3 ms·

So were these vulnerabilities present, and missed by Cure53's audit (https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf https://wiki.mozilla.org/images/f/f

• fulafel 9y ago
  Probably. It's well known that it's generally (and practically) intractable to find all vulnerabilities in a typical networked C program using reasonable auditing effort. If auditing worked, we would know how to secure C programs and the world would be a much different place.
  • throwme211345 9y ago
    But we do know how to write secure C. It's just time consuming and requires discipline. Two things that most developers don't have or want.
    • Xylakant 9y ago
      That seems to indicate “we” as a profession don’t actually know. Because the developer is always part of writing the code and thus, any process that results in C-Code has at least one insecure element.
      • throwme211345 9y ago
        "We" is inclusive - 'most developers' is exclusive. Mystery solved.