391–400 of 498 posts
Earlier quoted context omitted.
https://www.owasp.org/index.php/Using_freed_memory
"While it is technically feasible for the freed memory to be re-allocated and for an attacker to use this reallocation to launch a buffer overflow attack, we are unaware of any exploits based on this type of attack."
Earlier quoted context omitted.
I'm not entirely clear on your point. Are you suggesting that writing in C as opposed to Rust is somehow morally cleansing? Or are you suggesting that having higher level abstractions is somehow ruinous to ability? The evidence is pretty clear that programming in C does not confer enough skill to prevent disastrous mistakes despite its near-hardware level of abstraction, so I'd really like to know what you're saying…
I don't think I worded my original comment in the best way. However, I find that the people who make statements like "C makes it far more difficult to write safe and correct code" haven't touched the language in years if ever. Hence, no wonder it will be difficult for them because they have not practiced or been exposed to good C idioms. Correct code in C is actually easy since the language is very simple. Due to thi…
I broke back into this account just to share my marvel at the singly most wrong sentence in human history. The Mona Lisa of being incorrect about programming.
I audit code for security vulnerabilities in several languages professionally. You are correct about the benefits of unit testing, which is language agnostic, but C is not and cannot be Easy To Be Correct, ever, no matter what.
Earlier quoted context omitted.
Can you elaborate on this? What exactly do you mean with unrelated source and might you give a concrete example what a company could NOT do if this code would be GPL'ed.
The readline library for example. If I want to use it, I have to GPL my whole program. I probably might not have modified readline at all. Or any other GPL software which gets somehow linked together with my code. Just watch the controversy whether ZFS kernel modules may be delivered as pre-compiled binaries (sources are fully available). The output of compilers and parsers which are GPLed, also are implicitly covere…
Earlier quoted context omitted.
It is interesting no one suggested Rust project internal ide support. They are developing something called Oracle.This is basically everything IDE needs (autocomplete, reference finding, error checking, etc). Oracle haven't finished yet.But after Oracle being ready, I think every editor/IDE out there can provide best experience for rust by simply calling a bunch of API which is very simple thing to do compare to writ…
Slightly off-topic, but isn't Oracle a bit of a dangerous name to use? I seem to remember it was something to do with some big company or other... ;)
Earlier quoted context omitted.
You could just use atom and install some rust plugins.
I would, but the last time I installed atom and tried to start it the base text editor, without any added plugins, took 3 minutes to start and used ~600mb of system memory. In comparison, Eclipse starts in under a minute and uses about half that on my system. Atom when I tried it was much to large for my system. I might look at it again.
Though if you want an IDE a plugin for IntelliJ exists too.
Earlier quoted context omitted.
I expect it's because because the first part is essentially preaching to the choir, and because Richard Hipp very much disagrees with the second part[0] > Rewriting SQLite in Rust, or some other trendy “safe” language, would not help. In fact it might hurt. (see link for expansion on that matter, which is a question of tooling and testing) [0] http://blog.regehr.org/archives/1292#comment-18452
Prof. Regehr did not find problems with SQLite. He found constructs in the SQLite source code which under a strict reading of the C standards have “undefined behaviour”, which means that the compiler can generate whatever machine code it wants without it being called a compiler bug. That’s an important finding. But as it happens, no modern compilers that we know of actually interpret any of the SQLite source code in…
This discussion seems to miss a couple things. SQLite is embedded quite often, by programs written in C; would embedding a rust library and possibly runtime fix things? The parent program would still potentially have defects and those defects could impact SQLite.
SQLite is also rather mature, I do t see how you can compare a rewrite to nature code. Take OpenSSL as an example, they are t tossing it, they are fixing it, it's a much more shallow lift to fix it.
I'm all for some big rust programs to prove its case though, a mailer, a dns daemon, some sort of database. Something useful cut from whole cloth, and ideally something we have historically not done well. I don't think a rewrite is it though.
Earlier quoted context omitted.
> The last decade has seen an explosion of modern C++ code using best practices that routinely exhibits the same memory safety issues. Examples? I'd be surprised if best practice C++ (C++11, say) had memory safety issues. (I realize that's only the last half- decade...) > C is worse. Certainly. Lack of destructors alone makes it hard to create safe abstractions.
> Examples? I'd be surprised if best practice C++ (C++11, say) had memory safety issues. Pwn2Own last week. For more examples, search any browser engine's bug tracker. Yes, this is all modern C++.
Is it? You're telling me that all code in all browsers have been re-written into C++11 (or C++14) with best practices? I don't believe you. At a minimum, I'm going to need some documentation before I believe that.
[Edit: I'm not trying to pull a No True Scotsman here. I just doubt that browsers have been completely rewritten into modern C++, or with anything approaching best practices. I've seen how long old code lives to believe it without some supporting evidence.]
Earlier quoted context omitted.
> I don't see why we shouldn't be moving to languages like Rust given the chance, as C makes it far more difficult to write safe and correct code I agree in principal, however the timing is wrong. Rust is a very new language (less than 6 years old), and is undeniably totally unproven. It is the latest "buzz" language, and may not be around long term... nobody knows. What-more, a full-fledged re-write of CoreUtils in…
Alupis wrote: "Average users who just consume distro's are not going to switch to a new unproven CoreUtils (even if they knew how), and distro maintainers are not going to switch until it's proven either. It will take a huge company with a huge install-base switching and testing it in production for many years before others start to feel comfortable... however this is also an enormous burden on said mega-corporation,…
I don't see Mozilla doing this, really. There's no direct benefit, and there's a nebulous future benefit for Rust.
Mozilla is using Rust components in Firefox though (as well as Servo being mostly Rust). "Adopting Rust as the language of choice" seems to be happening already -- I've heard a lot of folks enthusiastic about (re)writing in Rust. This stuff takes time, though.
Earlier quoted context omitted.
I was going to say it only takes about 30 seconds to fork and change the license if you want to. Then I decided to check if someone had already done so. Yep. https://github.com/ivegotasthma/coreutils/commit/4c7dcbd912a... I didn't count, but that may have taken less than 30 seconds.
Is that valid? The original license had: > The above copyright notice and this permission notice shall be > included in all copies or substantial portions of the Software. As those have now been stripped away, it seems like a license violation.