Hacker News Reader

Comment by pakwa | Hacker News Reader

Tech has essentially created this problem. Can’t tech fix it?

Not to sound like a broken record but…. This was yet another memory management bug that would have been prevented if using a memory safe language

On a brighter note, apple is currently in the process of converting almost all iMessage components to Swift for this reason. I'm sure it is taking many engineering hours, and image parsers/open source libraries like this are the most difficult to convert.

Just one component, the one that parses incoming messages. The problem here is that it parsed the message and decided to pass it to ImageIO, which is written in C++.

Is there a link that mentions this ? The bug was in the ImageIO/Core Graphics layer so are they re-writing all Core Graphics components in Swift ?

Yeah, something tells me that they're not going to be rewriting an image decoder to have a runtime...

Let’s hope they make swift work of it

1000 FTEs thwart the world’s nation state hackers?

I’m only a few more CVE’s from advocating C++ and Objective(ly)-C(rap) proponents be subject to registration and public humiliation whenever the (inevitable) next issue occurs.

I get it, legacy crap has momentum and you can’t ignore that. What’s not ok is the mountain of people who pretend that’s not a problem.

Hence why having legal liability is so relevant for making this a reality.

The industry will only really change when pushed to do so.

Or memory safe hardware.

Construction has essentially created the problem of potholes. Can they fix it?

"The invention of the ship was also the invention of the shipwreck" ― Paul Virilio

Good analogy.

Question here is: can they fix potholes faster than new ones show up?

Seems answer is no for tech. And construction, these days.

It takes an expert to know that there's vulnerability. Whereas construction engineer can "see" the pothole and so they can fix it. Software engineer has to "know from exploits" that there's a vulnerability so they can fix it. It's not far away when OS are written in memory safe languages like Rust.

You mean far away like 1961?

https://en.m.wikipedia.org/wiki/Burroughs_large_systems

Nowadays still being sold to governments that care about security.

https://itupdate.com.au/page/unisys-clearpath-mcp-unsurpasse...

https://www.unisys.com/ms/client-education/course-catalog/cl...

Or maybe 1983?

https://en.m.wikipedia.org/wiki/Rational_R1000

Maybe 1982,

https://news.ycombinator.com/item?id=22375449

Plenty of examples (those are a tiny snippet) on how safe OSes should be written, until there is liability the easiest way will always win.

It's more complex to find security bugs, yes, but I think the analogy stands.

In order for a construction engineer to "see" a pothole, they need to actually know where the pothole is and physically go there.

When you have millions of kilometers of paving across a continental-sized country, like the US or China, for example, this is unfeasible. "Seeing" a pothole isn't so simple as it might give you a first impression...

I think the answer is probably an astounding yes for both, if you think of the trend of vulnerabilities/units of software generated.

The move to a large majority of software being run in a sandboxed environment has drastically reduced this sort of thing.

They surely do, because if I can prove the pothole broke my car, I can sue them, or have my insurance take legal action.

Eventually this will be standard in software as well.

As long as people aren't put in jail for faulty software, it will never be fixed.

Remember Diginotar?

Who knows how many lives were affected in Iran...

Surgeons aren't put in jail for faulty surgery. Wanting this for software is a bit draconian.

Surgeons can be held accountable and can lose their license at least.

That has never happened to software developers.

I think we have vastly different standards on what's reasonable and prudent between software developers and surgeons!

Nope, it can't. As long as you use tech, it's a risk management situation, and a cat and mouse game.

Reply on news.ycombinator.com