3 ms·
We need to be prepared to write less software, with a smaller attack surface. Less is more. Bloated code is the critical problem. Once upon a time, I read C fu
by daitangio 17d ago
We need to be prepared to write less software, with a smaller attack surface.
Less is more.
Bloated code is the critical problem.
Once upon a time, I read C function
> char gets(char str);
is the first buffer overflow entry point, because it does not check the size of the destination buffer.
Sadly we cannot remove it from standard-C yet AFAI Know.
The success of Rust versus other languages is its secure-by-compile-time promise.
Also a lean java could help, but Java is so verbose/slow to start it bumps you away.
- legulere 17d agoMemory unsafety in C/C++ is a big portion of security issues, but it's not everything there is.
- meindnoch 17d ago>Sadly we cannot remove it from standard-C yet AFAI Know. The C standard definitively removed this function in 2011 from its specification.
- eichin 17d agogets() was deprecated in C++11, removed entirely in C++14, and also removed in C11. So while it should have been removed in 1989, it did finally get done over a decade ago.
- nazgulsenpai 16d agoobligatory https://github.com/kelseyhightower/nocode https://github.com/kelseyhightower/nocode