News for hackers. Stuff that matters.

A comment on Why did the OpenSSL punycode vulnerability happen. Parent comment

Re:Why did the OpenSSL punycode vulnerability happen by insanitybit on Wednesday November 02, 2022 @07:48PM (#33444526)
> In what kind of software bounds check have this significant perf. penalty?

All kinds. But a lot of it is just that parsers are extremely easy to benchmark and benchmarks promote optimization.

> Cannot C have some wrapper over those poor strings

Sure, but there's nothing native.

[ Parent | on HN ]
Re:Why did the OpenSSL punycode vulnerability happen by tester756 on Wednesday November 02, 2022 @07:51PM (#33444564)
>Sure, but there's nothing native.

But why? strings are used by all programmers everyday

I struggle to understand why you wouldn't want to make them state of the art, or decent at least.

[ Parent | on HN ]
Re:Why did the OpenSSL punycode vulnerability happen by thephyber on Wednesday November 02, 2022 @08:15PM (#33444854)
> > Sure, but there's nothing native.

> But why? strings are used by all programmers everyday

Different kinds of strings can have extremely different performance profiles.

A statically allocated string of ASCII (single byte) characters.

A dynamically allocated string of unicode (multibyte) characters where the length of allocation is not known ahead of time is very different. C requires the developer to know the differences and knows how to deal with them treat them.

[ Parent | on HN ]
Re:Why did the OpenSSL punycode vulnerability happen by insanitybit on Wednesday November 02, 2022 @07:53PM (#33444586)
C is an extremely conservative language. You don't even get booleans unless you're in C99 and import it.
[ Parent | on HN ]
Re:Why did the OpenSSL punycode vulnerability happen by int_19h on Thursday November 03, 2022 @06:43AM (#33449193)
You do get them without #include <stdbool.h>, you'll just have to contend with ugly spellings like _Bool and _True.
[ Parent | on HN ]
Re:Why did the OpenSSL punycode vulnerability happen by anjbe on Thursday November 03, 2022 @07:00AM (#33449307)
bool, true, and false as native keywords are on track to show up in C23. https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2393.pdf
[ Parent | on HN ]
Re:Why did the OpenSSL punycode vulnerability happen by pjmlp on Thursday November 03, 2022 @08:38AM (#33450090)
Because WG14 doesn't care about security, for them C is basically a portable macro assembler with added conveniences.
[ Parent | on HN ]