Hacker News new | past | comments | ask | show | jobs | submit login

Sure pal, in an imaginary world where:

Apache/nginx don't exist,

Chrome/V8 don't exist,

Firefox doesn't exist,

GCC/Clang don't exist,

MySQL doesn't exist,

TensorFlow doesn't exist,

VLC doesn't exist,

and the list goes on and on ...




every single one of those has had exploits


Did I say they don't?

All software has bugs.

Is this supposed to be news?


Problem with memory corruption as a bug is that unlike most classes of bug, memory corruption allows remote code execution. (see return oriented programming for the basic version, block oriented programming for the more complex version that bypasses most (all?) mitigation strategies) There are other types of bug that allow remote code execution like this, such as SQL or command-line injection, but those can be solved with better libraries.* However, memory management requires a strong enough type system in the language.

* Sorta, for command-line injection you have to know the way the command you are using processes flags and environmental variables in order to know that the filtering you are doing will work. It is absolutely better to use a library instead if you can get away with it.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: