News for hackers. Stuff that matters.
Re:Endlessh: An SSH Tarpit by nickcw on Wednesday September 16, 2020 @07:31AM (#24491578)
Great idea!

I'm not sure we should be writing new network connected daemons in C though.

Re:Endlessh: An SSH Tarpit by klodolph on Wednesday September 16, 2020 @08:05AM (#24491785)
> I'm not sure we should be writing new network connected daemons in C though.

In general, yes. However, in this case--no, that's not helpful advice--because this program doesn't actually receive input from clients! Kind of hard to trigger exploitable behavior on a program that only sends output.

Re:Endlessh: An SSH Tarpit by codeulike on Wednesday September 16, 2020 @08:28AM (#24491939)
Kind of hard to trigger exploitable behavior on a program that only sends output.

It wouldn't suprise me to find there were still possible exploits

Re:Endlessh: An SSH Tarpit by fb03 on Wednesday September 16, 2020 @08:45AM (#24492102)
Explaining, since you were downvoted without a proper reason:

While everything is possible, most exploits happen on buffer overflows on user-received custom data. and since this is not allocating any buffer to receive anything (besides internal connection structures that are filled by the OS), the attack/exploit surface on this one is really tiny, if existent at all.

Re:Endlessh: An SSH Tarpit by ravi-delia on Wednesday September 16, 2020 @09:25AM (#24492468)
Crucially, endlessh has a smaller codebase than some shell scripts I've written. If you have ever used any program written with even a single line of Python, you have more to worry about than a 843 line program that appends a string to a socket.
Re:Endlessh: An SSH Tarpit by kmbfjr on Wednesday September 16, 2020 @10:59AM (#24493308)
Your concern is well founded, but what are you going to use that doesn't end up touching libraries written in...C?

We're a long way from "Smashing the Stack", people are aware of mitigation and the care that needs to be taken, precautions have been made inside operating systems and compilers.

Re:Endlessh: An SSH Tarpit by MCOfficer on Wednesday September 16, 2020 @11:33AM (#24493649)
I take the bait... rust.
Re:Endlessh: An SSH Tarpit by efreak on Wednesday September 16, 2020 @02:24PM (#24495687)
Re:Endlessh: An SSH Tarpit by young_unixer on Wednesday September 16, 2020 @10:12PM (#24500450)
Until there's a better alternative to C at its level of performance, people will keep using C.