News for hackers. Stuff that matters.
Re:Zcoin implementation bug enabled attacker to create over ... by Sanddancer on Tuesday March 07, 2017 @06:18AM (#13809592)
Yep. I'd add that if it's a warning you're absolutely certain of, use the warning control pragmas to suppress them, and document why the warning's suppressed. Keep the compiler output clean so you can see where you need to examine.
Re:Zcoin implementation bug enabled attacker to create over ... by pacaro on Tuesday March 07, 2017 @09:33AM (#13810567)
Yup. I'm a big fan of

  -Wall -Wextra -Werror
If these options are set before you write any code, then these problems don't arise.
Re:Zcoin implementation bug enabled attacker to create over ... by yoklov on Tuesday March 07, 2017 @10:54AM (#13811315)
Worth noting you should probably disable -Werror for distribution if you expect users to compile your code. They aren't going to fix your error for you and you can't know what warnings will be added to future compilers, nor what previous compiler versions marked as errors. Among many other people saying the same thing see [0] if you don't trust me.

Also IMO you often want to explicitly disable a few of those from -Wall and -Wextra -- Looking at the last c++ project I wrote, I turned off a few things like `-Wno-unused-parameter` for example.

[0]: http://blog.schmorp.de/2016-02-27-tidbits-for-the-love-of-go...

Re:Zcoin implementation bug enabled attacker to create over ... by pacaro on Tuesday March 07, 2017 @12:22PM (#13812366)
Absolutely agree.

As you get further into a project you tend to need subtler tools. But for the rough work when starting out, my preference is to be stricter, which can be relaxed as necessary, rather than starting out lax and reaching a point where tightening becomes Sisyphean.

Re:Zcoin implementation bug enabled attacker to create over ... by aaronmdjones on Wednesday March 08, 2017 @04:34AM (#13819116)
Or if you're using clang you can just

  -Weverything
Which does actually turn on all warnings (so you'll probably want to add things like -Wno-unused -Wno-padded).

Under gcc, '-Wall -Wextra -Wpedantic' does not enable all warnings. There are still more than 40 flags you have to give if you really want all of them.

The reason why boggles my mind to this day.

Re:Zcoin implementation bug enabled attacker to create over ... by daira on Tuesday March 07, 2017 @01:50PM (#13813347)
Zcash, for example, is built with `-Werror` (edit: not `-Wall`, but we're working on that). So this is absolutely feasible on a Bitcoin-derived codebase.
Re:Zcoin implementation bug enabled attacker to create over ... by TeMPOraL on Tuesday March 07, 2017 @06:25AM (#13809612)
Exactly. That's what I meant by "ignore"; "suppress" was the word I was looking for.