4 ms·
> > It has more than 2M lines of C code. Almost all libraries were written from scratch. > Every professional security researcher reading this just raised an e
by adrusi 11y ago
> > It has more than 2M lines of C code. Almost all libraries were written from scratch.
> Every professional security researcher reading this just raised an eyebrow and thought to themselves, "That's a vulnerable application."
That may be true, but substitute "C" with "Python" and wouldn't you have the same reaction? Maybe you would expect it to be slightly less vulnerable, but the key risk that I read in that statement (I am not a security professional) is the "2M" and the "written from scratch". The risk from "C" is secondary.
- Avshalom 11y agoLess vulnerable is still an improvement.
- serge2k 11y agoNot if it doesn't work anymore.
- RichN 11y agoI would think a 2M line Python application would suffer logic bugs, like the C version. However, I wouldn't worry about indexing off the end of arrays, NULL pointer accesses, etc. which occur in C (sometimes silently) on top of the logic errors.