You mean crappy programmers strike again? This bug would not happen by properly using structs, typedefs, enums, etc to qualify data types and explicitly declare (in a human-readable way anyway) what values to return when. Just using integers as return values with no intermediate abstraction is crazy.

Since we aren't all as smart as you, there's genuine value in languages & principles that guide us dummies to naturally avoid these kinds of issues as part of the happy path

Given the poor track record of the OpenSSL project, the grand parent's complaint for crappy programming isn't unfounded.

I'm not that smart. I don't have a high IQ or anything. I'm not even a professional software engineer. But if I need to use a tool, I learn the right way to use it. I don't expect it to be easy to use.

The biggest lie in software is that new software is better than old software. Anyone who's used software for long enough knows this is ridiculous. You introduce some new software which has some new features indented to fix an old flaw. But then it turns out there's new flaws in the new software that become more of an issue than the old flaws.

Most tools in the world don't change significantly over time. Instead of changing the tool, people learn how to use the tool to avoid problems. But that doesn't work in a world where nobody learns how to use the tool right, or is constantly picking up new tools and never learning lessons.

Isn't the compiler supposed to protect us? /s

Feels harsh to call C programmers "crappy" but ok

Isn’t Linus a pretty hard-core C programmer?

Not sure I’d call him “crappy.” Not to his face, anyway …

I'm fairly sure he'd have no such reticence to calling you (or me) crappy to our (mailing list) faces...

This is true, but I have to admit, he does C (and programming, in general) quite well.

> This bug would not happen by not using C

FTFY

Come on. As 0xbadcafebee hinted at, you can practically write OCaml in C if you wish to. And good luck dealing with timing attacks, secure data deletion and overflow behavior in other languages.

All those are pretty easy in Rust.

Rust software is bug free by design /s.

Rust software is free of entire classes of bugs by default, by design, and the language lends itself to patterns that eliminate even more.

Sure, but none of the classes of bugs you mention contain Log4Shell.

The only issue is that Rust programmers do not do anything usefull. The only place i heard Rust is used is in Firefox. So, if Rust is so good, will be nice to see some real world uses.

LOOOL

Nobody is making that argument. It's about what the language/libraries guide you to naturally.

Really not a value-add contribution. A lot of software that has existed forever is written in C by unpaid volunteers; are you planning to rewrite it in rust?

Further, snark could be made about how this will have near zero security impact yet there’s a far more serious bug (log4j) which has already had significant cost and follows endless patterns of Java developers embedding logic flow in untrusted data. “Just don’t use Java lol” etc

Edit: Hahaha, hey David. Had no idea that was you.

Who is this :D mason?