Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google assigns a CVE for libwebp and gives it a 10.0 score

stackdiary.com

Post reply on HN
Print view View original

111–120 of 235 posts

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#111

Post by steveklabnik »

ninkendo wrote: post #101
ojii wrote: post #30

Earlier quoted context omitted.

Hubris and people thinking they can safely code in memory unsafe languages (they can't)

A memory-safe language could have easily resulted in the same vulnerability. In this context, “memory-safe” means it does bounds checking on an array when you try to access an element. But the webp code does bounds checks up-front so that array accesses can be non-checked, to help performance. (If they didn’t want this performance, they could have easily used a std::vector and used bounds-checked access.) The vulnera…

> presumably

This is a big presumption. Yes, it could happen. In practice, doing this isn't even the first tool you'd reach for in this circumstance; the compiler can and will eliminate duplicate bounds checks, so if you've hoisted it early, you shouldn't be using unchecked accesses, even if you care about performance, until you've demonstrated why the compiler isn't okay with removing them. The extra ceremony ("unsafe { foo.get_unchecked(n) {" vs "foo[n]") makes this even simpler to catch in code review.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#112

Post by greesil »

jefftk wrote: post #65
matthewdgreen wrote: post #43

Earlier quoted context omitted.

A phone released in October 2020 is about to stop getting security updates?!

Pixel used to be 3y of security updates. Starting with the 6 (2021) they switched to 5y. https://endoflife.date/pixel

Supposedly 7 years soon. Maybe. https://www.theverge.com/2023/9/25/23888831/pixel-8-pro-seve...

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#113

Post by dnedic »

malfist wrote: post #77
toomuchtodo wrote: post #64

Earlier quoted context omitted.

This is why I'm bullish on LLMs for application security vulnerability searches (like Shodan for code). It'll see what humans don't.

Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.

Humans can't be forced to evaluate every piece of code 100000 times in an hour. LLMs can.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#114

Post by KronisLV »

izacus wrote: post #102
KronisLV wrote: post #78

Earlier quoted context omitted.

> A phone released in October 2020 is about to stop getting security updates?! I actually looked into it, my previous phone was released in June 2020. The last security update for the phone came out in January 2022. I'm not sure whether they're just updating things infrequently or whether that model is abandoned altogether, but neither would speak highly of the Android support landscape for non-flagship phones. This…

Which phone would that be?

It's this manufacturer https://www.ulefone.com/index.html and probably many more out there, typically in the budget segment.

I can say that their rugged designs served me well, but some of the newer phones apparently have this weird component for wireless earphones and I don't really want that, so my current and future purchases are from different manufacturers. Was actually pretty close to stock Android, though!

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#115

Post by PhilipRoman »

AnthonyMouse wrote: post #109
saghm wrote: post #95

Earlier quoted context omitted.

The best solution to this sort of bug is not using languages that are susceptible to this sort of bug. At the very least, I think it's time to retire the fallacy that we're generally capable of producing sound programs in memory unsafe languages. Just like we don't write code manually checking raw SQL to protect against injections and we don't roll our own crypto when we need to encrypt something or do a key exchange…

I feel like we need for C and C++ what Typescript is for Javascript: Not a language from scratch but something which is as close as possible to the thing everyone is familiar with while doing the thing Rust does. A standard library where everything has the same names, the same kind of C++ objects and templates and RAII etc., change only this and nothing else. Because otherwise you make people learn 100 other things a…

Indeed, I would kill for a proof assistant that integrates with C

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#116

Post by ZiiS »

malfist wrote: post #77
toomuchtodo wrote: post #64

Earlier quoted context omitted.

This is why I'm bullish on LLMs for application security vulnerability searches (like Shodan for code). It'll see what humans don't.

Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.

Humans find security vulnerabilities all the time too. The assumption is a lot of the misses are because highly trained security experts don't have time to carefully read and understand all code without fatigue.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#117

Post by izacus »

KronisLV wrote: post #114
izacus wrote: post #102

Earlier quoted context omitted.

Which phone would that be?

It's this manufacturer https://www.ulefone.com/index.html and probably many more out there, typically in the budget segment. I can say that their rugged designs served me well, but some of the newer phones apparently have this weird component for wireless earphones and I don't really want that, so my current and future purchases are from different manufacturers. Was actually pretty close to stock Android, though!

Oh yeah, those OEMs are outright terrible with their support cycles :(

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#118

Post by Filligree »

Vt71fcAqt7 wrote: post #73
Filligree wrote: post #38

Earlier quoted context omitted.

I hope it does hurt JPEG-XL adoption. The reference implementation is C++, and it’s nearly guaranteed to have equally worrisome bugs in it — every image library has seen those over the years. We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language.

I'm sure this is what you meant, right ;) https://github.com/Traneptora/jxlatte

I'll take it. It's not like Java is slow nowadays.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#119

Post by philipwhiuk »

dnedic wrote: post #113
malfist wrote: post #77

Earlier quoted context omitted.

Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.

Humans can't be forced to evaluate every piece of code 100000 times in an hour. LLMs can.

With infinite hardware, sure. LLMs are pretty expensive to run vs fuzzing.

Re: Google assigns a CVE for libwebp and gives it a 10.0 score

#120

Post by kouteiheika »

secondcoming wrote: post #104
saghm wrote: post #95

Earlier quoted context omitted.

The best solution to this sort of bug is not using languages that are susceptible to this sort of bug. At the very least, I think it's time to retire the fallacy that we're generally capable of producing sound programs in memory unsafe languages. Just like we don't write code manually checking raw SQL to protect against injections and we don't roll our own crypto when we need to encrypt something or do a key exchange…

This response is becoming so tiresome

> This response is becoming so tiresome

I'd argue the constant stream of CVEs due to memory unsafety is even more tiresome.

Post reply on HN