3 ms·

Given all the attention COBOL has gotten lately, I still haven’t seen any discussion of its characteristics that make it relatively “safe”, secure, and fast. Th

Given all the attention COBOL has gotten lately, I still haven’t seen any discussion of its characteristics that make it relatively “safe”, secure, and fast. These are; all memory is statically allocated, no dynamic memory allocation. No user defined functions and no stack. Of course I’m referring to the 85 standard here and later versions added these things but 85 is very common on mainframes (my understanding please correct if wrong). These two things disallow entire classes of exploits and errors. Edit to add, rather than put out these puff pieces, ibm needs to figure out how to get mainframe access for developers, only then will they see usage increase.

voldacar 6y ago
Those things also disallow entire classes of program. Good luck writing a webserver or game engine without heap allocation
- shoo 6y ago
  While not addressing the comment of writing programs without heap allocation, a lot of programs can be compiled to execute using the only mov instructions: https://github.com/xoreaxeaxeax/movfuscator https://github.com/xoreaxeaxeax/movfuscator Yes, it can run doom: https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali... It just doesn't run doom terribly fast.
  - voldacar 6y ago
    ok, so how do you call malloc or syscalls with mov instructions? Do you just (assuming you turned on executable stack) use mov to write the corresponding non-mov instructions necessary to do those things to memory, then mov the address of these instructions to the ip register? im struggling a little here
    - lxdesk 6y ago
      These are classified as "libc things". When using mov you can still access libc like any other program. Go study movfuscator(which I linked again) if you would like a full understanding[0]. When you have to interface C with a not-very-Unixy system like Webassembly or these mainframes, you have to link to a compatible libc that remaps everything appropriately. Malloc isn't particularly more special than any libc function. It simply supports the fantasy that the memory is unlimited in scale. It was always of a static size, you were just handing off the chore of dividing it up. You can usefully implement dynamic sizing in languages with static memory allocation by pre-allocating large arrays and then maintaining handles and liveness flags. This is, in fact, how every console game used to do it until available memory sizes got into the hundreds of megabytes. Fragmentation and the subsequent crashes from OOM presented too much of a concern before then. [0] https://github.com/xoreaxeaxeax/movfuscator https://github.com/xoreaxeaxeax/movfuscator
      - monocasa 6y ago
        > interface C with a not-very-Unixy system like Webassembly or these mainframes To be fair, z/OS is technically a Unix these days.
      - voldacar 6y ago
        Ah I thought the idea was to make the whole program use nothing but mov instructions. Still cool though. That's an interesting point too about console games, it seems to make a lot of sense if the whole machine can be dedicated to running just your program
- AnimalMuppet 6y ago
  Good luck running a large maintainable application without user-defined functions.
bashook 6y ago
Is ASLR a capable solution to those weaknesses? ASLR is supported by the operating system. Though a system administrator would have to turn it on by following these instructions: https://www.ibm.com/support/knowledgecenter/SSLTBW_2.4.0/com.ibm.zos.v2r4.ieae100/aslr.htm https://www.ibm.com/support/knowledgecenter/SSLTBW_2.4.0/com...
- monocasa 6y ago
  ASLR is a stopgap that's difficult to consistently apply to a legacy system, since there's so many ways to accidentally leak address information.
lboc 6y ago
>ibm needs to figure out how to get mainframe access for developers, only then will they see usage increase. They already did, but seem to have a pathological aversion to actually publicizing it: https://www-01.ibm.com/events/wwe/ast/mtm/audit.nsf/enrollall https://www-01.ibm.com/events/wwe/ast/mtm/audit.nsf/enrollal...

voldacar 6y ago

Those things also disallow entire classes of program. Good luck writing a webserver or game engine without heap allocation

shoo 6y ago
While not addressing the comment of writing programs without heap allocation, a lot of programs can be compiled to execute using the only mov instructions: https://github.com/xoreaxeaxeax/movfuscator https://github.com/xoreaxeaxeax/movfuscator Yes, it can run doom: https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali... It just doesn't run doom terribly fast.
- voldacar 6y ago
  ok, so how do you call malloc or syscalls with mov instructions? Do you just (assuming you turned on executable stack) use mov to write the corresponding non-mov instructions necessary to do those things to memory, then mov the address of these instructions to the ip register? im struggling a little here
  - lxdesk 6y ago
    These are classified as "libc things". When using mov you can still access libc like any other program. Go study movfuscator(which I linked again) if you would like a full understanding[0]. When you have to interface C with a not-very-Unixy system like Webassembly or these mainframes, you have to link to a compatible libc that remaps everything appropriately. Malloc isn't particularly more special than any libc function. It simply supports the fantasy that the memory is unlimited in scale. It was always of a static size, you were just handing off the chore of dividing it up. You can usefully implement dynamic sizing in languages with static memory allocation by pre-allocating large arrays and then maintaining handles and liveness flags. This is, in fact, how every console game used to do it until available memory sizes got into the hundreds of megabytes. Fragmentation and the subsequent crashes from OOM presented too much of a concern before then. [0] https://github.com/xoreaxeaxeax/movfuscator https://github.com/xoreaxeaxeax/movfuscator
    - monocasa 6y ago
      > interface C with a not-very-Unixy system like Webassembly or these mainframes To be fair, z/OS is technically a Unix these days.
    - voldacar 6y ago
      Ah I thought the idea was to make the whole program use nothing but mov instructions. Still cool though. That's an interesting point too about console games, it seems to make a lot of sense if the whole machine can be dedicated to running just your program
AnimalMuppet 6y ago
Good luck running a large maintainable application without user-defined functions.

bashook 6y ago

Is ASLR a capable solution to those weaknesses? ASLR is supported by the operating system. Though a system administrator would have to turn it on by following these instructions: https://www.ibm.com/support/knowledgecenter/SSLTBW_2.4.0/com.ibm.zos.v2r4.ieae100/aslr.htm https://www.ibm.com/support/knowledgecenter/SSLTBW_2.4.0/com...

monocasa 6y ago
ASLR is a stopgap that's difficult to consistently apply to a legacy system, since there's so many ways to accidentally leak address information.

lboc 6y ago

>ibm needs to figure out how to get mainframe access for developers, only then will they see usage increase. They already did, but seem to have a pathological aversion to actually publicizing it: https://www-01.ibm.com/events/wwe/ast/mtm/audit.nsf/enrollall https://www-01.ibm.com/events/wwe/ast/mtm/audit.nsf/enrollal...