4 ms·
I upvoted you but yes and no. Replaced by what? Java? I agree that Java doesn't have buffer overflows/overrun nor free'ing / spraying issues but have you see h
by martinced 14y ago
I upvoted you but yes and no.
Replaced by what? Java? I agree that Java doesn't have buffer overflows/overrun nor free'ing / spraying issues but have you see how many critical Java bugs have affected Java lately!? That said the author of TFA itselfs comments that a rewrite in Java could help...
So I agree that with C / C++ it's always variations of the same old song: it's either a buffer overflow/overrun or it's some free()'ing / spraying issue and at one point they start getting old.
Basically what he says is that you either need compiler-based defenses or some less deterministic heap.
So, once again, randomization is the key here.
It seems that randomization is one of the most important trick against attackers. In some cases ASLR can already not be defeated anymore (on 64-bit Linux systems, in some cases). I hope people learn from that and start using more and more randomization and more heap protection techniques (as apparently OpenBSD is doing... Of course OpenBSD!).
Now the good thing is that these exploits are starting to get increasingly difficult to write and people can get paid lots of $$$ to write them legally, so it seems that there starts to be quite a healthy community of highly skilled white-hat hackers finding them.
And it's good because any white-hat hacker finding an exploit before a black-hat means that the exploit gets patched and that it's one less venue for the bad guys.
As to me I surf inside a VM: a KVM. I'll probably see if I can run a SELinux inside that KVM.
Because it sure sounds like we're still not anywhere close safe browsing.
- pjmlp 14y agoBy a strong type language in the lines of Pascal family of languages. A language with optional bound checking, modules, proper strings and no decay from arrays into pointers. Something along the lines of Ada, Modula-2 or similar. Additionally micro-kernel architectures with clean separation of process tasks.
- pcwalton 14y agoI wouldn't have such faith in address space layout randomization. It's an excellent protection, but it makes addresses of code into security-sensitive information; for it to be effective you'll always have to work to prevent leaks of code addresses. And shameless plug: Rust is designed to be the solution to exactly this sort of thing. The compiler is designed to prove that you can't have pointers into memory that you freed. Obviously, Rust code has to integrate with native libraries, and there can still be bugs there, but it should reduce the attack surface considerably.
- thirsteh 14y agoMany languages provide memory safety. None of them--none in popular use, anyway--have manual memory management. Granted, most applications that are written in C today don't actually need manual memory management.
- pcwalton 14y agoRust provides safe manual memory management.
- thirsteh 14y agoFair enough. Can you turn off the gc/explicitly free everything? If not, then e.g. Go provides the same kind of memory management, i.e. controlling the layout of objects in memory. It would probably be helpful to define what I mean by memory management: controlling allocs and frees. If Rust provides this, great. (Sorry, I don't know Rust very well.) Then your plug is certainly warranted.
- pcwalton 14y agoYes, you can write code without ever using the GC. You have to opt-in to use the GC by using the GC'd types, which are not the default. Rust never implicitly promotes anything to the garbage collected heap. There's a compiler lint mode you can turn on that verifies that you don't ever use the GC. Allocation and freeing can be done manually, using unique pointer types (like std::unique_ptr in C++, except the compiler verifies that it's safe).
- thirsteh 14y agoVery cool. Thanks.
- jiggy2011 14y agoWell , Java itself is implemented in some lower level language so the JVM can potentially have heap/stack overflows of it's own. Java does make it harder for the end user programmer to add these sorts of vulns to their own code though.
- pjmlp 14y agoNot really, unless you are speaking about Oracle's JVM.
- jiggy2011 14y agohow so?
- pjmlp 14y agoThere are many implementations of the Java programming language. Interpreters, JIT VMs and native code compilers. Most developers are only familiar with the official VM you can download from Oracle, which uses a JIT for code execution. This one is a mix of C, C++ and Java code. However alone from Oracle (previously Sun) there is a VM implemented in Java (Maxime), a VM only with C bindings for hardware access with everything else done Java (Squawk), the C++ code for Hotspot might be replaced with Java (maybe around Java 9 timeframe, project Graal) and the embedded edition of Java also supports native compilation. The Jikes RVM, like Maxime, is a meta-circular VM fully implemented in Java. Additionally there are native compilers like JET Excelsior. Despite what people think Java != VM. It is only a question of bootstrapping.