4 ms·

I'm kind of shocked that one of the qualifiers for choosing a tech-stack wasn't security, on a product that's specifically in the cyber-sec domain? They should

I'm kind of shocked that one of the qualifiers for choosing a tech-stack wasn't security, on a product that's specifically in the cyber-sec domain? They should have gone with Rust if they wanted to choose something new. C would have been respectable. >Some fairly trivial CSS build steps using node have more dependencies than our entire C# product! I don't know if I would really trust anything else written here. This is a security-focused product. Surely they understand that explicit, external dependencies are in fact safer than internal, implicit or "quiet" dependencies that make it hard to pinpoint attack vectors. It's really trivial to say, set up "canaries" around the former dependencies vs. the latter. Red team 101. Also .NET's runtime is _incredibly_ transparent, which is part of the reason why it's "reflection" capabilities are so powerful. And this can often be a great thing for developers, but I don't know about a security product that's supposed to be acting as a defense line. This is why even most obfuscation programs struggle with .NET because ultimately you can't really obfuscate much (pass some elementary things that have been obsolete since 2009 at least). .NET programs can also "mutate" dramatically with no hope of detection except by outside sources that are constantly checking for the integrity of known programs. And I'm not talking about "compile-after-delivery" vectors either. For example it's pretty well known in some circles that the CLR's dynamic assembly initialization and reflection capabilities allow you to even bypass AMSI. For _security-focused_ products and minimizing the blast radius on endpoints/systems, .NET (like other similar tech-stacks) really should be a no-go. >Honestly, we’re not doing real-time/systems/embedded programming; we can afford a GC pause. God this really hurts to read. You guys are really worried about the wrong thing(s).

CharlieDigital 2y ago
> I'm kind of shocked that one of the qualifiers for choosing a tech-stack wasn't security, on a product that's specifically in the cyber-sec domain? This is a bad take. GitHub's State of the Octoverse 2020 security report is a good read[0]. The nuget ecosystem has among the lowest package advisories, the percentage of active repos receiving Dependabot alerts, and .NET packages overall have very low numbers of direct dependencies (reducing the surface area for vulnerabilities in the supply chain). A big benefit of the large first party ecosystem and broad base class library is that there are large teams of paid, professional engineers whose job is to actually track CVEs and patch vulnerabilities in .NET and C# as well as Microsoft's first party libraries. If anything, I'd say .NET/C# are probably one of the better choices if you plan to build in a regulated or secure context because of the large first-party libraries and active monitoring and patching of CVEs by Microsoft engineers. [0] https://octoverse.github.com/2020/ https://octoverse.github.com/2020/ (download the full PDFs)
- whoknowsidont 2y ago
  [flagged]
  - Capricorn2481 2y ago
    > How is being focused on security for a security product a bad take? They're saying C# is more secure than other languages. > Why are you following me around between threads? You've accused a few users of this. It's a small site. I Think we're just noticing when there's an oddly hostile take on C# that's light on details, it's you. I don't use C#, so I'm curious about your perspective. I'm still waiting for substantive answers to your thoughts on things (like https://news.ycombinator.com/item?id=42873130 https://news.ycombinator.com/item?id=42873130) and not just mud slinging. You may have valid complaints, but it's coming off like you're spreading FUD. This comment isn't much better because they the original poster made their thoughts clear and you said "You think security is bad?!"
    - whoknowsidont 2y ago
      Be gone troll. The article mentioned nothing about stack security. I commented on it. I gave a pretty CLEAR and EXACT example on the type of exploits that the .NET runtime allows. I didn't mention C# one time in my post except for what was quoted in the article. It was about the .NET runtime. That's hardly "hostile" to C# when it's a technical fact and has been demonstrated and used out in the wild. And then the same people that spend all of their time in a religious war about C# posted something irrelevant to what was stated, and strangely didn't post ANYTHING on the article before I did. Only after I commented they show up, responding directly to me. And here you are again, being a weirdo on the internet. Seriously go do something else. C# doesn't love you, it's a tool. Not a religion. EDIT: The reddit history really tells it all. Constant downvotes, following people across subreddits, and constant yapping about Go vs C# going back years. https://old.reddit.com/user/_neonsunset/comments/ https://old.reddit.com/user/_neonsunset/comments/ -- The intense religiosity and dishonesty with which you/you all discuss this topic is legitimately insane. Close the browser. Go do something else.
jitl 2y ago
How is c an advisable/respectable choice for a web service & cloud orchestrator system?
- whoknowsidont 2y ago
  I think you need to look at the product we're talking about.
  - jitl 2y ago
    I did, it’s a thingy that creates tasty looking cloud objects (“canaries”) in your AWS account and then monitors them for suspicious access seemingly by slurping cloudtrail logs. C seems like a horrid language for this kind of very integration / API / glue heavy domain.

CharlieDigital 2y ago

> I'm kind of shocked that one of the qualifiers for choosing a tech-stack wasn't security, on a product that's specifically in the cyber-sec domain? This is a bad take. GitHub's State of the Octoverse 2020 security report is a good read[0]. The nuget ecosystem has among the lowest package advisories, the percentage of active repos receiving Dependabot alerts, and .NET packages overall have very low numbers of direct dependencies (reducing the surface area for vulnerabilities in the supply chain). A big benefit of the large first party ecosystem and broad base class library is that there are large teams of paid, professional engineers whose job is to actually track CVEs and patch vulnerabilities in .NET and C# as well as Microsoft's first party libraries. If anything, I'd say .NET/C# are probably one of the better choices if you plan to build in a regulated or secure context because of the large first-party libraries and active monitoring and patching of CVEs by Microsoft engineers. [0] https://octoverse.github.com/2020/ https://octoverse.github.com/2020/ (download the full PDFs)

whoknowsidont 2y ago
[flagged]
- Capricorn2481 2y ago
  > How is being focused on security for a security product a bad take? They're saying C# is more secure than other languages. > Why are you following me around between threads? You've accused a few users of this. It's a small site. I Think we're just noticing when there's an oddly hostile take on C# that's light on details, it's you. I don't use C#, so I'm curious about your perspective. I'm still waiting for substantive answers to your thoughts on things (like https://news.ycombinator.com/item?id=42873130 https://news.ycombinator.com/item?id=42873130) and not just mud slinging. You may have valid complaints, but it's coming off like you're spreading FUD. This comment isn't much better because they the original poster made their thoughts clear and you said "You think security is bad?!"
  - whoknowsidont 2y ago
    Be gone troll. The article mentioned nothing about stack security. I commented on it. I gave a pretty CLEAR and EXACT example on the type of exploits that the .NET runtime allows. I didn't mention C# one time in my post except for what was quoted in the article. It was about the .NET runtime. That's hardly "hostile" to C# when it's a technical fact and has been demonstrated and used out in the wild. And then the same people that spend all of their time in a religious war about C# posted something irrelevant to what was stated, and strangely didn't post ANYTHING on the article before I did. Only after I commented they show up, responding directly to me. And here you are again, being a weirdo on the internet. Seriously go do something else. C# doesn't love you, it's a tool. Not a religion. EDIT: The reddit history really tells it all. Constant downvotes, following people across subreddits, and constant yapping about Go vs C# going back years. https://old.reddit.com/user/_neonsunset/comments/ https://old.reddit.com/user/_neonsunset/comments/ -- The intense religiosity and dishonesty with which you/you all discuss this topic is legitimately insane. Close the browser. Go do something else.

jitl 2y ago

How is c an advisable/respectable choice for a web service & cloud orchestrator system?

whoknowsidont 2y ago
I think you need to look at the product we're talking about.
- jitl 2y ago
  I did, it’s a thingy that creates tasty looking cloud objects (“canaries”) in your AWS account and then monitors them for suspicious access seemingly by slurping cloudtrail logs. C seems like a horrid language for this kind of very integration / API / glue heavy domain.