Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

Post reply on HN
Print view View original

231–240 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#231

Post by tosti »

strenholme wrote: post #116
shakna wrote: post #66

Earlier quoted context omitted.

Well, as you bundle Lua 5.1 (as Lunacy), instead of making a library and loading it, and you bundled the 2012 version, you're probably affected by CVE-2014-5461 and others. Lua hasn't been security fix free.

Thank you for your concern. I fixed CVE-2014-5461 for Lunacy back in 2021: https://github.com/samboy/lunacy/commit/4de84e044c1219b06744... This is discussed here: https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2... In addition, I have done other security hardening with Lunacy compared to Lua 5.1: https://samboy.github.io/MaraDNS/webpage/lunacy/ Now, I should probably explain why I’m using Lua 5.1 instead…

I don't think you should take responsibility for bugs. Debugging is the act of removing bugs, so programming is the act of putting them in. Free software, per license, must not come with guarantees because the legal implications of any warranty whatsoever could cripple free software projects. The license of your nice DNS server includes the "as-is" wording for good reason.

That said, it is comendable that you've gone out of your way to hold up your software against very high standards. That kind of quality speaks for itself :)

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#232

Post by LtWorf »

washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

Nice troll fake account :)

And no "good faith" assumption here, since you literally claim debian stable ships broken kernels, according to you nobody should be able to even boot a computer.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#233

Post by LtWorf »

ExoticPearTree wrote: post #138
washingupliquid wrote: post #8

Maybe this is the kick in the ass Debian needs to upgrade the embarrassingly ancient dnsmasq in "stable" because while I can't think of any new features, the latest versions contain many non-CVE bug fixes. But I doubt it, they will lazily backport these patches to create some frankenstein one-off version and be done with it. Before anyone says "tHaT's wHaT sTaBlE iS fOr": they have literally shipped straight-up broke…

About a decade ago I switched to Ubuntu LTS because of Debian’s “policy?” of having pretty old packages in “stable” and a long release cycles. Nowadays, even with Ubuntu’s two year or so release cycle I have to use 3rd party packages to have up to date software (PHP being one) and not some version from three years ago. We no longer live in a world (with few exceptions) where running a 3-5 year old distribution (still…

I am running debian oldstable on two rpi-based appliances i built at home. They have been working fine for several years.

I'll have to update them because eventually security updates will stop. That means that the python code on them no longer works on current python versions, C++ needs some tweaks because some library changed API.

Better to do these things every few years than every 6 months for no reason whatsoever.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#234

Post by LtWorf »

lmm wrote: post #229
LtWorf wrote: post #225

Earlier quoted context omitted.

Yep, let's all use libraries that change API every day instead. That will be more productive.

The only thing worse than changing APIs is never changing APIs. Having to use APIs from 5 years ago sucks .

Having to modify a software every few months when it could be left untouched for 5 years and keep running sucks way more :)

Not every software needs updates, and if it doesn't, just using the new name for the API all the time is useless churn.

I'm starting to appreciate java, where all my software written for java5 still works fine without a single change.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#235

Post by amiga386 »

empath75 wrote: post #211
turpentine wrote: post #155

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=47943499 - 44 CVEs trying to replace coreutils with a greenfield rust rewrite. There's no free lunch.

They aren't the same kinds of problems, though.

They really are, though. Security is all-encompassing, including not just programming languages, libraries, programs, but also systems, humans and their processes. Don't forget physical security either.

There are no silver bullets, and if the Rust Hype Squad told you there were and all you had to do was buy their product, they were just bamboozling you to push adoption of their pet language.

Write in whichever language you like. Including Rust. Including C. Even PHP. You can write secure software if you put your mind to it.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#236

Post by Rexxar »

pdimitar wrote: post #196
bluedragon1221 wrote: post #171

Earlier quoted context omitted.

That is a very pretentious opinion. Dnsmasq is a ubiquitous project, ~14 years old, and has maintainers that are very experienced in c and in the codebase. Telling them to rewrite in a language they are (maybe) unfamiliar with, even with the help of AI, will make these maintainers' experience worthless. People seem to think that rewriting in rust just magically fixes all issues, but that's not how it works (See recen…

> People seem to think that rewriting in rust just magically fixes all issues Citations and links, please.

> Citations and links, please.

"bigiain" comment, in the same discussion is an example: https://news.ycombinator.com/item?id=48120707

There is comment like this everywhere, if you don't see them it's just that you don't want to see them. There are a little less frequent than 5 years ago but still frequent enough in each c, c++ or rust discussions.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#237

Post by pdimitar »

Rexxar wrote: post #236
pdimitar wrote: post #196

Earlier quoted context omitted.

> People seem to think that rewriting in rust just magically fixes all issues Citations and links, please.

> Citations and links, please. "bigiain" comment, in the same discussion is an example: https://news.ycombinator.com/item?id=48120707 There is comment like this everywhere, if you don't see them it's just that you don't want to see them. There are a little less frequent than 5 years ago but still frequent enough in each c, c++ or rust discussions.

Which part of the comment comes off as fanatic to you?

I'd disagree with that poster that you can write 100% security bug free code just like that.

> There is comment like this everywhere, if you don't see them it's just that you don't want to see them.

Can you discuss productively without attacks? Mine was, and still is, a question of genuine curiosity. And the only "fanatic" thing in your linked comment is a bogus 100% claim. I'm not seeing fanaticism.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#238

Post by pdimitar »

kokada wrote: post #227
pdimitar wrote: post #201

Earlier quoted context omitted.

I agree, absolutely. Hence my adjacent thought that maybe all this should just be thrown away and we should invent an FS with ACID semantics. I'm all for gradual improvements but at one point and on we should zoom even further out and pick our battles well.

If we are going so far to only guarantee correctness if we are using a FS that implements ACID semantics, why not just reinvent the whole kernel and remove all footguns, including memory safety? We could have a OS that each syscall to memory allocation can only be done through safe API. Otherwise, it doesn't really make sense. The only reason we have things like Rust and other memory safe languages is because we want…

Why not indeed? It would bring me a lot of hope.

Some time ago I loved the idea of Fuchsia... but then I learned it's made by Google. Sigh.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#239

Post by kokada »

pdimitar wrote: post #238
kokada wrote: post #227

Earlier quoted context omitted.

If we are going so far to only guarantee correctness if we are using a FS that implements ACID semantics, why not just reinvent the whole kernel and remove all footguns, including memory safety? We could have a OS that each syscall to memory allocation can only be done through safe API. Otherwise, it doesn't really make sense. The only reason we have things like Rust and other memory safe languages is because we want…

Why not indeed? It would bring me a lot of hope. Some time ago I loved the idea of Fuchsia... but then I learned it's made by Google. Sigh.

Yes, this is why I am saying your idea of just reinventing the FS doesn't make sense. You don't get neither the wider ecosystem you get by having an OS compatible with e.g., POSIX semantics nor all the benefits you could get if you reinvent the whole OS.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#240

Post by Rexxar »

pdimitar wrote: post #237
Rexxar wrote: post #236

Earlier quoted context omitted.

> Citations and links, please. "bigiain" comment, in the same discussion is an example: https://news.ycombinator.com/item?id=48120707 There is comment like this everywhere, if you don't see them it's just that you don't want to see them. There are a little less frequent than 5 years ago but still frequent enough in each c, c++ or rust discussions.

Which part of the comment comes off as fanatic to you? I'd disagree with that poster that you can write 100% security bug free code just like that. > There is comment like this everywhere, if you don't see them it's just that you don't want to see them. Can you discuss productively without attacks? Mine was, and still is, a question of genuine curiosity. And the only "fanatic" thing in your linked comment is a bogus…

> Which part of the comment comes off as fanatic to you?

I didn't use the word 'fanatic' neither the previous comment you were responded too.

> Can you discuss productively without attacks?

So you thing someone telling you "look a little harder" is a "personal attack" ? After I took some time to give you a link you ask for ?

> I'm not seeing fanaticism.

You are the only one using this word in this discussion.

Post reply on HN