4 ms·

"That Tor is mostly written in C is quite terrifying, and I'm very happy that I'm going to help fix that!" I don't get why so many people are so terrified by C

"That Tor is mostly written in C is quite terrifying, and I'm very happy that I'm going to help fix that!" I don't get why so many people are so terrified by C. It's been working well for almost 50 years.

est31 5y ago
Using C for this purpose (application processing untrusted data) is absolutely terrifying. Already when it was invented, C was a step backwards in terms of language design. C has been very successful, and there are definitely advantages like the ubiquitous support, but its lack of memory safety is causative for three quarters of all security bugs in software that is built in it. This share has been found by multiple independent projects so it's kind of a constant. And Tor is not just a random networked application, it manages data highly interesting for state level actors.
- Craighead 5y ago
  do you have a statistic for three quarters?
mhh__ 5y ago
Because C makes it really really easy to write test-free unsafe crap. The list of bugs caused by use if C is genuinely ridiculous. Now, I think there are ways to write robust C - I don't get many bugs now that I usually use AddressSanitizer and a static analyzer (the GCC one is really nice) but that simply isn't good enough any more for high-reliability code.
- calvinmorrison 5y ago
  Let's not mention all the undefined or compiler specific behavior. I love C but come on - let's be realistic
  - mhh__ 5y ago
    I absolutely hate C. Just that I have to use it sometimes.
xvector 5y ago
> It's been working well for almost 50 years. If you count being the source of countless security vulnerabilities "working well." It's pretty senseless to use C in security-sensitive contexts. Let alone Tor.
adrianN 5y ago
For some definitions of "working well", but not many definitions that include robustness against hackers.
pjmlp 5y ago
While security researchers keep taking advantage of memory corruption bugs during those 50 years.
- agumonkey 5y ago
  an interesting codependency curve

est31 5y ago

Using C for this purpose (application processing untrusted data) is absolutely terrifying. Already when it was invented, C was a step backwards in terms of language design. C has been very successful, and there are definitely advantages like the ubiquitous support, but its lack of memory safety is causative for three quarters of all security bugs in software that is built in it. This share has been found by multiple independent projects so it's kind of a constant. And Tor is not just a random networked application, it manages data highly interesting for state level actors.

Craighead 5y ago
do you have a statistic for three quarters?

mhh__ 5y ago

Because C makes it really really easy to write test-free unsafe crap. The list of bugs caused by use if C is genuinely ridiculous. Now, I think there are ways to write robust C - I don't get many bugs now that I usually use AddressSanitizer and a static analyzer (the GCC one is really nice) but that simply isn't good enough any more for high-reliability code.

calvinmorrison 5y ago
Let's not mention all the undefined or compiler specific behavior. I love C but come on - let's be realistic
- mhh__ 5y ago
  I absolutely hate C. Just that I have to use it sometimes.

xvector 5y ago

> It's been working well for almost 50 years. If you count being the source of countless security vulnerabilities "working well." It's pretty senseless to use C in security-sensitive contexts. Let alone Tor.

adrianN 5y ago

For some definitions of "working well", but not many definitions that include robustness against hackers.

pjmlp 5y ago

While security researchers keep taking advantage of memory corruption bugs during those 50 years.

agumonkey 5y ago
an interesting codependency curve