Hacker News Reader

Comment by winter_blue | Hacker News Reader

> ...isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only scratching the surface of the vulnerabilities that still lie in the code

Yup. For example, the Linux code for its relatively new[1] io_uring subsystem was so memory-exploit-ridden that Google disabled it for apps on Android, and entirely on ChromeOS, and their servers[2]. It is insane that this is how easy it has been for a person to break into Linux.

[1] released with kernel version 5.1 which came out in May 2019

[2] in June 2023: https://en.m.wikipedia.org/wiki/Io_uring#Security

View on HN

Only goes to show that C is a broken language and unfit for its purpose in today's day and age

For people downvoting, could you please explain which part of this statement you agree or disagree with?

The design of io_uring has nothing to do with the language the Linux kernel is implemented in. And safer languages really can't provide guarantees when the issue at hand is designing a shared memory cross-executable (kernel⋄userspace) API.

Just having first class slice types, where your pointer is paired with a length, which allows for doing bounds checking automatically is a huge upgrade over C, even if it doesn't solve every other problem.

Security exploits from out of bounds access should not be happening today, bounds checking is a solved problem, and has been solved for decades.

Time to make the point that not even C authors were able to change WG14 mind on the necessity of having fat pointers.

https://www.bell-labs.com/usr/dmr/www/vararray.pdf

That's a pretty interesting paper. Thanks for sharing it. I wonder why Dennis Ritchie, with the weight his name carries, wasn't able to push it into mainstream implementation...

Because once a language is managed by ISO, that doesn't matter, the author gets one vote like everyone else.

So this shows how the majority of WG14 members see security in C.

Kind of crazy we're still using monolithic kernels in 2023. Nothing about `io_uring` needs to happen with elevated privileges.

I would take a large—say, 2-5x—performance hit just to escape these kinds of vulnerabilities.

but isn't the whole point of io_uring that it's more performant?

A 2-5× performance hit is also a 2-5× CO₂ hit, and I wouldn't be willing to let myself or other people take that hit. We're throwing enough heat into the atmosphere already to make cats dance on our portable supercomputers as is.

Reply on news.ycombinator.com