News for hackers. Stuff that matters.
Re:Heap-based buffer overflow in Sudo by gautamcgoel on Tuesday January 26, 2021 @07:21PM (#25922687)
Hi Drew, I agree with everything you said re complexity and rust. What we really need is a modernized C language, tools that help us catch bugs like this, and a better culture of testing and accountability.

I'm curious whether you run OpenBSD, since you mentioned you use doas. Do you have any thoughts on OpenBSD?

Re:Heap-based buffer overflow in Sudo by tinco on Tuesday January 26, 2021 @08:26PM (#25923143)
Rust is modernized C. You are looking for something that already exists. If C programmers would be looking for tools to help catch bugs like this and a better culture of testing and accountability they would be using Rust.
Re:Heap-based buffer overflow in Sudo by lfairy on Friday January 29, 2021 @11:05PM (#25965915)
Yeah, Rust is about the simplest language that guarantees both memory safety + low-level control. Almost all of its complexity comes from having to satisfy both.
Re:Heap-based buffer overflow in Sudo by ddevault on Wednesday January 27, 2021 @08:08AM (#25927744)
Rust is modernized C++.
Re:Heap-based buffer overflow in Sudo by bionade24 on Monday February 01, 2021 @05:50PM (#25995211)
I really don't understand why people donvoted this despite it's obvious. I don't align with you on anything else bc I don't hate C++ and Rust but I have to admit Rust and C++ suffer from the same problems.
Re:Heap-based buffer overflow in Sudo by kaba0 on Tuesday January 26, 2021 @07:39PM (#25922828)
Modernizes C language = Zig.

But I don’t see a point in using systems languages for the usual UNIX tools, they could be rewritten in a more secure language. In the rare case performance is important, there is FFI, but they are usually IO-bound so there is not much point.

Re:Heap-based buffer overflow in Sudo by SSLy on Wednesday January 27, 2021 @04:55AM (#25926238)
I agree about secure languages. Last week I was daydreaming about reimplementing all non-RT parts in Lua.
Re:Heap-based buffer overflow in Sudo by ddevault on Tuesday January 26, 2021 @07:30PM (#25922754)
I don't run OpenBSD, for reasons that have little to do with security. In my opinon, OpenBSD is not agressive enough at complexity reduction (doas being an outlier, I think doas is quite a good size).
Re:Heap-based buffer overflow in Sudo by gautamcgoel on Tuesday January 26, 2021 @09:18PM (#25923504)
I see. What do you run, if you don't mind me asking?
Re:Heap-based buffer overflow in Sudo by ddevault on Wednesday January 27, 2021 @08:08AM (#25927738)
Alpine Linux.