No strcpy either

#1

Post by firesteelrain » Tue, Dec 30, 2025, 1:14 PM UTC

No strcpy either
daniel.haxx.se

Re: No strcpy either

#2

Post by senthil_rajasek » Tue, Dec 30, 2025, 1:38 PM UTC

Title is :

No strcpy either

@dang

Re: No strcpy either

#3

Post by pama » Tue, Dec 30, 2025, 1:49 PM UTC

Congrats on the completion of this effort! C/C++ can be memory safe but take some effort.

IMHO the timeline figure could benefit in mobile from using larger fonts. Most plotting libraries have horrible font size defaults. I wonder why no library picked the other extreme end: I have never seen too large an axis label yet.

Re: No strcpy either

#4

Post by snvzz » Tue, Dec 30, 2025, 1:57 PM UTC

The AI chatbot vulnerability reports part sure is sad to read.

Why is this even a thing and isn't opt-in?

I dread the idea of starting to get notifications from them in my own projects.

Re: No strcpy either

#5

Post by Y_Y » Tue, Dec 30, 2025, 1:59 PM UTC

snvzz wrote: post #4

The AI chatbot vulnerability reports part sure is sad to read. Why is this even a thing and isn't opt-in? I dread the idea of starting to get notifications from them in my own projects.

Because humans generate and relay the slop-reports in the hopes of being helpful

Re: No strcpy either

#6

Post by Snild » Tue, Dec 30, 2025, 2:08 PM UTC

senthil_rajasek wrote: post #2

Title is : No strcpy either @dang

I don't see a problem with that, but for the record, the title on the site is lower-case for me (both browser tab title, and the header when in reader mode).

Re: No strcpy either

#7

Post by Scubabear68 » Tue, Dec 30, 2025, 2:15 PM UTC

From the article:

> It has been proven numerous times already that strcpy in source code is like a honey pot for generating hallucinated vulnerability claims

This closing thought in the article really stood out to me. Why even bother to run AI checking on C code if the AI flags strcpy() as a problem without caveat?

Re: No strcpy either

#8

Post by captn3m0 » Tue, Dec 30, 2025, 2:16 PM UTC

Y_Y wrote: post #5

snvzz wrote: post #4

The AI chatbot vulnerability reports part sure is sad to read. Why is this even a thing and isn't opt-in? I dread the idea of starting to get notifications from them in my own projects.

Because humans generate and relay the slop-reports in the hopes of being helpful

s/being helpful/making money.

Re: No strcpy either

#9

Post by trollbridge » Tue, Dec 30, 2025, 2:19 PM UTC

snvzz wrote: post #4

The AI chatbot vulnerability reports part sure is sad to read. Why is this even a thing and isn't opt-in? I dread the idea of starting to get notifications from them in my own projects.

Making a strcpy honeypot doesn’t sound like a bad idea…

  void nobody_calls_me(const char *stuff) {
          char *a, *b;
          const size_t c = 1024;

          a = calloc(c);
          if (!a) return;
          b = malloc(c);
          if (!b) {
                  free(a);
                  return;
          }
          strncpy(a, stuff, c - 1);
          strcpy(b, a);
          strcpy(a, b);
          free(a);
          free(b);
  }

Some clever obfuscation would make this even more effective.

Re: No strcpy either

#10

Post by saagarjha » Tue, Dec 30, 2025, 2:22 PM UTC

Scubabear68 wrote: post #7

From the article: > It has been proven numerous times already that strcpy in source code is like a honey pot for generating hallucinated vulnerability claims This closing thought in the article really stood out to me. Why even bother to run AI checking on C code if the AI flags strcpy() as a problem without caveat?

Because people are stupid and use AI for things it is not good at.