News for hackers. Stuff that matters.
Re:Why CVE-2022-3602 was not detected by fuzz testing by nicoburns on Monday November 21, 2022 @01:45PM (#33696263)
> The actual solution is that open source, widely used code is a target for hackers.

The long term solution is likely using languages which are A. Memory safe, and B. make formal verification viable. Being widely used and open source isn't an issue if there are no exploitable bugs in the code.

Re:Why CVE-2022-3602 was not detected by fuzz testing by KingLancelot on Monday November 21, 2022 @03:22PM (#33697423)
I see a lot of people pushing memory safe languages, far more people than actually write systems code.

What is your primary language?

Re:Why CVE-2022-3602 was not detected by fuzz testing by pjmlp on Monday November 21, 2022 @03:36PM (#33697590)
Many of those people have experience writing systems programming code before UNIX and C got widespread outside Bell Labs.

Mac OS was originally written in Object Pascal + Assembly, just to cite one example from several.

Re:Why CVE-2022-3602 was not detected by fuzz testing by KingLancelot on Monday November 21, 2022 @04:35PM (#33698305)
Nice deflection, but you still didn’t answer the question.

Have you ever written in a memory safe language like you’re telling others to do?

Re:Why CVE-2022-3602 was not detected by fuzz testing by pjmlp on Monday November 21, 2022 @05:50PM (#33699264)
Yes, my dear, plenty of times since 1986.

Turbo Pascal, Turbo Basic, Modula-2, Ada, Oberon, ...

Re:Why CVE-2022-3602 was not detected by fuzz testing by dang on Monday November 21, 2022 @06:53PM (#33699894)
Please don't break the site guidelines just because another comment is bad. That only makes things worse.

https://news.ycombinator.com/newsguidelines.html

Re:Why CVE-2022-3602 was not detected by fuzz testing by dang on Monday November 21, 2022 @06:52PM (#33699892)
We've banned this account for breaking the site guidelines. Please don't create accounts to do that with. If you've decided you want to use HN as intended, that's fine, but in that case please review https://news.ycombinator.com/newsguidelines.html and be sure you're sticking to the rules.
Re:Why CVE-2022-3602 was not detected by fuzz testing by nicoburns on Monday November 21, 2022 @06:11PM (#33699506)
My primary language is JavaScript, but I use Rust when I need to write more low-level (or higher performance) code. I certainly haven't been writing kernel code or anything like that, but I think it's fair to say that I practice what I preach when it comes to using memory safe languages.