3 ms·

Dear z3t4, I write this letter from the distant past, late in the month of November in the distant pass of 2017. From your lofty throne upon a future so bright

Dear z3t4, I write this letter from the distant past, late in the month of November in the distant pass of 2017. From your lofty throne upon a future so bright, I urge you to remember the sad lives we lead as a return code type mismatch caused every Mac OS X machine running modern software to be accessible by anyone with physical access by typing "root" into the login field then hammering on the Enter key like a 9 year old. Morale is high, because we know we cannot be sued for this act of gross incompetence. We have decided to solve this problem by shaking our heads at people who code in C and ignoring any similarities to our own toolkits. Please remember us and our backwards ways. Sincerely, A time traveler from about 3 days ago.

z3t4 9y ago
C is statically typed ... And it didn't help. So it actually helps argument my point. It's not the first time a bug sneaked by the type checker.
- KirinDave 9y ago
  It's 2017 dude. C is weakly typed with a wholly insufficient type system. We're talking about statically checked type inference systems now. A better type checker, better standards and practices, and better discipline around customer facing code are all required, but folks like you demand that every programmer must do it all by hand and then never make a mistake. It's ludicrous. This is like you saying, "Well cars are so unsafe you can't expect to live if you ride in one. Look at these pictures of horrible car wrecks. These Model Ts are death traps. But we all drove to the talk in Teslas and we're not even sure what the heck you're on about. Don't use your lack of (or refusal to obtain) familiarity with type systems and type theory as evidence of their inability to help with these problems.
tom_mellior 9y ago
> a return code type mismatch caused every Mac OS X machine [...] I don't doubt you, but I was just trying to read up on details of this and the internet is so full of fluff pieces that I can't find anything technical real quick. Would you have a link to a writeup of the bug behind this issue?
- runeks 9y ago
  https://www.theregister.co.uk/2017/11/29/apple_macos_high_sierra_root_bug_patch/ https://www.theregister.co.uk/2017/11/29/apple_macos_high_si... The relevant function returns an opaque integer to signal failure/success. If this were typed properly — e.g. a type that represents either “Success” or “Failure” explicitly (rather than implicitly via an int) — the bug would be unlikely to happen, since it would require the function in question to explicitly return “Success” when in fact it had failed (as opposed to the opaque 0x01).
  - btown 9y ago
    In this specific case, strongly typing the CryptVerificationResult as an enum would have helped. But, generalizing the problem, if you had more complicated criteria for whether that branch should be taken, it can be far too easy to save an intermediate result into a (strongly typed) variable but never end up using it in the correct way in the condition statement itself. Rust goes part of the way here by ensuring that Result variables get checked: https://doc.rust-lang.org/std/result/#results-must-be-used https://doc.rust-lang.org/std/result/#results-must-be-used which to my knowledge is not something you can mimic in C/C++. But you could still forget a negation or use && instead of || somewhere, and have an uncommon code path fail. Code review reduces but doesn't eliminate the probability of these complex logic errors. What's really needed is tooling that ensures test coverage on a phrase-by-phrase, not line-by-line, basis. (Basic line coverage would have said that all these lines of code were executed in testing.) And you need a culture around paying attention to those results. That can be very difficult to build, but for mission-critical software (security included) you absolutely need that level of attention to detail.
    - steveklabnik 9y ago
      gcc has __attribute__((warn_unused_result)) which is similar to #[must_use].
    - KirinDave 9y ago
      > In this specific case, strongly typing the CryptVerificationResult as an enum would have helped. But, generalizing the problem, if you had more complicated criteria for whether that branch should be taken, it can be far too easy to save an intermediate result into a (strongly typed) variable but never end up using it in the correct way in the condition statement itself. We can capture that requirement with something called Linear typing, but even if we don't go for a compiler-enforced consumption the creation of a universally used family of result enums brings enormous discipline and reliability to error handling. In no small part because when considering the result of such an enum, the compiler can demand a total pattern match, which forces developers to consider what that failure means in context and present SOME kind of strategy (even if it's hard failure). The approaches of languages with type inference and more sophisticated type systems like OCaml and Haskell go even a step further because they can create workflows around these types, creating composite workflows that make it easy to handle errors. It becomes harder to ignore them, or write functions that ignore them. One of the reasons it's so easy to write parsers in languages like Haskell is that algebraic data types and applicative functor composition make it easy and even convenient to talk about the logic within the context of non-trivial error flows. It's much more frustrating to write a parser without a combinator framework in OCaml or Haskell. Similar stories exist for Validator, Either, and Maybe/Option. These techniques don't mandate error processing, but they make it more convenient to compose error-handling functions and offer more compiler checking when the results must be handled.

z3t4 9y ago

C is statically typed ... And it didn't help. So it actually helps argument my point. It's not the first time a bug sneaked by the type checker.

KirinDave 9y ago
It's 2017 dude. C is weakly typed with a wholly insufficient type system. We're talking about statically checked type inference systems now. A better type checker, better standards and practices, and better discipline around customer facing code are all required, but folks like you demand that every programmer must do it all by hand and then never make a mistake. It's ludicrous. This is like you saying, "Well cars are so unsafe you can't expect to live if you ride in one. Look at these pictures of horrible car wrecks. These Model Ts are death traps. But we all drove to the talk in Teslas and we're not even sure what the heck you're on about. Don't use your lack of (or refusal to obtain) familiarity with type systems and type theory as evidence of their inability to help with these problems.

tom_mellior 9y ago

> a return code type mismatch caused every Mac OS X machine [...] I don't doubt you, but I was just trying to read up on details of this and the internet is so full of fluff pieces that I can't find anything technical real quick. Would you have a link to a writeup of the bug behind this issue?

runeks 9y ago
https://www.theregister.co.uk/2017/11/29/apple_macos_high_sierra_root_bug_patch/ https://www.theregister.co.uk/2017/11/29/apple_macos_high_si... The relevant function returns an opaque integer to signal failure/success. If this were typed properly — e.g. a type that represents either “Success” or “Failure” explicitly (rather than implicitly via an int) — the bug would be unlikely to happen, since it would require the function in question to explicitly return “Success” when in fact it had failed (as opposed to the opaque 0x01).
- btown 9y ago
  In this specific case, strongly typing the CryptVerificationResult as an enum would have helped. But, generalizing the problem, if you had more complicated criteria for whether that branch should be taken, it can be far too easy to save an intermediate result into a (strongly typed) variable but never end up using it in the correct way in the condition statement itself. Rust goes part of the way here by ensuring that Result variables get checked: https://doc.rust-lang.org/std/result/#results-must-be-used https://doc.rust-lang.org/std/result/#results-must-be-used which to my knowledge is not something you can mimic in C/C++. But you could still forget a negation or use && instead of || somewhere, and have an uncommon code path fail. Code review reduces but doesn't eliminate the probability of these complex logic errors. What's really needed is tooling that ensures test coverage on a phrase-by-phrase, not line-by-line, basis. (Basic line coverage would have said that all these lines of code were executed in testing.) And you need a culture around paying attention to those results. That can be very difficult to build, but for mission-critical software (security included) you absolutely need that level of attention to detail.
  - steveklabnik 9y ago
    gcc has __attribute__((warn_unused_result)) which is similar to #[must_use].
  - KirinDave 9y ago
    > In this specific case, strongly typing the CryptVerificationResult as an enum would have helped. But, generalizing the problem, if you had more complicated criteria for whether that branch should be taken, it can be far too easy to save an intermediate result into a (strongly typed) variable but never end up using it in the correct way in the condition statement itself. We can capture that requirement with something called Linear typing, but even if we don't go for a compiler-enforced consumption the creation of a universally used family of result enums brings enormous discipline and reliability to error handling. In no small part because when considering the result of such an enum, the compiler can demand a total pattern match, which forces developers to consider what that failure means in context and present SOME kind of strategy (even if it's hard failure). The approaches of languages with type inference and more sophisticated type systems like OCaml and Haskell go even a step further because they can create workflows around these types, creating composite workflows that make it easy to handle errors. It becomes harder to ignore them, or write functions that ignore them. One of the reasons it's so easy to write parsers in languages like Haskell is that algebraic data types and applicative functor composition make it easy and even convenient to talk about the logic within the context of non-trivial error flows. It's much more frustrating to write a parser without a combinator framework in OCaml or Haskell. Similar stories exist for Validator, Either, and Maybe/Option. These techniques don't mandate error processing, but they make it more convenient to compose error-handling functions and offer more compiler checking when the results must be handled.