3 ms·

> using a low budget project with few developers maintaining one of the most used libraries in the whole World as an example of non memory safe languages perils

> using a low budget project with few developers maintaining one of the most used libraries in the whole World as an example of non memory safe languages perils is not exactly honest Why? That's the situation of enormous amount of code people use.

peoplefromibiza 4y ago
because Log4j is part of that enormous amount of code you talk about and it's probably used by much less experienced programmers on average, because Java it's safe by design, isn't it? Anyway heartbleed was discovered after many years, let's wait the same many years and see what kind of bugs we'll find in code written today with different languages. Full disclaimer: I do not write C code since long time ago and have no intention of going back, but dogmatic programmers that believe in "saviours" are a real mistery to me. The same people forgetting to free a resource are the same people that will forget to sanitize some input, meaning all of us make mistakes and will keep making them, in any language and those mistakes will be abused by some malevolent actor. Google problems are not everyone's problems. Goggle's solutions to problems are not everyone's solutions to the same problems. Assuming that what Google says is applicable everywhere is at best naive.
- fiedzia 4y ago
  > all of us make mistakes and will keep making them, in any language .. unless said language makes making those mistakes difficult or impossible. Sanitizing input for example has not been an issue for me for decades, as every framework I used handles that by default, I'd have to work extra hard to make a mistake there. > Google problems are not everyone's problems. In this case they are. Not only memory safety is an issue for many codebases that have at least some C somewhere, but also because Google products are used by milions. > Goggle's solutions to problems are not everyone's solutions to the same problems. > Assuming that what Google says is applicable everywhere is at best naive Any other time I'd agree with you, but I don't see anything Google-specific here.
  - peoplefromibiza 4y ago
    > unless said language makes making those mistakes difficult or impossible You're missing the point [1] (or I was unclear) Yes, improvements in neuro surgery can save lives, but the bulk of preventable deaths it's in human mistakes [2] that are almost impossible to make impossible. Just like the majority of the bugs are not prevented using rust, just a minority of them, which are also arguably the hardest to find and exploit, while a SQL injection can be exploid by a script kiddie with average IQ. [1] https://portswigger.net/daily-swig/mastodon-users-vulnerable-to-password-stealing-attacks https://portswigger.net/daily-swig/mastodon-users-vulnerable... [2] The three risk factors most commonly leading to preventable death in the population of the United States are smoking, high blood pressure, and being overweight.
    - fiedzia 4y ago
      > Just like the majority of the bugs are not prevented using rust, "For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerabilities". That's not minority. We are getting into minority territory now because of Rust and other memory-safe languages. > while a SQL injection can be exploid by a script kiddie with average IQ. Use any framework and it's solved problem.

peoplefromibiza 4y ago

because Log4j is part of that enormous amount of code you talk about and it's probably used by much less experienced programmers on average, because Java it's safe by design, isn't it? Anyway heartbleed was discovered after many years, let's wait the same many years and see what kind of bugs we'll find in code written today with different languages. Full disclaimer: I do not write C code since long time ago and have no intention of going back, but dogmatic programmers that believe in "saviours" are a real mistery to me. The same people forgetting to free a resource are the same people that will forget to sanitize some input, meaning all of us make mistakes and will keep making them, in any language and those mistakes will be abused by some malevolent actor. Google problems are not everyone's problems. Goggle's solutions to problems are not everyone's solutions to the same problems. Assuming that what Google says is applicable everywhere is at best naive.

fiedzia 4y ago
> all of us make mistakes and will keep making them, in any language .. unless said language makes making those mistakes difficult or impossible. Sanitizing input for example has not been an issue for me for decades, as every framework I used handles that by default, I'd have to work extra hard to make a mistake there. > Google problems are not everyone's problems. In this case they are. Not only memory safety is an issue for many codebases that have at least some C somewhere, but also because Google products are used by milions. > Goggle's solutions to problems are not everyone's solutions to the same problems. > Assuming that what Google says is applicable everywhere is at best naive Any other time I'd agree with you, but I don't see anything Google-specific here.
- peoplefromibiza 4y ago
  > unless said language makes making those mistakes difficult or impossible You're missing the point [1] (or I was unclear) Yes, improvements in neuro surgery can save lives, but the bulk of preventable deaths it's in human mistakes [2] that are almost impossible to make impossible. Just like the majority of the bugs are not prevented using rust, just a minority of them, which are also arguably the hardest to find and exploit, while a SQL injection can be exploid by a script kiddie with average IQ. [1] https://portswigger.net/daily-swig/mastodon-users-vulnerable-to-password-stealing-attacks https://portswigger.net/daily-swig/mastodon-users-vulnerable... [2] The three risk factors most commonly leading to preventable death in the population of the United States are smoking, high blood pressure, and being overweight.
  - fiedzia 4y ago
    > Just like the majority of the bugs are not prevented using rust, "For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerabilities". That's not minority. We are getting into minority territory now because of Rust and other memory-safe languages. > while a SQL injection can be exploid by a script kiddie with average IQ. Use any framework and it's solved problem.