5 ms·

It would be nice if you can move your existing C codebase piecemeal towards a more safe standard using linters and compiler checks. Because projects with a lot

by dep_b 6y ago

It would be nice if you can move your existing C codebase piecemeal towards a more safe standard using linters and compiler checks. Because projects with a lot of legacy (mostly C) code (which means all popular operating systems) cannot be rewritten towards safer languages without having an additional motivation like features that have a meaning to the business. So most likely a lot of it will stick around for a very long time but still needs to become 2021 level secure.

guerrilla 6y ago
One way to do that could be with frama-c [1]. It allows you to put the checks in comments that are interpreted prior to C compilation. See the example here [2]. 1. https://frama-c.com/ https://frama-c.com/ 2. https://frama-c.com/html/acsl.html https://frama-c.com/html/acsl.html
astrange 6y ago
iOS is doing this. No more information is available though. https://support.apple.com/guide/security/memory-safe-iboot-implementation-sec30d8d9ec1/web https://support.apple.com/guide/security/memory-safe-iboot-i...
- tinus_hn 6y ago
  What a lot of people don’t realize though is that only a company with the force of Apple can get the kind of access to the hardware you need to write this level of firmware. Apple writes every instruction executed by the processor from the moment it powers on until it’s booted. Unlike for instance devices running on the Intel platform, where the processor is running an entire OS behind your back, and you can’t turn it off.
- userbinator 6y ago
  That's not surprising. It's Apple, after all. I get downvoted a lot for saying this, but I'll say it anyway: I'm getting increasingly convinced that the purpose of this whole "safe languages" push is ultimately to the benefit of companies who want to deepen and their control over users. If you look at who the biggest proponents are, it's pretty obvious what their motivations are. They don't want you jailbreaking or rooting, they want to force you into their walled garden and keep you there. https://news.ycombinator.com/item?id=7883026 https://news.ycombinator.com/item?id=7883026
  - bscphil 6y ago
    Serious question: how does a project adopting a "safe" language benefit the company that's pushing it or give them more control? For example, if I write my web server in Go, does that benefit Google in any meaningful way? How? Likewise, I usually think of Mozilla as one of the primary promoters of safe languages (specifically, Rust). Do you think they benefit in some illicit way if someone chooses to use Rust? I read your linked post, but, without reading the whole thread, I'm not sure how it doesn't amount to saying that security bugs are, on net, a good thing. To be clear, I have my own criticisms of these newer languages that center on their corporate-driven development (e.g. they're generally designed around the belief that the developer should also be the final packager of the software or should at least determine what the final binary looks like), but their additional security is not something that I had thought to criticize as such.
    - userbinator 6y ago
      It's not about a single project or even many --- but the gradual normalisation/acceptance of "safe languages" (and likewise, the ostracising of "unsafe languages") that is the main concern. A "creeping absolutism", in other words. Do I want a browser that's free of remotely exploitable vulnerabilities? Yes. Do I want a "device" that I can't take control of, despite the fact that I bought it? Do I want unbreakable DRM? No. Hell no. The problem is that those who work on the latter will see the former, and adopt the same technologies to enslave instead of empower. Ultimately it's a balance of power. Neither total lawlessness nor total authoritarianism ("zero crime", as some like to call it), to use a real-world analogy.

by dep_b 6y ago

guerrilla 6y ago

One way to do that could be with frama-c [1]. It allows you to put the checks in comments that are interpreted prior to C compilation. See the example here [2]. 1. https://frama-c.com/ https://frama-c.com/ 2. https://frama-c.com/html/acsl.html https://frama-c.com/html/acsl.html

astrange 6y ago

iOS is doing this. No more information is available though. https://support.apple.com/guide/security/memory-safe-iboot-implementation-sec30d8d9ec1/web https://support.apple.com/guide/security/memory-safe-iboot-i...

tinus_hn 6y ago
What a lot of people don’t realize though is that only a company with the force of Apple can get the kind of access to the hardware you need to write this level of firmware. Apple writes every instruction executed by the processor from the moment it powers on until it’s booted. Unlike for instance devices running on the Intel platform, where the processor is running an entire OS behind your back, and you can’t turn it off.
userbinator 6y ago
That's not surprising. It's Apple, after all. I get downvoted a lot for saying this, but I'll say it anyway: I'm getting increasingly convinced that the purpose of this whole "safe languages" push is ultimately to the benefit of companies who want to deepen and their control over users. If you look at who the biggest proponents are, it's pretty obvious what their motivations are. They don't want you jailbreaking or rooting, they want to force you into their walled garden and keep you there. https://news.ycombinator.com/item?id=7883026 https://news.ycombinator.com/item?id=7883026
- bscphil 6y ago
  Serious question: how does a project adopting a "safe" language benefit the company that's pushing it or give them more control? For example, if I write my web server in Go, does that benefit Google in any meaningful way? How? Likewise, I usually think of Mozilla as one of the primary promoters of safe languages (specifically, Rust). Do you think they benefit in some illicit way if someone chooses to use Rust? I read your linked post, but, without reading the whole thread, I'm not sure how it doesn't amount to saying that security bugs are, on net, a good thing. To be clear, I have my own criticisms of these newer languages that center on their corporate-driven development (e.g. they're generally designed around the belief that the developer should also be the final packager of the software or should at least determine what the final binary looks like), but their additional security is not something that I had thought to criticize as such.
  - userbinator 6y ago
    It's not about a single project or even many --- but the gradual normalisation/acceptance of "safe languages" (and likewise, the ostracising of "unsafe languages") that is the main concern. A "creeping absolutism", in other words. Do I want a browser that's free of remotely exploitable vulnerabilities? Yes. Do I want a "device" that I can't take control of, despite the fact that I bought it? Do I want unbreakable DRM? No. Hell no. The problem is that those who work on the latter will see the former, and adopt the same technologies to enslave instead of empower. Ultimately it's a balance of power. Neither total lawlessness nor total authoritarianism ("zero crime", as some like to call it), to use a real-world analogy.