Ub-canaries: Programs that try to make compilers exploit undefined behavior | Hacker News Reader

Ub-canaries: Programs that try to make compilers exploit undefined behavior

github.com

24 pointsjsnell7 comments

I'm not sure I understand the point of this project. Is it to detect if new versions of compilers change what happens when you run into undefined behaviour?

I also don't understand the mindset behind the usage of the word "exploit" in this. Compilers can do whatever they want when dealing with undefined behaviour - whatever they do might be nice, might be horrible, but you cannot rely on it. They aren't exploiting anything - if anything, I'd argue that relying on compiler-specific behaviour is exploiting implementation details.

I'm not trying to be critical here, I really don't understand the motivation behind this project.

"exploit" => "cyber security" => "hey look, i can do cyber and you can hire me"

just a way to market oneself I guess here by using the hyperbole of "exploit". makes sense if you want to join the knee-jerk infosec industry.

The owner of the GitHub account is not looking for a job.

The owner of the GitHub account, on the other hand, speaks English and had heard the word “exploit” outside the context of infosec posturing. Definition appended for your perusal.

The phrase “exploit undefined behavior”, in the context of compilation, has been used for years, as a Google search would have told you.

___________

exploit

verb |ɪkˈsplɔɪt, ɛk-| [ with obj. ]

1 make full use of and derive benefit from (a resource): 500 companies sprang up to exploit this new technology.

2 make use of (a situation) in a way considered unfair or underhand: the company was exploiting a legal loophole. • benefit unfairly from the work of (someone), typically by overworking or underpaying them: women are exploited in the workplace.

Yeah, a guy with a username of 'balls2you' knows more about writing and computers than a professor of computer science (which the author is).

I assume that exploit is used in the sense of "takes advantage of" (eg. clang exploits signed overflow UB to omit this loop check)

It's useful to know which compilers are taking advantage of which UB, so when you're troubleshooting a bug that only occurs in one compiler and not another you can drill down and reason about which compiler uses which UB and perhaps more easily find the bug.

> I also don't understand the mindset behind the usage of the word "exploit" in this.

See the dictionary definition a couple of comments down. It is the perfect word to use because the two points of view (“the compiler is right!” and “I don't understand, everyone has always been doing this and suddenly programs stop working, compilers are unfair”) are represented as meanings 1 and 2.

The point is to know when compiler makers have decided to optimize (rightly, as you point out is one point of view) undefined behavior that is used in the wild by programmers that assume that a specific behavior will ensue. Undefined behavior used in OpenSSL, NTPD, libotr. The canary helps detect that bad things are about to happen.

http://www.mail-archive.com/openssl-dev@openssl.org/msg38690...

http://www.mail-archive.com/openssl-dev%40openssl.org/msg385...

http://trust-in-soft.com/dangling-pointer-indeterminate/

http://sourcecodebrowser.com/libotr/3.2.0/b64_8c_source.html...

That makes much more sense, I appreciate you replying.

Reply on news.ycombinator.com