Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

211–220 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#211

Post by empath75 »

turpentine wrote: post #155
unclejuan wrote: post #88

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

https://news.ycombinator.com/item?id=47943499 - 44 CVEs trying to replace coreutils with a greenfield rust rewrite. There's no free lunch.

They aren't the same kinds of problems, though.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#212

Post by asddubs »

strenholme wrote: post #116
shakna wrote: post #66

Earlier quoted context omitted.

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Thank you for your concern. I fixed CVE-2014-5461 for Lunacy back in 2021: https://github.com/samboy/lunacy/commit/4de84e044c1219b06744... This is discussed here: https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2... In addition, I have done other security hardening with Lunacy compared to Lua 5.1: https://samboy.github.io/MaraDNS/webpage/lunacy/ Now, I should probably explain why I’m using Lua 5.1 instead…

Why is Lua 5.1 the most popular version?

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#213

Post by krferriter »

LtWorf wrote: post #200
Yokohiii wrote: post #156

Earlier quoted context omitted.

The problem is the lack of talent that is willing to work on this, not the language. AI Security researchers at least do something. If it was so easy to rewrite everything in rust, I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day. I tell you why that is. Working on these things doesn't give you stars on github.

> I don't know why the response to this incidents isn't a rock solid replacement in rust, the next day. Go ahead and ask your AI to make it. What's stopping you?

> What's stopping you?

Based on their comment I guess they are worried they won't earn enough stars on github

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#214

Post by overfeed »

pdimitar wrote: post #195
bayindirh wrote: post #172

Earlier quoted context omitted.

People thinking that using a superior tool (on paper) enables them to automatically write better tools than the ones who are battle tested over the years baffles me to no end. Yes, you can go further, possibly faster. OTOH, nothing replaces experience and in-depth knowledge. GNU Coreutils embodies that knowledge and experience. uutils has none, and just tries to distill it with tests against the GNU one. ...and they…

My read on those was basically that the classic filesystems are hopelessly broken and we need ACID guarantees in the next-gen filesystems, like 20 years ago. Not saying all of them were about FS TOCTOU bugs but once I got to these, that was my takeaway. Obviously just using Rust cannot fix _all_ bugs, and I reject any criticisms towards Rust rewrites that tear down this particular straw man (its goal being to make it…

I like rust as a language, but boy, the violent, zero-sum proselytising gets on my nerves. It's not enough for Rust to win, but C must be beaten to a pulp and its head mounted on a pike.

New projects wearing an another project's skin have always bothered me - regardless of language. Ubuntu did a similar thing way back with libav masquerading as ffmpeg.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#215

Post by pdimitar »

overfeed wrote: post #214
pdimitar wrote: post #195

Earlier quoted context omitted.

My read on those was basically that the classic filesystems are hopelessly broken and we need ACID guarantees in the next-gen filesystems, like 20 years ago. Not saying all of them were about FS TOCTOU bugs but once I got to these, that was my takeaway. Obviously just using Rust cannot fix _all_ bugs, and I reject any criticisms towards Rust rewrites that tear down this particular straw man (its goal being to make it…

I like rust as a language, but boy, the violent, zero-sum proselytising gets on my nerves. It's not enough for Rust to win, but C must be beaten to a pulp and its head mounted on a pike. New projects wearing an another project's skin have always bothered me - regardless of language. Ubuntu did a similar thing way back with libav masquerading as ffmpeg.

How dramatic. I'll ask you as well: any proof for those colorful pictures you're drawing? Or are the people advocating for Rust a convenient target to vent other, very likely completely unrelated, frustrations?

I'm very happy to work with multiple programming languages without getting religious about any of them. They all have drawbacks, Rust included of course.

However, just my mere skepticism about the existence of the "violent proselytizing for Rust" of course immediately had me put in some imaginary group of fanatics. Which is of course normal. People love their binary camps and nuance and discission about merits be damned.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#216

Post by overfeed »

pdimitar wrote: post #201
LtWorf wrote: post #199

Earlier quoted context omitted.

But removing all the memory footguns while introducing hundreds of syscalls footguns where rust won't help you at all might not be better at all,

I agree, absolutely. Hence my adjacent thought that maybe all this should just be thrown away and we should invent an FS with ACID semantics. I'm all for gradual improvements but at one point and on we should zoom even further out and pick our battles well.

> maybe all this should just be thrown away and we should invent an FS with ACID semantics.

You're describing WinFS, which looked into and ultimately abandoned Microsoft 20 years ago. I'm sure other groups have looked into this as well, but there's no such thing as free lunch.

> I'm all for gradual improvements but at one point and on we should zoom even further out and pick our battles well.

That sounds a lot like picking up more battles, yet we all still have 24 hours a day. Recursively trying to perfect lower layers will have you like Hal changing the lightbulb https://youtu.be/AbSehcT19u0

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#217

Post by bayindirh »

pdimitar wrote: post #215
overfeed wrote: post #214

Earlier quoted context omitted.

I like rust as a language, but boy, the violent, zero-sum proselytising gets on my nerves. It's not enough for Rust to win, but C must be beaten to a pulp and its head mounted on a pike. New projects wearing an another project's skin have always bothered me - regardless of language. Ubuntu did a similar thing way back with libav masquerading as ffmpeg.

How dramatic. I'll ask you as well: any proof for those colorful pictures you're drawing? Or are the people advocating for Rust a convenient target to vent other, very likely completely unrelated, frustrations? I'm very happy to work with multiple programming languages without getting religious about any of them. They all have drawbacks, Rust included of course. However, just my mere skepticism about the existence of…

As another data point, I have gone through enough flame wars, incl. the usual ones, and Rust.

There's certainly a fanatic group of Rust developers who really want to eradicate C and C++ from the people's knowledge and all codebases in this universe, so far so openly hating the developers and designers of the said languages.

Same was (or still is) true for some LLVM/clang people w.r.t. GCC.

This is why I use neither.

I'm always happy to discuss PLT and merits of programming languages with neutral parties, even in lively fashion, but when open-mindedness gets thrown out of the window, I do leave the room.

These kinds of healthy discussions will benefit both parties. Hubris, ego, closed-mindedness and fanaticism won't.

Related: What Killed Smalltalk Could Kill Ruby, Too: https://www.youtube.com/watch?v=YX3iRjKj7C0

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#218

Post by pdimitar »

bayindirh wrote: post #217
pdimitar wrote: post #215

Earlier quoted context omitted.

How dramatic. I'll ask you as well: any proof for those colorful pictures you're drawing? Or are the people advocating for Rust a convenient target to vent other, very likely completely unrelated, frustrations? I'm very happy to work with multiple programming languages without getting religious about any of them. They all have drawbacks, Rust included of course. However, just my mere skepticism about the existence of…

As another data point, I have gone through enough flame wars, incl. the usual ones, and Rust. There's certainly a fanatic group of Rust developers who really want to eradicate C and C++ from the people's knowledge and all codebases in this universe , so far so openly hating the developers and designers of the said languages. Same was (or still is) true for some LLVM/clang people w.r.t. GCC. This is why I use neither.…

Well, I don't see them in HN is what I am saying. Obviously not scanning 24/7 but every time I enter an HN thread where Rust is even loosely mentioned, I brace for the inevitable bullies imagining they are victims. And this thread is exactly the same, sadly.

I am genuinely curious where this fanatic group is. Where are you witnessing them?

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#219

Post by pdimitar »

overfeed wrote: post #216
pdimitar wrote: post #201

Earlier quoted context omitted.

I agree, absolutely. Hence my adjacent thought that maybe all this should just be thrown away and we should invent an FS with ACID semantics. I'm all for gradual improvements but at one point and on we should zoom even further out and pick our battles well.

> maybe all this should just be thrown away and we should invent an FS with ACID semantics. You're describing WinFS, which looked into and ultimately abandoned Microsoft 20 years ago. I'm sure other groups have looked into this as well, but there's no such thing as free lunch. > I'm all for gradual improvements but at one point and on we should zoom even further out and pick our battles well. That sounds a lot like p…

Well, recursively trying to perfect lower layers is what I am advocating for us to not do.

As a guy who prefers to stop and think before coding, to me a lot of the older UNIX / GNU primitives seem broken (like the env vars process inheriting discussion that was here a while ago) and should be completely rethought. I also think people overreact and believe "everything will break". And we have libraries and runtimes that only implement small parts of libc and the deployed apps that use them are running mostly fine for years.

My broader point was: shall we not start breaking away from all this legacy? Must we always rely on corporations to lead the charge?

But yes, I do of course agree with the only 24h a day thing. And likely nobody would want to pay for such a trail-blazing work anyway. Sad world.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#220

Post by bayindirh »

pdimitar wrote: post #218
bayindirh wrote: post #217

Earlier quoted context omitted.

As another data point, I have gone through enough flame wars, incl. the usual ones, and Rust. There's certainly a fanatic group of Rust developers who really want to eradicate C and C++ from the people's knowledge and all codebases in this universe , so far so openly hating the developers and designers of the said languages. Same was (or still is) true for some LLVM/clang people w.r.t. GCC. This is why I use neither.…

Well, I don't see them in HN is what I am saying. Obviously not scanning 24/7 but every time I enter an HN thread where Rust is even loosely mentioned, I brace for the inevitable bullies imagining they are victims. And this thread is exactly the same, sadly. I am genuinely curious where this fanatic group is. Where are you witnessing them?

> I brace for the inevitable bullies imagining they are victims.

As a person who is bullied physically, verbally and emotionally for years, I'd not throw words bully/victim like wrapping paper like that. Moreover, I'd never bully anyone. I'm not that.

> I am genuinely curious where this fanatic group is. Where are you witnessing them?

Discord servers, mailing lists, issue threads, discussions, here and there. They are very vocal and abrasive minority, but it's enough to make me stay away from them. A special-ops group of these people claim that Rust needs no official specification and they can just ad-hoc develop the language and spec as the compiler evolves, as a side-product of compiler itself (i.e. spec is the compiler).

Last time I encountered them as functional programming fanatics in mid 2000s to 2010s. They successfully made me dislike the community so much that I didn't touch any functional programming language to this day.

Make no mistake: My favorite languages have the same fanatics, and I stay away from them, too. For example, C++ fanatics are an interesting bunch. They don't bully other languages, but new C++ developers who doesn't code like them or the way they like.

Maybe one day I'll start writing Rust, after gccrs stabilizes (they're going well) or really start writing lisp, but I'm sure that I'll never ask a question to a mere mortal about programming in either language.

Post reply on HN