5 ms·

This is 2019 and the security community has yet to deliver a proper solution to prevent the existence of such bugs. The mismatch between programmer intent and c

by ngneer 7y ago

This is 2019 and the security community has yet to deliver a proper solution to prevent the existence of such bugs. The mismatch between programmer intent and code behavior is appalling. Sure, super smart coders can avoid the bugs, much like super safe drivers can avoid the shoulder, but rumble strips are there for a reason. The bug would not have arisen if the language supported dependent typing. See Agda, for example. One day... https://en.wikipedia.org/wiki/Dependent_type https://en.wikipedia.org/wiki/Dependent_type

cjbprime 7y ago
> security community has yet to deliver a proper solution What do you want them to do? I think their solution is "use memory-safe languages like Golang or Rust (or even JavaScript/TypeScript) for new projects, not C or C++" and "use extensive fuzzing on legacy C code that hasn't been replaced yet". Fuzzing was capable of finding Heartbleed, and it's advanced massively (and been set up at scale to continuously test open source projects) since then.
- deleted 7y ago
  [deleted]
- guerrilla 7y ago
  > What do you want them to do? If you read to the end of the comment, it suggests dependent typing as the solution.
- z3phyr 7y ago
  Rust is pretty useful against memory based bugs, and it is prudent that new projects take advantage of it. But this in no way fixes the headache of security, because (1) almost all of the existing infrastructure code depends on C (2) New classes of bugs will eventually emmerge, some partly unfixable by software solution.
  - carlmr 7y ago
    >New classes of bugs will eventually emmerge, some partly unfixable by software solution. Sure Rust, ADA and such don't remove all classes of bugs, but they can reduce the attack surface considerably, giving you more time to focus on the remaining security bugs. And maybe people will invent software solutions that reduce the attack surface even more. Assembly is a fast car with no security features. C is a sportscar with a seatbelt. Rust is a sportscar with a seatbelt, airbags, ABS, ESC and emergency breaking. Of course you can still crash and die, it's just that you're less likely to do so.
    - braindeath 7y ago
      > Assembly is a fast car with no security features. C is a sportscar with a seatbelt. Given the ways you can trigger UB there is no difference between Assembly and C with regards to safety.
      - eigenloss 7y ago
        Just type "undefined behavior" here. I'm sure you have the time.
      - carlmr 7y ago
        I know what you mean, however I think C did bring down the amount of bugs compared to assembly, just by making code easier to read and higher level abstractions available. It's still not much though.
kerng 7y ago
Even with rumbling stripes before shoulder accidents still happen. And they will continue to happen, the same as security vulnerabilities in code.
bdamm 7y ago
This is more of computer science issue with languages insisting on being turing complete. I suppose governments could incentivize language designers to produce and support languages that eliminate ever larger classes of vulnerabilities by only buying software that is written in those kinds of languages.
dx87 7y ago
I'm sure the security community would love for these things to get fixed, but it's a constant fight trying to get developers to learn the correct way to do something. I've had developers tell my manager that having to fix security issues I report is putting them behind, so they wanted me to only be able to report security issues when they weren't working on anything else. Luckily my manager has my back and told them security is a top priority, even if it means fatures come out late.
crb002 7y ago
The problem was a shotgun parser. LangSec 101. Use a formal parser.
- petra 7y ago
  One of the creators of LangSec has joined Darpa: https://www.darpa.mil/staff/dr-sergey-bratus https://www.darpa.mil/staff/dr-sergey-bratus And now Darpa is working on two related projects: https://www.darpa.mil/attachments/SafeDocs%20ProposersDay-Final.pdf https://www.darpa.mil/attachments/SafeDocs%20ProposersDay-Fi... 1. SafeDocs - a document format made safe using LangSec. 2. Tools to help developer verify protocols using LangSec parsers, easily. Would be interesting to see. But still TCP/IP doesn't fit LangSec, if i remember correctly ?
z3phyr 7y ago
If the languages supported dependent types and everything that happens in cutting edge PL research, wouldn't programming become super hard anyway for average programmers who have pressure to deliver?
- peterkelly 7y ago
  Perhaps. But for for critical systems where security or reliability is a requirement, it's more important to get it right than to get it done quickly. Trying to rush these things is just asking for trouble.

by ngneer 7y ago

cjbprime 7y ago

> security community has yet to deliver a proper solution What do you want them to do? I think their solution is "use memory-safe languages like Golang or Rust (or even JavaScript/TypeScript) for new projects, not C or C++" and "use extensive fuzzing on legacy C code that hasn't been replaced yet". Fuzzing was capable of finding Heartbleed, and it's advanced massively (and been set up at scale to continuously test open source projects) since then.

deleted 7y ago
[deleted]
guerrilla 7y ago
> What do you want them to do? If you read to the end of the comment, it suggests dependent typing as the solution.
z3phyr 7y ago
Rust is pretty useful against memory based bugs, and it is prudent that new projects take advantage of it. But this in no way fixes the headache of security, because (1) almost all of the existing infrastructure code depends on C (2) New classes of bugs will eventually emmerge, some partly unfixable by software solution.
- carlmr 7y ago
  >New classes of bugs will eventually emmerge, some partly unfixable by software solution. Sure Rust, ADA and such don't remove all classes of bugs, but they can reduce the attack surface considerably, giving you more time to focus on the remaining security bugs. And maybe people will invent software solutions that reduce the attack surface even more. Assembly is a fast car with no security features. C is a sportscar with a seatbelt. Rust is a sportscar with a seatbelt, airbags, ABS, ESC and emergency breaking. Of course you can still crash and die, it's just that you're less likely to do so.
  - braindeath 7y ago
    > Assembly is a fast car with no security features. C is a sportscar with a seatbelt. Given the ways you can trigger UB there is no difference between Assembly and C with regards to safety.
    - eigenloss 7y ago
      Just type "undefined behavior" here. I'm sure you have the time.
    - carlmr 7y ago
      I know what you mean, however I think C did bring down the amount of bugs compared to assembly, just by making code easier to read and higher level abstractions available. It's still not much though.

kerng 7y ago

Even with rumbling stripes before shoulder accidents still happen. And they will continue to happen, the same as security vulnerabilities in code.

bdamm 7y ago

This is more of computer science issue with languages insisting on being turing complete. I suppose governments could incentivize language designers to produce and support languages that eliminate ever larger classes of vulnerabilities by only buying software that is written in those kinds of languages.

dx87 7y ago

I'm sure the security community would love for these things to get fixed, but it's a constant fight trying to get developers to learn the correct way to do something. I've had developers tell my manager that having to fix security issues I report is putting them behind, so they wanted me to only be able to report security issues when they weren't working on anything else. Luckily my manager has my back and told them security is a top priority, even if it means fatures come out late.

crb002 7y ago

The problem was a shotgun parser. LangSec 101. Use a formal parser.

petra 7y ago
One of the creators of LangSec has joined Darpa: https://www.darpa.mil/staff/dr-sergey-bratus https://www.darpa.mil/staff/dr-sergey-bratus And now Darpa is working on two related projects: https://www.darpa.mil/attachments/SafeDocs%20ProposersDay-Final.pdf https://www.darpa.mil/attachments/SafeDocs%20ProposersDay-Fi... 1. SafeDocs - a document format made safe using LangSec. 2. Tools to help developer verify protocols using LangSec parsers, easily. Would be interesting to see. But still TCP/IP doesn't fit LangSec, if i remember correctly ?

z3phyr 7y ago

If the languages supported dependent types and everything that happens in cutting edge PL research, wouldn't programming become super hard anyway for average programmers who have pressure to deliver?

peterkelly 7y ago
Perhaps. But for for critical systems where security or reliability is a requirement, it's more important to get it right than to get it done quickly. Trying to rush these things is just asking for trouble.