Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

D-Link patch doesn’t address all bugs listed in their own security advisory

devttys0.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#41

Post by rpcope1 »

jheriko wrote: post #35
psychometry wrote: post #11

Earlier quoted context omitted.

I don't write C at all but aren't there code analysis tools that catch things like this? Some kind of standard code linting library, maybe?

Yes there are these things, although usually more focused on C++ these days. Compiling C as C++ with a C++ compiler is not a bad idea though... many compilers which will deal with both and tend not to care about pure C very much at all. Modern, extremely popular compilers may not even support C89 features yet... not to mention that lots will allow dangerous things like returning nothing from a function with a non voi…

  Modern, extremely popular compilers may not even support C89 features yet...
Citation needed please. Also, because C is not a true subset of C++, it has seemed that many big C projects will not compile on C++ compilers because of corner cases, so this may be something to watch for. Much of the incompatibility rises from additions in C99.

References: (http://www.geeksforgeeks.org/write-c-program-wont-compiler-c..., http://david.tribble.com/text/cdiffs.htm#C90-vs-CPP98)

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#42

Post by tdicola »

click170 wrote: post #24
shmerl wrote: post #21

It's better to stick with OpenWRT or DD-WRT.

Care to share your opinion of why that is? Have you compared Tomato? What problems or deficiencies did you identify? More detail would be helpful.

Isn't Tomato way out of date? Wikipedia shows the last stable release was almost 5 years ago, and the website shows no dates on its releases (not a good sign). I ran Tomato for a long time and loved it, but I just got too nervous running such old software as the gateway to my network. Ended up upgrading to a cheap TP-Link router, switching to the latest and greatest OpenWRT release, and haven't had any complaints at all.

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#45

Post by spitfire »

wlesieutre wrote: post #15
Havoc wrote: post #8

I've just accepted that residential routers are full of assorted orifices (security holes, backdoors & holes in functionality). Then again I'm not hiding anything dubious - if I was I'd install a firewall box asap. (And yes I know the "nothing to hide" slippery slope etc argument)

I'm guessing that Apple's are better than average, since they have two versions (the built in HD on a time capsule doesn't make it appreciably different) and maintain them for long periods between upgrades. Asus/Netgear/D-Link/etc follow the "If we don't release an 802.11ac router every week, we won't get enough press releases out!" model, and their firmware suffers as a result. I'm not touching those unless I can wi…

Apple's routers are based on VxWorks. So if you trust VxWorks' networking, then you can trust Apples routers.

Personally I trust VxWorks over some patchwork router of the week by the usual vendors. It's used in many safety critical/medical applications, including the mars rovers.

The downside being that VxWorks has very low resource requirements, so some vendors use them to cut resources. Hence, You'd better be happy with the factory provided configuration because you can't flash them.

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#46

Post by ramidarigaz »

tdicola wrote: post #42
click170 wrote: post #24

Earlier quoted context omitted.

Care to share your opinion of why that is? Have you compared Tomato? What problems or deficiencies did you identify? More detail would be helpful.

Isn't Tomato way out of date? Wikipedia shows the last stable release was almost 5 years ago, and the website shows no dates on its releases (not a good sign). I ran Tomato for a long time and loved it, but I just got too nervous running such old software as the gateway to my network. Ended up upgrading to a cheap TP-Link router, switching to the latest and greatest OpenWRT release, and haven't had any complaints at…

There are forks of Tomato that have been updated much more recently. I'm running the "Toastman" build of Tomato.

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#47

Post by [deleted] »

jheriko wrote: post #32

this guy clearly has a passion for security. d-link could do well by firing whatever uncaring 9-to-5 programmers they have and hiring him. part of the problem is that people with this kind of passion and skill are few and far between... is very rare that good people want to work for a company like d-link on something like drivers or router software.

[deleted]

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#48

Post by userbinator »

comex wrote: post #12
carey wrote: post #2

I guess this is a reminder that writing secure C is actually really, really hard.

Writing completely secure C is hard, but this code is littered with extremely basic bugs like unchecked sprintf and not sanitizing arguments to system. Like, it's a basic rule that you should use snprintf instead of sprintf, possibly with exceptions for cases where you're absolutely sure the result fits in the provided buffer, and in this case there is sprintf everywhere and no checks on the input size whatsoever.

I wonder where this "length blindness" comes from, since it certainly leads to a lot of vulnerabilities. Are these programmers who started with a higher-level language than C, one with dynamically sized strings that automatically expand? Do they even know how big the buffer is, or how long the input string could conceivably be? Did they ever consider the case where the input is very, very long?

A funny analogy I've heard is "programmers who don't know the size of their buffers are like drivers who don't know the size of their cars."

Re: D-Link patch doesn’t address all bugs listed in their own security advisory

#50

Post by tdicola »

ramidarigaz wrote: post #46
tdicola wrote: post #42

Earlier quoted context omitted.

Isn't Tomato way out of date? Wikipedia shows the last stable release was almost 5 years ago, and the website shows no dates on its releases (not a good sign). I ran Tomato for a long time and loved it, but I just got too nervous running such old software as the gateway to my network. Ended up upgrading to a cheap TP-Link router, switching to the latest and greatest OpenWRT release, and haven't had any complaints at…

There are forks of Tomato that have been updated much more recently. I'm running the "Toastman" build of Tomato.

Ah, I wonder why doesn't the original project just fold up and point people at the currently maintained version. I'd still be very nervous about trusting my network to a random fork of mostly unmaintained software. At least with OpenWRT there's a very clear view into the (quite active) development, roadmaps to next releases, etc: https://dev.openwrt.org/roadmap
Post reply on HN