nanolith

30 ms·

331.
by nanolith 12y ago
Typically, it's not a good idea to argue with RMS. The pragmatic approach would be to just write the plugin for GCC, and keep it separate. GNU can certainly control what is mainlined, but the GPL is not violated simply by creating a
332.
by nanolith 12y ago
I agree.
333.
by nanolith 12y ago
There is a pragmatic perspective and a theoretic perspective. Pragmatically speaking, empirical methods can get one pretty far. It's better to have full coverage of empirical tests across an entire system than limited coverage of for
334.
by nanolith 12y ago
Beautiful. Formal verification does take more time over empirical testing methods such as unit testing, but when it comes to mission critical components such as cryptography or system code, this is time well spent.
335.
by nanolith 12y ago
When Rust has been around long enough, and people have started adopting it, then we'll see vulnerability reports in systems developed in Rust too. As I said, there are no silver bullets in security.
336.
by nanolith 12y ago
It's not nearly that simple. Look, I get it: you're a fan of Rust. That's great. Use whatever language floats your boat. But, it takes more than language features to solve security issues. Memory vulnerabilities are only
337.
by nanolith 12y ago
Luckily, I don't have to respond by your goalposts. You are hammering on a single class of security vulnerability out of hundreds of potential vulnerabilities. How does Rust prevent a confused deputy vulnerability? How about SQL Inje
338.
by nanolith 12y ago
It is true that TLS is part of the problem. But, it is also a widely deployed standard that cannot be changed overnight. That's why LibreSSL is necessary. We need to build simpler protocols that make better use of cryptographic primi
339.
by nanolith 12y ago
Let me assure you that this is true regardless of language or platform. I've done vulnerability analysis on codebases written in C++, Java, C#, Objective C, Ruby, and Python. I've found bugs in each of these platforms. The bigge
340.
by nanolith 12y ago
I agree with this assessment. There is nothing inherently wrong with C. While alternative languages have certain advantages, there are clear reasons why core foundational libraries like OpenSSL are written in C: portability, age of the co
341.
by nanolith 12y ago
I did not realize that one must have money to voice an opinion. Yes, I have money. No, it wouldn't be a wise investment to throw it at OpenSSL. Some problems are subtle enough that merely throwing money at them won't make them g
342.
by nanolith 12y ago
While this particular vulnerability in OpenSSL isn't nearly as bad as some of the other recent ones, it drives me crazy that we still have NULL pointer dereferences in something this critical. The worst part of this library is that th