4 ms·

I was actually more looking for practical issues. Usually the code that I write doesn't even handle strings a lot. Maybe I'm just using other languages for when

by aap_ 7y ago

I was actually more looking for practical issues. Usually the code that I write doesn't even handle strings a lot. Maybe I'm just using other languages for when I do that or maybe I'm using other approaches where others would use strings or maybe I just subjectively don't find them so bad as others. I'd just like to see exactly what people are complaining about so I could find out why I usually don't.

coldtea 7y ago
>I was actually more looking for practical issues. Those are not practical? Billions of dollars have been wasted on issues stemming from this...
- aap_ 7y ago
  I'd just like to see a concrete example for once.
  - coldtea 7y ago
    Like, apart from tons of well known bugs, and vulnerabilities caused from string manipulation? How exactly did you miss news items, reports, posts, university lectures, books, and even your own personal experience, on them? Or is the insinuation that we are hand-wavy about it, and you doubt the existence and scale of the problem? It's a well researched, well established problem, known for almost half a century. https://en.wikipedia.org/wiki/C_standard_library#Buffer_overflow_vulnerabilities https://en.wikipedia.org/wiki/C_standard_library#Buffer_over... https://security.web.cern.ch/security/recommendations/en/codetools/c.shtml https://security.web.cern.ch/security/recommendations/en/cod... http://www.informit.com/articles/article.aspx?p=430402&seqNum=2 http://www.informit.com/articles/article.aspx?p=430402&seqNu... https://randomascii.wordpress.com/2013/04/03/stop-using-strncpy-already/ https://randomascii.wordpress.com/2013/04/03/stop-using-strn... https://courses.cs.washington.edu/courses/cse341/04wi/lectures/26-unsafe-languages.html https://courses.cs.washington.edu/courses/cse341/04wi/lectur... (null termination) https://www.geeksforgeeks.org/why-strcpy-and-strncpy-are-not-safe-to-use/ https://www.geeksforgeeks.org/why-strcpy-and-strncpy-are-not... https://www.owasp.org/index.php/Reviewing_Code_for_Buffer_Overruns_and_Overflows#.E2.80.98Vanilla.E2.80.99_buffer_overflow https://www.owasp.org/index.php/Reviewing_Code_for_Buffer_Ov...: And let's not even get into format string issues...

by aap_ 7y ago

coldtea 7y ago

>I was actually more looking for practical issues. Those are not practical? Billions of dollars have been wasted on issues stemming from this...

aap_ 7y ago
I'd just like to see a concrete example for once.
- coldtea 7y ago
  Like, apart from tons of well known bugs, and vulnerabilities caused from string manipulation? How exactly did you miss news items, reports, posts, university lectures, books, and even your own personal experience, on them? Or is the insinuation that we are hand-wavy about it, and you doubt the existence and scale of the problem? It's a well researched, well established problem, known for almost half a century. https://en.wikipedia.org/wiki/C_standard_library#Buffer_overflow_vulnerabilities https://en.wikipedia.org/wiki/C_standard_library#Buffer_over... https://security.web.cern.ch/security/recommendations/en/codetools/c.shtml https://security.web.cern.ch/security/recommendations/en/cod... http://www.informit.com/articles/article.aspx?p=430402&seqNum=2 http://www.informit.com/articles/article.aspx?p=430402&seqNu... https://randomascii.wordpress.com/2013/04/03/stop-using-strncpy-already/ https://randomascii.wordpress.com/2013/04/03/stop-using-strn... https://courses.cs.washington.edu/courses/cse341/04wi/lectures/26-unsafe-languages.html https://courses.cs.washington.edu/courses/cse341/04wi/lectur... (null termination) https://www.geeksforgeeks.org/why-strcpy-and-strncpy-are-not-safe-to-use/ https://www.geeksforgeeks.org/why-strcpy-and-strncpy-are-not... https://www.owasp.org/index.php/Reviewing_Code_for_Buffer_Overruns_and_Overflows#.E2.80.98Vanilla.E2.80.99_buffer_overflow https://www.owasp.org/index.php/Reviewing_Code_for_Buffer_Ov...: And let's not even get into format string issues...