4 ms·

"No way to prevent this" say users of only language where this regularly happens

41 points by xena 1mo ago

inanutshellus 1mo ago
OK how is this on the homepage? The title means nothing without clicking the link and... I generally refuse to click on clickbait just to see whether there's a hook in it.
- sheauwn 1mo ago
  My guess is its almost exclusively due to the reference its making to the similarly titled Onion article. The actual article linked is basically a cut and paste replacing gun violence with memory vulnerabilities.
- freehorse 1mo ago
  Clicking on the link does not help either save the rightful first impression.
- dgacmu 1mo ago
  It's a pun on The Onion's repeating headline about gun deaths in the US ("only country where...") [1] . I thought it was pretty clear before I clicked it it was going to be talking about security vulnerabilities in C, but I live close to that world so I might be a biased audience. [1] https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_Says_Only_Nation_Where_This_Regularly_Happens https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...
  - inanutshellus 1mo ago
    Wow, thanks! Somehow I've missed the 39 times the Onion has carried that headline. I guess I'm part of today's 10,000.
    - burnt-resistor 1mo ago
      RIP Tim Heidecker.
casper14 1mo ago
Just use JavaScript and you should be fine!
cesaref 1mo ago
'the only language where 90% of the world's memory safety vulnerabilities have occurred in the last 50 years' Let's assume this is true, and ignoring the fact that it's not possible for more than 1 language to have >50% of the vulnerabilities, we are left pondering what proportion of the worlds software is written in C. If it's >90%, then C is safer than average :)
- luc0x61 1mo ago
  Assuming that C is the most successful language of its generation, among those letting purposely do anything with memory access, well, it's unfortunately possible to have it do anything. It's like saying with surprise that a harpoon gun may even kill people. Then successively implemented languages may have improved things (or they would have been useless efforts). When a single one of them will reach half the popularity of C (without running in any "unsafe" mode) it will be another great success. The original article was clearly just a polemical overkill by a maniac of another language. Or by a fisherman who kills fishes slapping them.
robmccoll 1mo ago
The only language where this happens? https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://www.sentinelone.com/vulnerability-database/cve-2026-37461/ https://www.sentinelone.com/vulnerability-database/cve-2026-... https://nvd.nist.gov/vuln/detail/cve-2026-71560 https://nvd.nist.gov/vuln/detail/cve-2026-71560 https://www.invicti.com/web-application-vulnerabilities/python-out-of-bounds-read-vulnerability-cve-2025-13836 https://www.invicti.com/web-application-vulnerabilities/pyth...
- K0nserv 1mo ago
  With the exception of the C++ case, these all seem to result in DDOS which, while bad, are barely security issues. It speaks to the difference between C and these other languages (Go, Python, Rust).
- hn92726819 1mo ago
  A crash is always better than OOB memory reads. All of these are crashes except the C++ one. The rust one is from 3 years ago and listed twice. This article is about the frequency of these bugs, not their existence. C and C++ are the only languages where this happens regularly
preommr 1mo ago
wtf is this garbage? I don't think the average C dev isn't aware that the language has pitfalls, especially around memory management. Also a lot of these problems are because C is used everywhere and has been for so long. Not because people are blind to it's problems.
- K0nserv 1mo ago
  The critique is more that the average, or at least loud, C programmer is resistant to fixing these problems (for example via Rust) and often arrogantly claim it's just a skill issue.
  - burnt-resistor 1mo ago
    The argument sometimes comes off like: "Why aren't you better at juggling double-edged swords that are on fire?" Perhaps the opposite side might say: "Why can't we juggle inertia-powered lighted yo-yos instead?"
bewareofscams 1mo ago
Why is it flagged?
- freehorse 1mo ago
  [flagged]
  - bewareofscams 1mo ago
    You are plain wrong https://news.ycombinator.com/item?id=40437379 https://news.ycombinator.com/item?id=40437379
    - freehorse 1mo ago
      I am aware of the reference. The fact that it uses wording that onion used in a more successful satire does not imply that this applied anywhere makes it also good satire or joke.

41 points by xena 1mo ago

OK how is this on the homepage? The title means nothing without clicking the link and... I generally refuse to click on clickbait just to see whether there's a hook in it.

sheauwn 1mo ago
My guess is its almost exclusively due to the reference its making to the similarly titled Onion article. The actual article linked is basically a cut and paste replacing gun violence with memory vulnerabilities.
freehorse 1mo ago
Clicking on the link does not help either save the rightful first impression.
dgacmu 1mo ago
It's a pun on The Onion's repeating headline about gun deaths in the US ("only country where...") [1] . I thought it was pretty clear before I clicked it it was going to be talking about security vulnerabilities in C, but I live close to that world so I might be a biased audience. [1] https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_Says_Only_Nation_Where_This_Regularly_Happens https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...
- inanutshellus 1mo ago
  Wow, thanks! Somehow I've missed the 39 times the Onion has carried that headline. I guess I'm part of today's 10,000.
  - burnt-resistor 1mo ago
    RIP Tim Heidecker.

casper14 1mo ago

Just use JavaScript and you should be fine!

cesaref 1mo ago

'the only language where 90% of the world's memory safety vulnerabilities have occurred in the last 50 years' Let's assume this is true, and ignoring the fact that it's not possible for more than 1 language to have >50% of the vulnerabilities, we are left pondering what proportion of the worlds software is written in C. If it's >90%, then C is safer than average :)

luc0x61 1mo ago
Assuming that C is the most successful language of its generation, among those letting purposely do anything with memory access, well, it's unfortunately possible to have it do anything. It's like saying with surprise that a harpoon gun may even kill people. Then successively implemented languages may have improved things (or they would have been useless efforts). When a single one of them will reach half the popularity of C (without running in any "unsafe" mode) it will be another great success. The original article was clearly just a polemical overkill by a maniac of another language. Or by a fisherman who kills fishes slapping them.

robmccoll 1mo ago

The only language where this happens? https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://nvd.nist.gov/vuln/detail/cve-2023-53161 https://www.sentinelone.com/vulnerability-database/cve-2026-37461/ https://www.sentinelone.com/vulnerability-database/cve-2026-... https://nvd.nist.gov/vuln/detail/cve-2026-71560 https://nvd.nist.gov/vuln/detail/cve-2026-71560 https://www.invicti.com/web-application-vulnerabilities/python-out-of-bounds-read-vulnerability-cve-2025-13836 https://www.invicti.com/web-application-vulnerabilities/pyth...

K0nserv 1mo ago
With the exception of the C++ case, these all seem to result in DDOS which, while bad, are barely security issues. It speaks to the difference between C and these other languages (Go, Python, Rust).
hn92726819 1mo ago
A crash is always better than OOB memory reads. All of these are crashes except the C++ one. The rust one is from 3 years ago and listed twice. This article is about the frequency of these bugs, not their existence. C and C++ are the only languages where this happens regularly

preommr 1mo ago

wtf is this garbage? I don't think the average C dev isn't aware that the language has pitfalls, especially around memory management. Also a lot of these problems are because C is used everywhere and has been for so long. Not because people are blind to it's problems.

K0nserv 1mo ago
The critique is more that the average, or at least loud, C programmer is resistant to fixing these problems (for example via Rust) and often arrogantly claim it's just a skill issue.
- burnt-resistor 1mo ago
  The argument sometimes comes off like: "Why aren't you better at juggling double-edged swords that are on fire?" Perhaps the opposite side might say: "Why can't we juggle inertia-powered lighted yo-yos instead?"

bewareofscams 1mo ago

Why is it flagged?

freehorse 1mo ago
[flagged]
- bewareofscams 1mo ago
  You are plain wrong https://news.ycombinator.com/item?id=40437379 https://news.ycombinator.com/item?id=40437379
  - freehorse 1mo ago
    I am aware of the reference. The fact that it uses wording that onion used in a more successful satire does not imply that this applied anywhere makes it also good satire or joke.