5 ms·

This is very impressive, but I’ll be honest, I wouldn’t want to expose any new software written in C to the internet.

by nynx 5y ago

__vim__ 5y ago
I feel this comment is misguided. Plenty of new code is written in C, particularly in the scientific computing space. If the code in question doesnt do lots memory management and expects the user to provide a memory block to be populated with values, then I see no issues. C code tends to be faster than other implementations even without optimizations. Moreover, lots of interpreted languages have good interoperability with C so a C compiled code can be called in many languages using simple high level interfaces.
0xFFFFFFFFF 5y ago
Can I ask you why? I mean, I know about memory safety and stuff, but it is that bad?
- roca 5y ago
  Yes it is.
  - deleted 5y ago
    [deleted]
- pizza234 5y ago
  Independent researches (Microsoft/Mozilla) showed that around 70% of security vulnerabilities are caused by memory safety bugs. That's one heck of a "memory safety and stuff" :) Here's one reference: https://msrc-blog.microsoft.com/2019/07/18/we-need-a-safer-systems-programming-language/ https://msrc-blog.microsoft.com/2019/07/18/we-need-a-safer-s...
  - postalrat 5y ago
    "memory safety bugs" sounds pretty broad. What sort of vulnerability doesn't involve memory access?
    - UncleMeat 5y ago
      Something like SQL injection is a vulnerability that is not exploiting a memory error.
    - nynx 5y ago
      its “memory safety”, not “accesses memory”
  - shatteredspace 5y ago
    That reference and the original blog post where 70% was indicated is only dealing with security vulnerabilities in Microsoft's software, not everyone's. So while other software that isn't Microsoft most certainly has memory safety bugs, this blog doesn't speak for those, only Microsoft's. The only part that Mozilla is indicated is in reference to Rust.
    - syvolt 5y ago
      If one of the largest software companies around can't get memory safety right, it does make a guy start to think that maybe most people should avoid having to handle it if they can.
      - shatteredspace 5y ago
        I don't have a fully developed opinion on that, so I won't try to come up with one on the spot. My comment is purely because I felt the parent left out details about the blog post that should have been pointed out.
    - saagarjha 5y ago
      Google has done similar research on their codebases and found results in line with Microsoft’s.
jazzyjackson 5y ago
I wouldn’t be too worried about a bitcoin node since the whole point is to stay in consensus with the rest of the network
kahlonel 5y ago
Yeah it’s not like the browser you are using, the OS you have installed, or even the firmware of the keyboard you’re typing this on is written in C.

This is very impressive, but I’ll be honest, I wouldn’t want to expose any new software written in C to the internet.

by nynx 5y ago

This is very impressive, but I’ll be honest, I wouldn’t want to expose any new software written in C to the internet.

I feel this comment is misguided. Plenty of new code is written in C, particularly in the scientific computing space. If the code in question doesnt do lots memory management and expects the user to provide a memory block to be populated with values, then I see no issues. C code tends to be faster than other implementations even without optimizations. Moreover, lots of interpreted languages have good interoperability with C so a C compiled code can be called in many languages using simple high level interfaces.

0xFFFFFFFFF 5y ago

Can I ask you why? I mean, I know about memory safety and stuff, but it is that bad?

roca 5y ago
Yes it is.
- deleted 5y ago
  [deleted]
pizza234 5y ago
Independent researches (Microsoft/Mozilla) showed that around 70% of security vulnerabilities are caused by memory safety bugs. That's one heck of a "memory safety and stuff" :) Here's one reference: https://msrc-blog.microsoft.com/2019/07/18/we-need-a-safer-systems-programming-language/ https://msrc-blog.microsoft.com/2019/07/18/we-need-a-safer-s...
- postalrat 5y ago
  "memory safety bugs" sounds pretty broad. What sort of vulnerability doesn't involve memory access?
  - UncleMeat 5y ago
    Something like SQL injection is a vulnerability that is not exploiting a memory error.
  - nynx 5y ago
    its “memory safety”, not “accesses memory”
- shatteredspace 5y ago
  That reference and the original blog post where 70% was indicated is only dealing with security vulnerabilities in Microsoft's software, not everyone's. So while other software that isn't Microsoft most certainly has memory safety bugs, this blog doesn't speak for those, only Microsoft's. The only part that Mozilla is indicated is in reference to Rust.
  - syvolt 5y ago
    If one of the largest software companies around can't get memory safety right, it does make a guy start to think that maybe most people should avoid having to handle it if they can.
    - shatteredspace 5y ago
      I don't have a fully developed opinion on that, so I won't try to come up with one on the spot. My comment is purely because I felt the parent left out details about the blog post that should have been pointed out.
  - saagarjha 5y ago
    Google has done similar research on their codebases and found results in line with Microsoft’s.

jazzyjackson 5y ago

I wouldn’t be too worried about a bitcoin node since the whole point is to stay in consensus with the rest of the network

kahlonel 5y ago

Yeah it’s not like the browser you are using, the OS you have installed, or even the firmware of the keyboard you’re typing this on is written in C.