Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AsmBB – a lightweight web forum engine written in assembly language

asmbb.org

Post reply on HN
Print view View original

111–120 of 131 posts

Re: AsmBB – a lightweight web forum engine written in assembly language

#111

Post by tasn »

kragen wrote: post #102
tasn wrote: post #51

Earlier quoted context omitted.

I can see this maybe being true in a high level language (depending on the dependency), though it's definitely not the case with assembly. OpenSSL, for example, was hit with quite a few serious bugs over the years, and I'd still choose using it than my own SSL implementation. Especially in assembly.

people who are not familiar with cryptography are often unaware of this, but cryptographic algorithms are among the kinds of code most commonly written in assembly not only are they almost never subject to the kinds of security problems we commonly associate with low-level languages like assembly or c (for example, buffer overflows and heap corruption) they also commonly need to run in constant time to prevent timing…

I'm aware, and this is a good point to bring up about cryptography. I had the protocol code in mind when I was talking about the bugs. I should have used curl as example in retrospect. :)

Re: AsmBB – a lightweight web forum engine written in assembly language

#114

Post by IshKebab »

10000truths wrote: post #43
ChuckMcM wrote: post #41

I like this, and kudos for going for assembly language. It is certainly true that reducing dependencies reduces the attack surface for something, that does not, in and of itself, make it "secure". But yes, in a probabilistic sort of way it reduces the chances of exploits. Of course assembly language has zero memory safety or other guarantees which probabilistically increases risk. I can't say if I think they balance…

> Of course assembly language has zero memory safety or other guarantees which probabilistically increases risk. I can't say if I think they balance out one way or the other. I would posit that assembly + Linux kernel ABI is safer than the traditional C/C++ stack because they are not littered with nearly as much "undefined behavior". Signed arithmetic overflows and underflows as expected. Memory allocation with mmap…

Maybe so but I wouldn't recommend running forum software written in C++ either!

"This footgun is safer than a footknife!"

Re: AsmBB – a lightweight web forum engine written in assembly language

#115

Post by kragen »

tasn wrote: post #111
kragen wrote: post #102

Earlier quoted context omitted.

people who are not familiar with cryptography are often unaware of this, but cryptographic algorithms are among the kinds of code most commonly written in assembly not only are they almost never subject to the kinds of security problems we commonly associate with low-level languages like assembly or c (for example, buffer overflows and heap corruption) they also commonly need to run in constant time to prevent timing…

I'm aware, and this is a good point to bring up about cryptography. I had the protocol code in mind when I was talking about the bugs. I should have used curl as example in retrospect. :)

i agree that probably assembly is an especially bug-prone language to implement things like protocol logic and asn.1 parsing; but high-level programming languages are pretty bad at things like that, too. it still mostly depends on your system design: assembly might be a perfectly fine language in which to implement a bytecode interpreter for a safe asn.1 parser in a non-turing-complete language you can formally verify. assembly's weak points don't matter much for bytecode interpreters

incidentally those 85000 lines of assembly are about 12% of the total openssl codebase

Re: AsmBB – a lightweight web forum engine written in assembly language

#117

Post by ustad »

apgwoz wrote: post #100
revskill wrote: post #97

Earlier quoted context omitted.

Whos' Chuck Norris ?

That answered my question. Chuck Norris is a martial artist that had an acting career. He got a second wind of fame when he became a meme… Chuck Norris Facts. https://en.wikipedia.org/wiki/Chuck_Norris_facts

"Chuck Norris's Social Security number is the last nine digits of pi."

Re: AsmBB – a lightweight web forum engine written in assembly language

#119

Post by tommek4077 »

true_pk wrote: post #17

In the header, there’s a button to disable live notifications. On a side note, showing a list of forum users to someone who isn’t logged in is probably a bad idea. Is it something configurable?

Welcome to the internet young one. That is what forums do since forever. And probably configurable as well.

Re: AsmBB – a lightweight web forum engine written in assembly language

#120

Post by ozozozd »

bee_rider wrote: post #78
throwup238 wrote: post #66

Earlier quoted context omitted.

> OpenSSL, for example, was hit with quite a few serious bugs over the years, and I'd still choose using it than my own SSL implementation. Especially in assembly. That's the difference between a programmer and a real engineer: an engineer doesn't need any help from dependencies to make his code totally insecure.

Engineers do design, implementation is the job of the technician or machinist or somebody like that. If the engineer’s code ends up shipped to customers, something very strange has happened.

No snark but this is the ultimate example of “tell me you never built software without telling me you never built software”

Unless I totally missed the sarcasm.

Post reply on HN