Hacker News new | past | comments | ask | show | jobs | submit login

Sure. The C Standard library relies on 0 terminated strings. The Linux API relies on 0 terminated strings. Every C library I've every used relied on 0 terminated strings for its interface.

So you use a translation layer. Sorry, I just don't like them, but if you're fine putting these on all your interfaces with other libraries, well, what can I say? :-)

> If you want automatic bounds checks, then C is not the language for you.

I would reframe that as: "if you're ok with buffer overflow malware injection, then C is the language for you!" Nobody has yet figured out how to stop that.

The sad thing is it's so fixable with just a minor, compatible change to C.




> I would reframe that as: "if you're ok with buffer overflow malware injection, then C is the language for you!" Nobody has yet figured out how to stop that.

Write manual bound checks and good code in general? Granted you won't be able to catch every vulnerability, but at some point other vectors are so much easier to exploit that you won't have to worry about these anymore.


Oh, of course! Just write good code! Well kiss my grits. I can't believe the solution has been sitting here staring me in the face all this time.

I promise I'll write good code from now on. Scout's honor.


Even John Carmack thinks "writing good code" is impossible: https://youtu.be/I845O57ZSy4?t=1351 ; p


> Write manual bound checks and good code in general?

40 years of C buffer overflows argues that doesn't work.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: