Hacker News Reader

Comment by cwyers | Hacker News Reader

> there are simple ways to avoid shooting yourself in the feet with those

A cursory look at the CVE list for any C software in the wild indicates that no, there are not simple ways to avoid shooting yourself in the feet with manual memory management in C. It's _incredibly hard_ even for "elite" programmers who have a lot of incentive to avoid these problems. The counterpoint is that people are probably going to spend less time looking for ways to maliciously use those problems in your C game than they are in the Linux kernel, but there is plenty of potential for even seasoned C coders to engage in bullet-on-foot violence.

View on HN

Yeah, I am not talking about vulnerabilities. I am simply talking about ease of use and avoidance of leaks and crashes.

Writing super secure code is usually not a requirement for gamedev, and I completely agree, this is hard and potentially harder in C than, say, in Rust.

It's a requirement if you do network I/O whether you realize it or not.

In gamedev, we often use UDP for network I/O.

I am far from an expert in security but I've done a bit of reversing/hacking when I was 16 years old (DOS era)

I think this is hard to check for everything, but in my opinion, good security can be achieved with extreme simplicity.

Packets are fixed-size, every fields are manually bound checked and the packet is rejected if anything looks wrong.

That jibes with my knowledge.

But I've seen some real weird stuff before. ;) Folks using variable-length fields and happily just dumping the contents into eval(), all sorts of awful.

Bad code is bad code, in any language.

If a bug in a game's network IO crashes/takes over the whole OS, the security vulnerability is in the OS, not in the game.

No. Security is a full-stack endeavor. At all levels it is incumbent upon software professionals to build secure and resilient systems, any time they're exposed to a network. The OS should backstop your efforts, not replace them.

I disagree. As a user, I want to be able to run weird software without having it impact the rest of my system. Browsers and mobile OSs get this much more right than desktop OSs.

This does not meaningfully follow. What you "want" is orthogonal to the responsibility of the vendors of software.

The OS should protect where it can. So should software, lest your networked game nuke, say, the parts of your home directory to which it has permissions because without those permissions it can't do something it needs to.

This is just defense-in-depth. It's super basic stuff and HN is literally the only place I see people galaxy-braining about the idea that you have an obligation to not write shit code.

I suspect GP's point is that a networked game should be limited in access to only parts of one's home directory relevant for that game (that is: the game's own save data or configuration files or what have you). It is absolutely the job of the operating system to provide that sort of sandboxing/isolation.

Sure. That's great. That also breaks down sometimes, too.

Defense in depth. Write good, sane, secure, fail-closed code when you want to ship that code to other people--or don't write code.

That's not the point. The point is, if you do network I/O, you are processing untrusted packets from the internet. If a carefully crafted set of such packets can trigger, say, a buffer overflow, you're toast.

A first line of defence is authentication. Make sure the packets come from a trusted source (you can MAC each packet for this), so only those trusted sources could possibly trigger the vulnerability.

If the only trusted source is an authoritative server, you might be able to hide that buffer overflow. If your network code is peer to peer however, you have to trust the other players not to run a cheat that takes over your machine… but at least that's not the whole internet.

Vulnerabilities can be used to cause crashes.

In fact, generally a memory safety vulnerability will initially manifest itself as a crash before a more advanced targeted exploit can be used against it.

>Writing super secure code is usually not a requirement for gamedev

Many consoles have been "jailbroken" by making buggy games load specially crafted savegames that ended up in code execution.

That also extends to players downloading innocent-looking maps, savegames, models. etc that exploit bugs and end up in code execution too.

Also if you have an online game then you can have RCE bugs, especially if players are expected to be able to connect to 3rd party servers.

(Not saying I necessarily disagree with you, just a counterpoint)

> Many consoles have been "jailbroken" by making buggy games load specially crafted savegames that ended up in code execution.

That's an argument for using C in gamedev, isn't it? ;)

These are game developers though. On the list of requirements and priorities, I'm sure code safety is right beside commenting code and clean code. Not in a disparaging way. But tight deadlines, crazy expectations and insane work hours doesn't leave much time or energy to worry about it.

Not sure that's a good point. The CVE list for almost any programming language can get you to the conclusion that you can shoot yourself in the feet despite not being as tricky as C.

> A cursory look at the CVE list for any C software in the wild

How can I see that list? I'm interested in comparing languages this way.

Reply on news.ycombinator.com