▲ | PLG88 7 months ago | ||||||||||||||||
I may be off base, but as the world moves to zero-trust networking, we can always embed a zero-trust network into our C++ app so that it can be distributed across the network while having no listening ports on the underlay network - i.e., my memory safety exploit cannot just be exploited by anyone on the WAN, LAN, or host OS network. My C++ app unattackable via conventional IP-based tooling, all conventional network threats are immediately useless. This capability exists in completely open source, such as OpenZiti - https://openziti.io/. | |||||||||||||||||
▲ | AlotOfReading 7 months ago | parent | next [-] | ||||||||||||||||
The way C and C++ are standardized, you can't rely on the correct functioning of anything in the presence of undefined behavior, including memory unsafety. For what it's worth, I also opened a random file in the OpenZiti C SDK and immediately found safety issues like this: https://github.com/openziti/ziti-tunnel-sdk-c/blob/9993f61e6... That's why this topic is such a big deal. Even people who really should know better like the OpenZiti authors aren't able to reliably write safe code. | |||||||||||||||||
| |||||||||||||||||
▲ | SkiFire13 7 months ago | parent | prev [-] | ||||||||||||||||
You'll still have to e.g. parse and interpret data from the internet if you want to communicate with anyone else, and that's a potential vector for an exploit. This has commonly be the way exploitations work in games. | |||||||||||||||||
|