Re:Zerocoin implementation bug
by skolsuper on Friday February 17, 2017 @11:33PM
(#13673620)
Another major bug caused by copy+paste. I seem to remember a security researcher article months (years?) ago that identified this theme, showed a way to grep a codebase for likely c+p errors and found a load of bugs in real production code that had remained hidden for years. I think I landed there from HN, but my google-fu is failing me now, can anyone else remember it?
[ Parent
| on HN ]
Probably not what you mean, but this (https://news.ycombinator.com/item?id=12853211) submission about the PVS-Studio static analyzer also shows a bunch of copy+paste errors being found.
Interesting.
How would you minimize these type of errors by design or best practice?
I guess languages with a lack of higher order abstractions and no strong type system might be more prone to this type of errors.
This isn't a subtle or difficult-to-find case. It's a case of "why the heck would anyone write code like that, in any language, in the first place?" The only language-level abstraction needed to avoid this particular kind of duplicated code, is a loop.
Re:Zerocoin implementation bug
by stevenroose on Saturday February 18, 2017 @05:06PM
(#13676975)
I want to know..
I went looking for this again today. It's not the article I was talking about, but you might find this interesting: