3 ms·

My fear comes from the fact that I was a security consultant, and reviewed a lot of C applications containing nasty bugs.

• kwertyoowiyop 5y ago
  Definitely. Though Linux code has probably been tested more thoroughly, and run through more static analysis, than any other C code base. That does help me sleep a little better at night.
• freedomben 5y ago
  Interesting, I had the same job in mid to late 00s, although I wasn't a consultant so my sample was the company's codebases (of which there were a lot because we built a lot of embedded systems on top of vxworks that did a lot of network communications, sometimes in very niche protocols), not necessarily the codebases of company's that are worried enough that they hire a consultant. That was right around the time when compilers and security tools were becoming available that could flag nearly every possible problem. At that point false positives became a big challenge. What years were you a consultant reviewing C applications?
  • baby 5y ago
    I'm guessing you were using tools like coverity? I actually never used such tools. I mostly did manual reviews and sometimes implemented fuzzers with AFL. But most of the code I looked at was crypto code. Did that at Matasano/NCC Group from 2015-2019
    • freedomben 5y ago
      it's been 15 years so I don't remember the names of the tools, but coverity rings a bell. There was one that we used to make fun of a lot because it was written in Java, but it was by far the best at finding stuff. It would even show you the AST to help point out problems. I'm suddenly feeling really nostalgic about GUIs written in Swing and SWT :-D
• yjftsjthsd-h 5y ago
  What percentage of non-C applications did you review? I suspect C has enough footguns to be an issue, but its popularity, especially in low-level software (kernels, codecs, firmware) ensures that it'll show up in security issues regardless of how bad the languages itself is.
  • selfmodruntime 5y ago
    There is a significant margin between C applications and those of languages with a GC, at least in my experience.
    • netr0ute 5y ago
      How much GC stuff have you seen in comparison to C?
      • baby 5y ago
        There's a difference in GC languages though. strongly typed languages like Golang will always be more secure than dynamically typed languages like Python.
  • baby 5y ago
    I reviewed mostly C, then reviewed mostly Golang. But I also reviewed codebases in Erlang, Perl, Java, C++, Rust, Python, Javascript, etc. Mind you I was mostly reviewing cryptographic-related applications, but most C applications contained bugs that had nothing to do with the logic (lots of memory corruption bugs) while most Golang applications contained logic bugs. Or at least I would find logic bugs because Golang was both rid of most memory corruption bugs, and also an extremely readable language (so easier for me to understand the code and find logic bugs). Although Golang still had nil dereference bugs (happens a lot when people used protobuf), because they don't have sum types. Today I think a great language would be a mix between a readable language like Go (with good defaults, toolings, stdlib) and a safe languages like Rust.