3 ms·

> I'm sure the CVE numbers will overwhelmingly show that most RCE-capable vulnerabilities are in C/C++. Maybe that's because most software is written in C/C++?

azernik 7y ago
Compared to Java, Javascript, Python, put together?
- adev_ 7y ago
  > Compared to Java, Javascript, Python, put together? Yes still. Look to your laptop right now and count the software running in C/C++ vs anything else. They still dominate by far. And the current fashion of writing everything in Javascript + Electron/NodeJS, just made the C/C++ backend more important than ever. NodeJS is in C/C++, V8 is in C++, Chromium is in C++, Firefox is in C++/Rust and every library behind are in C.
  - pjmlp 7y ago
    So lets us constrain to the Linux kernel, with its patch review process, ksan and static analysis tooling. As per Google talk at Linux Kernel Summit 2018, 68% of Linux kernel exploits are caused by C's lack of safety against memory corruption, in spite of all the tools and processes they have in place. Hence, the Kernel Self Protection Project sponsored by Google. https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr...
AgentME 7y ago
Even if you corrected for that, I would still expect this to be true. A potential RCE in C/C++ is literally as easy as writing past the end of an array or writing to a pointer to something that's already been freed. Few other languages give such huge consequences to minor mistakes in average code. The arguments that C/C++ are just as safe as other languages and that's it's just a matter of opinion or experience are unfounded. It's like saying a minefield is just as safe as anywhere else to walk because you can randomly suddenly die anywhere else too because of stuff like strokes or heart attacks. You just gotta have good landmine senses and it's your own fault if you can't avoid them.
dodobirdlord 7y ago
This is certainly not the case. Line-for-line I'm sure that most software is written in Javascript.

azernik 7y ago

Compared to Java, Javascript, Python, put together?

adev_ 7y ago
> Compared to Java, Javascript, Python, put together? Yes still. Look to your laptop right now and count the software running in C/C++ vs anything else. They still dominate by far. And the current fashion of writing everything in Javascript + Electron/NodeJS, just made the C/C++ backend more important than ever. NodeJS is in C/C++, V8 is in C++, Chromium is in C++, Firefox is in C++/Rust and every library behind are in C.
- pjmlp 7y ago
  So lets us constrain to the Linux kernel, with its patch review process, ksan and static analysis tooling. As per Google talk at Linux Kernel Summit 2018, 68% of Linux kernel exploits are caused by C's lack of safety against memory corruption, in spite of all the tools and processes they have in place. Hence, the Kernel Self Protection Project sponsored by Google. https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Pr...

AgentME 7y ago

Even if you corrected for that, I would still expect this to be true. A potential RCE in C/C++ is literally as easy as writing past the end of an array or writing to a pointer to something that's already been freed. Few other languages give such huge consequences to minor mistakes in average code. The arguments that C/C++ are just as safe as other languages and that's it's just a matter of opinion or experience are unfounded. It's like saying a minefield is just as safe as anywhere else to walk because you can randomly suddenly die anywhere else too because of stuff like strokes or heart attacks. You just gotta have good landmine senses and it's your own fault if you can't avoid them.

dodobirdlord 7y ago

This is certainly not the case. Line-for-line I'm sure that most software is written in Javascript.