4 ms·

The problem with Mozilla's C++ code is that it was developed in a time where memory-safety was an afterthought and they're still paying for that. Rewriting it i

by blub 7y ago

The problem with Mozilla's C++ code is that it was developed in a time where memory-safety was an afterthought and they're still paying for that. Rewriting it in anything will offer a great opportunity of improving it. For example, the real fix for their vulnerable code example is using automatic bounds checking, just as Rust does. Replacing [] with at, eliminates the vulnerability. Most C++ programmers are allergic to at, so Mozilla could have created some container wrappers that do this by default. GCC and I think also clang have a macro which adds automatic bounds-checking to the STL containers.

JoshTriplett 7y ago
> Replacing [] with at, eliminates the vulnerability. And for decades of C and C++ programmers, [] is still the most obvious way to index an array. And the most obvious way creates potential security vulnerabilities. See Rusty Russell's classic "easy to use versus hard to misuse" posts: http://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html http://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html and https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html .
- blub 7y ago
  Historically, C and C++ programmers didn't care much about safety, especially if they had to give up performance to reach it. This is changing in the newest C++ standards and tooling (e.g. clang's -Wlifetimes). Bounds checking is slower, so that's the main reason why it's shunned. Rust made it mandatory, but from what I've seen there are people disabling that to squeeze some drops of performance nevertheless. Luckily, I think Rust also has an option of replacing indexing with iteration, thereby avoiding the performance hit. I think it currently does this a bit better than C++, but I might be wrong. Anyway, my critique still stands, that blog post is really low effort and doesn't prove much. I've looked at some of the fixes for Firefox security bugs and the code reminds one of the typical older C++ projects with raw pointers everywhere. Perhaps implementing a browser requires all sorts of unsafe access patterns.
  - JoshTriplett 7y ago
    The Rust compiler can eliminate bounds checking anywhere it can prove that it doesn't need it. And beyond that, you always have the option of writing an unsafe block, and people sometimes do in carefully selected cases driven by profiling. (That also encourages keeping such code carefully contained and well-scrutinized.) I'm not arguing that bounds-checking should be mandatory. I'm arguing that bounds-checking should be the default, and you should have to knowingly bypass it, rather than the other way around.
staticassertion 7y ago
Meh. There are probably very few C++ codebases that have received more security attention than those of browsers like Firefox. Bug bounties, fuzzing, tons of hardening work. It's really just not accurate to say "they weren't writing good C++" or "it's a legacy codebase". Those could both be true things, but it's totally glossing over the hundreds of millions of dollars invested in fixing that codebase.
- blub 7y ago
  Tons of hardening work to plug an endless sieve. If browsers had remained sane, allowing one to download HTML, CSS and pictures instead of running so-called applications, they would have been secured a long time ago and we would have had a decent internet instead of this spyware and ads infested mess. With the rate of change that they're subjected to, they will never be secure. In 10 years Firefox will perhaps be 50% Rust and still full of vulnerabilities.
  - staticassertion 7y ago
    > If browsers had remained sane This has no bearing on the issue. Yes, browsers are fast moving codebases. No one is arguing otherwise. > In 10 years Firefox will perhaps be 50% Rust and still full of vulnerabilities. Someone has already cited a case study from Mozilla showing a significant improvement in memory safety for components moved over to Rust, so all evidence at this point is to the contrary.
  - JoshTriplett 7y ago
    If browsers had refused to run applications, we'd have a lot more native applications that don't have any sandbox at all.
    - blub 7y ago
      Native applications do have sandboxes, macOS definitely has this, Windows has this, iOS, Android... AppStores can also perform various checks which will never happen on web sites. The web is really the wild west, why do you think browsers are the main attack vector nowadays?

by blub 7y ago

JoshTriplett 7y ago

> Replacing [] with at, eliminates the vulnerability. And for decades of C and C++ programmers, [] is still the most obvious way to index an array. And the most obvious way creates potential security vulnerabilities. See Rusty Russell's classic "easy to use versus hard to misuse" posts: http://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html http://ozlabs.org/~rusty/index.cgi/tech/2008-03-30.html and https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html https://ozlabs.org/~rusty/index.cgi/tech/2008-04-01.html .

blub 7y ago
Historically, C and C++ programmers didn't care much about safety, especially if they had to give up performance to reach it. This is changing in the newest C++ standards and tooling (e.g. clang's -Wlifetimes). Bounds checking is slower, so that's the main reason why it's shunned. Rust made it mandatory, but from what I've seen there are people disabling that to squeeze some drops of performance nevertheless. Luckily, I think Rust also has an option of replacing indexing with iteration, thereby avoiding the performance hit. I think it currently does this a bit better than C++, but I might be wrong. Anyway, my critique still stands, that blog post is really low effort and doesn't prove much. I've looked at some of the fixes for Firefox security bugs and the code reminds one of the typical older C++ projects with raw pointers everywhere. Perhaps implementing a browser requires all sorts of unsafe access patterns.
- JoshTriplett 7y ago
  The Rust compiler can eliminate bounds checking anywhere it can prove that it doesn't need it. And beyond that, you always have the option of writing an unsafe block, and people sometimes do in carefully selected cases driven by profiling. (That also encourages keeping such code carefully contained and well-scrutinized.) I'm not arguing that bounds-checking should be mandatory. I'm arguing that bounds-checking should be the default, and you should have to knowingly bypass it, rather than the other way around.

staticassertion 7y ago

Meh. There are probably very few C++ codebases that have received more security attention than those of browsers like Firefox. Bug bounties, fuzzing, tons of hardening work. It's really just not accurate to say "they weren't writing good C++" or "it's a legacy codebase". Those could both be true things, but it's totally glossing over the hundreds of millions of dollars invested in fixing that codebase.

blub 7y ago
Tons of hardening work to plug an endless sieve. If browsers had remained sane, allowing one to download HTML, CSS and pictures instead of running so-called applications, they would have been secured a long time ago and we would have had a decent internet instead of this spyware and ads infested mess. With the rate of change that they're subjected to, they will never be secure. In 10 years Firefox will perhaps be 50% Rust and still full of vulnerabilities.
- staticassertion 7y ago
  > If browsers had remained sane This has no bearing on the issue. Yes, browsers are fast moving codebases. No one is arguing otherwise. > In 10 years Firefox will perhaps be 50% Rust and still full of vulnerabilities. Someone has already cited a case study from Mozilla showing a significant improvement in memory safety for components moved over to Rust, so all evidence at this point is to the contrary.
- JoshTriplett 7y ago
  If browsers had refused to run applications, we'd have a lot more native applications that don't have any sandbox at all.
  - blub 7y ago
    Native applications do have sandboxes, macOS definitely has this, Windows has this, iOS, Android... AppStores can also perform various checks which will never happen on web sites. The web is really the wild west, why do you think browsers are the main attack vector nowadays?