Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

No strcpy either

daniel.haxx.se

Post reply on HN
Print view View original

31–40 of 151 posts

Re: No strcpy either

#31

Post by Sharlin »

Scubabear68 wrote: post #7

From the article: > It has been proven numerous times already that strcpy in source code is like a honey pot for generating hallucinated vulnerability claims This closing thought in the article really stood out to me. Why even bother to run AI checking on C code if the AI flags strcpy() as a problem without caveat?

Because these people who run AI checks on OSS code and submit bogus bug reports either assume that AIs don't make mistakes, or just don't care if the report is legit or not, because there's little to no personal cost to them even if it isn't.

Re: No strcpy either

#32

Post by lesuorac »

t43562 wrote: post #18

I've always wondered at the motivatons of the various string routines in C - every one of them seems to have some huge caveat which makes them useless. After years I now think it's essential to have a library which records at least how much memory is allocated to a string along with the pointer. Something like this: https://github.com/msteinert/bstring

It's from a time before computer viruses no?

But also all of this book-keeping takes up extra time and space which is a trade-off easily made nowadays.

Re: No strcpy either

#33

Post by andrepd »

Sharlin wrote: post #30
kccqzy wrote: post #26

Earlier quoted context omitted.

Yeah but fixed width strings don’t need null termination. You know exactly how long the string is. No need to find that null byte.

Good luck though remembering not to pass one to any function that does expect to find a null terminator.

Seriously. We have type systems and compilers that help us to not forget these things. It's not the 70s anymore!

Re: No strcpy either

#34

Post by Snild »

1f60c wrote: post #20
Snild wrote: post #6

Earlier quoted context omitted.

I don't see a problem with that, but for the record, the title on the site is lower-case for me (both browser tab title, and the header when in reader mode).

I think the submission originally had a typo ("strpy", with no C)

Ah.

Re: No strcpy either

#35

Post by [deleted] »

andrepd wrote: post #33
Sharlin wrote: post #30

Earlier quoted context omitted.

Good luck though remembering not to pass one to any function that does expect to find a null terminator.

Seriously. We have type systems and compilers that help us to not forget these things. It's not the 70s anymore!

[deleted]

Re: No strcpy either

#36

Post by [deleted] »

ninkendo wrote: post #29
kccqzy wrote: post #26

Earlier quoted context omitted.

Yeah but fixed width strings don’t need null termination. You know exactly how long the string is. No need to find that null byte.

Until you pass them as a `char *` by accident and it eventually makes its way to some code that does expect null termination. There’s languages where you can be quite confident your string will never need null termination… but C is not one of them.

[deleted]

Re: No strcpy either

#37

Post by lesuorac »

TZubiri wrote: post #24

LMAO After all this time the initial AI Slop report was right: https://hackerone.com/reports/2298307

?

Nonce and websockets don't appear at all in the blog post. The only thing the ai slop got right is that by removing strcpy curl will get less issues [submitted about it].

Re: No strcpy either

#38

Post by lesuorac »

Tempest1981 wrote: post #15
saagarjha wrote: post #10

Earlier quoted context omitted.

Because people are stupid and use AI for things it is not good at.

> people are stupid people overestimate AI

Its weird though because looking through the hackone reports in the slop wiki page there aren't actually reproduction steps. It's basically always just a line of code and an explanation of how a function can be mis-used but not a "make a webserver that has this hardcoded response".

So like why doesn't the person iterate with the AI until they understand the bug (and then ultimately discover it doesn't exist)? Like have any of this bug reports actually paid out? It seems like quickly people should just give up from a lack of rewards.

Re: No strcpy either

#39

Post by amenhotep »

lesuorac wrote: post #38
Tempest1981 wrote: post #15

Earlier quoted context omitted.

> people are stupid people overestimate AI

Its weird though because looking through the hackone reports in the slop wiki page there aren't actually reproduction steps. It's basically always just a line of code and an explanation of how a function can be mis-used but not a "make a webserver that has this hardcoded response". So like why doesn't the person iterate with the AI until they understand the bug (and then ultimately discover it doesn't exist)? Like ha…

As long as the number of people newly being convinced that AI generated bounty demands are a good way to make money equals or exceeds the number of people realising it isn't and giving up, the problem remains.

Not helped, I imagine, that once you realise it doesn't work, an easy pivot is to start convincing new people that it'll work if they pay you money for a course on it.

Re: No strcpy either

#40

Post by rini17 »

lesuorac wrote: post #32
t43562 wrote: post #18

I've always wondered at the motivatons of the various string routines in C - every one of them seems to have some huge caveat which makes them useless. After years I now think it's essential to have a library which records at least how much memory is allocated to a string along with the pointer. Something like this: https://github.com/msteinert/bstring

It's from a time before computer viruses no? But also all of this book-keeping takes up extra time and space which is a trade-off easily made nowadays.

Yes, in the old times if you crashed a program or whole computer with invalid input, it was your fault.

Viruses did exist, and these were considered users' fault too.

Post reply on HN