Several months in the life of Project Zero – Part 1: The Chrome bug of suffering

Re:Several months in the life of Project Zero – Part 1: The ... by pjmlp on Wednesday February 12, 2020 @02:48AM (#22306770)

> C-style programming in C++ is also a bad sign; the IOBuffer design pattern with separate storage of buffers and their sizes is inherently dangerous.

This the main take away. Even when writing C, just prefer safe libraries to default strings and arrays, when possible.

By the way, MSR is hiring for Checked C.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by ChuckNorris89 on Wednesday February 12, 2020 @03:00AM (#22306840)

>By the way, MSR is hiring for Checked C

Only internships ATM according to their web page

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by Recursing on Wednesday February 12, 2020 @10:10AM (#22309375)

https://github.com/Microsoft/checkedc#we-are-hiring

> We have positions available for a Principal Software Engineer and Senior Software Engineer. We are looking for engineers who have production compiler development experience and who value shipping software.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by pjmlp on Wednesday February 12, 2020 @04:10AM (#22307208)

Internships aren't done for free, so it is still a job.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by aneutron on Wednesday February 12, 2020 @04:38AM (#22307367)

While that is true, when one says "hiring", it generally refers to a somewhat "tenured" or "continued" position.

At least that's what I understood from your original comment.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by pjmlp on Wednesday February 12, 2020 @05:03AM (#22307510)

Fair enough.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by xvilka on Wednesday February 12, 2020 @09:25AM (#22309021)

There is no reason to spend time on any variant of C in the age of Rust.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by pjmlp on Wednesday February 12, 2020 @10:05AM (#22309326)

Sure there is, as much as I dislike C, no one is going to port the existing UNIX and POSIX clones to something else.

And even then, many of those interfaces are based in C semantics anyway.

So anything that helps to reduce the amount of possible security exploits per line of C code is welcomed.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by acdha on Wednesday February 12, 2020 @10:25AM (#22309516)

For new projects, sure. For existing projects, it's not trivial to convert them and anyone working on something significant is going to need time to do a migration during which additional new C code will almost certainly need to be written.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by xvilka on Wednesday February 12, 2020 @11:30AM (#22310197)

It can be semi-automated with the amazing c2rust[1] tool.

[1] https://github.com/immunant/c2rust

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by acdha on Wednesday February 12, 2020 @12:50PM (#22310922)

“semi-” is not a synonym for “easily done with production-ready results”. Until that changes, people are going to need to write new C code even if they're working to refactor their code into a better language.

[ Parent | on HN ]

Re:Several months in the life of Project Zero – Part 1: The ... by fortran77 on Wednesday February 12, 2020 @10:26AM (#22309524)

Good point. We can do this in Go.

[ Parent | on HN ]