Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google assigns a CVE for libwebp and gives it a 10.0 score

stackdiary.com

Post reply on HN
Print view View original

141–150 of 235 posts

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#141

Post by aidenn0 »

AnthonyMouse wrote: post #109
saghm wrote: post #95

Earlier quoted context omitted.

The best solution to this sort of bug is not using languages that are susceptible to this sort of bug. At the very least, I think it's time to retire the fallacy that we're generally capable of producing sound programs in memory unsafe languages. Just like we don't write code manually checking raw SQL to protect against injections and we don't roll our own crypto when we need to encrypt something or do a key exchange…

I feel like we need for C and C++ what Typescript is for Javascript: Not a language from scratch but something which is as close as possible to the thing everyone is familiar with while doing the thing Rust does. A standard library where everything has the same names, the same kind of C++ objects and templates and RAII etc., change only this and nothing else. Because otherwise you make people learn 100 other things a…

Something like this? http://cyclone.thelanguage.org/wiki/Cyclone%20for%20C%20Prog...

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#142

Post by yjftsjthsd-h »

Filligree wrote: post #38
Vt71fcAqt7 wrote: post #27

Earlier quoted context omitted.

True, and most websites will reencode images for compression anyway. But the point still stands this makes "hacked by clicking a link" a reality again for some people which should have ended along with flash and java applets. The current mainstream is that "you won't get hacked if you don't install." (not to say that this is the best security practise..) Since you don't install images most people will just assume the…

I hope it does hurt JPEG-XL adoption. The reference implementation is C++, and it’s nearly guaranteed to have equally worrisome bugs in it — every image library has seen those over the years. We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language.

I was under the impression that modern C++ is a "sane language" - it looks like "smart pointers" are a thing now?

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#143

Post by raverbashing »

mxkopy wrote: post #136
Aeolos wrote: post #126

Earlier quoted context omitted.

For people downvoting, could you please explain which part of this statement you agree or disagree with?

[flagged]

> C is syntactic sugar around assembly

It isn't

As an example, see how C 'int', 'short', 'long' or whatever becomes actual different types

> just admit you're not interested in computers

I have the popcorn ready already for when the next C "hotshot" shoots himself in the foot yet again because he thinks a chainsaw without an emergency brake is just more fun

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#144

Post by yjftsjthsd-h »

Pxtl wrote: post #71
mnw21cam wrote: post #3

The point about Android is particularly important. I wouldn't like to estimate the proportion of Android phones that are in regular use that no longer receive security updates.

Is there any site that shows what phones are still getting security updates? I'm worried that this will be the thing that makes me retire my son's old Moto G... 5 I think? It's probably out of security updates. Which kills me, he's a careful boy and it's a solid phone, this is unnecessary E-Waste.

I don't know of a site that tracks it, but in the phone settings you can see when it last got security patches.

Also, if you want to get security updates without the e-waste, you could just install LineageOS on it.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#145

Post by colejohnson66 »

yjftsjthsd-h wrote: post #134
xavxav wrote: post #125

I'm tired and cranky today so this will lack subtlety, but: You don't have to use Rust but you **can't** use C. There's no reason to be finding these bugs in 2023; period, we can do better and we know how to do better, there's just no reason apart from legacy code (and even then) that you should be using memory unsafe languages in production.

For an image decoding library, you'll still need to expose a C API if you want anything to be able to use your library. You could only provide a library for your preferred language(s) but if like Google you're trying to push an all-new format the ecosystem buy-in is a big deal. And obviously you can provide a C-compatible library without writing the library in C, but it's more complexity to handle. (Edit: I should me…

If you want a C-style API, that can be had in Rust as well: https://stackoverflow.com/questions/71904069/how-can-i-expor...

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#146

Post by bcrosby95 »

mxkopy wrote: post #136
Aeolos wrote: post #126

Earlier quoted context omitted.

For people downvoting, could you please explain which part of this statement you agree or disagree with?

[flagged]

> C is syntactic sugar around assembly.

The C abstract machine, and the undefined behavior shenanigans compilers are pulling off says otherwise.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#147

Post by adrianmonk »

secondcoming wrote: post #104
saghm wrote: post #95

Earlier quoted context omitted.

The best solution to this sort of bug is not using languages that are susceptible to this sort of bug. At the very least, I think it's time to retire the fallacy that we're generally capable of producing sound programs in memory unsafe languages. Just like we don't write code manually checking raw SQL to protect against injections and we don't roll our own crypto when we need to encrypt something or do a key exchange…

This response is becoming so tiresome

The lack of response is way more tiresome. We keep having the same catastrophic failures decade after decade. Let's do nothing.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#148

Post by raydev »

AnthonyMouse wrote: post #109
saghm wrote: post #95

Earlier quoted context omitted.

The best solution to this sort of bug is not using languages that are susceptible to this sort of bug. At the very least, I think it's time to retire the fallacy that we're generally capable of producing sound programs in memory unsafe languages. Just like we don't write code manually checking raw SQL to protect against injections and we don't roll our own crypto when we need to encrypt something or do a key exchange…

I feel like we need for C and C++ what Typescript is for Javascript: Not a language from scratch but something which is as close as possible to the thing everyone is familiar with while doing the thing Rust does. A standard library where everything has the same names, the same kind of C++ objects and templates and RAII etc., change only this and nothing else. Because otherwise you make people learn 100 other things a…

I'm asking this into the comment section, since I'm curious if anyone has checked:

Does Zig fill this space in any way? It still allows manual memory management but offers more protections, the specifics I'm unclear on.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#149

Post by radlad »

yjftsjthsd-h wrote: post #138
radlad wrote: post #133

Earlier quoted context omitted.

On this note, I was really surprised to find Red Hat's OCI runtime is written in C: https://github.com/containers/crun Is anyone working on a Rust version?

Well runc is in Go, which isn't Rust but at least isn't C.

Yes, and Red Hat has metrics and explanations showing why Go is not exactly ideal here.

And yet I am surprised they chose C as a replacement... hence my question above!

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#150

Post by oconnore »

mxkopy wrote: post #136
Aeolos wrote: post #126

Earlier quoted context omitted.

For people downvoting, could you please explain which part of this statement you agree or disagree with?

[flagged]

But assembly _is_ outdated, at least for the purpose of authoring large community software projects.
Post reply on HN