| |
| ▲ | rbanffy 3 hours ago | parent [-] | | C is not to blame for programmers using its features unwisely and, as a result, writing buggy code. Writing secure C code requires discipline, and, most likely, keeping yourself limited to a subset of the language. This is why languages like Rust have their place - their compilers impose the discipline and the restraint C doesn't. It's not impossible to write code with memory safety issues in Rust - it's just a lot harder. I remember saying the same about Java - it doesn't make writing the program any easier, but it makes writing some bugs difficult. | | |
| ▲ | kstrauser 3 hours ago | parent | next [-] | | > C is not to blame for programmers using its features unwisely and, as a result, writing buggy code. Writing secure C code requires discipline, and, most likely, keeping yourself limited to a subset of the language. It sure is to blame. Evidence shows you need wisdom, discipline, and an impossibly high bar of encyclopedic knowledge of every feature of C and all common libc's combined with an inhuman perfection of never once making a single typo, and a vast amount of tooling to analyze the code and find some of the bugs that made it through anyway. The best, most trusted, most accomplished C programmers I could name still have a track record of writing vulnerabilities triggered by C footguns, not just garden variety logic bugs that could affect code written in any language. Can I write more diligent C code than the OpenBSD team? Than the Linux devs? Than Fabrice "I made everything" Bellard? Not a chance, but C has bitten each of them. Us mortals don't stand a chance. | | |
| ▲ | rbanffy 2 hours ago | parent [-] | | > Us mortals don't stand a chance. I'd say it's just a matter of moving in shorter steps, test incrementally, use extensive tooling to poke holes at your code, and develop those Linux/BSD/Fabrice skills. You might not be able to accomplish as much as these people did, but that's OK as well. The world still needs simpler programs. | | |
| ▲ | kstrauser 2 hours ago | parent [-] | | Why even bother, though? I have +- 8 hours a day to write code. I can spend 7.5 hours writing business logic and .5 hours getting the thing to compile (Rust/Python/Java/C#/whatever), or .5 hours writing business logic and 7.5 hours convincing myself I haven't added an RCE. I just don't see a valid use case for writing non-trivial C programs today. Maintaining existing programs, sure. That stuff isn't going away. Writing anything new in it today, though, seems like engineering malpractice. |
|
| |
| ▲ | KingOfCoders an hour ago | parent | prev | next [-] | | "Writing secure C code requires discipline" Ah the old, you're using the tool wrong. Yes, perhaps, although a tool that no one seems to be able to use correctly, see kernel bugs, zero days everywhere, bugs in cURL by people who seem very rigorous and thorough, in google and microsoft products, etc. I'm not sure the tool is innocent in this. If the highest paid C developers in the world can't use it, who can? | |
| ▲ | cowlevel 3 hours ago | parent | prev | next [-] | | Yes and no. I'd say there's nothing wrong with C - it's not evil - but maybe we still shouldn't use it because we should demand things C doesn't provide. There's nothing wrong with assembly code either but we rarely use it. | | |
| ▲ | chuckadams an hour ago | parent [-] | | C was adequate for its era, though it had major problems from day one: like array pointer decay, lack of counted strings, aliasing just about anywhere and everywhere, and a legacy of squishy types it inherited from BCPL which was about as well-typed as Forth. Even so, it did yeomans work, but it's now long past its use-by date. I still want C to burn in a fire, but I suppose it's at least earned an honorable Viking funeral (yeah I know that's ahistorical but you get the idea). |
| |
| ▲ | chuckadams 3 hours ago | parent | prev | next [-] | | > C is not to blame for programmers using its features unwisely "Make no mistakes" works about as well for humans as it does for AI, and we have decades of lived experiences to draw on for that verdict. | | |
| ▲ | tialaramex 2 hours ago | parent | next [-] | | And this isn't even a new thing for Programming. We already learned this lesson once. Go look at a nineteenth century mechanical signal box. When you, through inattention or even malevolence, try to release signals so that train B can plough into train A, the lever won't move because it is physically impossible due to mechanical interlocking, you need to move a piece of sold metal through another piece of solid metal and it won't go. Do not rely on humans to do boring but important things, they are very bad at this. | |
| ▲ | rbanffy 2 hours ago | parent | prev [-] | | I didn't say "make no mistakes". I said "using its features unwisely". If you can't write software that manages shared mutable state, then don't do it. The world still needs lots of simpler programs. | | |
| ▲ | chuckadams 2 hours ago | parent [-] | | Why can't simpler programs be written in languages that at least make an attempt to be memory-safe? |
|
| |
| ▲ | echelon 2 hours ago | parent | prev | next [-] | | C allows you to express things easily which should not be easily expressable. When people do these things it is almost always in error. That is the fault of the language. | |
| ▲ | Ar-Curunir 3 hours ago | parent | prev [-] | | “C cannot fail; it can only be failed” |
|
|
| |
| ▲ | echoangle 4 hours ago | parent | next [-] | | Don't you think the style of video looks a bit unprofessional? It's like the next iPhone being presented by the Apple CEO but using a vTuber avatar with subway surfer gameplay in the background. | | |
| ▲ | nicce 3 hours ago | parent | next [-] | | In some circles it is a sign of credibility. Leaking it beforehand is very unprofessional, however. After all, furries run the internet. | | |
| ▲ | owenmarshall 3 hours ago | parent [-] | | > In some circles it is a sign of credibility. I was griping about my day being ruined over the breakfast table and my son was interested. I showed him the video and he asked why there was an anime girl on the screen? My response was "if you've worked with computers for any length of time, and you ever see a video of a terminal posted with an anime, catgirl, or furry overlay, you know something really bad is coming your way." | | |
| ▲ | cowlevel 3 hours ago | parent [-] | | is this about to become the new meta? become a furry anime catgirl just to get people to take you more seriously? |
|
| |
| ▲ | jareklupinski 3 hours ago | parent | prev [-] | | > the next iPhone being presented by the Apple CEO but using a vTuber avatar sounds like a good time |
| |
| ▲ | airtnp 4 hours ago | parent | prev [-] | | Before the official fix someone published it, and it seems the person is not associated with Calif: https://x.com/k_firsov | | |
| ▲ | echoangle 4 hours ago | parent [-] | | How did they get access to the script though? The output seems to be identical to the real PoC, so it looks like the same script. | | |
| ▲ | nicce 4 hours ago | parent | next [-] | | Which makes someone to think, whether Calif could not wait for the responsible disclosure. Or someone leaked the video for someone they should not have. | |
| ▲ | klausa 2 hours ago | parent | prev [-] | | They got access to the video, not the script. Calif authored the video and it was accidentally made public. |
|
|
|
