Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Rule of 2

chromium.googlesource.com

Post reply on HN
Print view View original

41–50 of 59 posts

Re: The Rule of 2

#41

Post by staticassertion »

Vogtinator wrote: post #22
pjmlp wrote: post #16

Earlier quoted context omitted.

Morris Worm. About 70% of CVE reported exploits are due to memory corruption. Living with the remaining 30% would already be a huge security improvement.

The Morris Worm happened back when security was not really a big concern. Memory corruption is much harder (and in most cases realistically not at all) to exploit beyond a DoS, and that's what you would get with "safe" languages such as Rust or Python as well. Heartbleed, Shellshock, Dirty COW etc. would all happen exactly the same way in different programming languages. Yes, there is clearly a benefit in using somet…

Most recent (and the first public) Chrome ITW attack used memory corruption attack. One to exploit the renderer, another to exploit the underlying kernel to escape the sandbox.

I believe the same is true (roughly) with the Coinbase attack that went after Firefox.

In short, memory safety is not only responsible for the majority of reported vulns, but also the exploited ones, at least in the case of browsers.

> Heartbleed, Shellshock, Dirty COW etc. would all happen exactly the same way in different programming languages.

Heartbleed is impossible in a memory safe language, at the least. Same with cloudbleed for that matter.

DirtyCow and shellshock, sure.

It's a bit of a moot point though - human energy is finite, consider if we could spend energy on problems like DirtyCow and shellshock instead of memory safety issues that simply don't exist in many languages.

Re: The Rule of 2

#42

Post by staticassertion »

missblit wrote: post #27
Vogtinator wrote: post #22

Earlier quoted context omitted.

The Morris Worm happened back when security was not really a big concern. Memory corruption is much harder (and in most cases realistically not at all) to exploit beyond a DoS, and that's what you would get with "safe" languages such as Rust or Python as well. Heartbleed, Shellshock, Dirty COW etc. would all happen exactly the same way in different programming languages. Yes, there is clearly a benefit in using somet…

Didn't Heartbleed rely on reading uninitialized data? I'd assume memory safety includes preventing code from reading uninitialized data.

Yes, and correct.

Re: The Rule of 2

#43

Post by jchw »

sitkack wrote: post #35
jchw wrote: post #28

Earlier quoted context omitted.

I work at Google and as far as I know Rust is not really “in house” at Google, at least not any more than C#. Both languages exist in some form, Google does have some plugins for Unity and I believe Fuchsia has some Rust code. It is indeed unclear what criteria was used to select languages, though it’s really not very relevant to the primary point anyway. (Legal line noise: my opinions are not those of my employer.)

Rust has been pulled into the Android tree.

That's genuinely exciting to hear. Thanks for letting me know.

Re: The Rule of 2

#44

Post by [deleted] »

est31 wrote: post #20
rectang wrote: post #17

Earlier quoted context omitted.

No-thank-you to the gratuitous Firefox FUD.

https://gs.statcounter.com/browser-market-share/desktop/worl... https://data.firefox.com/dashboard/user-activity If you check where Firefox was 10 years ago to where it's now you can see the trend. It still continues. In the last year, Firefox lost more than 10% of its market share. A component of this is probably Firefox not being able to capture growth of the entire market, but the trend also holds for the absolute…

[deleted]

Re: The Rule of 2

#45

Post by tyingq »

chubot wrote: post #34
tyingq wrote: post #9

"If you can be sure that the input comes from a trustworthy source" Perl's "taint" [1] capability is pretty interesting in this space. Do other languages have something similar? [1] https://perldoc.perl.org/perlsec.html#Taint-mode "You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale i…

Wow that's interesting. I've never heard of this in Perl or Ruby, and I always thought of taint analysis as static rather than dynamic. Though I don't have experience with it, maybe one reason it isn't used is because of false positives? For efficiency reasons, Perl takes a conservative view of whether data is tainted. If an expression contains tainted data, any subexpression may be considered tainted, even if the va…

"Has anyone used this?"

Perhaps not much on purpose, but it kicks in automatically if the Perl script is setuid. So you'll find questions about it where people are struggling with it.

Re: The Rule of 2

#46

Post by zetafunction »

johnday wrote: post #4

Two actually seems like a lot here. Why would you angle for two and not one? It seems like the latter two (unsafe implementation language and high privilege) are both within the purview of developers. Is it just a case of resource management?

1. The only option for avoiding an unsafe implementation language is currently Java, which is limited to Android.

2. Avoiding high privilege often means going out of process, which is challenging on resource-constrained devices.

Re: The Rule of 2

#47

Post by zetafunction »

oconnor663 wrote: post #3

> But if you transform the image into a format that doesn‘t have PNG’s complexity (in a low-privilege process, of course), the malicious nature of the PNG ‘should’ be eliminated and then safe for parsing at a higher privilege level. Even if the attacker manages to compromise the low-privilege process with a malicious PNG, the high-privilege process will only parse the compromised process' output with a simple, plausi…

https://bugs.chromium.org/p/chromium/issues/list?q=Type%3DBu...

It's not clear that all these bugs can be turned into an attack, but that sure is a lot of bugs.

Re: The Rule of 2

#48

Post by [deleted] »

realharo wrote: post #18
tyingq wrote: post #9

"If you can be sure that the input comes from a trustworthy source" Perl's "taint" [1] capability is pretty interesting in this space. Do other languages have something similar? [1] https://perldoc.perl.org/perlsec.html#Taint-mode "You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale i…

I'm not aware of a similar feature built into other languages, but most of it could be easily achieved with almost any type system. Just have two separate types, e.g. UnsafeString and regular String, and some kind of `convert` function that takes a validation function as an argument. You'd get compile-time checking that way. People don't tend to use such things in practice though, and you would also have to ban a por…

[deleted]

Re: The Rule of 2

#49

Post by eikenberry »

est31 wrote: post #20
rectang wrote: post #17

Earlier quoted context omitted.

No-thank-you to the gratuitous Firefox FUD.

https://gs.statcounter.com/browser-market-share/desktop/worl... https://data.firefox.com/dashboard/user-activity If you check where Firefox was 10 years ago to where it's now you can see the trend. It still continues. In the last year, Firefox lost more than 10% of its market share. A component of this is probably Firefox not being able to capture growth of the entire market, but the trend also holds for the absolute…

Neither of those charts go back far enough because if they did you'd see this has all happened before, and even worse at one point. When IE was taking over the world FF fell to <5% of the market, yet it survived. It's not dead until its dead and with Chrome killing off ad-blockers I bet we'll see some reversal of the current trends when that ships.

Re: The Rule of 2

#50

Post by aidos »

realharo wrote: post #18
tyingq wrote: post #9

"If you can be sure that the input comes from a trustworthy source" Perl's "taint" [1] capability is pretty interesting in this space. Do other languages have something similar? [1] https://perldoc.perl.org/perlsec.html#Taint-mode "You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale i…

I'm not aware of a similar feature built into other languages, but most of it could be easily achieved with almost any type system. Just have two separate types, e.g. UnsafeString and regular String, and some kind of `convert` function that takes a validation function as an argument. You'd get compile-time checking that way. People don't tend to use such things in practice though, and you would also have to ban a por…

This can be a useful pattern - though I’ve never seen it used for this usecase. A similar one is templating languages (like Jinja) where you need to wrap strings if you want to send HTML to your templates with them being escaped on render.

We use something similar where we have a BadNumber class in our code (python). Any operation with another number will also create a BadNumber. It allows us to make sure that these tainted numbers are always obvious.

Post reply on HN