News for hackers. Stuff that matters.
Re:What science can tell us about C and C++'s security (2020) by jmull on Monday August 02, 2021 @12:31PM (#28038875)
> In conclusion, the empirical research supports the proposition that using memory-safe programming languages for these projects would result in a game-changing reduction in total number of vulnerabilities

There are some missing pieces here. A software rewrite introduces a lot of new bugs. Take one of these OSs. They’ve been fixing security bugs for decades, ~30% of which are non-memory safety related. A rewrite in a truly memory safe language will have zero memory safety-related bug but will include a substantial number of new, non-memory-safety security bugs, the kind it took decades to remove from the original code.

I think there would be a long term payoff, but considering the resources required, it’s unclear if a rewrite effort could even succeed at all. Realistically, you’re going to end up forking, with some development happening on a rewrite fork with low feature velocity and other development happening on a higher feature velocity fork with no rewrite effort. With low features and years with actually more security bugs, I’m not sure the rewrite fork would even survive.

“using memory-safe programming languages for these projects” is easy to say, but what’s the actual path that can be followed from here to there?

Re:What science can tell us about C and C++'s security (2020) by alkonaut on Monday August 02, 2021 @03:04PM (#28041209)
“Using” memory safe languages as in selecting a language for green field projects vs “using” to mean “rewrite in” are two very different propositions. I don’t think many would consider rewriting a million line code base in a different language without other motivation than fixing memory safety. However all large code bases have some modularity and modules are added and rewritten. At that point the decision to use a different language is easier. That this now happens in Linux and elsewhere is a clear sign of the times.
Re:What science can tell us about C and C++'s security (2020) by pylua on Monday August 02, 2021 @12:39PM (#28039006)
I principle I agree with this . However , if companies really believe there is zero tolerance for security issues , the only way forward is to, no matter the cost, proceed forward with a way that will minimize security problems. Otherwise we are just paying lip service to security .
Re:What science can tell us about C and C++'s security (2020) by andi999 on Monday August 02, 2021 @12:50PM (#28039169)
If you want zero security issues, probably Ada with spark is the way to go.
Re:What science can tell us about C and C++'s security (2020) by AnimalMuppet on Monday August 02, 2021 @12:37PM (#28038984)
What you say is true, and I'm not sure that "rewrite everything" is a valid approach. But if you're starting something today, you might take this data into account when choosing the language...
Re:What science can tell us about C and C++'s security (2020) by ExtraE on Monday August 02, 2021 @02:53PM (#28041069)
Yes. I don't think rewrite everything was what the original author was arguing for, either.
Re:What science can tell us about C and C++'s security (2020) by AnimalMuppet on Monday August 02, 2021 @03:07PM (#28041241)
But someone will argue for it, so the warning not to is worthwhile.
Re:What science can tell us about C and C++'s security (2020) by threatripper on Monday August 02, 2021 @01:53PM (#28040180)
I don't quite agree with you. Rewriting software in general removes a lot of security related bugs because the new design is more clear. Of course some new ones will be introduced and need to be weeded out but I think those kind of bugs are the minority and can be weeded out in a fraction of the time it took for the original software.

On the other hand it introduces a lot of usability bugs. Many things are they way they are because of many bug reports of many users that all have their own workflows and usage patterns. These kinds of bugs are harder to weed out. Also they can lead to early refusal by the users of the old software.

Then there is the Version-2 effect of packing in too many new features and deliberately introducing fundamental changes that break everything at once. This, in my opinion, is the worst about a complete rewrite.

Re:What science can tell us about C and C++'s security (2020) by jstimpfle on Monday August 02, 2021 @02:02PM (#28040325)
c.f. "Second System Effect". How many examples of successful rewrites of large systems can you come up with?

The new design will only be better if there were actual lessons learned, which probably at least requires that it be done by the same people.

Also, compared to incremental development I can attest that a big-bang rewrite takes a lot of grit to do all the grunt work again, replacing perfectly working and now rather boring infrastructure. It's very hard to suffer through it, even if some other parts could be substantially better.

Re:What science can tell us about C and C++'s security (2020) by mamcx on Monday August 02, 2021 @02:57PM (#28041116)
> How many examples of successful rewrites of large systems can you come up with?

Considering the size of the software industry... a LOT.

I have done a DOZEN of rewrites from langs to langs and each (bar one) have been successfully.

But success is not proclaimed, how failures are...

---

A good rewrite is just a good refactoring but with a higher chance of success. A bad rewrite is mostly an amplification of larger issues in the org/group, lack of experience (yeah, your first one is likely to fail!) or lack of clear goals.

Also, rewriting a terrible designed software to another language without fix the terrible designs WILL be terrible.

---

On this matter, considering the calibre of the people that build C/C++ things at the core AND the calibre of Rust/ADA and other few tools + the enormous resources of the companies behind them, a rewrite must be successfully. BUt is not, and when you zoom at the postmortens, how much is truly to blame for the langs or tools? Not much.

* And if the tools have a big part of blame, is beause was not the correct tool for the job... so, is part of the larger issues in the org/group"

Re:What science can tell us about C and C++'s security (2020) by jstimpfle on Monday August 02, 2021 @03:03PM (#28041183)
> I have done a DOZEN of rewrites from langs to langs and each (bar one) have been successfully.

How large were these systems? How many developers? How long did the rewrite take?

> A good rewrite is just a good refactoring but with a higher chance of success

Are you saying it's not a restart from scratch? In that case I don't call that a rewrite. Maybe a "rewrite of this or that module" which is more likely to succeed.

Re:What science can tell us about C and C++'s security (2020) by mamcx on Monday August 02, 2021 @03:22PM (#28041400)
Most have been mainly me. I normally was hired and get stuck doing this kind of stuff until the other team was supporting the old project. Along the way was the one that push source control, tickets system, crude CI to the larger team...

Maybe being solo or being part of a small team is good after all. A rewrite is normally called because of a BIG mess, and most of that is simplify stuff.

My niche is "enterprise" software, where is HIGHLY dependent in niche details from non-developers, so having not clarity of what the software actually do, why or how, and neither the people that use it understand it. Zero or useless documentation, and all the bad red flags you think off.

2 have been large-ish (I think from the POV of most people in my country are large but not from the POV of people that work in companies like google).

One was in a startup (at the time one of the largest paying customers of Google cloud). The other was in succession of failed attempts between maybe 2 or 3 groups of developers (the one before me was a big consultant company with a large team that left me with a BIIIIG mess!).

The longest rewrite was 2 years (from FoxPro to .NET, an ERP, 1-5 devs, only me all the time p.d: just the core, the rest was later). This was a near failure that was turned around.

The one were we failed was by lack of properly understand the severity of downtime for the customers and not provide a transparent migration, in real time, of the data. The cost in days - for the testing, upgrade and all that) cost them more money than they pay for the new software.

The company I work back them get broke working for the government in another contract and the customer was not willing to recover from it. Is certainly the most sad history of my career because it was not that impossible to turn the ship around - the software was ready, only need to retrofit how move the data without downtime-, but everything go under in no time...

Re:What science can tell us about C and C++'s security (2020) by mamcx on Monday August 02, 2021 @03:42PM (#28041648)
> A good rewrite is just a good refactoring but with a higher chance of success >Are you saying it's not a restart from scratch? In that case I don't call that a rewrite. Maybe a "rewrite of this or that module" which is more likely to succeed.

Not, the rewrites have ben from scratch, including from LANG-A to LANG-B.

What i mean is that the properties of a successfully refactoring/rewrite are similar. Only that with a rewrite you can go DEPPER and WIDER in what you change/improve.

For example, when I rewrite certain program that uses Access/Excel just using PostgreSQL was a massive plus, not just on speed and reliability. A refactoring probably will only go for internal cleaning but with the rewrite I slash a lot of moving parts.

Re:What science can tell us about C and C++'s security (2020) by btilly on Monday August 02, 2021 @03:46PM (#28041703)
Ironically the second system effect was named by Fred Brooks in The Mythical Man-Month. It is ironic because his background was heading development of a large, and ultimately successful, second system. Namely IBM's OS/360.

Moving on, Brooks correctly identified that third systems do much better than second systems. (The pattern is that the first system suffers from your general incompetence, the second system tries to over-abstract and shove too many features in there, and the third system is the first where you can strike a pragmatic balance.)

Still Mozilla/Firefox was a rewrite of Netscape, Python 3 a rewrite of Python 2, Doom a rewrite of Wolfenstein 3D, and so on.

Many companies have a history of their third version of software being significantly better, meaning that they survived the first and second systems to get there. For example the first successful version of Windows was Windows 3.1.

There is another kind of successful rewrite, which is a copycat product. For example MS Excel is a rewrite of Lotus 1-2-3 and Microsoft Word is a rewrite of WordPerfect. And, to keep this from just being picking on Microsoft, Google's Dalvik was a rewrite of the JVM. (And then Oracle sued...)

Re:What science can tell us about C and C++'s security (2020) by AnimalMuppet on Monday August 02, 2021 @03:23PM (#28041413)
> Rewriting software in general removes a lot of security related bugs because the new design is more clear.

That seems unduly optimistic. A re-write may keep the same design because it's known to work. Or it may try to make a better one. That new design can easily fail to actually be better. You can have the version 2 effect in the design, not just in the features.

Re:What science can tell us about C and C++'s security (2020) by Zababa on Monday August 02, 2021 @03:49PM (#28041743)
That might be a very naive view of things, but can't you extract a test suite of the current system (including non-regression tests) to use it to develop the new system? Or do it part by part, ship of Theseus style?
Re:What science can tell us about C and C++'s security (2020) by Const-me on Monday August 02, 2021 @04:27PM (#28042183)
Not sure that gonna work.

Operating systems abstract away hardware differences, and providing portable APIs to userspace processes. Internally, OS kernels are spending non-trivial complexity dealing with random hardware shenanigans. Can't unit test them.

Re:What science can tell us about C and C++'s security (2020) by babatuba on Monday August 02, 2021 @04:24PM (#28042146)
I totally agree with this sentiment. It is probably better to make robust code-quality software for scanning and eliminating these vulnerabilities. Taking C as an example, it is a simple language so probably also the easiest language in common low-level use to be able to parse and detect serious issues.

The benefits to that are more advantageous given the sheer amount of code on systems.