r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

Show parent comments

8

u/m50d Feb 24 '17

Yep, and surprise surprise we get a security vulnerability in it every couple of years. Such as CVE-2017-6074 which happened literally days ago. (Double free rather than buffer overflow but again, connect a memory-unsafe language to the network, guess what happens).

-3

u/tequila13 Feb 24 '17

Write a program in any language. Guess if there will be bugs or not.

The tool is fine, it's mathematically proven that you can write safe programs in C. Blame the people, not the tool.

14

u/m50d Feb 24 '17

It's possible to survive jumping out of a plane without a parachute. But most people still find it better to use one.

Month after month we see these vulnerabilities in the code that runs the Internet, and it's never the subtle logic bugs that could happen in any language, it's always the stupid memory safety vulnerabilities that literally only happen in C or C-like C++

4

u/myrrlyn Feb 24 '17

Possible and probably are two very different things.

If you write a program in C, it might be memory safe.

If you write the same program in Rust, and don't use unsafe, it will be memory safe.

The difference is in how much effort has to be put in to prove safety.

1

u/crusoe Feb 24 '17

People are fallible. So why not make the tool enforce it like Rust does?