3 ms·

[flagged]

by q3k 2y ago

[flagged]

deleted 2y ago
[deleted]
happosai 2y ago
Well it was solved decades ago in Java yet Java apps have proven no more secure in general. It is a broader ecosystem problem that there almost no incentive to write secure code. Security is an afterthought like documentation.
- stavros 2y ago
  > Java apps have proven no more secure in general Really? I think an extraordinary claim like "eliminating a whole class of problems makes applications no more secure in general" should also come with extraordinary evidence.
  - petee 2y ago
    I think Java's CVE list should say enough. Point being humans can muck anything up, regardless of safeguards
    - stavros 2y ago
      A CVE list says nothing. I made my own language which has no CVEs, that obviously doesn't mean it's secure. The relevant metric is "CVEs per unit of functionality".
      - sedatk 2y ago
        Also, popularity directly affects the number of CVEs.
    - bastawhiz 2y ago
      This is a nonsense statement unless you note the Java runtime. Java is a language. The runtime is the software that runs the Java code. There's more than one runtime.
    - Clamchop 2y ago
      The point of the person you're replying to is that JVM software has far fewer vulnerabilities than it would have otherwise. The number of CVEs reveals that there is a lot of Java software and that there's a strong culture of importing dependencies. But we also care about the nature of them, the normalized relative frequency of very serious flaws like RCE exploits.
eqvinox 2y ago
C, C++ and assembly are 3 languages where this regularly happens. Can we stop with the snide comments now please? They're not helpful.
cushychicken 2y ago
[flagged]
anthk 2y ago
Not an issue with ath9k. Guess why. Hint: not Rust related.
asveikau 2y ago
My anecdotal experience with mediatek wifi is it's a very flakey, low quality brand. That might be more of the reason. The firmware is probably unpolished, rushed, not maintained by competent people.
dang 2y ago
"Don't be snarky. [...] Omit internet tropes." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

[flagged]

by q3k 2y ago

[flagged]

deleted 2y ago

[deleted]

happosai 2y ago

Well it was solved decades ago in Java yet Java apps have proven no more secure in general. It is a broader ecosystem problem that there almost no incentive to write secure code. Security is an afterthought like documentation.

stavros 2y ago
> Java apps have proven no more secure in general Really? I think an extraordinary claim like "eliminating a whole class of problems makes applications no more secure in general" should also come with extraordinary evidence.
- petee 2y ago
  I think Java's CVE list should say enough. Point being humans can muck anything up, regardless of safeguards
  - stavros 2y ago
    A CVE list says nothing. I made my own language which has no CVEs, that obviously doesn't mean it's secure. The relevant metric is "CVEs per unit of functionality".
    - sedatk 2y ago
      Also, popularity directly affects the number of CVEs.
  - bastawhiz 2y ago
    This is a nonsense statement unless you note the Java runtime. Java is a language. The runtime is the software that runs the Java code. There's more than one runtime.
  - Clamchop 2y ago
    The point of the person you're replying to is that JVM software has far fewer vulnerabilities than it would have otherwise. The number of CVEs reveals that there is a lot of Java software and that there's a strong culture of importing dependencies. But we also care about the nature of them, the normalized relative frequency of very serious flaws like RCE exploits.

eqvinox 2y ago

C, C++ and assembly are 3 languages where this regularly happens. Can we stop with the snide comments now please? They're not helpful.

cushychicken 2y ago

[flagged]

anthk 2y ago

Not an issue with ath9k. Guess why. Hint: not Rust related.

asveikau 2y ago

My anecdotal experience with mediatek wifi is it's a very flakey, low quality brand. That might be more of the reason. The firmware is probably unpolished, rushed, not maintained by competent people.

dang 2y ago

"Don't be snarky. [...] Omit internet tropes." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html