4 ms·

"memory safe" languages aren't a silver bullet and urgently rewriting core libraries in a new language can be more dangerous than our current process of analyzi

• marcosdumay 11y ago
  Of course, there's no silver bullet. But this is yet another bug that could not exist at all in a language with automatic memory management. And there are lots and lots of those bugs.
  • laumars 11y ago
    Indeed. But my point was there's lots and lots of ways code can have bugs. Vulnerabilities like these are serious, but rushing through a reimplementation in another language is bound to fail in a multitude of other ways. What we need is not to have knee-jerk reactions akin to angry mops carrying flaming torches and sharpened pitchforks. What we need is to praise the excellent work researchers are doing and to offer our time and/or money into: a) more security research, b) development of experimental alternatives written in memory safe languages, c) yet more security research except this time on the experimental counterparts, d) thorough testing of the experimental counterparts to ensure functional compatibility. Maybe a few years down the line we will have something usable in a few bleeding edge Linux distributions, but it will be even longer still before it will have the backing of Debian, RHEL and SLES.