mjg59,
@mjg59@nondeterministic.computer avatar

Proposing a significant increase in system security by replacing all C-based string manipulation with callouts to perl https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

federicomena,
@federicomena@mstdn.mx avatar

@mjg59 maybe one can dress as "*p++" for a scary costume this year.

est,
@est@emily.news avatar

@federicomena @mjg59 that’s just ruby

martini,

@mjg59 I always have trouble finding that one when someone alludes to it … that was on mac os x right?

mjg59,
@mjg59@nondeterministic.computer avatar

@martini Yup

adambyte,

@mjg59 Is it an oversimplification for me to say that null-terminated strings were a mistake? Because it really seems like null-terminated strings were a mistake.

mjg59,
@mjg59@nondeterministic.computer avatar

@adambyte Oh gosh yes

adambyte,

@mjg59 Wait. Yes it's an oversimplification, or yes they were a mistake?

mjg59,
@mjg59@nondeterministic.computer avatar

@adambyte Oh definitely a mistake

mjg59,
@mjg59@nondeterministic.computer avatar

@adambyte of course, tagged length strings are also an issue if you have no way to ensure that the tag length matches the allocated length

adambyte,

@mjg59 Couldn't you build that into the language relatively easily? E.g. if strings are immutable in the language, then any writing to a string variable compiles into: calculate the string length + tag length, make a sys call to allocate that amount and throw an exception if the call fails, then write the bytes into that chunk of memory.

mjg59,
@mjg59@nondeterministic.computer avatar

@adambyte what if someone overwrites the tag through some other poor quality bounds checking?

adambyte,

@mjg59 Then you've got some other poor quality bounds checking. Overriding a string length tag isn't worse than overwriting anything else, is it? AFAIK that's essentially random, chaotically determined by the language, the compiler, and the program.

joeyh,
@joeyh@hachyderm.io avatar

@mjg59 eh, just rewrite libc in rust

Anarcat,

@joeyh that's actually happening, isn't it? i think there's even more than one crate...

joncruz,
@joncruz@mstdn.social avatar

@mjg59 🙀

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • DreamBathrooms
  • mdbf
  • ethstaker
  • magazineikmin
  • GTA5RPClips
  • rosin
  • thenastyranch
  • Youngstown
  • osvaldo12
  • slotface
  • khanakhh
  • kavyap
  • InstantRegret
  • Durango
  • provamag3
  • everett
  • cisconetworking
  • Leos
  • normalnudes
  • cubers
  • modclub
  • ngwrru68w68
  • tacticalgear
  • megavids
  • anitta
  • tester
  • JUstTest
  • lostlight
  • All magazines