4 ms·
Maybe you have a very broad definition of RCE, one that does not match up with RCE as used by security professionals ?
by noselasd 7y ago
Maybe you have a very broad definition of RCE, one that does not match up with RCE as used by security professionals ?
- tgflynn 7y agoI've seen a couple of different definitions, but the most restrictive appears to be that RCE means the ability to execute arbitrary code on a remote host (https://en.wikipedia.org/wiki/Arbitrary_code_execution https://en.wikipedia.org/wiki/Arbitrary_code_execution). Note that the definition returned at the top of a Google search for RCE is considerably more general than this. There are many pieces of software that allow a remote user to execute arbitrary code remotely. Some examples are ssh and the Jupiter notebook running a Python or Julia kernel. Of course these types of software usually include an authentication/authorization mechanism limiting access to authorized users. Any bug in the implementation of this mechanism could potentially allow the unauthorized remote execution of arbitrary code. No "safe" language alone can prove the absence of all such bugs. At a minimum doing so would require a complete specification of who is authorized to execute what code and how they are to prove their identity to the software along with a formal proof that the implementation completely implements the spec.
- deleted 7y ago[deleted]