> AsmBB is very secure web application, because of the internal design and the reduced dependencies.
There's a lot of value in using well tested dependencies, and even Chuck Norris will have bugs writing complex software in assembly. Especially when doing string manipulation which this project should be doing a lot of.
Surely you mean CPUs will have bugs executing Chuck Norris' impeccable assembly code.
He deal with security threats at the source, by tracking down the hacker and kicking them in the head.
Not just any kicks, but roundhouse kicks of course.
e.g. "AsmBB focuses on security in its design and reduced reliance on dependencies."
OpenSSL, for example, was hit with quite a few serious bugs over the years, and I'd still choose using it than my own SSL implementation. Especially in assembly.
That's the difference between a programmer and a real engineer: an engineer doesn't need any help from dependencies to make his code totally insecure.
First time I hear about technicians writing code.
see jack w. reeves's 'code as design' series, beginning with 'what is software design?' from 01992, for a fuller explanation https://www.developerdotstar.com/mag/articles/reeves_design.... https://www.developerdotstar.com/mag/articles/reeves_origina... https://www.developerdotstar.com/mag/articles/reeves_13years..., and the discussion on wiki https://wiki.c2.com/?TheSourceCodeIsTheDesign=
Unless I totally missed the sarcasm.
not only are they almost never subject to the kinds of security problems we commonly associate with low-level languages like assembly or c (for example, buffer overflows and heap corruption) they also commonly need to run in constant time to prevent timing side-channel information leaks, and while that is not trivial to achieve in any language, it's more feasible in assembly than in c. also, they are commonly a performance bottleneck, and they commonly need kinds of bit manipulations that c is typically slow at, which rewards assembly implementations
openssl in particular contains about 85000 lines of assembly language, mostly embedded in perl files. (it uses perl as a sort of alternative macro assembler)
incidentally those 85000 lines of assembly are about 12% of the total openssl codebase
HTTP is fairly trivial as well; if you're afraid of little things like that, you'll never deliver best-in-class software.
in this case, though, they're linking with sqlite, so all that is out the window
as far as i know, though it's a lot simpler than asmbb, httpdito doesn't have any security holes: http://canonical.org/~kragen/sw/dev3/server.s http://canonical.org/~kragen/sw/dev3/httpdito-readme
as 10000truths points out in https://news.ycombinator.com/item?id=38985198, in assembly you don't have to deal with undefined behavior, and that helps a lot. occasionally you have behavior that varies by implementations, but there's no nasal demons, and in particular you can add two unknown integers without even hitting implementation-defined behavior. and, in theory, you can never guarantee that a c program won't overflow its stack, and i've had this happen in practice on arduino, where it collided with the heap. and signedness bugs (which are commonly security holes; even qmail had one) are plausibly easier to avoid in assembly than in c, though recent compiler versions help with that
Chuck Norris is a martial artist that had an acting career. He got a second wind of fame when he became a meme… Chuck Norris Facts. https://en.wikipedia.org/wiki/Chuck_Norris_facts