I'm very surprised this hasn't been done a decade ago.

So what's the lesson here? Aggressively remove old features, as you suggest? Rewrite everything every few years? Software has become way too complex to closely audit everything forever...

It is very educative to read about security models on Multitics, ClearPath, System 360/370, OS/400 among many other similar systems, their attack vectors, and what we ended up getting by having winner takes it all with UNIX based systems.

This year we celebrated 30 years of Morris worm.

Wow. That was one hell of a night. Melted down our university computer labs, packed with desperate undergrads trying to complete and turn in their projects before midnight deadline...

How did admins manage to disinfect servers? It should have been a hell of fun for them, provided it was the first pandemic ever.

Hard reboot with email server disabled.

Shellshock comes to mind.

https://en.wikipedia.org/wiki/Shellshock_(software_bug)

Is there some advantage to LHS-first that I can't think of?

LHS first: JavaScript, Java, Go, C#, Swift, PHP, Ruby

RHS first: C++, Python, Rust

I ran this sort of code for all of them:

    def lhs(): print "LHS"; return 0
    def rhs(): print "RHS"; return 0
    a = [0]
    a[lhs()] = rhs()

If I remember rightly, there is the example:

    a = {-1, -1}
    x = 0
    a[++x] = x
    print(a[0] + " " + a[1])

I always love (read sarcasm) to see awesome code, such as:

    z = a & b > c | d

    z = a > b ? c < d ? e : f : g ? h : i

And I think he's agreeing with you, he's just sarcastic.

C does not support his first example. The standard states that the behavior is undefined.

You're probably not wrong, but I specifically remember there was something you could do in order to trick the compiler to allow modification on the left hand side to happen. It could possibly be by having two variable names referencing the same variable - for example.

Besides, the whole point was that it's usually not clever "trying to be clever". It just creates confusion. I don't personally believe the majority of people need to test the entire C spec to it's absolute boundary. A subset serves most people perfectly well.

That's stylistically ugly but not hard to predict; at some point I had it beaten into my head that ternaries are always at the bottom of the single-character operator precedence stack (I really hope all languages stick to that). I'd expect most people to know this.

> z = a & b > c | d

That is harder to predict. I wouldn't expect most people to know this one without looking up a precedence list.

Also there is none of the code golf in there that you have just given as an example.

To expand your example a bit:

  class ShoutyContainer:
      def __setitem__(self, index, value):
          print("Assignment")
  
  def lhs(): print("LHS")
  def rhs(): print("RHS")
  a = ShoutyContainer()
  a[lhs()] = rhs()

  RHS
  LHS
  Assignment

You might call this code snippet analogous:

    class ShoutyNumber:
        def __init__(self, n):
            self.n = n
            print(f'Created {self.n}')
    
        def __add__(self, other):
            print(f'Added with {self.n}')
            return self.n + other.n
    
    ShoutyNumber(1) + ShoutyNumber(2)

    Created 1
    Created 2
    Added with 1

I did not check C++ but for C, according to ISO/IEC 9899:1999 section 6.5.16 paragraph 4 on the semantics of the assignment operator: "The order of evaluation of the operands is unspecified."

  t-order.c:10:8: warning: unsequenced modification and access to 'x' [-Wunsequenced]
    foo[x++] = x;

Think of lisp But then lisp require parentheses

Think of j but the strange right hand side then fork/train.

It is hard for this simple thing. Even = and =: get Python dictator for life resigned.

Just hard

The problem here, in any case, isn't the order of evaluation. It's that the array bound check is done at the wrong time.

0 - https://golang.org/ref/spec#Assignments 1 - https://golang.org/ref/spec#Order_of_evaluation

In places like Australia and America, if you have a group of people and you’re going round them (e.g. reading in turns or playing various card games), you’d be more likely to go clockwise from on top rather than counter-clockwise.

But in India, they naturally go counter-clockwise from on top rather than clockwise, and I once saw someone playing a game of hearts on a phone there, and it was going counter-clockwise.

Localisation definitely entails more than just translating strings. Layout and functionality changes can be involved.

Dealing is done either clockwise or counterclockwise. If this is omitted from the rules, then it should be assumed to be:

* clockwise for games from North America, North and West Europe and Russia; * counterclockwise for South and East Europe and Asia, also for Swiss games and all Tarot games.

[1] https://www.pagat.com/mech.html

For better or worse left-to-right has "won" in programming-land and I fully agree with alangpierce that it's the natural choice for evaluation order as well. We read left-to-right and the computer should as well. That's one of the main problems I have with Python. Evaluating right-to-left just feels like being contrarian.

That’s a reason it matters which one is evaluated first, but not a reason to evaluate the RHS first.

It's been a while, however, so I might be remembering wrong (or indeed have misunderstood).

There's even claims it's the fifth most popular language out there today. https://visualstudiomagazine.com/articles/2018/12/17/tiobe-v... Though there's not a lot of other parties who agree with that, on one hand, on the other hand, a shockingly large number of developers do not work in Silicon Valley, and a lot of those developers aren't using the latest JavaScript frameworks for their day-to-day jobs.

Internet development can't just be for people with expensive cs degrees.

I'm not alone! I know multiple coding languages but for fun coding (i.e. I'm not being paid to do it) I fallback to VB.Net as I just don't have to think about it, it just flows from my fingers. Once it's an EXE it's no different from C# and as no-one else has to support my code, who cares that it's in VB.Net. I actually don't understand the hate that VB.Net gets. I think maybe people are just biased based on their knowledge of bad VB code from the VB6 and earlier days.

I'm also a huge fan of ASP. It's small, fast, and super simple to deploy onto any Windows server. If you are just writing a small web based tool for end users that's easy for people to maintain, then ASP is still definitely the way to go for Windows Web servers. By comparison, I've recently converted a few ASP tools to PHP that run on the same spec of hardware (under debian, not Windows) and PHP is definitely slower than ASP.

I know a few folks with mediocre high school degrees that are quite comfortable with command line tools, there's no clear divide saying that rich folks -> CLI, poor folks - > GUIs :)

[0]: https://en.wikipedia.org/wiki/Visual_InterDev

I’m teaching them a bit of a Python as well, but I’m impressed with the material they’re doing at school, it’s all good stuff even if the language is a bit clunky. Apparently they will be using Java for the International Baccalaureate in a few years.

[0]: https://en.wikipedia.org/wiki/Comparison_of_C_Sharp_and_Visu...

[1]: https://docs.microsoft.com/en-us/dotnet/visual-basic/languag...

Having said that I know there are concerns that by focusing on 'real' computer science the course has swung too far away from everyday practical computing skills. Personally I think schools should have a bias towards putting weight on the academic end of the vocational-academic spectrum.

I've avoided pushing Python too hard, they have enough on their plates learning VB, but I have dipped into it with them to show how it does some things differently. I don't want to make them feel resentful about learning VB, that wouldn't be constructive, so I'm learning VB along with them. I do think it's useful to understand what things are pretty fundamental, and which things can vary meaningfully between languages though.

When I did secondary school "technology" which was the overseeing subject, we used BBC basic and 6502 assembly (some of us anyway!) to drive CNC equipment and Lego and spent half of the time with a soldering iron in hand and etching PCBs and stuff. In business studies, a wholly separate subject at the time, we learned how to use spreadsheets, word processors, write letters etc on RiscOS which had just rolled out about then.

I think the education now is abysmal in comparison. Why? A weird reason. None of the technology I learned about then is relevant now. 6502 assembly is dead, BBC BASIC is dead, RiscOS is dead, all the software packages are dead, China makes my PCBs etc. The education it gave me was a mental model of computing and how to approach problems with self sufficiency.

I feel a lot of technology platforms now, including .Net (something I have been using since day one), remove all self sufficiency from you and abstract so much away that it's harmful. I see many younger staff at companies I have worked for who's education has left them with so many gaps that self sufficient problem solving is impossible.

My eldest just did a test where one of the questions was to describe the fetch and execute cycle, so they do cover low level concepts in Comp Sci GCSE.

PCBs and integrated circuits is in GCSE Electronics. Robots and control systems I'm not sure about but they have that stuff and a 3D printer and laser cutter in the Design and Technology lab. I'd have been all over that stuff in my day, but my girls prefer to spend their time in the fully equipped soundproofed music studio practicing 7 Nation Army with their rock band after school. Kids these days! And this at a public school, albeit a really good one.

EDIT: To anyone who didn't get it, XML literals are used like this:

  Dim myContact = <contact><%= p.Name %></contact>
  Dim allContacts = <contacts><%= From c in db.contacts Select <contact><%= c.Name %></contact> %></contacts>

https://blogs.msdn.microsoft.com/ericlippert/tag/vbscript/

To give one example, that is somewhat relevant here because it describes one of the biggest misfeatures of the language - default properties - that is used in the exploit:

https://blogs.msdn.microsoft.com/ericlippert/2005/08/30/vbsc...

    Function DoSomething(name As String) As String
    End Function

For example, all variables in VBS are Variants, you can't declare things as explicit types, say strings or integers. If you need to instantiate classes residing in external COM libraries you need to use the CreateObject() built-in and specify that class's "ProgID" e.g.

    Set thinger = CreateObject("MyLib.Thingy")

    Dim thinger As MyLib.Thingy

And I know what you mean, regardless of what flavor it was I've had to some pretty crazy stuff using VB for Access, Excel and Outlook. Once you show something small and helpful to someone you wrote in VB they think they can automate the whole office with it. Sometimes it works, sometimes not but even when it worked it was always kind of brittle and I found myself have to code around a lot of exceptions which was pretty darn tedious.

All in all I don't think VB.net is too terrible but I would not be sorry to see a lot of legacy VB just quietly disappear. I feel like in 20 - 30 years though it will be the new COBOL given the amount of internal business systems that were implemented using it in the 90's and 2000's.

And nowadays powershell seems a great replacement.

[1] of course Windows wasn't meant for tinkerers but for users/customers, developping was for the MSDN side of things, for which you'd agree to pay because you'd sell your creations I guess

Moving data dumps onto and from SFTPs.

Emptying outlook mailboxes and storing their content so our SSIS/SSAS services can use it.

Stuff like that. We could use other things I suppose but, and it is slowly getting replaced, but VBScript is the only language everyone knows, from the IT technician to the developers and that had been really valuable to us.

Bugs will of course happen, but failure to fuzz products from companies that employ tens of thousands of people seems inexcusable.

These big, old systems are full of crashes. Many of them have been triggered and investigated before, and determined not to be a security vulnerability, and so left as they are. If you fuzz these systems, you might find a lot more false positives than real exploitable vulnerabilities. It might be even worse than that, with the false positives being so many that they get in the way of the fuzzer actually discovering new issues.

If these were newer projects, it might make sense to really clean the codebase up and fix every crash. That would make debugging tools more useful, and it would avoid future cases where some compiler update turns your "harmless" crash into an exploit. But in these legacy projects, that sort of cleanup would be very expensive, and many of the devs with the expertise to do a proper job of it have long since moved on. It really might not make economic sense to invest that much in cleanup, even if Microsoft has fully internalized the cost of vulnerabilities to their users.

Fuzzing scripting languages is particularly complicated because the languages themselves have infinite state. The more complicated the Fuzzer the more coverage it has, but even writing a bespoke language specific Fuzzer is about as complicated as creating the language itself.

Sadly we are still quite far from the ideal way.

For that we need more escalations on company lawsuits so that it actually becomes more professional.

How leaks can become RCE.

Did similar exploits happen in JavaScript?

I guess some lisps might be simple but I wouldn't call Common Lisp simple!