3 ms·
I mean, yeah, these things are kind of silly. So is, "But it's even scarier: it's written in C. I guess this is from like 2010? Don't run stuff like this."
by ergonaught 4y ago
I mean, yeah, these things are kind of silly. So is, "But it's even scarier: it's written in C. I guess this is from like 2010? Don't run stuff like this."
- tptacek 4y agoFail2ban is written in Python and managed to have a vulnerability.
- Jorengarenar 4y agoSince when being written in Python automatically makes a program less vulnerability prone than usual?
- tptacek 4y agoIt depends I guess on where you start the count; some people would say Elias' "Smashing The Stack", I'd say Lopatic's HP-UX exploit, some people would go all the way back to RTM's worm.
- _flux 4y agoWell it does make the developer try harder to have a vulnerability. You can't just forget to bound check an array indexing, you need to actually take instructions from the Internet (e.g. eval, import, or exec in case of fail2ban), but of course the way this happens is usually very indirect (e.g. race condition). No programming language can stop a determined developer from creating a vulnerability, but some languages make the task easier than others.
- rurban 4y agoIt's mostly shell scripts, with a few C handlers. Very minimal.