CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq • Hacker News Board

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#241

Post by pdimitar » Thu, May 14, 2026, 11:06 AM UTC

Rexxar wrote: post #240

pdimitar wrote: post #237

Earlier quoted context omitted.

Which part of the comment comes off as fanatic to you? I'd disagree with that poster that you can write 100% security bug free code just like that. > There is comment like this everywhere, if you don't see them it's just that you don't want to see them. Can you discuss productively without attacks? Mine was, and still is, a question of genuine curiosity. And the only "fanatic" thing in your linked comment is a bogus…

> Which part of the comment comes off as fanatic to you? I didn't use the word 'fanatic' neither the previous comment you were responded too. > Can you discuss productively without attacks? So you thing someone telling you "look a little harder" is a "personal attack" ? After I took some time to give you a link you ask for ? > I'm not seeing fanaticism. You are the only one using this word in this discussion.

> So you thing someone telling you "look a little harder" is a "personal attack" ? After I took some time to give you a link you ask for ?

If you are taking the time to find a link then understand that your effort can be for naught if you could not resist to insert "if you don't see them it's just that you don't want to see them". What's your imagined ideal outcome when you comment... this, exactly?

Advice: just put the link and skip snarky commentary. Trying to emotionally load your message does not move discussions forward. It puts them in a corner.

> You are the only one using this word in this discussion.

OK, fair -- then I want to hear what words you'd use. Apart from the guy claiming an imaginary "all security bugs will be fixed" which I already said I disagree with, are there other criticisms?

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#242

Post by ExoticPearTree » Thu, May 14, 2026, 11:11 AM UTC

LtWorf wrote: post #233

ExoticPearTree wrote: post #138

Earlier quoted context omitted.

About a decade ago I switched to Ubuntu LTS because of Debian’s “policy?” of having pretty old packages in “stable” and a long release cycles. Nowadays, even with Ubuntu’s two year or so release cycle I have to use 3rd party packages to have up to date software (PHP being one) and not some version from three years ago. We no longer live in a world (with few exceptions) where running a 3-5 year old distribution (still…

I am running debian oldstable on two rpi-based appliances i built at home. They have been working fine for several years. I'll have to update them because eventually security updates will stop. That means that the python code on them no longer works on current python versions, C++ needs some tweaks because some library changed API. Better to do these things every few years than every 6 months for no reason whatsoever…

> That means that the python code on them no longer works on current python versions, C++ needs some tweaks because some library changed API.

And this is why you update often, to keep up with the programming language ecosystem too. I have seen way too many times software unmaintained for years and then when it was actually time to upgrade it would take much more time to bring it to current framework versions than it would have taken if it was updated regularly throughout the years.

And I was not referring to hobby projects you do at home.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#243

Post by Rexxar » Thu, May 14, 2026, 11:21 AM UTC

pdimitar wrote: post #241

Rexxar wrote: post #240

Earlier quoted context omitted.

> Which part of the comment comes off as fanatic to you? I didn't use the word 'fanatic' neither the previous comment you were responded too. > Can you discuss productively without attacks? So you thing someone telling you "look a little harder" is a "personal attack" ? After I took some time to give you a link you ask for ? > I'm not seeing fanaticism. You are the only one using this word in this discussion.

> So you thing someone telling you "look a little harder" is a "personal attack" ? After I took some time to give you a link you ask for ? If you are taking the time to find a link then understand that your effort can be for naught if you could not resist to insert "if you don't see them it's just that you don't want to see them". What's your imagined ideal outcome when you comment... this , exactly? Advice: just put…

> What's your imagined ideal outcome when you comment... this, exactly?

That you take more time to search yourself before asking other to do it.

> Advice: just put the link and skip snarky commentary

As usual, the one requesting compliance to other is often the worst offender.

> Apart from the guy claiming an imaginary "all security bugs will be fixed" which I already said I disagree

That was exactly the point of the 'bluedragon1221' initial comment you were responded to. So finally you agree ?

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#244

Post by PunchyHamster » Thu, May 14, 2026, 2:33 PM UTC

dang wrote: post #230

PunchyHamster wrote: post #168

Earlier quoted context omitted.

[flagged]

Could you please stop breaking the site guidelines? We've already asked you once. https://news.ycombinator.com/newsguidelines.html

Sorry, I got carried away, the whole blind trust in AI tools gets me wound up a bit too fast, I'll try to be better.

> We've already asked you once.

there are no notifications of any kind about that or the fact the comment has been flagged so I genuinely didn't notice previous one and only noticed this after I noticed rate limiting.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#245

Post by jerf » Thu, May 14, 2026, 4:14 PM UTC

ok123456 wrote: post #208

jerf wrote: post #202

Earlier quoted context omitted.

The initial release of dnsmasq was in 2001. The list of viable languages for a high-performance network server at the time was still not all that long. Erlang wasn't on it. Too big a performance hit, too much opaque runtime that may not have been stable at the time, too few contributors, big dependency footprint of stuff most things wouldn't have installed. (When I used Erlang for a production system in more like the…

Ocaml was fine in 2001.

"Too few contributors".

I was a language explorer and I think I hadn't heard of Ocaml by then. Even if you built the best dnsmasq project ever in Ocaml nobody would have heard of it or known how to build it.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#246

Post by LtWorf » Thu, May 14, 2026, 4:44 PM UTC

ExoticPearTree wrote: post #242

LtWorf wrote: post #233

Earlier quoted context omitted.

I am running debian oldstable on two rpi-based appliances i built at home. They have been working fine for several years. I'll have to update them because eventually security updates will stop. That means that the python code on them no longer works on current python versions, C++ needs some tweaks because some library changed API. Better to do these things every few years than every 6 months for no reason whatsoever…

> That means that the python code on them no longer works on current python versions, C++ needs some tweaks because some library changed API. And this is why you update often, to keep up with the programming language ecosystem too. I have seen way too many times software unmaintained for years and then when it was actually time to upgrade it would take much more time to bring it to current framework versions than it…

> And this is why you update often

Updating often would mean waste time every year rather than every 6 years. Do we agree that 6 > 1?

At work they pay me so I'm there no matter what, but it's still a cost for the company to have me do that rather than something useful.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#247

Post by empath75 » Thu, May 14, 2026, 7:08 PM UTC

amiga386 wrote: post #235

empath75 wrote: post #211

Earlier quoted context omitted.

They aren't the same kinds of problems, though.

They really are, though. Security is all-encompassing, including not just programming languages, libraries, programs, but also systems, humans and their processes. Don't forget physical security either. There are no silver bullets, and if the Rust Hype Squad told you there were and all you had to do was buy their product, they were just bamboozling you to push adoption of their pet language. Write in whichever langua…

If you have a pick proof lock, that is better than an easily picked lock, even if someone can still kick your down down, or if you forget to lock it.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#248

Post by strenholme » Thu, May 14, 2026, 10:09 PM UTC

asddubs wrote: post #212

strenholme wrote: post #116

Earlier quoted context omitted.

Thank you for your concern. I fixed CVE-2014-5461 for Lunacy back in 2021: https://github.com/samboy/lunacy/commit/4de84e044c1219b06744... This is discussed here: https://samboy.github.io/MaraDNS/webpage/security.html#CVE-2... In addition, I have done other security hardening with Lunacy compared to Lua 5.1: https://samboy.github.io/MaraDNS/webpage/lunacy/ Now, I should probably explain why I’m using Lua 5.1 instead…

Why is Lua 5.1 the most popular version?

Very good question. I can tell you why I chose Lua 5.1 for MaraDNS:

• Lua 5.1 is smaller than Lua 5.4

• Lua 5.1 is LuaJIT compatible; Lua 5.4/5.5 isn’t as compatible

LuaJIT is a version of Lua 5.1 which is an incredibly fast scripting language because it, in real time, compiles Lua 5.1 code in to native instructions. The only wart LuaJIT has is that its RISC-V port is incomplete, but that will undoubtedly change as RISC-V slowly gets more popular.

The other reason to stick to Lua5.1 is because Lua changes its syntax between versions; e.g. bitwise operations in Lua 5.4 are very different than how they are done in Lua5.1, to the point it’s difficult to make a polyglot library which can do bitwise operations in both Lua 5.1 and Lua 5.4. I am of the opinion Lua 5.3 should had been named Lua 6.0 for the simple reason that having native integers in Lua is a pretty significant backwards compatibility breaking change.

Since Lua (well, Lunacy) is the only tool in MaraDNS which isn’t standardized (e.g. MaraDNS uses only POSIX-comatible shell scripts, it uses “make” because that’s a standardized tool with multiple implementations, C is also a standard with multiple implementations, etc.), sticking to Lua5.1 allows me to use a version of Lua with multiple implementations and, as such, is informally standardized.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#249

Post by megous » Thu, May 14, 2026, 10:56 PM UTC

ok123456 wrote: post #206

user3939382 wrote: post #174

Earlier quoted context omitted.

Maybe the problem is the way we think of dynamic memory. “Oh I don’t know what my maximum size for this is going to be, everything has to be dynamic” Is that really true? Is it really the end of the world for programs to declare maximum acceptable sizes for their inputs, and after that error out or use a ring buffer? If sizes were known you could design around that when using them. Your ram bank is finite, why is eve…

This is exactly how people thought before 1995. Then everyone started "smashing the stack for fun and profit." In the end, you're trading one set of bugs (dynamic memory bugs and hard to reliably exploit) for another (overflow and easy to reliably exploit).

Yeah, you still have to check for the limits, not just declare them. Then have fun smashing anything.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#250

Post by BLKNSLVR » Fri, May 15, 2026, 4:12 AM UTC

romaniitedomum wrote: post #144

BLKNSLVR wrote: post #137

Earlier quoted context omitted.

For a number of reasons, I feel that the only way we got here was via some kind of infinite improbability drive. (mostly unrelated to topic at hand though)

> For a number of reasons, I feel that the only way we got here was via some kind of infinite improbability drive. Oh very much so! In my mind, it seems that someone must have figured out what the universe was for, and now it's been replaced with something even more bizarre and inexplicable.

"Oh, I see you've discovered subatomic particles... here, have some quantum phenomena, see how long that keeps you busy"