3 ms·

Published last friday - https://seclists.org/oss-sec/2023/q1/20 https://seclists.org/oss-sec/2023/q1/20 Oodles of vulns in linux that are made possible by C's

Published last friday - https://seclists.org/oss-sec/2023/q1/20 https://seclists.org/oss-sec/2023/q1/20 Oodles of vulns in linux that are made possible by C's lack of safety guarantees.

simplotek 4y ago
> Oodles of vulns in linux that are made possible by C's lack of safety guarantees. I'm sorry, isn't your link about how a user found a memory error in the Linux codebase? It seems way farfetched to jump to your conclusion from that starting point. I mean, doesn't Linux have over 12 million lines of code right now?
- UncleMeat 4y ago
  It is one example of gazillions. I chose it because it was published a few days ago. We've somehow as a community just come to accept that linux will be riddled with security vulns. This is incredible to me, as the security of an enormous number of our applications depends on the kernel being secure. What ratio of vulns to lines of code in linux would you find acceptable?
  - simplotek 4y ago
    > It is one example of gazillions. It's literally a single memory error in over 12 million lines of code. What exactly was the point you were trying to make? > We've somehow as a community just come to accept that linux will be riddled with security vulns. I'm sorry, your claim is pure nonsense detached from reality. What exactly led you to believe it's reasonable to jump from finding a single memory error among over 12M loc to "riddled with security vulnerabilities"? Linux quite literally dominates the list of most secure OSs. Where exactly do you base your personal assertion?
    - UncleMeat 4y ago
      Vulns are found at a roughly uniform rate. I mean, we can go search the CVE database for the linux kernel. Surely you don't think that this is the only vuln ever discovered there?
      - simplotek 4y ago
        > Vulns are found at a roughly uniform rate. I'm sorry, this means nothing. As you made extraordinary claims regarding the security of Linux, did you based your personal assertion on any real world comparison between OSes? Because so far you failed to provide any support for your claim, beyond pointing out a mailing list thread on a single memory error in a RC1 within a 12M loc codebase.
        UncleMeat 4y ago
        What number of vulns would be acceptable to you?
        simplotek 4y ago
        > What number of vulns would be acceptable to you? Please stop trying to avoid the question. Either you based your personal assertions on concrete data, or you're just a clueless troll spewing baseless nonsense. You've repeatedly tried to dance your way out if substantiating your extraordinary claims. Either you're able to come up with any semblance of support for your claims, or you can't. What is it?
        UncleMeat 4y ago
        Here are 2,300 CVEs in linux. https://www.linuxkernelcves.com/cves https://www.linuxkernelcves.com/cves. You can wander through and look for terms like use-after-free and buffer overflow. I'm not comparing it to other operating systems. I'm not suggesting that people stop using linux. I'm suggesting that as an industry we need to take this seriously and improve the safety of the most widely used and critical piece of software on the planet.

Published last friday - https://seclists.org/oss-sec/2023/q1/20 https://seclists.org/oss-sec/2023/q1/20 Oodles of vulns in linux that are made possible by C's lack of safety guarantees.

simplotek 4y ago

> Oodles of vulns in linux that are made possible by C's lack of safety guarantees. I'm sorry, isn't your link about how a user found a memory error in the Linux codebase? It seems way farfetched to jump to your conclusion from that starting point. I mean, doesn't Linux have over 12 million lines of code right now?

UncleMeat 4y ago
It is one example of gazillions. I chose it because it was published a few days ago. We've somehow as a community just come to accept that linux will be riddled with security vulns. This is incredible to me, as the security of an enormous number of our applications depends on the kernel being secure. What ratio of vulns to lines of code in linux would you find acceptable?
- simplotek 4y ago
  > It is one example of gazillions. It's literally a single memory error in over 12 million lines of code. What exactly was the point you were trying to make? > We've somehow as a community just come to accept that linux will be riddled with security vulns. I'm sorry, your claim is pure nonsense detached from reality. What exactly led you to believe it's reasonable to jump from finding a single memory error among over 12M loc to "riddled with security vulnerabilities"? Linux quite literally dominates the list of most secure OSs. Where exactly do you base your personal assertion?
  - UncleMeat 4y ago
    Vulns are found at a roughly uniform rate. I mean, we can go search the CVE database for the linux kernel. Surely you don't think that this is the only vuln ever discovered there?
    - simplotek 4y ago
      > Vulns are found at a roughly uniform rate. I'm sorry, this means nothing. As you made extraordinary claims regarding the security of Linux, did you based your personal assertion on any real world comparison between OSes? Because so far you failed to provide any support for your claim, beyond pointing out a mailing list thread on a single memory error in a RC1 within a 12M loc codebase.
      - UncleMeat 4y ago
        What number of vulns would be acceptable to you?
        simplotek 4y ago
        > What number of vulns would be acceptable to you? Please stop trying to avoid the question. Either you based your personal assertions on concrete data, or you're just a clueless troll spewing baseless nonsense. You've repeatedly tried to dance your way out if substantiating your extraordinary claims. Either you're able to come up with any semblance of support for your claims, or you can't. What is it?
        UncleMeat 4y ago
        Here are 2,300 CVEs in linux. https://www.linuxkernelcves.com/cves https://www.linuxkernelcves.com/cves. You can wander through and look for terms like use-after-free and buffer overflow. I'm not comparing it to other operating systems. I'm not suggesting that people stop using linux. I'm suggesting that as an industry we need to take this seriously and improve the safety of the most widely used and critical piece of software on the planet.