3 ms·
As others have pointed out, a huge amount of C code is going to stay with us for quite some time. While fighting for the adoption of other languages is right an
by Perseids 10y ago
As others have pointed out, a huge amount of C code is going to stay with us for quite some time. While fighting for the adoption of other languages is right and noble, what I would consider practical is eliminating (the worst of) memory management related exploitation for any C/C++ code at compile time. There has been done quite some work that shows this can be done efficiently, e.g. SoftBound+CETS [1]. Heck, even WebAssembly shows that you can get complete control flow protection for a comparatively low price. I would gladly use a Linux distribution that compiled all packages with such protections, even if it ran about 20% slower.
[1] https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ https://www.cs.rutgers.edu/~santosh.nagarakatte/softbound/ ; presentation: https://media.ccc.de/v/30C3_-_5412_-_en_-_saal_1_-_201312271830_-_bug_class_genocide_-_andreas_bogk https://media.ccc.de/v/30C3_-_5412_-_en_-_saal_1_-_201312271...