4 ms·

Sure but in 17 years writing C for a living, with lines of code by the millions, and (embedded) devices running my code all over the world I still have to know

by scoutt 6y ago

Sure but in 17 years writing C for a living, with lines of code by the millions, and (embedded) devices running my code all over the world I still have to know about an integer overflow bug. Sure, I don't always write bug-free code (as anyone), but when I say it's not so terrible I mean that UD should be considered a rare case, and it's not worth even a single night of quiet sleep, let alone switching languages or overreacting. Hey, I am more afraid of a flipping bit due to power supply noises. And I don't want to say either that my code is perfect, or since it never happened to me it will never happen to you and that you can go around triggering UD everywhere since it's not a big deal. But I also like to warn young players that "boooo UD!" is just part of a FUD tactic for them to adopt some shiny new language.

pjmlp 6y ago
Would you feel the same way when we finally manage to get liability laws for security exploits, like we are now discussing in Germany?
- scoutt 6y ago
  If some of my systems fail, people might die. Should I still be worried for a liability?
  - pjmlp 6y ago
    As an professional Engineer I would be.
jjnoakes 6y ago
There is a ton of software out there that is riddled with bugs. Much of it is run behind closed doors, isn't exposed to attack vectors like the internet, and happily churns along because no one is trying to attack it. Lots of other software might be exposed to the internet or to malicious users but no one has stumbled across it and tried to exploit it yet. Code like that may be ok for now simply because of the circumstances, but I don't think that's a pass to ignore UB or to discourage folks from trying to improve the status quo. Because some day either the developer of that code, who is used to ignoring this kind of thing, might write some code that has to be more correct or it will get exploited. Or the code itself might get changed, or exposed to attackers, or copied into some other program. These things happen and they are preventable. And you don't even have to switch languages - turning on sanitizers when you compile and fixing issues as they are found, and encouraging others to do the same, is better (in my opinion) than categorizing folks worrying about and working on this issue - in C and in other languages - as FUD spreaders.
- scoutt 6y ago
  There are worse things than can happen with bad wrote code other than security bugs. It doesn’t have to necessarily be exposed to the internet or users/attackers for bad things to happen. I truly believe that people just forgot this little fact. Again, I don’t discourage people from preventing UD, but, again, it’s not a big deal. Especially is not something to be afraid of. My code is as much as correct, verified, analyzed and tested as possible, and most of the times compliant with the most absurd certifications. Again, I still have to find a bug or fail a test because some strange UD.
  - MaxBarraclough 6y ago
    > Especially is not something to be afraid of. Disagree. UB in C can mean your program silently going off the rails in a way that isn't possible in many other languages. UB really can manifest in bizarre and scary ways on real platforms. [0][1][2][3] If it isn't manifesting that way in your case, that's just good fortune. > I still have to find a bug or fail a test because some strange UD I should hope your safety-critical code is not permitted to contain known instances of unintended undefined behaviour. (There can be exceptions where UB is truly intended. JIT compilation always relies on UB, for instance, not that this would apply to safety-critical code.) If your program contains undefined behaviour, that means that at best, it works by coincidence. Safety-critical code should not work by coincidence, it should be correct by construction (to steal a term from the formal methods world). Also, it's UB, not UD. [0] https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=633 https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=63... [1] https://cryptoservices.github.io/fde/2018/11/30/undefined-behavior.html https://cryptoservices.github.io/fde/2018/11/30/undefined-be... [2] https://blog.regehr.org/archives/759 https://blog.regehr.org/archives/759 [3] https://blog.regehr.org/archives/767 https://blog.regehr.org/archives/767
    - scoutt 6y ago
      Again, I am not saying "go ahead and don't care about UB". I know what it is; I know what it can do. Just don't make it a big deal. You (plural) make it sound like it's impossible to build a system with C or any other laguange that allows UB, because it probably runs by coincidence. Yet the world keeps spinning and super safe flashy languages are still running on top of UB-illed OS wrote in C. > I should hope your safety-critical code is not permitted to contain known instances of unintended undefined behaviour. It's not. > Also, it's UB, not UD. Now that you mention it I checked my other comments I wrote from my phone and noticed it changed UB with UD.

by scoutt 6y ago

pjmlp 6y ago

Would you feel the same way when we finally manage to get liability laws for security exploits, like we are now discussing in Germany?

scoutt 6y ago
If some of my systems fail, people might die. Should I still be worried for a liability?
- pjmlp 6y ago
  As an professional Engineer I would be.

jjnoakes 6y ago

There is a ton of software out there that is riddled with bugs. Much of it is run behind closed doors, isn't exposed to attack vectors like the internet, and happily churns along because no one is trying to attack it. Lots of other software might be exposed to the internet or to malicious users but no one has stumbled across it and tried to exploit it yet. Code like that may be ok for now simply because of the circumstances, but I don't think that's a pass to ignore UB or to discourage folks from trying to improve the status quo. Because some day either the developer of that code, who is used to ignoring this kind of thing, might write some code that has to be more correct or it will get exploited. Or the code itself might get changed, or exposed to attackers, or copied into some other program. These things happen and they are preventable. And you don't even have to switch languages - turning on sanitizers when you compile and fixing issues as they are found, and encouraging others to do the same, is better (in my opinion) than categorizing folks worrying about and working on this issue - in C and in other languages - as FUD spreaders.

scoutt 6y ago
There are worse things than can happen with bad wrote code other than security bugs. It doesn’t have to necessarily be exposed to the internet or users/attackers for bad things to happen. I truly believe that people just forgot this little fact. Again, I don’t discourage people from preventing UD, but, again, it’s not a big deal. Especially is not something to be afraid of. My code is as much as correct, verified, analyzed and tested as possible, and most of the times compliant with the most absurd certifications. Again, I still have to find a bug or fail a test because some strange UD.
- MaxBarraclough 6y ago
  > Especially is not something to be afraid of. Disagree. UB in C can mean your program silently going off the rails in a way that isn't possible in many other languages. UB really can manifest in bizarre and scary ways on real platforms. [0][1][2][3] If it isn't manifesting that way in your case, that's just good fortune. > I still have to find a bug or fail a test because some strange UD I should hope your safety-critical code is not permitted to contain known instances of unintended undefined behaviour. (There can be exceptions where UB is truly intended. JIT compilation always relies on UB, for instance, not that this would apply to safety-critical code.) If your program contains undefined behaviour, that means that at best, it works by coincidence. Safety-critical code should not work by coincidence, it should be correct by construction (to steal a term from the formal methods world). Also, it's UB, not UD. [0] https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=633 https://devblogs.microsoft.com/oldnewthing/20140627-00/?p=63... [1] https://cryptoservices.github.io/fde/2018/11/30/undefined-behavior.html https://cryptoservices.github.io/fde/2018/11/30/undefined-be... [2] https://blog.regehr.org/archives/759 https://blog.regehr.org/archives/759 [3] https://blog.regehr.org/archives/767 https://blog.regehr.org/archives/767
  - scoutt 6y ago
    Again, I am not saying "go ahead and don't care about UB". I know what it is; I know what it can do. Just don't make it a big deal. You (plural) make it sound like it's impossible to build a system with C or any other laguange that allows UB, because it probably runs by coincidence. Yet the world keeps spinning and super safe flashy languages are still running on top of UB-illed OS wrote in C. > I should hope your safety-critical code is not permitted to contain known instances of unintended undefined behaviour. It's not. > Also, it's UB, not UD. Now that you mention it I checked my other comments I wrote from my phone and noticed it changed UB with UD.