Hacker News Reader

Comment by nynx | Hacker News Reader

This is very impressive, but I’ll be honest, I wouldn’t want to expose any new software written in C to the internet.

Yeah it’s not like the browser you are using, the OS you have installed, or even the firmware of the keyboard you’re typing this on is written in C.

I feel this comment is misguided. Plenty of new code is written in C, particularly in the scientific computing space. If the code in question doesnt do lots memory management and expects the user to provide a memory block to be populated with values, then I see no issues. C code tends to be faster than other implementations even without optimizations. Moreover, lots of interpreted languages have good interoperability with C so a C compiled code can be called in many languages using simple high level interfaces.

Can I ask you why? I mean, I know about memory safety and stuff, but it is that bad?

Yes it is.

Independent researches (Microsoft/Mozilla) showed that around 70% of security vulnerabilities are caused by memory safety bugs. That's one heck of a "memory safety and stuff" :)

Here's one reference: https://msrc-blog.microsoft.com/2019/07/18/we-need-a-safer-s...

"memory safety bugs" sounds pretty broad. What sort of vulnerability doesn't involve memory access?

its “memory safety”, not “accesses memory”

Something like SQL injection is a vulnerability that is not exploiting a memory error.

That reference and the original blog post where 70% was indicated is only dealing with security vulnerabilities in Microsoft's software, not everyone's.

So while other software that isn't Microsoft most certainly has memory safety bugs, this blog doesn't speak for those, only Microsoft's.

The only part that Mozilla is indicated is in reference to Rust.

If one of the largest software companies around can't get memory safety right, it does make a guy start to think that maybe most people should avoid having to handle it if they can.

I don't have a fully developed opinion on that, so I won't try to come up with one on the spot. My comment is purely because I felt the parent left out details about the blog post that should have been pointed out.

Google has done similar research on their codebases and found results in line with Microsoft’s.

I wouldn’t be too worried about a bitcoin node since the whole point is to stay in consensus with the rest of the network

Reply on news.ycombinator.com