4 ms·
Except in C, validation of user input can in itself be an exploit vector.
by Ygg2 5mo ago
Except in C, validation of user input can in itself be an exploit vector.
- greybeard69 5mo agoTurtles all the way down.
- layer8 5mo agoThat’s true in other languages as well. Any programmatic task can end up being an exploit vector.
- pjc50 5mo agoNo? That's the whole point of formal verification? You can even kind of retrofit this to C. The classic example is "sel4". You just need a set of proofs that the code doesn't trigger UB. This ends up being much larger and more complicated than the C itself.
- rocketrascal 5mo agoYou can fail to verify something which you actually wanted to verify (i.e you made a proof of something else instead of the thing that mattered). See WPA2 KRACK as an example.
- Ygg2 5mo agoYeah, but only in C* can those errors end up as more UB. * terms and limits may apply.
- eru 5mo agoMany other languages also have UB. But almost none is as trigger happy as C and C++ are.