4 ms·

> ...isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only sc

> ...isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only scratching the surface of the vulnerabilities that still lie in the code Yup. For example, the Linux code for its relatively new[1] io_uring subsystem was so memory-exploit-ridden that Google disabled it for apps on Android, and entirely on ChromeOS, and their servers[2]. It is insane that this is how easy it has been for a person to break into Linux. [1] released with kernel version 5.1 which came out in May 2019 [2] in June 2023: https://en.m.wikipedia.org/wiki/Io_uring#Security https://en.m.wikipedia.org/wiki/Io_uring#Security

raverbashing 3y ago
Only goes to show that C is a broken language and unfit for its purpose in today's day and age
- Aeolos 3y ago
  For people downvoting, could you please explain which part of this statement you agree or disagree with?
  - mxkopy 3y ago
    [flagged]
    - raverbashing 3y ago
      > C is syntactic sugar around assembly It isn't As an example, see how C 'int', 'short', 'long' or whatever becomes actual different types > just admit you're not interested in computers I have the popcorn ready already for when the next C "hotshot" shoots himself in the foot yet again because he thinks a chainsaw without an emergency brake is just more fun
      - peteradio 3y ago
        > chainsaw without an emergency brake is just more fun Fun and fast!
    - bcrosby95 3y ago
      > C is syntactic sugar around assembly. The C abstract machine, and the undefined behavior shenanigans compilers are pulling off says otherwise.
    - oconnore 3y ago
      But assembly _is_ outdated, at least for the purpose of authoring large community software projects.
    - callalex 3y ago
      I want to create software that doesn’t harm users. That doesn’t at all imply that I’m not interested in computers. In fact guaranteeing safety for users shows a profound interest in computers.
      - deleted 3y ago
        [deleted]
      - deleted 3y ago
        [deleted]
    - bigbillheck 3y ago
      > C is syntactic sugar around assembly. Even if this is true (and I don't believe it is), it's not useful.
    - ryeights 3y ago
      All programming languages are syntactic sugar around processor instructions
  - eqvinox 3y ago
    The design of io_uring has nothing to do with the language the Linux kernel is implemented in. And safer languages really can't provide guarantees when the issue at hand is designing a shared memory cross-executable (kernel⋄userspace) API.
    - chlorion 3y ago
      Just having first class slice types, where your pointer is paired with a length, which allows for doing bounds checking automatically is a huge upgrade over C, even if it doesn't solve every other problem. Security exploits from out of bounds access should not be happening today, bounds checking is a solved problem, and has been solved for decades.
      - pjmlp 3y ago
        Time to make the point that not even C authors were able to change WG14 mind on the necessity of having fat pointers. https://www.bell-labs.com/usr/dmr/www/vararray.pdf https://www.bell-labs.com/usr/dmr/www/vararray.pdf
        winter_blue 3y ago
        That's a pretty interesting paper. Thanks for sharing it. I wonder why Dennis Ritchie, with the weight his name carries, wasn't able to push it into mainstream implementation...
        pjmlp 3y ago
        Because once a language is managed by ISO, that doesn't matter, the author gets one vote like everyone else. So this shows how the majority of WG14 members see security in C.
diogenes4 3y ago
Kind of crazy we're still using monolithic kernels in 2023. Nothing about `io_uring` needs to happen with elevated privileges. I would take a large—say, 2-5x—performance hit just to escape these kinds of vulnerabilities.
- hderms 3y ago
  but isn't the whole point of io_uring that it's more performant?
- eqvinox 3y ago
  A 2-5× performance hit is also a 2-5× CO₂ hit, and I wouldn't be willing to let myself or other people take that hit. We're throwing enough heat into the atmosphere already to make cats dance on our portable supercomputers as is.

raverbashing 3y ago

Only goes to show that C is a broken language and unfit for its purpose in today's day and age

Aeolos 3y ago
For people downvoting, could you please explain which part of this statement you agree or disagree with?
- mxkopy 3y ago
  [flagged]
  - raverbashing 3y ago
    > C is syntactic sugar around assembly It isn't As an example, see how C 'int', 'short', 'long' or whatever becomes actual different types > just admit you're not interested in computers I have the popcorn ready already for when the next C "hotshot" shoots himself in the foot yet again because he thinks a chainsaw without an emergency brake is just more fun
    - peteradio 3y ago
      > chainsaw without an emergency brake is just more fun Fun and fast!
  - bcrosby95 3y ago
    > C is syntactic sugar around assembly. The C abstract machine, and the undefined behavior shenanigans compilers are pulling off says otherwise.
  - oconnore 3y ago
    But assembly _is_ outdated, at least for the purpose of authoring large community software projects.
  - callalex 3y ago
    I want to create software that doesn’t harm users. That doesn’t at all imply that I’m not interested in computers. In fact guaranteeing safety for users shows a profound interest in computers.
    - deleted 3y ago
      [deleted]
    - deleted 3y ago
      [deleted]
  - bigbillheck 3y ago
    > C is syntactic sugar around assembly. Even if this is true (and I don't believe it is), it's not useful.
  - ryeights 3y ago
    All programming languages are syntactic sugar around processor instructions
- eqvinox 3y ago
  The design of io_uring has nothing to do with the language the Linux kernel is implemented in. And safer languages really can't provide guarantees when the issue at hand is designing a shared memory cross-executable (kernel⋄userspace) API.
  - chlorion 3y ago
    Just having first class slice types, where your pointer is paired with a length, which allows for doing bounds checking automatically is a huge upgrade over C, even if it doesn't solve every other problem. Security exploits from out of bounds access should not be happening today, bounds checking is a solved problem, and has been solved for decades.
    - pjmlp 3y ago
      Time to make the point that not even C authors were able to change WG14 mind on the necessity of having fat pointers. https://www.bell-labs.com/usr/dmr/www/vararray.pdf https://www.bell-labs.com/usr/dmr/www/vararray.pdf
      - winter_blue 3y ago
        That's a pretty interesting paper. Thanks for sharing it. I wonder why Dennis Ritchie, with the weight his name carries, wasn't able to push it into mainstream implementation...
        pjmlp 3y ago
        Because once a language is managed by ISO, that doesn't matter, the author gets one vote like everyone else. So this shows how the majority of WG14 members see security in C.

diogenes4 3y ago

Kind of crazy we're still using monolithic kernels in 2023. Nothing about `io_uring` needs to happen with elevated privileges. I would take a large—say, 2-5x—performance hit just to escape these kinds of vulnerabilities.

hderms 3y ago
but isn't the whole point of io_uring that it's more performant?
eqvinox 3y ago
A 2-5× performance hit is also a 2-5× CO₂ hit, and I wouldn't be willing to let myself or other people take that hit. We're throwing enough heat into the atmosphere already to make cats dance on our portable supercomputers as is.