Hacker News Reader

Counter counter point: SQL injections and buffer overflows now require nearly intentional effort to introduce into a codebase, whereas they used to be the default.

The question is: when we find a common class of vulnerability, what's the best way to deal with it?

View on HN

We find SQLI regularly. We don't find buffer overflows very often! That bug class has been mitigated. It's better to eliminate bug classes, and memory safety is a good idea. But it's a good idea we've had in mainstream software engineering for coming up on 2 decades, and your default assumption about any piece of software should still be that it harbors grave vulnerabilities.

Yes. Buffer overflows were mitigated at the language level. We use languages instead of 'just bytes'.

Buffer overflows are best mitigated at the language level. Other vulnerabilities aren't.

Reply on news.ycombinator.com