4 ms·
coreboot just initializes the hardware, the logo is something that the payload displays: https://www.coreboot.org/Payloads https://www.coreboot.org/Payloads Th
by est31 3y ago
coreboot just initializes the hardware, the logo is something that the payload displays: https://www.coreboot.org/Payloads https://www.coreboot.org/Payloads
The most typically used payload is u-boot: https://docs.u-boot.org/en/latest/ https://docs.u-boot.org/en/latest/
u-boot supports specifying splash screens via "splashfile", but it seems only bmp and maybe some raw image format are supported: https://github.com/u-boot/u-boot/blob/2f0282922b2c458eea7f85c500a948a587437b63/common/splash_source.c#L4 https://github.com/u-boot/u-boot/blob/2f0282922b2c458eea7f85...
In other words, no support for png, which this exploit uses :). That doesn't mean that coreboot/u-boot aren't written in C though which is a language known for its vulnerabilities.
- a1o 3y ago> which is a language known for its vulnerabilities C is not known for its vulnerabilities, it's known for being fast, portable, and low on abstractions. It's a perfect fine language to write this kind of code. There are techniques like fuzzing and using things like valgrind that can catch invalid input and memory issues quite quickly.
- zlg_codes 3y agoYeah that stuck out to me, too. The fucking kernel is written in C. 90% or more of the networking stack is written in C. Graphics APIs are written in C. Compilers, databases, firmwares, older video games, everything. C is not known for vulnerabilities, it simply makes it easy to shoot yourself in the foot. The tooling exists to improve code safety, but generally if you don't do anything crazy, nothing crazy happens. Lasers, chainsaws and pressure washers are all easy to hurt one's self with but I wouldn't say they're known for creating injuries. It's more like people are stupid enough to hurt themselves with tools regularly. It's not hard to check a value before dereferencing or freeing it. It's hard to remember to do it.
- yencabulator 3y agoLasers are so known for creating eye injuries they come with warning stickers. Chainsaws are so known for accidents they come with warning pamphlets instructing you in how to use them in ways that minimize the risk -- including recommendations for wearing reinforced chaps to protect your legs. So, following your comparison, it should be perfectly valid to apply a warning sticker to C that says "Warning: Known to state of California to cause data corruption and accidental code execution".
- zlg_codes 3y agoExcept all programming languages can corrupt data. Even knives with sheaths can be misused to harm one's self. Are we gonna include warnings for SQL injection risk? This is a stupid premise.
- yencabulator 3y ago> Are we gonna include warnings for SQL injection risk? No, we've moved to calling conventions that avoid SQL injections: bind params. That argument speaks for minimizing use of C, not in its defense.
- zlg_codes 3y agoNo, all I'm seeing from you is "it's possible to break in C therefore C bad." It's okay to admit you don't like a programming language.
- yencabulator 3y agoConstructing SQL by string manipulation is hard to get right, hence we largely stopped doing that. Same story with C, really. It's okay to admit you're irrationally attached to a tool, and calling things stupid because of it.
- nine_k 3y agoRather, C is know for lack of guard rails, like no bounds checking by default, and some unfortunate early design decisions, like the handling of null, or zero-terminated strings. These are partly mitigated by modern compilers, but can't be done with completely. I'm anticipating the time when Rust and Zig will displace C as the default language for writing hardware-interfacing code. It's not going to happen tomorrow, though.