
  There's a tendency to assume that because newer languages are safer than C that they are "safe". I suspect people would be unlikely to think about the problem in the same way for, say, Go or Rust, even though there are still security gotchas that can happen when dealing with system calls from those languages. But, then again, a lot of the kinds of security bugs tame() is addressing really are already unlikely in Go or Rust. But, now that I think about it, I would like to see examples of priv-sep in Go or Rust. It's a challenging problem in C, and one that I never implemented (I was moving away from working on any C projects within a couple of years of priv-sep being introduced into OpenSSH), and one of the things that is neat about tame() is that is seems to abstract some of those difficult aspects. So, seeing best practices for priv-sep in a modern language would be really cool...I wouldn't even know where to start to figure it out, since I'm so new to both Rust and Go.
  - technofiend 11y ago
    I keep wondering if it's time for a Gopen BSD or a Rust in BSDeace or some equally terrible name that means re-writing the OS except for the fiddly assembler bits in a safer language. Where are Vernor Vinge's Focused programmers when you really need to outsource something?
    - vezzy-fnord 11y ago
      lsub is currently working on a Plan 9-ish OS in Go called Clive, though still as a research system: http://lsub.org/ls/clive.html http://lsub.org/ls/clive.html
      - technofiend 11y ago
        Oh man Plan 9 broke my heart once already when they didn't become the Next Big Thing. I was digging their take on namespaces after seeing something similar for filesystems on Apollo's UNIX. I would love to "break glass" (I.e. temporarily gain privileged access) to a remote system's namepace and dtrace/systemtap running processeses without ever leaving my desktop.
shanemhansen 11y ago
You can call tame() from other languages, I assume it would offer just as much benefit in python or ruby.
- SwellJoe 11y ago
  Wouldn't it need to happen at a lower level than merely having some bindings to tame()? I mean, the interpreter itself wouldn't be subject to tame(), even if some specific C calls made within your Python or Ruby program are; when you call a Python or Ruby function that makes syscalls on your behalf (which is a lot of syscalls), they wouldn't be subject to tame(). But, maybe I'm misunderstanding how it works. It doesn't appear to be a switch that turns on tame() for the whole process. I don't know that it would be useless when wrapped and called from Python or Ruby, but it seems unlikely to have the same effect it has on C code (but, then again, C code needs a lot more help than Python or Ruby).
  - im3w1l 11y ago
    Wouldn't tame applied to the process that called it? And for an interpreted language, that would be the interpreter. And if the interpreter can't is unable to do something, then the interpreted code would be unable to do it too.
    - SwellJoe 11y ago
      Ah, yes, I guess you're right. I was thinking this wasn't just a switch for the whole process, but reading the examples again, I see that it is a switch for the whole process. So, it isn't as comparable to taint (which attaches to data, rather than the whole process) as I'd initially thought, except in the sense of being an automated method to prevent some kinds of stupid security mistakes.
  - tedunangst 11y ago
    Your ruby interpreter is in the same process as your ruby code. One might imagine using tame to prevent the yaml parser from calling system().

joosters 11y ago

Perl's taint checking really was ahead of its time (introduced in 1988, according to Wikipedia!) Are there other languages that have this feature? (wiki only mentions Ruby)

pmarin 11y ago
Tcl has a safe interpreter mode https://www.tcl.tk/man/tcl/TclCmd/safe.htm https://www.tcl.tk/man/tcl/TclCmd/safe.htm
jameshart 11y ago
Taint checking offers a false sense of safety. Sure, data that originates in a request is unsafe, but does that means data retrieved from storage is safe? The right thing to do is to move away from plain string concatenation/interpolation: don't build dynamic SQL, don't hack together strings into JavaScript or HTML - use smart, format-aware templating tools (like golang's HTML templates) and parameterization.
- joosters 11y ago
  Data read from files is also tainted. I disagree with the 'false sense of security' as well - just like every other security feature from any system or technique you care to name, taint checking improves security but makes absolutely no claim that it magically makes your code completely secure.
lmm 11y ago
In a language with a modern type system it doesn't need to be a language-level feature. I use Scala and any use of unadorned String will be picked up in code review, because generally we prefer to use some specific type that says what it represents.
- jfoutz 11y ago
  It's amusing the solution you present is code review. I'd bet naked strings never get that far, because your business libraries all expect CustomerName or whatever.
  - lmm 11y ago
    Sure, but occasionally new programmers will do a bunch of work with a String and and only wrap it as a CustomerName before making a library call.
nightcracker 11y ago
World of Warcraft's addon system uses a taint system to keep certain actions in the UI secure. It uses Lua, but I don't believe the taint system is available by default in Lua.

protomyth 11y ago

"I'm unlikely to ever start a new project in C again" I wonder what this would look like in other languages? It would be interesting to try this out in another language.

SwellJoe 11y ago
There's a tendency to assume that because newer languages are safer than C that they are "safe". I suspect people would be unlikely to think about the problem in the same way for, say, Go or Rust, even though there are still security gotchas that can happen when dealing with system calls from those languages. But, then again, a lot of the kinds of security bugs tame() is addressing really are already unlikely in Go or Rust. But, now that I think about it, I would like to see examples of priv-sep in Go or Rust. It's a challenging problem in C, and one that I never implemented (I was moving away from working on any C projects within a couple of years of priv-sep being introduced into OpenSSH), and one of the things that is neat about tame() is that is seems to abstract some of those difficult aspects. So, seeing best practices for priv-sep in a modern language would be really cool...I wouldn't even know where to start to figure it out, since I'm so new to both Rust and Go.
- technofiend 11y ago
  I keep wondering if it's time for a Gopen BSD or a Rust in BSDeace or some equally terrible name that means re-writing the OS except for the fiddly assembler bits in a safer language. Where are Vernor Vinge's Focused programmers when you really need to outsource something?
  - vezzy-fnord 11y ago
    lsub is currently working on a Plan 9-ish OS in Go called Clive, though still as a research system: http://lsub.org/ls/clive.html http://lsub.org/ls/clive.html
    - technofiend 11y ago
      Oh man Plan 9 broke my heart once already when they didn't become the Next Big Thing. I was digging their take on namespaces after seeing something similar for filesystems on Apollo's UNIX. I would love to "break glass" (I.e. temporarily gain privileged access) to a remote system's namepace and dtrace/systemtap running processeses without ever leaving my desktop.

shanemhansen 11y ago

You can call tame() from other languages, I assume it would offer just as much benefit in python or ruby.

SwellJoe 11y ago
Wouldn't it need to happen at a lower level than merely having some bindings to tame()? I mean, the interpreter itself wouldn't be subject to tame(), even if some specific C calls made within your Python or Ruby program are; when you call a Python or Ruby function that makes syscalls on your behalf (which is a lot of syscalls), they wouldn't be subject to tame(). But, maybe I'm misunderstanding how it works. It doesn't appear to be a switch that turns on tame() for the whole process. I don't know that it would be useless when wrapped and called from Python or Ruby, but it seems unlikely to have the same effect it has on C code (but, then again, C code needs a lot more help than Python or Ruby).
- im3w1l 11y ago
  Wouldn't tame applied to the process that called it? And for an interpreted language, that would be the interpreter. And if the interpreter can't is unable to do something, then the interpreted code would be unable to do it too.
  - SwellJoe 11y ago
    Ah, yes, I guess you're right. I was thinking this wasn't just a switch for the whole process, but reading the examples again, I see that it is a switch for the whole process. So, it isn't as comparable to taint (which attaches to data, rather than the whole process) as I'd initially thought, except in the sense of being an automated method to prevent some kinds of stupid security mistakes.
- tedunangst 11y ago
  Your ruby interpreter is in the same process as your ruby code. One might imagine using tame to prevent the yaml parser from calling system().