Re:Polypane: A browser for responsive and accessible develop...
by marginalia_nu on Thursday November 25, 2021 @07:34AM
(#29340808)
If it is your intent, it's also disturbingly easy to hide behavior from code reviewers. The Underhanded C Coding Contest has a lot of examples of this type of stuff: http://www.underhanded-c.org/_page_id_25.html
I can already hear some of you starting to type a rant about how this actually is a C problem and not something that would happen in a modern language like ${YOUR_FAVORITE_LANGUAGE:-rust}; and to an extent it is true that C is especially vulnerable to this particular vector of attack, but like it or not a lot of open source software if it isn't written in C, depends on libraries that are. This includes the Linux kernel, OpenSSL, cURL. WebKit is written in C++ which might as well be C for the sake of this discussion. Other languages have other attack vectors, like the fractal-like dependency tree of NPM for example, something that has been demonstrated time and time again to be more than a hypothetical security risk.
I can already hear some of you starting to type a rant about how this actually is a C problem and not something that would happen in a modern language like ${YOUR_FAVORITE_LANGUAGE:-rust}; and to an extent it is true that C is especially vulnerable to this particular vector of attack, but like it or not a lot of open source software if it isn't written in C, depends on libraries that are. This includes the Linux kernel, OpenSSL, cURL. WebKit is written in C++ which might as well be C for the sake of this discussion. Other languages have other attack vectors, like the fractal-like dependency tree of NPM for example, something that has been demonstrated time and time again to be more than a hypothetical security risk.