News for hackers. Stuff that matters.
Re:The Mainframe Is a Modern Platform by marktangotango on Tuesday May 19, 2020 @06:07PM (#23240882)
Given all the attention COBOL has gotten lately, I still haven’t seen any discussion of its characteristics that make it relatively “safe”, secure, and fast. These are; all memory is statically allocated, no dynamic memory allocation. No user defined functions and no stack. Of course I’m referring to the 85 standard here and later versions added these things but 85 is very common on mainframes (my understanding please correct if wrong).

These two things disallow entire classes of exploits and errors.

Edit to add, rather than put out these puff pieces, ibm needs to figure out how to get mainframe access for developers, only then will they see usage increase.

Re:The Mainframe Is a Modern Platform by voldacar on Tuesday May 19, 2020 @06:19PM (#23240970)
Those things also disallow entire classes of program. Good luck writing a webserver or game engine without heap allocation
Re:The Mainframe Is a Modern Platform by shoo on Tuesday May 19, 2020 @06:34PM (#23241097)
While not addressing the comment of writing programs without heap allocation, a lot of programs can be compiled to execute using the only mov instructions: https://github.com/xoreaxeaxeax/movfuscator

Yes, it can run doom: https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali...

It just doesn't run doom terribly fast.

Re:The Mainframe Is a Modern Platform by voldacar on Wednesday May 20, 2020 @04:12AM (#23244501)
ok, so how do you call malloc or syscalls with mov instructions? Do you just (assuming you turned on executable stack) use mov to write the corresponding non-mov instructions necessary to do those things to memory, then mov the address of these instructions to the ip register? im struggling a little here
Re:The Mainframe Is a Modern Platform by lxdesk on Wednesday May 20, 2020 @07:42AM (#23245696)
These are classified as "libc things". When using mov you can still access libc like any other program. Go study movfuscator(which I linked again) if you would like a full understanding[0]. When you have to interface C with a not-very-Unixy system like Webassembly or these mainframes, you have to link to a compatible libc that remaps everything appropriately.

Malloc isn't particularly more special than any libc function. It simply supports the fantasy that the memory is unlimited in scale. It was always of a static size, you were just handing off the chore of dividing it up. You can usefully implement dynamic sizing in languages with static memory allocation by pre-allocating large arrays and then maintaining handles and liveness flags. This is, in fact, how every console game used to do it until available memory sizes got into the hundreds of megabytes. Fragmentation and the subsequent crashes from OOM presented too much of a concern before then.

[0] https://github.com/xoreaxeaxeax/movfuscator

Re:The Mainframe Is a Modern Platform by voldacar on Wednesday May 20, 2020 @07:32PM (#23253272)
Ah I thought the idea was to make the whole program use nothing but mov instructions. Still cool though. That's an interesting point too about console games, it seems to make a lot of sense if the whole machine can be dedicated to running just your program
Re:The Mainframe Is a Modern Platform by monocasa on Wednesday May 20, 2020 @09:53AM (#23246765)
> interface C with a not-very-Unixy system like Webassembly or these mainframes

To be fair, z/OS is technically a Unix these days.

Re:The Mainframe Is a Modern Platform by AnimalMuppet on Tuesday May 19, 2020 @08:02PM (#23241816)
Good luck running a large maintainable application without user-defined functions.
Re:The Mainframe Is a Modern Platform by bashook on Tuesday May 19, 2020 @06:24PM (#23241011)
Is ASLR a capable solution to those weaknesses? ASLR is supported by the operating system. Though a system administrator would have to turn it on by following these instructions: https://www.ibm.com/support/knowledgecenter/SSLTBW_2.4.0/com...
Re:The Mainframe Is a Modern Platform by monocasa on Wednesday May 20, 2020 @09:55AM (#23246788)
ASLR is a stopgap that's difficult to consistently apply to a legacy system, since there's so many ways to accidentally leak address information.
Re:The Mainframe Is a Modern Platform by lboc on Tuesday May 19, 2020 @10:30PM (#23242707)
>ibm needs to figure out how to get mainframe access for developers, only then will they see usage increase.

They already did, but seem to have a pathological aversion to actually publicizing it:

https://www-01.ibm.com/events/wwe/ast/mtm/audit.nsf/enrollal...