News for hackers. Stuff that matters.
Re:Zcoin implementation bug enabled attacker to create over ... by WalterBright on Tuesday March 07, 2017 @01:03AM (#13808580)
You're right. My contention is that the language itself should no longer accept such code, it shouldn't be relegated to an ignorable warning or a 3rd party tool that isn't run.
Re:Zcoin implementation bug enabled attacker to create over ... by gpawl on Tuesday March 07, 2017 @01:26AM (#13808650)
Indeed, the next standard should ban such things, and modern compilers should reject these patterns by default, unless a --legacy_security_unsage flag is set.
Re:Zcoin implementation bug enabled attacker to create over ... by WalterBright on Tuesday March 07, 2017 @01:37AM (#13808686)
Perhaps the switch should be named:

   --accept_my_buggy_stupid_code
so nobody is going to type that in by accident, and nobody is going to want to defend it in the code review process. And the compiler vendor will still get a gold star for being 100% language compliant :-)
Re:Zcoin implementation bug enabled attacker to create over ... by Strom on Tuesday March 07, 2017 @01:05AM (#13808585)
Yes, major improvements could be made by changing the defaults of the tools that beginners use. I edited my original comment to be more clear on this as well.
Re:Zcoin implementation bug enabled attacker to create over ... by WalterBright on Tuesday March 07, 2017 @01:20AM (#13808625)
I think we're going to have to disagree. It isn't just an issue for beginner code. Experts make such mistakes, too. Expecting them to not make mistakes is unrealistic, and sending them back for more training isn't going to work, either.

I can't think of a reason any modern language should accept such code.

If you're interested, I recommend the series "Air Disasters" on TV. Each episode analyzes one crash, where investigators determine the cause of the accident, and what the corrective action should be taken. Often, it comes down to "how could a pilot with 10,000 hours experience make such a mistake". While it would be easy for investigators to blame the pilot, often they find that the mistake was just too easy to make, and they recommend changing the design or procedures or both.

Re:Zcoin implementation bug enabled attacker to create over ... by gpawl on Tuesday March 07, 2017 @01:27AM (#13808652)
I think strom meant that beginners don't know to turn on -Wall -Werror and friends