News for hackers. Stuff that matters.

A comment on GraphicsMagick and ImageMagick popen() shell vulnerability via filename. Parent comment

Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by lillesvin on Monday May 30, 2016 @05:13AM (#11800391)
That's rarely PHP failing but whatever framework/CMS is used. That's like saying C++ is inherently insecure because there exists a lot of software written in C++ with security holes.
[ Parent | on HN ]
Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by cyphar on Monday May 30, 2016 @01:14PM (#11802171)
Did you read the second sentence I wrote? Just because you can write safe code in a language that tries to make you footgun at every turn, doesn't mean that language is a good language. Pick a language that doesn't suffer from crippling security issues (which, sure, you can workaround -- but why use a language that requires workarounds to get security?).
[ Parent | on HN ]
Re:GraphicsMagick and ImageMagick popen() shell vulnerabilit... by ndj7 on Friday June 03, 2016 @04:47PM (#11833164)
We started Imageflow (https://www.imageflow.io ) in C to design the C ABI for interop with all the host languages, but we're swapping out components for Rust every time it's possible/practical.
[ Parent | on HN ]