Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Thursday, 01-Feb-2024 03:12:02 JST Rich Felker

   in reply to

   • Dan Turner
   • Ross Grady

   @dan_turner @rossgrady Based on what I saw with the attempts to rewrite coreutils, it would be full of subtle behavioral nonconformances which would be deemed unimportant or improvements. 🤦

   When every violation of interface contract is itself a potentially CVE-worthy vulnerability.

   You cannot reimplement things right without deep understanding of what was done before and why, but so many ppl want to do it from a "let's throw everything out & start over" attitude.

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Dan Turner (dan_turner@cosocial.ca)'s status on Thursday, 01-Feb-2024 03:12:03 JST Dan Turner

     in reply to

     • Ross Grady

     @rossgrady possible Eldritch horror: can we write a libc alternative in Rust?

   • Embed this notice
     Ross Grady (rossgrady@dood.net)'s status on Thursday, 01-Feb-2024 03:12:04 JST Ross Grady
     I just don't even know what else needs to be said about a bunch of people who are presumably pretty good at what they do -- the glibc maintainers -- still managing to introduce a *new* buffer overflow bug (new circa 2022) into one of the most important codebases anywhere, which in turn leads to multiple CVEs.
     
     Like, if you're still writing C of any kind in the 21st century, you have to ask yourself "am I better at manual memory safety than the glibc team?" And if the answer is no, then you're probably also writing these kinds of bugs.
     
     RE: https://infosec.exchange/users/BleepingComputer/statuses/111847408179020212