university of minnesota today coming out with groundbreaking research that the best C programmers in the world can't tell if you're giving them bad C
maybe C is bad
Conversation
Replying to
I feel like I would have been tricked by this regardless of the programming language literally just on the basis of the authority of "affiliated with the university of minnesota"
4
1
38
yeah this is mostly that they sent a bunch of patches claiming to be fixing issues found by static analysis tools, implying that they knew what they were doing, and coming from a reasonably trustworthy source
--> the patches got fairly little review
3
18
hmm those kinds of patches would also be incredibly tedious to read, which is like a DoS against a human
1
24
yeah, now that they've published and humans are actually looking at them they're going "wow this is obvious trash", just, when they were first submitted they mostly got "alright I'll take your word for it"
like, C has plenty of problems but this isn't really related to them
5
24
They're removing a ton of useful fixes because they can't easily distinguish them from the tiny subset of the commits that were intentionally wrong. It's not accurate that they've easily identified which ones are bad. They're removing many useful fixes resulting in adding bugs.
It has a lot to do with the language. In most statically typed languages, these kinds of mistakes don't give you don't execution vulnerabilities. You would have to very explicitly dynamically load code or use explicitly unsafe APIs which result in scrutiny not otherwise applied.
1
In C, everything is unsafe code. There is nowhere that you cannot get code execution vulnerabilities via a tiny mistake. You're always just about to have one of those vulnerabilities if you make the slightest mistake in the most innocuous code unrelated to access control, etc.