4 ms·

I just cringed when I saw C++ and safety in one sentence. This is good statistics to showcase gut feeling, thanks.

72deluxe 4y ago
I presume you're using an operating system and browser written in Rust? If not, it would seem that the C/C++ based operating systems and browsers that you are use are perfectly safe to use, no??
- carlmr 4y ago
  Those OSes and browsers do show memory safety issues time and time again. They are some of the most hardened codebases, and still fail in light of the issues with C and C++.
  - TigerTeamX 4y ago
    Exactly.
  - 72deluxe 4y ago
    The languages are not at fault. The fallible users of them are. This is identical to me writing a garbage sentence in English and then proclaiming that English as a language is wrong and needs to be replaced because it's perfectly possible to write something grammatically incorrect in it. Surely you can see the difference but are conflating use of the language with the language itself.
- UncleMeat 4y ago
  Published last friday - https://seclists.org/oss-sec/2023/q1/20 https://seclists.org/oss-sec/2023/q1/20 Oodles of vulns in linux that are made possible by C's lack of safety guarantees.
  - simplotek 4y ago
    > Oodles of vulns in linux that are made possible by C's lack of safety guarantees. I'm sorry, isn't your link about how a user found a memory error in the Linux codebase? It seems way farfetched to jump to your conclusion from that starting point. I mean, doesn't Linux have over 12 million lines of code right now?
    - UncleMeat 4y ago
      It is one example of gazillions. I chose it because it was published a few days ago. We've somehow as a community just come to accept that linux will be riddled with security vulns. This is incredible to me, as the security of an enormous number of our applications depends on the kernel being secure. What ratio of vulns to lines of code in linux would you find acceptable?
      - simplotek 4y ago
        > It is one example of gazillions. It's literally a single memory error in over 12 million lines of code. What exactly was the point you were trying to make? > We've somehow as a community just come to accept that linux will be riddled with security vulns. I'm sorry, your claim is pure nonsense detached from reality. What exactly led you to believe it's reasonable to jump from finding a single memory error among over 12M loc to "riddled with security vulnerabilities"? Linux quite literally dominates the list of most secure OSs. Where exactly do you base your personal assertion?
        UncleMeat 4y ago
        Vulns are found at a roughly uniform rate. I mean, we can go search the CVE database for the linux kernel. Surely you don't think that this is the only vuln ever discovered there?
        simplotek 4y ago
        > Vulns are found at a roughly uniform rate. I'm sorry, this means nothing. As you made extraordinary claims regarding the security of Linux, did you based your personal assertion on any real world comparison between OSes? Because so far you failed to provide any support for your claim, beyond pointing out a mailing list thread on a single memory error in a RC1 within a 12M loc codebase.

I presume you're using an operating system and browser written in Rust? If not, it would seem that the C/C++ based operating systems and browsers that you are use are perfectly safe to use, no??

carlmr 4y ago
Those OSes and browsers do show memory safety issues time and time again. They are some of the most hardened codebases, and still fail in light of the issues with C and C++.
- TigerTeamX 4y ago
  Exactly.
- 72deluxe 4y ago
  The languages are not at fault. The fallible users of them are. This is identical to me writing a garbage sentence in English and then proclaiming that English as a language is wrong and needs to be replaced because it's perfectly possible to write something grammatically incorrect in it. Surely you can see the difference but are conflating use of the language with the language itself.
UncleMeat 4y ago
Published last friday - https://seclists.org/oss-sec/2023/q1/20 https://seclists.org/oss-sec/2023/q1/20 Oodles of vulns in linux that are made possible by C's lack of safety guarantees.
- simplotek 4y ago
  > Oodles of vulns in linux that are made possible by C's lack of safety guarantees. I'm sorry, isn't your link about how a user found a memory error in the Linux codebase? It seems way farfetched to jump to your conclusion from that starting point. I mean, doesn't Linux have over 12 million lines of code right now?
  - UncleMeat 4y ago
    It is one example of gazillions. I chose it because it was published a few days ago. We've somehow as a community just come to accept that linux will be riddled with security vulns. This is incredible to me, as the security of an enormous number of our applications depends on the kernel being secure. What ratio of vulns to lines of code in linux would you find acceptable?
    - simplotek 4y ago
      > It is one example of gazillions. It's literally a single memory error in over 12 million lines of code. What exactly was the point you were trying to make? > We've somehow as a community just come to accept that linux will be riddled with security vulns. I'm sorry, your claim is pure nonsense detached from reality. What exactly led you to believe it's reasonable to jump from finding a single memory error among over 12M loc to "riddled with security vulnerabilities"? Linux quite literally dominates the list of most secure OSs. Where exactly do you base your personal assertion?
      - UncleMeat 4y ago
        Vulns are found at a roughly uniform rate. I mean, we can go search the CVE database for the linux kernel. Surely you don't think that this is the only vuln ever discovered there?
        simplotek 4y ago
        > Vulns are found at a roughly uniform rate. I'm sorry, this means nothing. As you made extraordinary claims regarding the security of Linux, did you based your personal assertion on any real world comparison between OSes? Because so far you failed to provide any support for your claim, beyond pointing out a mailing list thread on a single memory error in a RC1 within a 12M loc codebase.