7 ms·

I'm kind of torn on this. On the one hand, Curl is a great piece of software with a better security record than most, the engineering choices it's made thus fa

I'm kind of torn on this. On the one hand, Curl is a great piece of software with a better security record than most, the engineering choices it's made thus far have served it just fine, and its developers quite reasonably view rewriting it as risky and unnecessary. On the other hand, the state of internet security is really terrible, and the only way it'll ever get fixed is if we somehow get to the point where writing networking code in a non-memory-safe language is considered professional malpractice. Because it should be; reliably not introducing memory corruption bugs without a compiler checking your work is a higher standard than programmers can realistically be held to, and in networking code such bugs often have immediate and dramatic security consequences. We need to somehow create a culture where serious programmers don't try to do this, the same way serious programmers don't write in BASIC or use tarball backups as version control. That so much existing high-profile networking software is written in C makes this a lot harder, because everyone thinks "well all those projects do it so it must be okay".

baldfat 10y ago
> the only way it'll ever get fixed is if we somehow get to the point where writing networking code in a non-memory-safe language is considered professional malpractice. So using Linux, Windows, BSD or MacOS servers are malpractice? I think you might have over stated your case. So are you waiting for a memory safe Herd re-write? A memory safe any OS will be decades away if someone wanted to start tackling it now.
- freddref 10y ago
  writing, not using.
- pjmlp 10y ago
  Microsoft does research how to improve security at OS level and sometimes those efforts do end up on Windows. Latest examples, Windows 10 secure kernel and Device Driver protection. https://myignite.microsoft.com/sessions/36925 https://myignite.microsoft.com/sessions/36925 Or the new Windows USB stack, written in the P language. https://github.com/p-org/P https://github.com/p-org/P UNIXes, not so much beyond patching C exploits.
  - madphrodite 10y ago
    And the last windows 7 update black screened my pc and left me in limbo till I was able to restore. What exactly is your point? Windows is not a standard to be held higher than..well anything.
    - dsacco 10y ago
      The parent commenter used Windows 10 as an example and you used Windows...7. His point, which is that Microsoft actively researches and implements OS-level security improvements, hasn't been rebutted by your statement about Windows 7. Windows 7 was released in 2009. There are substantial proactive improvements that Microsoft cannot feasibly backport to older OS versions even if they're still within the support period, and the corporate culture was simply different when Windows 7 was released.
      - madphrodite 10y ago
        Did you know that I can still run, patch and support linux distributions written in 2009 if I want to? Did you know that?
      - petee 10y ago
        Counter-point: Windows 10 updates locked up 2 of my machines - Microsoft has a tough time implementing most things properly...
      - madphrodite 10y ago
        Substantial proactive improvements not relevant to the same build|OS which comes full circle to the linux comment which is so hated. That is: anyone with source and knowledge can make it work and those without...blackscreen.
    - baldfat 10y ago
      I think the vast majority of people would say Windows has been getting much better in security since the days of XP. People can choose Linux, BSD, MacOS or Windows and have a good choice that is reasonably secure.
- fiedzia 10y ago
  > So using Linux, Windows, BSD or MacOS servers are malpractice? If you sell it as "secure", yes absolutely. And there are many applications where you would not be even considered as a contractor for doing so. There is increasing number of situations where you want to provide hard guarantees (written in contract) about quality of the software and service you are providing. "we are using Linux" sometimes is not good enough.
- kps 10y ago
  Of course they're overstated their case. Needs differ. When I wrote networking code a couple jobs ago it was in assembler, because a new frame will be along in 67ns whether you're ready or not.
marcosdumay 10y ago
At extreme cases, where you want to prove your network stack, you'd have to write it in C (or something equivalently dangerous), because you can't prove big runtimes. But in mid-way applications, dangerous languages are dangerous, and should be avoided. I'd think the most "correct" way to handle this is to create small bits of network code with proof of correctness that handles down parsed and tagged (typed) data into code in high level languages. In that case, Curl type of code would still be in C.
- bluejekyll 10y ago
  With Rust this tradeoff of safe-with-runtime vs. unsafe-without-runtime is no longer your only choice. Now you can choose safe-with-strong-compiler-no-runtime...
  - pjmlp 10y ago
    This tradeoff wasn't already an issue with languages like Modula and Ada.
    - bluejekyll 10y ago
      Yeah, I realized after posting that this would be a critique. I should have stipulated that it's a C syntactic language, which seems to be many peoples preference based on the most successful languages out there. I never did much with Ada or Modula, so I won't claim to know anything more than their syntax, etc.
    - staticassertion 10y ago
      As far as I am aware Ada is not memory safe without a runtime and with the presence of non-static memory. So you either have a runtime, no deallocation, or unsafety.
      - pjmlp 10y ago
        C also needs a runtime, it is called crt0 on UNIX and it is what calls main(), sets up global initialization functions (constructor functions in GCC C), emulates floating point,... As for Ada, you can selectively disable which parts of the runtime actually land on the generated executable via compiler pragmas. Deallocation can be done via pools or controlled types.
greenhouse_gas 10y ago
Small history of security: First major security breech through buffer -overflow was in the late 80s. So when Java came out, they played it "safe" - the language, despite having pointers will be absolutely safe. NullPointerExceptions and ArrayOutOfBoundsException will cause the program to crash rather than corrupting the stack. Perfect. Except it wasn't. It ended up being so "holy" that it's now banned in browsers. So, everyone said to move to JS. Another "perfectly safe" language. But it's too slow. So JIT it. Now it's no longer "perfectly safe". Rinse and repeat. And rust won't help here, because while the " compiler " can be guaranteed safe, the code it outputs can't (think of a C compiler written in Rust). Maybe the solution isn't to rely on language (except for the Kernel) but to make of easy to spawn OS processes that simply have no rights to call any syscalls and limited amount of memory (or a white-listed amount of syscalls). Take it like this: Firefox (the browser) has full rights. It starts a process (which can only connect to the network to IP RemoteHost). If process dies (for whatever reason) or takes too long, tell user that "sorry, sites broken". Now, malicious code causes the attacker to run arbitrary code? Who cares? You can't overwrite the browser's code and can't break out. The browser just has to ensure that its subprocess gives you good output. Same with JS, CSS, or image libraries.
- vidarh 10y ago
  > Maybe the solution isn't to rely on language (except for the Kernel) but to make of easy to spawn OS processes that simply have no rights to call any syscalls and limited amount of memory (or a white-listed amount of syscalls). We have that [1] [2]. It's cumbersome to use, but it's based on the bpf JIT used for tcddump etc. We also have a variety of other mechanisms you can combine with that to tie down a process. But even then it's hard to get this right in a way that's both performant and secure, because you have to protect every user every time, while for an attacker a very low success rate can still be worth it. [1] https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt https://www.kernel.org/doc/Documentation/prctl/seccomp_filte... [2] https://wiki.mozilla.org/Security/Sandbox/Seccomp https://wiki.mozilla.org/Security/Sandbox/Seccomp
- doomrobo 10y ago
  You're conflating the issues of running untrusted code with running trusted code on untrusted input. JS is untrusted code that you run on your computer. Your other examples generally do not fall into this camp. Java being an allegedly safe server-side language has nothing to do with it being a very difficult language to sandbox when running untrusted code. It doesn't matter what language the malware I just downloaded was written in, because it's malware and it's running on my computer. What makes Java different from C in this case is that when I run a Java application on my server, I can be more confident in the fact that I will not have a buffer overflow, even when I expose the service to the entire internet.
Corrado 10y ago
I get the feeling that very few old school authors would come forward and say "Hey, my project code is not good and needs to be re-written." Most of the time the message is more like "Sure we're using C but we're very careful and have built in a lot of safeguards." I like your idea of a default mindset of internet tools should be written in a safe language with proper engineering techniques. I'm not sure I would go as far as malpractice but it might be a good stick to use to force makers into better practices.

baldfat 10y ago

> the only way it'll ever get fixed is if we somehow get to the point where writing networking code in a non-memory-safe language is considered professional malpractice. So using Linux, Windows, BSD or MacOS servers are malpractice? I think you might have over stated your case. So are you waiting for a memory safe Herd re-write? A memory safe any OS will be decades away if someone wanted to start tackling it now.

freddref 10y ago
writing, not using.
pjmlp 10y ago
Microsoft does research how to improve security at OS level and sometimes those efforts do end up on Windows. Latest examples, Windows 10 secure kernel and Device Driver protection. https://myignite.microsoft.com/sessions/36925 https://myignite.microsoft.com/sessions/36925 Or the new Windows USB stack, written in the P language. https://github.com/p-org/P https://github.com/p-org/P UNIXes, not so much beyond patching C exploits.
- madphrodite 10y ago
  And the last windows 7 update black screened my pc and left me in limbo till I was able to restore. What exactly is your point? Windows is not a standard to be held higher than..well anything.
  - dsacco 10y ago
    The parent commenter used Windows 10 as an example and you used Windows...7. His point, which is that Microsoft actively researches and implements OS-level security improvements, hasn't been rebutted by your statement about Windows 7. Windows 7 was released in 2009. There are substantial proactive improvements that Microsoft cannot feasibly backport to older OS versions even if they're still within the support period, and the corporate culture was simply different when Windows 7 was released.
    - madphrodite 10y ago
      Did you know that I can still run, patch and support linux distributions written in 2009 if I want to? Did you know that?
    - petee 10y ago
      Counter-point: Windows 10 updates locked up 2 of my machines - Microsoft has a tough time implementing most things properly...
    - madphrodite 10y ago
      Substantial proactive improvements not relevant to the same build|OS which comes full circle to the linux comment which is so hated. That is: anyone with source and knowledge can make it work and those without...blackscreen.
  - baldfat 10y ago
    I think the vast majority of people would say Windows has been getting much better in security since the days of XP. People can choose Linux, BSD, MacOS or Windows and have a good choice that is reasonably secure.
fiedzia 10y ago
> So using Linux, Windows, BSD or MacOS servers are malpractice? If you sell it as "secure", yes absolutely. And there are many applications where you would not be even considered as a contractor for doing so. There is increasing number of situations where you want to provide hard guarantees (written in contract) about quality of the software and service you are providing. "we are using Linux" sometimes is not good enough.
kps 10y ago
Of course they're overstated their case. Needs differ. When I wrote networking code a couple jobs ago it was in assembler, because a new frame will be along in 67ns whether you're ready or not.

marcosdumay 10y ago

At extreme cases, where you want to prove your network stack, you'd have to write it in C (or something equivalently dangerous), because you can't prove big runtimes. But in mid-way applications, dangerous languages are dangerous, and should be avoided. I'd think the most "correct" way to handle this is to create small bits of network code with proof of correctness that handles down parsed and tagged (typed) data into code in high level languages. In that case, Curl type of code would still be in C.

bluejekyll 10y ago
With Rust this tradeoff of safe-with-runtime vs. unsafe-without-runtime is no longer your only choice. Now you can choose safe-with-strong-compiler-no-runtime...
- pjmlp 10y ago
  This tradeoff wasn't already an issue with languages like Modula and Ada.
  - bluejekyll 10y ago
    Yeah, I realized after posting that this would be a critique. I should have stipulated that it's a C syntactic language, which seems to be many peoples preference based on the most successful languages out there. I never did much with Ada or Modula, so I won't claim to know anything more than their syntax, etc.
  - staticassertion 10y ago
    As far as I am aware Ada is not memory safe without a runtime and with the presence of non-static memory. So you either have a runtime, no deallocation, or unsafety.
    - pjmlp 10y ago
      C also needs a runtime, it is called crt0 on UNIX and it is what calls main(), sets up global initialization functions (constructor functions in GCC C), emulates floating point,... As for Ada, you can selectively disable which parts of the runtime actually land on the generated executable via compiler pragmas. Deallocation can be done via pools or controlled types.

greenhouse_gas 10y ago

Small history of security: First major security breech through buffer -overflow was in the late 80s. So when Java came out, they played it "safe" - the language, despite having pointers will be absolutely safe. NullPointerExceptions and ArrayOutOfBoundsException will cause the program to crash rather than corrupting the stack. Perfect. Except it wasn't. It ended up being so "holy" that it's now banned in browsers. So, everyone said to move to JS. Another "perfectly safe" language. But it's too slow. So JIT it. Now it's no longer "perfectly safe". Rinse and repeat. And rust won't help here, because while the " compiler " can be guaranteed safe, the code it outputs can't (think of a C compiler written in Rust). Maybe the solution isn't to rely on language (except for the Kernel) but to make of easy to spawn OS processes that simply have no rights to call any syscalls and limited amount of memory (or a white-listed amount of syscalls). Take it like this: Firefox (the browser) has full rights. It starts a process (which can only connect to the network to IP RemoteHost). If process dies (for whatever reason) or takes too long, tell user that "sorry, sites broken". Now, malicious code causes the attacker to run arbitrary code? Who cares? You can't overwrite the browser's code and can't break out. The browser just has to ensure that its subprocess gives you good output. Same with JS, CSS, or image libraries.

vidarh 10y ago
> Maybe the solution isn't to rely on language (except for the Kernel) but to make of easy to spawn OS processes that simply have no rights to call any syscalls and limited amount of memory (or a white-listed amount of syscalls). We have that [1] [2]. It's cumbersome to use, but it's based on the bpf JIT used for tcddump etc. We also have a variety of other mechanisms you can combine with that to tie down a process. But even then it's hard to get this right in a way that's both performant and secure, because you have to protect every user every time, while for an attacker a very low success rate can still be worth it. [1] https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt https://www.kernel.org/doc/Documentation/prctl/seccomp_filte... [2] https://wiki.mozilla.org/Security/Sandbox/Seccomp https://wiki.mozilla.org/Security/Sandbox/Seccomp
doomrobo 10y ago
You're conflating the issues of running untrusted code with running trusted code on untrusted input. JS is untrusted code that you run on your computer. Your other examples generally do not fall into this camp. Java being an allegedly safe server-side language has nothing to do with it being a very difficult language to sandbox when running untrusted code. It doesn't matter what language the malware I just downloaded was written in, because it's malware and it's running on my computer. What makes Java different from C in this case is that when I run a Java application on my server, I can be more confident in the fact that I will not have a buffer overflow, even when I expose the service to the entire internet.

Corrado 10y ago

I get the feeling that very few old school authors would come forward and say "Hey, my project code is not good and needs to be re-written." Most of the time the message is more like "Sure we're using C but we're very careful and have built in a lot of safeguards." I like your idea of a default mindset of internet tools should be written in a safe language with proper engineering techniques. I'm not sure I would go as far as malpractice but it might be a good stick to use to force makers into better practices.