Ban C language

Just in, 11 year old bug in Linux kernel just got patched by SUSE:
suse.com/support/kb/doc?id=7018645

It's a privilege escalation bug thanks to C's lack of security concept. In the current DCCP implementation an skb for a DCCP_PKT_REQUEST
packet is forcibly freed via __kfree_skb in dccp_rcv_state_process if
dccp_v6_conn_request successfully returns [3].

However, if IPV6_RECVPKTINFO is set on a socket, the address of the
skb is saved to ireq->pktopts and the ref count for skb is incremented
in dccp_v6_conn_request [4], so skb is still in use. Nevertheless, it
still gets freed in dccp_rcv_state_process.

The fix is to call consume_skb, which accounts for skb->users,
instead of doing goto discard and therefore calling __kfree_skb.

To exploit this double-free, it can be turned into a use-after-free:

// The first free:
kfree(dccp_skb)
// Another object allocated on the same place as dccp_skb:
some_object = kmalloc()
// The second free, effectively frees some_object
kfree(dccp_skb)

As this point we have a use-after-free on some_object. An attacker can
control what object that would be and overwrite it's content with
arbitrary data by using some of the kernel heap spraying techniques.
If the overwritten object has any triggerable function pointers, an
attacker gets to execute arbitrary code within the kernel.

See github.com/torvalds/linux/commit/5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4


How many times has C proven to be an old relic unfit for modern secure computing. OpenSSL's heartbleed, Grub2's Password exploit (the 29 key bypass), Shellshock -- all originate from one root of problem:
"C"


C is the reason why we still have shitty backdoors.
C is the reason why we cannot utilize multiple cores efficiently.
C is the reason why our programs continue to reveal security exploits after decades.
C holds back technology advancement to the 80's .

Other urls found in this thread:

seclists.org/oss-sec/2017/q1/471
doc.rust-lang.org/book/inline-assembly.html
twitter.com/NSFWRedditGif

source seclists.org/oss-sec/2017/q1/471

>all originate from one root of problem
>shitty programming
fuck off op

You know realize that the critical crypto lib you're using to keep your privacy safe from the surveillance state as well as criminals relies on a language so unsafe that even experts of the language frequently make critical mistakes while writing it.

>C was a mistake
- Dennis Ritchie (1941 - 2011)

Linus is 10 times better programmer than a local fizzbuzzer like you, user.

C was a mistake

t. Ken Thompson, the creator of Golang

What the fuck did you just fucking say about me, you little bitch? I’ll have you know I graduated top of my class in the Logic Gates, and I’ve been involved in numerous secret raids on Telegraph, and I have over 300 confirmed cisco certifications. I am trained in gorilla patching and I’m the top MOVer in the entire ASM forces. You are nothing to me but just another pointer. I will wipe you the fuck out with double precision the likes of which has never been seen before on this Board, mark my fucking words. You think you can get away with saying that shit to me over the Internet? Think again, fucker. As we speak I am contacting my secret network of neckbeards across the USA and your IP is being traced right now so you better prepare for the storm, maggot. The storm that wipes out the pathetic little thing you call your life. You’re fucking dead, kid. I can be anywhere, anytime, and I can kill -9 you in over seven hundred ways, and that’s just with my bare shell. Not only am I extensively trained in api hooking, but I have access to the entire arsenal of the Intel® 64 and IA-32 Architectures Software Developer Manuals and I will use it to its full extent to wipe your miserable ass off the face of the continent, you little shit. If only you could have known what unholy retribution your little “clever” comment was about to bring down upon you, maybe you would have held your fucking Linus. But you couldn’t, you didn’t, and now you’re paying the price, you goddamn idiot. I will shit fury all over you and you will drown in it. You’re fucking read, kiddo.

A modern gc implementation would be great.

Hack me famalam.

Sperglord of the day. Post fizzbuzz.

There has been a lot of these exploits in the Linux kernel nowadays, why is that?

I remember the dirtyc0w that appeared a couple of months ago, that was a funny one...

but, what would replace C?

So better rewrite the kernel in C++ or Java?

>why is that?
It's becoming pretty lucrative.

Rust soon(tm)

Rust isn't the answer, you fucking dirty Rust commie.

>but, what would replace C?
Haskell.

linux is becoming popular, so expect viruses like its windows98

Rust never™

R U S T
U
S
T

Rus IS the answer, you fucking degenerate redneck

>the answer, you fucking degenerate
Russian will replace C

Rust is a new Sup Forums meme or what? i wasnt here for two months and boom, rust everywhere,..

>There has been a lot of these exploits in the Linux kernel nowadays, why is that?
Now that Linux has gotten traction, the spotlight is on Linux.

Now, people are sarting to realize how shitty and unsafe C is, don't get me wrong. Linus and his core co devs are genius programmers. But not even those people are able to defend C's retardation

rust is mozilla's retarded child right?

...

This is the proof of HN and r/programming come here too.

...

OP here, most of the times I am in lwn

Go. Maybe JS and Python for userland stuff.

Go for userland
Rust for platform

Rust is the future.

Use redox then.

>A language with GC
>Replace C

i think there is a high chance of JS being everywhere, that shit is going too far, i saw even a complete backend written in JS

if unix kernel hackers can't write error free c nobody can

Fork OpenBSD with Rust. That'd be the most secure OS ever possible.

Rust and only Rust

look at that Rust™ hype, i cant wait that e-joke dies...

Name one (1) programming language that offers the same safeties as Rust that could have a chance of replacing C.

You are the kind of retro hipster faggot that likes to pretend that he likes music from the 90's

It is kind of sad to see the state of C but everyone knew it was going to come to this point. Most people learn C now only to keep programs afloat and to exploit C programs. Actually the only real reason for learning C now is to learn how to exploit it.

Rust is pretty much the future. Nothing else can really touch it in terms of how much further ahead it is of the competition.

if i get a windows patch everytime, that someone hype Rust...

Hindi no good. Sup Forums only English.

Somebody needs to rewrite Linux kernel in Go or something.

>GC in the kernel

>He thinks kernel programming can be safe

>Ban bad programmers

>It's a privilege escalation bug thanks to the authors' lack of security concept.

FTFY

>>Ban bad programmers
>Linus
>Bad programmer
Show me your fizzbuzz

How would RUST exactly be bug free in writing a kernel?
What is the benefit of it?

>C is the reason why we still have shitty backdoors.
>C is the reason why we cannot utilize multiple cores efficiently.
>C is the reason why our programs continue to reveal security exploits after decades.
>C holds back technology advancement to the 80's .
if you are going to troll at least try harder

Trying to convert opinions into facts? Trump administration surely has a position open for people like you

>only real reason for learning C now is to learn how to exploit it.
Maybe, but the chance to get an actual job is a good thing.

>Rust is pretty much the future.

X is the future, Y is obsolete. Also the shitty LLVM and the lack of tools makes it harder to spread in the industry.

Read OP

Dumb tramp fag fuck off

If everyone coded in C for phone devices then we wouldn't need more RAM than in PCs to just run that android crap system.

>get an actual job
Learn Java

If Linux wrote this code, that proves he has no idea about DCCP protocol.

OP doesn't show how would RUST protect against double free.

*JavaScript

You sure do :^^)

These

no, I have no idea about DCCP.
good false equivalent tho, really shows your smarts.

>no, I have no idea about DCCP.
And yet you comment on LInus' knowledge

Because C is a hipster shit like Rust, that used by nobody aside some memer. Sure.

> You are stupid because you made a typo, I feel so superior now

Pajeet please. Learn English.

if you wanna go for HW or for low-level proggraming, then you shoud go for C...

Rust*

itt rust plebs who don't get laid and can't into C try to force retarded meme onto C sex gods top kek five star good stuff

so in Rust you can't make mistakes?

node?

I completely agree. There're also people who mentioned Haskell in this thread.

It's way harder than C to make mistakes

you mean that (you) mentoned haskell?

Great argument, but landed in the ebin.

This will trigger the rusty autismo. In the past i tried rust, but i have yet to see a stable and well optimized program written in it. F# have higher chance to be mainstream and ada is safer, but need low level assperger.

This comment shows what /dtp/-posters actually are.

don't be afraid to fail, be afraid not to try. making mistakes is how you learn. humans can't do error free anything. fuck your rust

Rust guarantees close to zero chance of data race

Can this anti-C shilling stop? C is here to stay and there is nothing you cucks can do about it.

Posting in the "Ban C language" general thread.

This is what I don't understand, how is it harder to make mistakes in RUST?

It's easy to make mistakes in JAVA, it's easy to make mistakes in C++ and it's easy to do so in C, but in RUST it's harder?

>muh safe place XD
Kill yourself faggot

u calling me a racist?

May be a compiler generates more errors to prevent shitposters to compile their bad code.

The point is that a bug is not the language its fault but the programmer. If Linus made that error then yes, he fucked up. He's just a human being and this is why FOSS is important.

Rust is a meme now

For as long as we use descendants of Unix, i.e. Linux and BSD, C is here to stay. Honestly we could really use a new modern OS but I don't see it happening any time soon.

Haskell and Go are also memes.

but isn't this possible with GCC to turn on all the minor bugs on compiler too?

Yes this is why Rust is more safe as the compiler is smart to do more thorough checks

There are some memory safety issues that no C compiler can detect

example: dangling pointers

I don't know, I'm not a Rust programmer, I have alt conservative views on programming languages.

There're tons of workarounds, smart pointers etc, no one uses this shit in C. People choose C because they want the closest code to native asm without bells and whistles.

You misunderstand, it's not like rust restricts you from making mistakes. It _teaches_ you to not make mistakes.

Oh boy here we go again,

We need to atleast translate userland products in Rust. Can't wait for the C meme to finally die

>workarounds
And Rust has built in support for 10 more safety checks

If you want inline assembly, Rust will definately let you do that

You can start porting today.

I'm actually trying to port neo-vim to Rust.

Good luck!

but what if I want to write ASM code is easy to read format, you know. what C was created to do.

Motivation is, using the existing Vim legacy to create a really user friendly IDE

>what if I want to write ASM code is easy to read format
pretty easy to me
doc.rust-lang.org/book/inline-assembly.html