4 ms·

Heartbleed was in openssl. I didn't ask about memory safety in C. Caddy author was pretty accurate with his statement, I asked for proof. Heartbleed is not the

by zmxz 4y ago

Heartbleed was in openssl. I didn't ask about memory safety in C. Caddy author was pretty accurate with his statement, I asked for proof. Heartbleed is not the only memory leak, there's plenty, C's been around like software written in it. I'm aware of shortcomings.

mholt 4y ago
Guess which web servers use(d) openssl...
xyzzyz 4y ago
Sorry, I don’t get understand your response. Most Caddy’s competitors use OpenSSL, and so are vulnerable to bugs in it. A lot of those bugs, like for example heartbleed, are only possible due to the nature of the C language. Those kinds of bugs, the memory safety bugs, are prevented when using memory safe languages like Go. These bugs are real and serious, and collectively cost billions of dollars in damages.
- zmxz 4y ago
  I don't understand your response. There's not a single proof except heartbleed in OpenSSL. I merely asked the author to provide the proof, not for you and I to engage in Go's memory safety and billions in damages and inherent nature of C and so on. If we were to sum all the "damages" caused by faulty software, we'd arrive at a number that exceeds the total sum of money on planet Earth, let's not use that false metric for this discussion. Is there an actual problem right now with nginx that Caddy circumvents with its architecture? Yes or no? That's the question.
  - mholt 4y ago
    Yes
  - xyzzyz 4y ago
    Yes. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2028 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2028 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2089 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2089 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4315 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4315 Should I go on? None of the above errors is possible in a memory safe language like golang.

by zmxz 4y ago

mholt 4y ago

Guess which web servers use(d) openssl...

xyzzyz 4y ago

Sorry, I don’t get understand your response. Most Caddy’s competitors use OpenSSL, and so are vulnerable to bugs in it. A lot of those bugs, like for example heartbleed, are only possible due to the nature of the C language. Those kinds of bugs, the memory safety bugs, are prevented when using memory safe languages like Go. These bugs are real and serious, and collectively cost billions of dollars in damages.

zmxz 4y ago
I don't understand your response. There's not a single proof except heartbleed in OpenSSL. I merely asked the author to provide the proof, not for you and I to engage in Go's memory safety and billions in damages and inherent nature of C and so on. If we were to sum all the "damages" caused by faulty software, we'd arrive at a number that exceeds the total sum of money on planet Earth, let's not use that false metric for this discussion. Is there an actual problem right now with nginx that Caddy circumvents with its architecture? Yes or no? That's the question.
- mholt 4y ago
  Yes
- xyzzyz 4y ago
  Yes. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0133 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2028 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2028 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2089 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2089 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4315 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4315 Should I go on? None of the above errors is possible in a memory safe language like golang.