Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

201–210 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#201
post #199

Earlier quoted context omitted.

My read on those was basically that the classic filesystems are hopelessly broken and we need ACID guarantees in the next-gen filesystems, like 20 years ago. Not saying all of them were about FS TOCTOU bugs but once I got to these, that was my takeaway. Obviously just using Rust cannot fix _all_ bugs, and I reject any criticisms towards Rust rewrites that tear down this particular straw man (its goal being to make it…

But removing all the memory footguns while introducing hundreds of syscalls footguns where rust won't help you at all might not be better at all,

I agree, absolutely. Hence my adjacent thought that maybe all this should just be thrown away and we should invent an FS with ACID semantics.

I'm all for gradual improvements but at one point and on we should zoom even further out and pick our battles well.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#202
post #197

For folks with more experience in this specific domain, dumb question: why is more software in this space not written in e.g. Erlang or some other garbage collected, concurrent language runtime?

The initial release of dnsmasq was in 2001. The list of viable languages for a high-performance network server at the time was still not all that long. Erlang wasn't on it. Too big a performance hit, too much opaque runtime that may not have been stable at the time, too few contributors, big dependency footprint of stuff most things wouldn't have installed. (When I used Erlang for a production system in more like the 2015 time frame it still had rough corners if you weren't using it exactly for the use case it was meant for.) This isn't specially a criticism of Erlang, it would have been like this across many languages and runtimes.

A lot of these systems that are getting hit, and will probably continue to be hit over the next few weeks or months, have a similar story. The Linux kernel's only other potentially viable choice was C++ at the time. OpenSSL, a perennial security offender, was started in 1998. You can look up your own favorite major system library with major security issues and it's probably the same story.

I'm as aggressive as anyone about saying "don't write a new project in C for network access", but cast me back to 1998 and I couldn't tell you what other viable choices there are either. There are safer languages, but they were much, much smaller than the C community, and I couldn't promise you how stable they were either. Java was out, and I don't know when to draw the exact line as to when it became a serious contender for a network server, but late 200Xs would be my guess; certainly what I saw in 1999 wasn't yet.

Example: I ran a Haskell network server in 2011 for something relatively unimportant and it fell over under conditions that would not have been very extreme for a production network; I know it was Haskell and not my code because I reused the same code base in 2013 with no changes in the core run loop and it did about 90% better; still not enough that I would have put that system into a real production use case but enough to show it wasn't my code failing. So while Haskell may have existed in the 200Xs, it wouldn't have qualified as a viable choice for a network server at the time.

There's a lot more viable choices today than there used to be.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#204

Earlier quoted context omitted.

> dnsmasq has served me well for like an eternity in multiple setups for different use cases. As all software it has bugs. And once located those get fixed. Its author is also easy to communicate with. I concur. The last part, however, is quite worrisome. Dnsmasq is ran by one person, published on their own git and I did not see any information about other maintainers. It is a super important (and great, and useful,…

[flagged]

>>>uses dummy accounts to bend the voting and discussionThis is a false accusation with no evidence to back it up. Let me state this clearly: I am not using sockpuppet accounts nor am I stacking the vote.

Ycombinator is a secure site and @dang does not allow sockpuppets nor stacked voting.

What you are seeing is the hacker spirit of the Ycombinator community: Hackers believe in software diversity, and strongly oppose monoculture, so welcome people who bring up and discuss alternative software.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#205

Earlier quoted context omitted.

That is a very pretentious opinion. Dnsmasq is a ubiquitous project, ~14 years old, and has maintainers that are very experienced in c and in the codebase. Telling them to rewrite in a language they are (maybe) unfamiliar with, even with the help of AI, will make these maintainers' experience worthless. People seem to think that rewriting in rust just magically fixes all issues, but that's not how it works (See recen…

> People seem to think that rewriting in rust just magically fixes all issues Citations and links, please.

I am not a journalist, nor your nanny.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#206

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

Maybe the problem is the way we think of dynamic memory. “Oh I don’t know what my maximum size for this is going to be, everything has to be dynamic” Is that really true? Is it really the end of the world for programs to declare maximum acceptable sizes for their inputs, and after that error out or use a ring buffer? If sizes were known you could design around that when using them. Your ram bank is finite, why is eve…

This is exactly how people thought before 1995. Then everyone started "smashing the stack for fun and profit." In the end, you're trading one set of bugs (dynamic memory bugs and hard to reliably exploit) for another (overflow and easy to reliably exploit).

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#207

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

I disagree -- we're clearly getting better safeguards by way of AI agents to spot potential vulnerabilities!

[dead]

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#208
post #202
post #197

For folks with more experience in this specific domain, dumb question: why is more software in this space not written in e.g. Erlang or some other garbage collected, concurrent language runtime?

The initial release of dnsmasq was in 2001. The list of viable languages for a high-performance network server at the time was still not all that long. Erlang wasn't on it. Too big a performance hit, too much opaque runtime that may not have been stable at the time, too few contributors, big dependency footprint of stuff most things wouldn't have installed. (When I used Erlang for a production system in more like the…

Ocaml was fine in 2001.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#209

Earlier quoted context omitted.

> People seem to think that rewriting in rust just magically fixes all issues Citations and links, please.

I am not a journalist, nor your nanny.

Then you're claiming falsehoods supporting your prejudices. Good to know.

Though I wonder why.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#210
post #202
post #197

For folks with more experience in this specific domain, dumb question: why is more software in this space not written in e.g. Erlang or some other garbage collected, concurrent language runtime?

The initial release of dnsmasq was in 2001. The list of viable languages for a high-performance network server at the time was still not all that long. Erlang wasn't on it. Too big a performance hit, too much opaque runtime that may not have been stable at the time, too few contributors, big dependency footprint of stuff most things wouldn't have installed. (When I used Erlang for a production system in more like the…

Great context, thanks. I wasn't in the industry then so this is interesting to hear how decisions were being made at the time.
Post reply on HN