News for hackers. Stuff that matters.
Re:Spectre and the end of langsec by the_af on Thursday January 11, 2018 @01:35PM (#16126446)
> Rust and Haskell programs are subject to Spectre attacks just as badly as K&R C ones from 1983. All that pontification didn't actually work!

Um, Rust and Haskell aren't about security against malicious attackers exploiting hardware/system flaws. They are about correctness against programmers writing (some classes of) bugs by mistake. The two aren't directly related. Program correctness is a worthy goal even if it doesn't protect you against hardware problems.

Re:Spectre and the end of langsec by wott on Thursday January 11, 2018 @07:11PM (#16129312)
Except that they go annoying everyone with their memory safety as if it was a huge breakthrough, when in fact most of the serious information leakages do not originate from such problems but simply from design errors.

Same goes for the proponents of formal stuff like Coq. Even worse, because those languages are so insufferable that they induce design errors, the number of which will grow each time a poor soul will have to maintain the... thing. Then, all right, there is no mistake, the result maps perfectly to all your design errors.

Re:Spectre and the end of langsec by the_af on Sunday January 14, 2018 @02:05PM (#16145671)
Design errors are a class of mistakes. Nobody can help you with design errors. Functional programming, immutability, static typing et al address other kinds of mistakes.

> when in fact most of the serious information leakages do not originate from such problems

We've already established that the parent post made a mistake in thinking FP is about safety against attackers / information leakage. Why are you still talking about this?

> because those languages are so insufferable that they induce design errors

[citation needed]

What's your actual experience with these languages?