Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

191–200 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#191

Post by nsvd2 »

zrm wrote: post #30
koverstreet wrote: post #22

Earlier quoted context omitted.

No, that's exactly the thing to complain about. That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. Not to mention, you think the C of today is bad? Have you looked at old C? And the disadvantage is that backporting is manual, resource intensive, and prone to error - and the p…

> That whole model dates to before automated testing was even really a thing, and no one knew how to do QA; your QA was all the people willing to run your code and report bugs, and that took time. That's not what it's about. What it's about is, newer versions change things. A newer version of OpenSSH disables GSSAPI by default when an older version had it enabled. You don't want that as an automatic update because it…

There are bleeding edge and rolling release distributions. Debian is simply not that and has no desire to be.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#192

Post by infinet »

SoftTalker wrote: post #49

Never liked using dnsmasq. Always felt like too much in one tool. A local caching resolver, dhcp server, and tftp/pxe boot setup were always things I preferred to configure separately.

There are few dnsmasq (only?) features that are indispensable to some. Examples: sending query of *.example.com to certain upstream servers, or returning NXDOMAIN for phishing sites, or adding all resolved IPs for *.example.org to an ipset for policy routing. The last one works on FreeBSD as well although BSD does not have ipset. The list of *.example_xyz.com can be huge and it is said recent dnsmasq can handle them efficiently.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#193

Post by ajsnigrutin »

Orygin wrote: post #186
kokada wrote: post #169

Earlier quoted context omitted.

Not sure how reliable this site is, but if it is correct it looks like 10: https://www.cvedetails.com/vulnerability-list/vendor_id-72/p... . Maybe coreutils is so old that most security vulnerabilities was solved before CVE even existed. But I think this is also a good argument why we are replacing a solid piece of C code to Rust just because it is "memory safe" and then have lots of CVEs related to things like TOCTO…

I'm not against rewriting it in Rust because I believe it really may help in certain class of bugs, but indeed it should not be replacing the old version instantly for that reason. Both could co exist, even tho you still need some guinea pigs to test it out and find issues. Other than security, Rust brings major improvement to the tooling and may help bring fresh members that wouldn't want to contribute to C code. I…

> Other than security, Rust brings major improvement to the tooling and may help bring fresh members that wouldn't want to contribute to C code. I understand why some projects go that route

But it loses old members who don't program in rust, already know the projects, all the reasons of why "this thing" was done "that way". and introduces a new set of bugs, plus now you have two versions of the same thing to maintain.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#194

Post by yjftsjthsd-h »

PunchyHamster wrote: post #168
yjftsjthsd-h wrote: post #11

Earlier quoted context omitted.

Who said it can't? https://news.ycombinator.com/item?id=47759709 appears to be a nearly flawless (per spec) zip implementation.

[flagged]

No, a collection of fuzzers and the lean proof assistant found (almost) no bugs.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#195

Post by pdimitar »

bayindirh wrote: post #172
kokada wrote: post #169

Earlier quoted context omitted.

Not sure how reliable this site is, but if it is correct it looks like 10: https://www.cvedetails.com/vulnerability-list/vendor_id-72/p... . Maybe coreutils is so old that most security vulnerabilities was solved before CVE even existed. But I think this is also a good argument why we are replacing a solid piece of C code to Rust just because it is "memory safe" and then have lots of CVEs related to things like TOCTO…

People thinking that using a superior tool (on paper) enables them to automatically write better tools than the ones who are battle tested over the years baffles me to no end. Yes, you can go further, possibly faster. OTOH, nothing replaces experience and in-depth knowledge. GNU Coreutils embodies that knowledge and experience. uutils has none, and just tries to distill it with tests against the GNU one. ...and they…

My read on those was basically that the classic filesystems are hopelessly broken and we need ACID guarantees in the next-gen filesystems, like 20 years ago.

Not saying all of them were about FS TOCTOU bugs but once I got to these, that was my takeaway.

Obviously just using Rust cannot fix _all_ bugs, and I reject any criticisms towards Rust rewrites that tear down this particular straw man (its goal being to make it impossible to argue against). That's toxic and I get surprised every time people on HN try to argue in that childish way.

But if we can remove all C memory safety foot guns then that by itself is worth a lot already.

Losing decades-old knowledge on how the dysfunctional lower-level systems work would be regrettable and even near-fatal for any such projects. That I'd agree with. But it also raises the question on whether those lower-level systems don't need a very hard long look and -- eventually -- a replacement.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#196

Post by pdimitar »

bluedragon1221 wrote: post #171
Yokohiii wrote: post #156

Earlier quoted context omitted.

The problem is the lack of talent that is willing to work on this, not the language. AI Security researchers at least do something. If it was so easy to rewrite everything in rust, I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day. I tell you why that is. Working on these things doesn't give you stars on github.

That is a very pretentious opinion. Dnsmasq is a ubiquitous project, ~14 years old, and has maintainers that are very experienced in c and in the codebase. Telling them to rewrite in a language they are (maybe) unfamiliar with, even with the help of AI, will make these maintainers' experience worthless. People seem to think that rewriting in rust just magically fixes all issues, but that's not how it works (See recen…

> People seem to think that rewriting in rust just magically fixes all issues

Citations and links, please.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#198

Post by LtWorf »

asa400 wrote: post #197

For folks with more experience in this specific domain, dumb question: why is more software in this space not written in e.g. Erlang or some other garbage collected, concurrent language runtime?

In C you can normally directly map struct to network packets so that's quite easy. In other languages it's not often as simple.

Plus of course they are slower and bigger.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#199

Post by LtWorf »

pdimitar wrote: post #195
bayindirh wrote: post #172

Earlier quoted context omitted.

People thinking that using a superior tool (on paper) enables them to automatically write better tools than the ones who are battle tested over the years baffles me to no end. Yes, you can go further, possibly faster. OTOH, nothing replaces experience and in-depth knowledge. GNU Coreutils embodies that knowledge and experience. uutils has none, and just tries to distill it with tests against the GNU one. ...and they…

My read on those was basically that the classic filesystems are hopelessly broken and we need ACID guarantees in the next-gen filesystems, like 20 years ago. Not saying all of them were about FS TOCTOU bugs but once I got to these, that was my takeaway. Obviously just using Rust cannot fix _all_ bugs, and I reject any criticisms towards Rust rewrites that tear down this particular straw man (its goal being to make it…

But removing all the memory footguns while introducing hundreds of syscalls footguns where rust won't help you at all might not be better at all,

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#200

Post by LtWorf »

Yokohiii wrote: post #156
unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

The problem is the lack of talent that is willing to work on this, not the language. AI Security researchers at least do something. If it was so easy to rewrite everything in rust, I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day. I tell you why that is. Working on these things doesn't give you stars on github.

> I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day.

Go ahead and ask your AI to make it. What's stopping you?

Post reply on HN