News for hackers. Stuff that matters.

A comment on Will Hare replace C? Or Rust? Or Zig? Or anything else?. Parent comment

Re:Will Hare replace C? Or Rust? Or Zig? Or anything else? by mplewis on Tuesday May 03, 2022 @10:34AM (#31248821)
When you say you take security pretty seriously, and mention the Hare crypto module, are you talking about the crypto module which silently falls back to storing secure data on the heap when Linux keyctl is not present on the platform?

https://lwn.net/Articles/893327/

[ Parent | on HN ]
Re:Will Hare replace C? Or Rust? Or Zig? Or anything else? by ddevault on Tuesday May 03, 2022 @10:41AM (#31248923)
Yes. As I reiterated many times in that thread, having your data stored in the heap does not introduce any immediate vulnerabilities, and this behavior is thoroughly documented in the standard library.

It is possible for two people who both take security seriously to come away with different take-aways. Once some CVEs are found in Hare you might have some fuel for your argument, but until then it's just speculation.

[ Parent | on HN ]