2 ms·

Yeah the logging bug was bad. That’s one bad bug. C++ has bugs that bad that are found and weaponized daily. So, Java is much safer probably by 2-3 orders of

Yeah the logging bug was bad. That’s one bad bug. C++ has bugs that bad that are found and weaponized daily. So, Java is much safer probably by 2-3 orders of magnitude. Also - the log4j thing shows just how dangerous class loading is. It’s an eval like mechanism. Probably future languages designed with safety in mind should avoid eval-like mechanisms as well as avoiding type system escape hatches.

nneonneo 3y ago
FWIW, class loading isn't necessary for log4j to be bad - unchecked Java deserialization is sufficient for pretty bad pwnage. So we really should add "no unchecked deserialization" to the list of things that a safe language should have. Java's biggest mistake here, IMHO, was to have a serialization setup that was based solely on a generic interface rather than having the caller declare up front what class it expects to see. In the latter case, so long as you aren't storing naked Object/Serializable fields, type limits strongly restrict the set of naughty objects that can show up in your deserialized object graph. Rust Serde gets this right.
- pizlonator 3y ago
  What I mean by class loading being bad isn’t that it’s bad that you can load a new class, but that it’s possible to pass a string into an api and have that api vend you a class. That’s bad even if it’s a class that exists already and doesn’t need to be newly loaded. I think unchecked serialization is bad because it leads to that “given a string you get an instance of the class named by it” problem.
ttfkam 3y ago
Ha! Like C & C++ coders haven't been sending and receiving structs as byte streams over networks. Less common today to be sure, but that was a VERY common practice that obviously led to a lot of CVEs. C coders before the internet went public, working on Novell Netware networks were slinging structs willy-nilly over their token ring and thin net, let me tell you!

nneonneo 3y ago

FWIW, class loading isn't necessary for log4j to be bad - unchecked Java deserialization is sufficient for pretty bad pwnage. So we really should add "no unchecked deserialization" to the list of things that a safe language should have. Java's biggest mistake here, IMHO, was to have a serialization setup that was based solely on a generic interface rather than having the caller declare up front what class it expects to see. In the latter case, so long as you aren't storing naked Object/Serializable fields, type limits strongly restrict the set of naughty objects that can show up in your deserialized object graph. Rust Serde gets this right.

pizlonator 3y ago
What I mean by class loading being bad isn’t that it’s bad that you can load a new class, but that it’s possible to pass a string into an api and have that api vend you a class. That’s bad even if it’s a class that exists already and doesn’t need to be newly loaded. I think unchecked serialization is bad because it leads to that “given a string you get an instance of the class named by it” problem.

ttfkam 3y ago

Ha! Like C & C++ coders haven't been sending and receiving structs as byte streams over networks. Less common today to be sure, but that was a VERY common practice that obviously led to a lot of CVEs. C coders before the internet went public, working on Novell Netware networks were slinging structs willy-nilly over their token ring and thin net, let me tell you!