How about fixing the defective MMU ?
CVE-2026-2291 Heap buffer overflow, Infinite loop, Integer underflow, Heap buffer overflow ..
CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
181–190 of 256 posts
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#182Earlier quoted context omitted.
The problem is the lack of talent that is willing to work on this, not the language. AI Security researchers at least do something. If it was so easy to rewrite everything in rust, I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day. I tell you why that is. Working on these things doesn't give you stars on github.
That is a very pretentious opinion. Dnsmasq is a ubiquitous project, ~14 years old, and has maintainers that are very experienced in c and in the codebase. Telling them to rewrite in a language they are (maybe) unfamiliar with, even with the help of AI, will make these maintainers' experience worthless. People seem to think that rewriting in rust just magically fixes all issues, but that's not how it works (See recen…
I'm pretty sure we are getting close to the point where a few thousand bucks worth of tokens is enough for an agent coding session to reproduce a significant sized (but not linux kernel sized) C codebase in Rust that's 100% security bug for security bug compatible with the original. And _maybe_ "given enough eyeballs, all bugs are shallow" was true or even close top true once. But non of the "new code" ever has a _single_ eyeball cast over it. You know how sometimes you can stare into the code you wrote for weeks, but as soon as somebody else sees it they go "Hmmm, that bit looks odd. Are you sure it's right?" For most vibe coders or agents coders, it's all the same tool that generated the code that's looking for the bugs - it seems reasonable to assume that if a particular LLM generated the buggy code in the first place, it's at least as unlikely to find the bugs as a human who write buggy code?
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#183Earlier quoted context omitted.
The problem is the lack of talent that is willing to work on this, not the language. AI Security researchers at least do something. If it was so easy to rewrite everything in rust, I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day. I tell you why that is. Working on these things doesn't give you stars on github.
That is a very pretentious opinion. Dnsmasq is a ubiquitous project, ~14 years old, and has maintainers that are very experienced in c and in the codebase. Telling them to rewrite in a language they are (maybe) unfamiliar with, even with the help of AI, will make these maintainers' experience worthless. People seem to think that rewriting in rust just magically fixes all issues, but that's not how it works (See recen…
I think I was ambiguous.
> If it was so easy to rewrite everything in rust, I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day.
Meaning that AI/Rust enthusiasts are supposed to supply solutions. Of course they won't.
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#184Earlier quoted context omitted.
That is a very pretentious opinion. Dnsmasq is a ubiquitous project, ~14 years old, and has maintainers that are very experienced in c and in the codebase. Telling them to rewrite in a language they are (maybe) unfamiliar with, even with the help of AI, will make these maintainers' experience worthless. People seem to think that rewriting in rust just magically fixes all issues, but that's not how it works (See recen…
I'm pretty sure we are getting close to the point where a few thousand bucks worth of tokens is enough for an agent coding session to reproduce a significant sized (but not linux kernel sized) C codebase in Rust that's 100% security bug for security bug compatible with the original. And _maybe_ "given enough eyeballs, all bugs are shallow" was true or even close top true once. But non of the "new code" ever has a _si…
> I'm pretty sure we are getting close to the point where a few thousand bucks worth of tokens is enough for an agent coding session to reproduce a significant sized (but not linux kernel sized) C codebase in Rust
Given a comprehensive test suite for the original, probably, yes. if the test suite isn't great, you are still going to spend a lot of time/tokens chasing edge cases.
> that's 100% security bug for security bug compatible with the original
You can do this part without AI. c2rust will give you a translation that retains all the security bugs (and all the memory unsafety). The hope is that the AI in the loop will let you convert it to idiomatic rust (and hence avoid the memory unsafely, and in doing so, also resolve some of the security issues).
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#185Earlier quoted context omitted.
That's a bit shameless, indeed. dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. Why should I switch over to something way less proven? I'm quite sure your software also has bugs, many still not located. Maybe because it's less popular/ less well known nobody cares to…
> dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. I concur. The last part, however, is quite worrisome. Dnsmasq is ran by one person, published on their own git and I did not see any information about other maintainers. It is a super important (and great, and useful,…
[flagged]
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#186Earlier quoted context omitted.
How many CVEs in coreutils over the years? The project has the advantage of being old enough for them to be fixed. Call me when the rust rewrite has been there that long and still has more CVEs than the GNU counterpart.
Not sure how reliable this site is, but if it is correct it looks like 10: https://www.cvedetails.com/vulnerability-list/vendor_id-72/p... . Maybe coreutils is so old that most security vulnerabilities was solved before CVE even existed. But I think this is also a good argument why we are replacing a solid piece of C code to Rust just because it is "memory safe" and then have lots of CVEs related to things like TOCTO…
I'm not against rewriting it in Rust because I believe it really may help in certain class of bugs, but indeed it should not be replacing the old version instantly for that reason. Both could co exist, even tho you still need some guinea pigs to test it out and find issues.
Other than security, Rust brings major improvement to the tooling and may help bring fresh members that wouldn't want to contribute to C code. I understand why some projects go that route
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#187It's a good thing this software isn't used in millions of devices which almost never receive updates.
Well, it is a good thing to get control of your own hardware, when the vendor decides that no you won't do what you want with it.
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#188Earlier quoted context omitted.
> dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. I concur. The last part, however, is quite worrisome. Dnsmasq is ran by one person, published on their own git and I did not see any information about other maintainers. It is a super important (and great, and useful,…
[flagged]
My point was not in the one-person aspect (I use fantastic software done by one person, I also develop some (used by a niche)), it is the bus factor that is worrisome.
Some projects die because the dev abandons them (slowly or abruptly). Usually you see this happening with time and have the time to turn around.
The bus factor is drastic. One day the project lives and the next day it is gone. There is nobody anymore to push PRs etc. As I said, you can have it picked up via a fork and hope for the best (= that current users will somehow know). havng a backup contibutor eevn just to make the transition is a nice thing to have.
> Seeing it here, how someone "shamelessly" (in their own words) adverts their own competing project and then uses dummy accounts to bend the voting and discussion in their favouring… that's definitely NOT how trust is build up. It's something which instantly makes me stay away from a project (better or not).
Not sure how this relates to my comment?
Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#189Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq
#190Earlier quoted context omitted.
That line of thinking is exactly why I ended up using maradns for my dns hosting way back. 10/10, no regrets, would recommend.
What do you use for DHCP and how do you have DHCP update local DNS entries? Or do you just rely on mDNS to work?
I use maradns to provide dns, not to resolve it. My vps does not require its own dhcp server.