Live data from Hacker News

CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

lists.thekelleys.org.uk

251–256 of 256 posts

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#251

Earlier quoted context omitted.

Why is Lua 5.1 the most popular version?

Very good question. I can tell you why I chose Lua 5.1 for MaraDNS: • Lua 5.1 is smaller than Lua 5.4 • Lua 5.1 is LuaJIT compatible; Lua 5.4/5.5 isn’t as compatible LuaJIT is a version of Lua 5.1 which is an incredibly fast scripting language because it, in real time, compiles Lua 5.1 code in to native instructions. The only wart LuaJIT has is that its RISC-V port is incomplete, but that will undoubtedly change as R…

appreciate the answer!

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#252

Earlier quoted context omitted.

They really are, though. Security is all-encompassing, including not just programming languages, libraries, programs, but also systems, humans and their processes. Don't forget physical security either. There are no silver bullets, and if the Rust Hype Squad told you there were and all you had to do was buy their product, they were just bamboozling you to push adoption of their pet language. Write in whichever langua…

If you have a pick proof lock, that is better than an easily picked lock, even if someone can still kick your down down, or if you forget to lock it.

That's not a great analogy. There are no pick-proof locks (...that are mechanically operated and admit keys; I'm presuming you didn't mean "pick-proof" in that there is no keyhole to pick but is defeated some other way, e.g. a keypad, you meant maximally pick-resistant in contrast to "easily picked")

And honestly? No! If someone can kick your door down, don't waste your money on a super-secure lock, they will just kick your door down. And if you're having your door kicked down on the regular, don't even focus on bolstering the door (they'll either start using power tools or take some other tact like smashing your windows or drilling through the floor or roof). Leave the door open if you like, but move whatever's attracting the attention of intruders somewhere more defensible. Focusing on the securing the wrong thing is also a security flaw!

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#253

Earlier quoted context omitted.

> I brace for the inevitable bullies imagining they are victims. As a person who is bullied physically, verbally and emotionally for years, I'd not throw words bully/victim like wrapping paper like that. Moreover, I'd never bully anyone. I'm not that . > I am genuinely curious where this fanatic group is. Where are you witnessing them? Discord servers, mailing lists, issue threads, discussions, here and there. They a…

> As a person who is bullied physically, verbally and emotionally for years, I'd not throw words bully/victim like wrapping paper like that. Moreover, I'd never bully anyone. I'm not that. I was bullied as well. Knowing karate and aikido helped but not much, those people just hated me for reasons I never quite understood and kept coming in groups even. Some days I wondered whether I'll go back home from school alive.…

> But why avoid Rust itself? Why look down on any rewrite-in-Rust initiatives?

It's not avoiding, but choosing not to work with it, and it boils down to a couple of reasons. First, I don't work with a language which doesn't have a native GCC frontend. This is part due to supporting GCC & Free Software, and part don't liking rugpulls like license changes and whatnot. My personal weight is beyond negligible in changing outcomes of big currents, but at least I have my principles and stick to them. It's worth noting that I'm not "burning inside" to keep this stance. It's natural for me to do this, and I already like and write C++ and I'm somewhat experienced in that preventing race conditions and memory safety, so that keeps me covered. For smaller stuff I like Go these days. It's a goofball of a language which is very performant and excellent for what it's designed for.

I like to have a tool belt covering a wide gamut of scenarios, and what I use most covers all the needs I have. So Rust is interesting, I don't need it for now.

For the rust rewrites, while I'm not against them in principle, rewriting GPL software with MIT and other permissive licenses is against my values, so I don't support any of them. Writing GPL software with Rust is very possible, and I might do that in the future, but currently I have a couple of heavyweight C++ projects I'd rather work on (in the caliber of material simulations running on HPC systems).

> I refuse to feel shame about wanting to learn and absorb other people's expertise.

My reasons for not interacting with communities are very different. I'm not ashamed of failing, doing mistakes or whatnot. The reasons of I'm tired of interacting with rude people who gets their dopamine from putting people down, so I don't want to navigate all the thorns of the people to get a small bit of knowledge from them. Second, I'm relatively good with reading language references and documentation. I can ingest API documentation with ease and work from first principles.

If required, I can fight the good fight in any arena. I just don't see value of doing it for anything and everything.

In short, I'm not that hopeless to play that game. I'll rather die on hills which are worthy of the fight.

> I start with an LLM session

I don't use LLMs because I don't condone how they are trained, and again reading the reference is much better than a chat interface for me.

Hope that helps.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#254

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=47943499 - 44 CVEs trying to replace coreutils with a greenfield rust rewrite. There's no free lunch.

They aren't the same kinds of problems, though.

Ah...these security issues are perfectly cromulent because my shiny new magical beans language let's me screw up in brand new ways, not the old and busted boomer screwups. New is always awesome.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#255
post #160

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=47943499 - 44 CVEs trying to replace coreutils with a greenfield rust rewrite. There's no free lunch.

How many CVEs in coreutils over the years? The project has the advantage of being old enough for them to be fixed. Call me when the rust rewrite has been there that long and still has more CVEs than the GNU counterpart.

> The project has the advantage of being old enough for them to be fixed.

That's exactly the point though - replacing established projects is inherently risky no matter how many safety buzzwords the replacement can cram into its GitHub tags.

Re: CERT is releasing six CVEs for serious security vulnerabilities in dnsmasq

#256

I think this is the breaking point where replacing our code written in C for code written in memory safe languages is becoming urgent. The vast majority of vulnerabilities found recently are directly related to being written in memory unsafe languages, it's very difficult to justify that a DNS/DHCP server can't be written in rust or go and without using unsafe (well, maybe a few unsafe calls are still needed, but the…

Maybe the problem is the way we think of dynamic memory. “Oh I don’t know what my maximum size for this is going to be, everything has to be dynamic” Is that really true? Is it really the end of the world for programs to declare maximum acceptable sizes for their inputs, and after that error out or use a ring buffer? If sizes were known you could design around that when using them. Your ram bank is finite, why is eve…

> Is it really the end of the world for programs to declare maximum acceptable sizes for their inputs, and after that error out

It's supremely annoying when you run into arbitrary limits like that as a user. Often it's like a deliberate expiration date for the software as the world moves on to larger files/etc.

Post reply on HN