Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by tdhz77 on Saturday March 20, 2021 @02:35PM
(#26525032)
All languages are unsafe. We find bugs of “safe” languages sometimes 30 years after the exploit was introduced. Just because we don’t know doesn’t make them safe.
[ Parent
| on HN ]
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by pjmlp on Saturday March 20, 2021 @03:13PM
(#26525340)
Indeed, however given that 70% of exploits are caused by memory corruption bugs, like in this case, the IT world would be much safer if we only had to deal with the remaing 30%.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by nynx on Saturday March 20, 2021 @02:38PM
(#26525050)
While that's true, the likelihood of a bug like this existing in an application written in a language like python, go, or rust (heck, even C++) is orders of magnitude less than the likelihood of it being in software written in C.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by glnz on Saturday March 20, 2021 @02:45PM
(#26525103)
Why does Python have a safe reputation around here? Everything is constantly rewritten by corporate sponsored developers and it is usually easy to find invalid accesses.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by nynx on Saturday March 20, 2021 @02:49PM
(#26525135)
Personally, I dislike python. However, it's indisputably safer than C.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by Ar-Curunir on Saturday March 20, 2021 @02:53PM
(#26525182)
All languages are unsafe the same way all diseases are fatal.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by burundi_coffee on Saturday March 20, 2021 @02:37PM
(#26525044)
I think it still makes a difference if languages are created with safety in mind.
Re:CVE-2021-27135: xterm flaw may allow remote code executio...
by mnd999 on Saturday March 20, 2021 @02:40PM
(#26525064)
It certainly does help but as the parent says it’s not a silver bullet.
The lazy unhelpful comment above adds very little to the discussion when the software in question is (in some cases decades) older than those languages.