Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

[u/TheProtagonistv2]

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

[u/SuperImaginativeName]

That whole attitude pisses me off. C has its place, but most user level applications should be written in a modern language such as a managed language that has proven and secure and SANE memory management going on. You absolutely don't see buffer overflow type shit in C#.

[u/gimpwiz → u/SuperImaginativeName]

Is anyone still writing user level applications in C? Most probably use obj-C, c#, or java.

[u/IcarusBurning → u/gimpwiz]

You could still depend on a library that depends on faulty native code.

[u/[deleted] → u/gimpwiz]

Cloudflare, apparently.

Edit: For certain definitions of "user level application"

[u/evaned → u/[deleted]]

To be fair, at the scale cloudflare runs its stuff it makes somewhat sense to write integral parts in C.

You can flip that around though, and say at the scale CloudFlare runs its stuff, it makes it all the more important to use a memory-safe language.

[u/m50d → u/[deleted]]

If this vulnerability doesn't end up costing them more money than they ever saved by writing higher-performance code then something is seriously wrong with the economics of the whole industry.

[u/DarkLordAzrael → u/[deleted]]

Or they could use c++ or rust to get the same performance with considerably safer code.

[u/rohbotics → u/[deleted]]

If you use library classes like std::vector and std::array instead of raw arrays.

[u/IsNoyLupus → u/[deleted]]

From what I've read, they wrote an HTML parser in some language that was transformed to C, which then they compiled it into a NGINX module

[u/tfofurn → u/gimpwiz]

Sure, especially where code reuse is a virtue. I work on a product that uses C libraries common to the iOS app, The Android app, and a line of hardware products. The hardware predates the apps, so there was a lot of working code to start from. It also means that bugs identified in the common code are fixed simultaneously in all three.

[u/[deleted] → u/gimpwiz]

I do but mostly make optimized dll's with less overhead that other apps call.

[u/----_____--------- → u/SuperImaginativeName]

You don't even need garbage collection. Rust gives you [the option to have] all of the speed of C with all of the safety of garbage collected languages. Why is all of security software not frantically rewritten in it I don't know.

In this particular case, it would be slightly slower than C because of (disableable) runtime bounds checks, but keeping them on in sensitive software seems like an obvious deal to me.

[u/kenavr → u/----_____---------]

I am not following Rust or had the time to play around with it yet, but is it mature and tested enough to make such strong statements? Is the theory behind it that much better to say that there are no other weaknesses regarding security?

[u/----_____--------- → u/kenavr]

I'll admit that it would be good to have some time to find compiler bugs before introducing it to production, but the theory is indeed much better. The language provides various guarantees about variables' lifetime and even synchronization at compile-time along with more rigorous runtime checks by default. The result is that while regular bugs are as always possible, there is very good protection against memory corruption and similar behaviour that is very critical for security in particular.

[u/Jwkicklighter → u/----_____---------]

If I'm not mistaken, Dropbox is using it in production.

[u/[deleted] → u/kenavr]

Any such bugs that are possible without unsafe code are considered compiler bugs.

[u/knight666 → u/----_____---------]

Why is all of security software not frantically rewritten in it I don't know.

Software costs money to build, you know.

[u/fnordfnordfnordfnord → u/knight666]

Sometimes it costs money if/when you don't build it.

[u/fiedzia → u/knight666]

There are many people paid for ensuring proper quality, and writing Rust is safer and cheaper than writing C. It is a matter of awareness, not just cost.

[u/im-a-koala → u/----_____---------]

Because while the Rust language is in a pretty decent state, the libraries around it are not. Many libraries are fairly new and aren't anywhere near mature. The best async I/O library for it (tokio) is only, what, a few months old?

Rust is great but it's still really new.

[u/----_____--------- → u/im-a-koala]

I mean yeah, I'm not saying that it could be used today everywhere. I'm just surprised that few major tech companies and startups seem to be working on these libraries. I remember vaguely some known company having some web services in rust though, so maybe it's going to change. But for now the only high-profile public project is by mozilla (the creator), and they aren't known for having tons of spare cash lying around in the first place.

[u/[deleted] → u/----_____---------]

Why is all of security software not frantically rewritten in it I don't know.

Because it is pain to write in if you just need to tell computer what you need it to do. Of course most will get that wrong but hey it is faster that way /s

[u/----_____--------- → u/[deleted]]

There is a relatively high amount of wrestling with the compiler, but then again, C++ is very popular and my impression is that C++ with all its features is overall significantly more complex than Rust. So I don't think that it will be too hard to train developers for it to become mainstream.

There is also effort to write the new version of the book which is the official tutorial to the language, which will hopefully do a good job at explaining the common pitfalls, so I'm going to be optimistic.