News for hackers. Stuff that matters.

A comment on Malware Encoded in DNA Can Hack Gene-Sequencing Software. Parent comment

Re:Malware Encoded in DNA Can Hack Gene-Sequencing Software by yoz-y on Friday August 11, 2017 @04:11AM (#14987591)
I remember that perl has (had?) a feature where all variables would be "tainted". Using a tainted variable would make the program exit in an error and the only way to clean them is to pass them through a regex.
[ Parent | on HN ]
Re:Malware Encoded in DNA Can Hack Gene-Sequencing Software by viraptor on Friday August 11, 2017 @05:05AM (#14987844)
Tainted is a terribly flawed concept unfortunately. At least the way it's implemented normally.

Strings are never universally tainted. They're tainted for a specific purpose. One language will treat backticks as a string quote, another as a subshell substitution. One will think $ is ok, another will interpolate the string. But in most cases I've seen, tainted flag is just used for "Ah, we quoted the ' in the string - you're safe now" :-(

[ Parent | on HN ]