Hacker News Reader

Comment by oblio | Hacker News Reader

(Future readers can safely ignore the rest of the comment, I was struck by the "did not read the article" disease)

Surprised that software has security flaws? Especially software written in "let-me-use-that-chainsaw-to-trim-the-bushes" C? :)

I know that there will be security flaws in any language, but if there ever was software today that deserved a safer programming language, the init system was it. Or the web browser.

View on HN

Yeah this issue really has nothing to do with C

It's not the logic of hammering my own fingers that is flawed, it is my choice of a hammer!

You can program touch() to create files with 0777 rights in any language, not just C.

Although the specific cause -- (mode_t)-1 -- is something that you can't really do in many languages. So you'd likely have to write 0777 or equivalent explicitly down, making it so much more obvious what a bad idea that is.

It's one part of a cascade of errors. The author(s) defined an opaque MODE_INVALID but wrote code depending on their 'knowledge' of its underlying value. Signed/unsigned confusion is typical of C, though.

The 'fixed' code¹ has the property that calling it to create a file with mode==0 (i.e. no permissions) actually creates one with mode==0644 (i.e. some permissions), which is a wtf r u doin that can't be blamed on C.

¹ https://github.com/systemd/systemd/commit/06eeacb6fe029804f2...

Isn't that what I said?

Yes, but other languages would use optional or special null-like value which cannot be automatically converted into integer.

Reply on news.ycombinator.com