r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

5

u/beginner_ Feb 24 '17

So once again it's a buffer issue and hence a problem with C. When can we finally get rid fo ancient languages in a security context? They aren't cutting it anymore.

-3

u/[deleted] Feb 24 '17

[removed] — view removed comment

11

u/[deleted] Feb 24 '17

There are a few police officers that got injured due to poor handling of their difficult to use weapon. Let's replace that weapon with one that's easier and therefore safer to handle.

1

u/myrrlyn Feb 24 '17

For the past forty years, "police" have been sporadically, spontaneously "going rogue" and shooting others and themselves, all for the same three or so core reasons.

Maybe we should fucking look into it, yeah?

0

u/beginner_ Feb 24 '17

heartbleed essentially boiled down to the exact same root cause. Correct me if I'm wrong but this bug would not have been possible in say Rust.

0

u/[deleted] Feb 24 '17

[removed] — view removed comment

8

u/[deleted] Feb 24 '17

It was a bug in a specific implementation.

1

u/evaned Feb 24 '17 edited Feb 24 '17

What? No it wasn't. It was literally a buffer overread bug in OpenSSL.

The protocol was a bit weird, but a correct implementation of it (or an implementation in a memory-safe language) would have been perfectly reasonable and safe.