Oof. I hate to call C a mistake. I hold the language close to my heart; quirks and all.

Sure there are safer models for computing. But it has served its purpose for a long time. A small language allowing highly performant programs/operating systems to be written. Plus we got to see the beautiful art form of exploit writing. Sure at what cost (lots), but all hackers can appreciate when a system gets owned. It’s the intentions that come after which bother us all.

Don’t get me wrong, I’m excited for newer languages like rust to come along. However, I learned so much about low level computing from c, and I’m forever grateful.

Hats off to Dennis Ritchie. Thanks for creating a language I met so many other hackers through, and sparking the curiosity of hacking within me.

Parsing unstruted strings without escaping special characters is an issue in any language. This is completely Apple's fault.

Funny how these faults keep happening over and over again in the same set of languages.

I am pretty sure that I can have injection attacks from unsanatized user inputs in any language.

Yes, but some languages (like my personal favorite Rust) make it practically impossible to happen with their equivalent of printf().

Funny how most car crashes are caused by humans driving.

It's completely their fault either way. They are responsible for the technology they use.

This nasty printf()-like way of formatting is a giant footgun though. Apple are not the first ones to fall into this trap.

We've all been trained to sanitize user input, but the WiFi SSID isn't a user input string, so why should I need to sanitize it? --some poor dev wondering where their Twitterverse sympathy is

Yeah it is, I can definitely type my SSID in any device that I have.

I'm typing a new SSID in right now...

In a better language than C, format string injection would be less likely to lead to arbitrary read/write/RCE.

I'll admit I looked around before writing this and saw that Python's str.format() can be pretty bad. So let's say a reasonably constrained formatting language in a good runtime -- the attacker is limited in what they can see or control, and the formatter can see how many arguments were actually passed so it doesn't tromp off into other memory.

You are making a false equivalence—not all languages are equally busted. Any sanely designed modern language does not allow this to happen. Accidentally parsing a string you didn’t mean to parse is a fault of C’s outdated API design, a design flaw that keeps tripping people up again and again.

> Any sanely designed modern language does not allow this to happen

Sorry, how does Rust protect you against injection again?

By requiring format strings to be literals.

https://play.rust-lang.org/?version=stable&mode=debug&editio...

Why would Rust do anything weird when presented with the string "%p%s%s%s%s%n"?

Why would C?

Do you want the obvious explanation? Because the string was passed into the format string parameter of some sprintf-like, a common mistake in C usually caught by warnings but seemingly ignored or suppressed in this case.

edit: turns out from the analysis it was CFStringCreateWithFormatAndArguments, so yes, a sprintf-like used incorrectly

This is possible with any language. Not just C.

No, Rust for example explicitly disallows this.

https://play.rust-lang.org/?version=stable&mode=debug&editio...

You miss my point entirely.

What is your point then?

You can do this in any language. Rust doesn't support it with PrintLn but it's still possible with Rust. Stop acting like C did anything wrong.

C wasn't a mistake. It used to be very popular for a reason. Just like steem locomotives, they served their purpose very well in their time, but the world has moved on.

Are Apple using C for this level of subsystem? I thought a lot was in Objective-C or is that just higher level stuff?

Apple uses C for some bits.

Also there are Objective C APIs which take format strings, like +[NSString stringWithFormat:] and the system function NSLog().

Even Swift uses format strings in places. https://developer.apple.com/documentation/swift/string/31267...

I would like to see Rust run on a PDP-8.

But it doesn't need to, and we are talking about a modern system.

C was great for its time, now its time to move on and use a sensible language.