Hacker News Reader

Comment by thallium205 | Hacker News Reader

Pretty much any kernel bug gets a CVE by default now, right?

Is that all there is here? The quantifier "several" did not prepare me for the wall of CVE numbers in this list.

https://docs.kernel.org/process/cve.html states that because almost any kernel bug can potentially compromise system security, the CVE team acts with extreme caution and labels nearly all bug fixes with a CVE

yes because the majority are memory safety issues, and it's automatically assumed that a memory safety bug can lead to a vuln

one again illustrating the importance of encapsulating unsafe behavior. perhaps c should get a __UNSAFE { } block, where memory access is encapsulated and thus most bugs occurring outside of those blocks do not need to be marked as CVEs.

> perhaps c should get a __UNSAFE { } block,

I think the convention for this is at the filesystem level and most programmers use the `.c` suffix to indicate it

in that case we need a block of system memory marked as unsafe so i can run these programs in it encapsulated

perhaps we could call it a sedimentchest?

I think that’s just called “memory”. Encapsulation is your machine.

See xkcd's sandboxing cycle. They exist, they're called processes

cheap shot lol

C has many more ways to trigger undefined behaviour than memory access. If C had unsafe blocks they'd restrict most forms of signed integer arithmetic and shifting, for a start.

No. It's because Greg doesn't like the CVE system and MITRE, the stupidest decision ever, made Greg a CNA, and this is his tantrum that he's been waiting 40 years to throw.

Yes. It looks funny, but it's a nothing burger.

Reply on news.ycombinator.com