Why did the OpenSSL punycode vulnerability happen

Re:Why did the OpenSSL punycode vulnerability happen by tester756 on Wednesday November 02, 2022 @07:51PM (#33444564)

>Sure, but there's nothing native.

But why? strings are used by all programmers everyday

I struggle to understand why you wouldn't want to make them state of the art, or decent at least.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by thephyber on Wednesday November 02, 2022 @08:15PM (#33444854)

> > Sure, but there's nothing native.

> But why? strings are used by all programmers everyday

Different kinds of strings can have extremely different performance profiles.

A statically allocated string of ASCII (single byte) characters.

A dynamically allocated string of unicode (multibyte) characters where the length of allocation is not known ahead of time is very different. C requires the developer to know the differences and knows how to deal with them treat them.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by insanitybit on Wednesday November 02, 2022 @07:53PM (#33444586)

C is an extremely conservative language. You don't even get booleans unless you're in C99 and import it.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by int_19h on Thursday November 03, 2022 @06:43AM (#33449193)

You do get them without #include <stdbool.h>, you'll just have to contend with ugly spellings like _Bool and _True.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by anjbe on Thursday November 03, 2022 @07:00AM (#33449307)

bool, true, and false as native keywords are on track to show up in C23. https://www.open-std.org/jtc1/sc22/wg14/www/docs/n2393.pdf

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by pjmlp on Thursday November 03, 2022 @08:38AM (#33450090)

Because WG14 doesn't care about security, for them C is basically a portable macro assembler with added conveniences.

[ Parent | on HN ]