4 ms·

The "security issues" with IoT are a consequence of security mindset (or lack thereof), not a programming language.

by avip 8y ago

freehunter 8y ago
Agreed, Rust isn't going to matter over Javascript or even Visual Basic 6.0 if you're leaving port 22 open to the Internet with a username of "root" and a password of... well, just hit the enter key at the prompt, because there's no password set by default. Or exposing an anonymous TFTP server to the Internet, with a cron job running every hour to automatically flash any firmware that's dropped into there. That's pretty much par for the course in IoT security.
illuminati1911 8y ago
IoT development in general has bad security mindset, but it does not let JS slip away from the responsibility. Javascript's runtime interpretation + lack of strong typing is the real issue here and not just for embedded devices, but for any application.
- allover 8y ago
  > Javascript's runtime interpretation + lack of strong typing is the real issue here and not just for embedded devices, but for any application. Explain how 'runtime interpretation + lack of strong typing' is significant for security. JS is memory safe which makes it a more secure choice than e.g. C/C++.
  - pjmlp 8y ago
    Unsanitized data given to eval() is an open door for exploits, whereas lack of strong typing makes it easier for logic programming errors, due to typos or implicit conversions. Memory corruption is just one possible attack vector.
    - allover 8y ago
      eval() is a pretty opt-in security vuln, and there are ways of doing the equivalent in statically typed languages. Logic errors are pretty hard to quantify, but if there're stats on vulnerabilities caused by logical errors that could only happen in languages without strong types I'd love to see them. Meanwhile there's a whole class of vulnerabilities attributable to lack of memory safety that are pretty easily distinguished, including some of the most notorious (cloudbleed, heartbleed).

The "security issues" with IoT are a consequence of security mindset (or lack thereof), not a programming language.

by avip 8y ago

The "security issues" with IoT are a consequence of security mindset (or lack thereof), not a programming language.

Agreed, Rust isn't going to matter over Javascript or even Visual Basic 6.0 if you're leaving port 22 open to the Internet with a username of "root" and a password of... well, just hit the enter key at the prompt, because there's no password set by default. Or exposing an anonymous TFTP server to the Internet, with a cron job running every hour to automatically flash any firmware that's dropped into there. That's pretty much par for the course in IoT security.

illuminati1911 8y ago

IoT development in general has bad security mindset, but it does not let JS slip away from the responsibility. Javascript's runtime interpretation + lack of strong typing is the real issue here and not just for embedded devices, but for any application.

allover 8y ago
> Javascript's runtime interpretation + lack of strong typing is the real issue here and not just for embedded devices, but for any application. Explain how 'runtime interpretation + lack of strong typing' is significant for security. JS is memory safe which makes it a more secure choice than e.g. C/C++.
- pjmlp 8y ago
  Unsanitized data given to eval() is an open door for exploits, whereas lack of strong typing makes it easier for logic programming errors, due to typos or implicit conversions. Memory corruption is just one possible attack vector.
  - allover 8y ago
    eval() is a pretty opt-in security vuln, and there are ways of doing the equivalent in statically typed languages. Logic errors are pretty hard to quantify, but if there're stats on vulnerabilities caused by logical errors that could only happen in languages without strong types I'd love to see them. Meanwhile there's a whole class of vulnerabilities attributable to lack of memory safety that are pretty easily distinguished, including some of the most notorious (cloudbleed, heartbleed).