6 ms·

This is the thing - it's NOT super human. It's not even difficult. It's nothing more than learned behavior. I, for example, just had the advantage of having emp

This is the thing - it's NOT super human. It's not even difficult. It's nothing more than learned behavior. I, for example, just had the advantage of having employers pay me to learn this stuff on the job. Debugging a C++ template crash is difficult. Finding out why the Windows TCP stack does certain things is difficult. Writing clean and non-memory-over-writey 'C' isn't even close to those.

nickpsecurity 11y ago
I have no idea what kinds of apps you're writing where it's that easy. Most apps with widespread use do complex things with code integrated in from many styles and skill levels of programmer. They have to get code cranked out quickly to meet deadlines. In the process, someone slips up with a pointer, array, whatever. This has been true for many projects done by experienced C programmers. Hence, if not superhumans, then writing safe/secure C in such circumstances takes unusual talent. Whereas, it's effortless for people using something like Modula-3 to avoid most of those problems. By design. And checking for fools that turned it off is easy to automate: text search for "UNSAFE."
- ArkyBeagle 11y ago
  Hi nick! I don't know how to describe what it is I do. For lack of a better rubric - "embedded". Frequently, large things are involved, large things with diesel engines. Shipping bugs is always an option. I'm pretty adamant about not doing that any more than I have to. And I work fast enough that this isn't a problem - most of that is that I know how to code & test very quickly. But there's furniture in the code to check for the usual 'C' bug suspects. And yes - "hell is other people's code." This is why I try very very hard not to leave these sort of bugs around, build test fixtures and do other things to defend myself. I have used static analysis now and again. It's kind of nice. Again, and again, and again, dysfunctional organizations abound and it's possible to avoid them altogether. But first you must earn to identify them. It would be absolutely fascinating to work with a security pro to see how I'm doing. Right now, that's not in the cards.
  - nickpsecurity 11y ago
    "Hi nick!" Well, hello there. "For lack of a better rubric - "embedded". Frequently, large things are involved, large things with diesel engines." That's actually pretty cool as I'm gradually learning more about embedded systems. The problem with subversion and INFOSEC was the hardware on up. Got ASIC methodology done. Gotta learn embedded. You do control systems, CAN's, and dashboards for construction hardware and 18-wheelers or something? Generators at datacenters? Ok, I'm running out of ideas as I only think about diesels so much. re rest It looks like your an outlier in my overall claim. The reason is that you've picked a field and specific companies that let you do pretty custom work that's mostly your code at the quality level you prefer. Good for you. It just doesn't negate anything I said about getting C right in general. Your circumstances and effort just make you an exception to the rule. :)
    - ArkyBeagle 11y ago
      We'd chatted before - for some reason your handle is mnemonic :) I'd just as soon not be specific if you don't mind. And in the past it's been wireless, data collecting, even point of sale. Longer past, databases and such. Your last paragraph is spot on. I'm a tiny mote in the overall cost structure, there's a healthy risk aversion and lead times favor good practice. The downside is - I don't have much cover when things don't work. I'm sympathetic to the plight of people dealing with this, and have the conceit ( probably misplaced ) that I can offer encouragement.
      - nickpsecurity 11y ago
        "We'd chatted before - for some reason your handle is mnemonic :)" I figured but memory looses stuff. I tried to make my email handle mnemonic for lay people and technical alike. Rare success. It was accidental if it happened for nickpsecurity handle. "I'd just as soon not be specific if you don't mind. And in the past it's been wireless, data collecting, even point of sale." Wireless collection of emissions for Volkswagon[1]. Yes, I understand the need for confidentiality and keeping emails from the person giving the orders. We'll move along. "there's a healthy risk aversion and lead times favor good practice." Well, that's good. The lead times being an enabler for software QA is a good thing to remember. The "release early, release often" companies might be harder to get onboard with QA. Don't need glacial cycles but at least a few months to work out bugs on significant features. [1] Totally made up fact.
adrianN 11y ago
Come on, if it were that easy we wouldn't have so many security bugs that can be directly traced to some memory corruption issue. Do you think that for example the Firefox developers are either too stupid to do it right or that they just don't care about security or maybe that it's a harder problem than you claim it to be.
- nickpsecurity 11y ago
  That's what I'm saying. I refuse to call people that build things like Firefox incompetent. Apparently, there's intrinsic difficulty to using the language both productively and carefully at the same time. Note: Firefox is coded in C++, though. Rather than contradictory, that what you say is still true given C++ is a safer, more organized C they still can't use safely.
  - ArkyBeagle 11y ago
    I am prepared to call anyone who ships bad code incompetent. We are ALL incompetent at some level, and perhaps on some days. Narrow is the way. You have to look them in the eye and say "It's not ready. You can force me, but you will first provide documentary evidence of that force ( an email prints off just fine ) and by the way here's what you're risking and do try to keep up." And I am dead serious, folks. This is what it will take. It will take each and every contributor making it his/her personal mission as if it was their Klingon honor. The culture right now doesn't even know how to ask for that. Right now, it looks like we can barely even have a conversation about it. Id love to see Modula-<n>, or Rust, or anything else used. But the logistics of that are daunting.
    - dikaiosune 11y ago
      > each and every contributor making it his/her personal mission as if it was their Klingon honor > Id love to see Modula-<n>, or Rust, or anything else used. But the logistics of that are daunting. I'm curious to know why you apparently think the logistics of the first are feasible but the logistics of the latter daunting. To me there's a clear winner in logistical feasibility, and it's definitely not what you're suggesting.

nickpsecurity 11y ago

I have no idea what kinds of apps you're writing where it's that easy. Most apps with widespread use do complex things with code integrated in from many styles and skill levels of programmer. They have to get code cranked out quickly to meet deadlines. In the process, someone slips up with a pointer, array, whatever. This has been true for many projects done by experienced C programmers. Hence, if not superhumans, then writing safe/secure C in such circumstances takes unusual talent. Whereas, it's effortless for people using something like Modula-3 to avoid most of those problems. By design. And checking for fools that turned it off is easy to automate: text search for "UNSAFE."

ArkyBeagle 11y ago
Hi nick! I don't know how to describe what it is I do. For lack of a better rubric - "embedded". Frequently, large things are involved, large things with diesel engines. Shipping bugs is always an option. I'm pretty adamant about not doing that any more than I have to. And I work fast enough that this isn't a problem - most of that is that I know how to code & test very quickly. But there's furniture in the code to check for the usual 'C' bug suspects. And yes - "hell is other people's code." This is why I try very very hard not to leave these sort of bugs around, build test fixtures and do other things to defend myself. I have used static analysis now and again. It's kind of nice. Again, and again, and again, dysfunctional organizations abound and it's possible to avoid them altogether. But first you must earn to identify them. It would be absolutely fascinating to work with a security pro to see how I'm doing. Right now, that's not in the cards.
- nickpsecurity 11y ago
  "Hi nick!" Well, hello there. "For lack of a better rubric - "embedded". Frequently, large things are involved, large things with diesel engines." That's actually pretty cool as I'm gradually learning more about embedded systems. The problem with subversion and INFOSEC was the hardware on up. Got ASIC methodology done. Gotta learn embedded. You do control systems, CAN's, and dashboards for construction hardware and 18-wheelers or something? Generators at datacenters? Ok, I'm running out of ideas as I only think about diesels so much. re rest It looks like your an outlier in my overall claim. The reason is that you've picked a field and specific companies that let you do pretty custom work that's mostly your code at the quality level you prefer. Good for you. It just doesn't negate anything I said about getting C right in general. Your circumstances and effort just make you an exception to the rule. :)
  - ArkyBeagle 11y ago
    We'd chatted before - for some reason your handle is mnemonic :) I'd just as soon not be specific if you don't mind. And in the past it's been wireless, data collecting, even point of sale. Longer past, databases and such. Your last paragraph is spot on. I'm a tiny mote in the overall cost structure, there's a healthy risk aversion and lead times favor good practice. The downside is - I don't have much cover when things don't work. I'm sympathetic to the plight of people dealing with this, and have the conceit ( probably misplaced ) that I can offer encouragement.
    - nickpsecurity 11y ago
      "We'd chatted before - for some reason your handle is mnemonic :)" I figured but memory looses stuff. I tried to make my email handle mnemonic for lay people and technical alike. Rare success. It was accidental if it happened for nickpsecurity handle. "I'd just as soon not be specific if you don't mind. And in the past it's been wireless, data collecting, even point of sale." Wireless collection of emissions for Volkswagon[1]. Yes, I understand the need for confidentiality and keeping emails from the person giving the orders. We'll move along. "there's a healthy risk aversion and lead times favor good practice." Well, that's good. The lead times being an enabler for software QA is a good thing to remember. The "release early, release often" companies might be harder to get onboard with QA. Don't need glacial cycles but at least a few months to work out bugs on significant features. [1] Totally made up fact.

adrianN 11y ago

Come on, if it were that easy we wouldn't have so many security bugs that can be directly traced to some memory corruption issue. Do you think that for example the Firefox developers are either too stupid to do it right or that they just don't care about security or maybe that it's a harder problem than you claim it to be.

nickpsecurity 11y ago
That's what I'm saying. I refuse to call people that build things like Firefox incompetent. Apparently, there's intrinsic difficulty to using the language both productively and carefully at the same time. Note: Firefox is coded in C++, though. Rather than contradictory, that what you say is still true given C++ is a safer, more organized C they still can't use safely.
- ArkyBeagle 11y ago
  I am prepared to call anyone who ships bad code incompetent. We are ALL incompetent at some level, and perhaps on some days. Narrow is the way. You have to look them in the eye and say "It's not ready. You can force me, but you will first provide documentary evidence of that force ( an email prints off just fine ) and by the way here's what you're risking and do try to keep up." And I am dead serious, folks. This is what it will take. It will take each and every contributor making it his/her personal mission as if it was their Klingon honor. The culture right now doesn't even know how to ask for that. Right now, it looks like we can barely even have a conversation about it. Id love to see Modula-<n>, or Rust, or anything else used. But the logistics of that are daunting.
  - dikaiosune 11y ago
    > each and every contributor making it his/her personal mission as if it was their Klingon honor > Id love to see Modula-<n>, or Rust, or anything else used. But the logistics of that are daunting. I'm curious to know why you apparently think the logistics of the first are feasible but the logistics of the latter daunting. To me there's a clear winner in logistical feasibility, and it's definitely not what you're suggesting.