4 ms·

While it is true that in 1979 buffer overflows were known by researchers, it wasn't until much later when it started being exploited in the wild.

pjmlp 10y ago
The problem with security was already well known: "The first principle was security: The principle that every syntactically incorrect program should be rejected by the compiler and that every syntactically correct program should give a result or an error message that was predictable and comprehensible in terms of the source language program itself. Thus no core dumps should ever be necessary. It was logically impossible for any source language program to cause the computer to run wild, either at compile time or at run time. A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to - they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980, language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law." -- The Emperor’s Old Clothes By C.A.R. Hoare Communications of the ACM, 1981 As for exploits in the wild, before the UNIX worm there were the game cheats on home micros.
- partycoder 10y ago
  Buffer overflows were discovered earlier than that, in 1972. http://csrc.nist.gov/publications/history/ande72.pdf http://csrc.nist.gov/publications/history/ande72.pdf However regular C programmers in the 70s and 80s were not defending themselves against arbitrary code execution from buffer overflows. In addition, you can take C programming books from the time and see how functions like memcpy and strcpy were being used in unsafe ways. That is my point. If you are going to reuse old programs, be aware that in earlier decades there wasn't as much awareness about security as there is today.

pjmlp 10y ago

The problem with security was already well known: "The first principle was security: The principle that every syntactically incorrect program should be rejected by the compiler and that every syntactically correct program should give a result or an error message that was predictable and comprehensible in terms of the source language program itself. Thus no core dumps should ever be necessary. It was logically impossible for any source language program to cause the computer to run wild, either at compile time or at run time. A consequence of this principle is that every occurrence of every subscript of every subscripted variable was on every occasion checked at run time against both the upper and the lower declared bounds of the array. Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to - they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980, language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law." -- The Emperor’s Old Clothes By C.A.R. Hoare Communications of the ACM, 1981 As for exploits in the wild, before the UNIX worm there were the game cheats on home micros.

partycoder 10y ago
Buffer overflows were discovered earlier than that, in 1972. http://csrc.nist.gov/publications/history/ande72.pdf http://csrc.nist.gov/publications/history/ande72.pdf However regular C programmers in the 70s and 80s were not defending themselves against arbitrary code execution from buffer overflows. In addition, you can take C programming books from the time and see how functions like memcpy and strcpy were being used in unsafe ways. That is my point. If you are going to reuse old programs, be aware that in earlier decades there wasn't as much awareness about security as there is today.