6 ms·

Would Fil-C have prevented the first or third?

by samtheprogram 11mo ago

lotharcable 11mo ago
[flagged]
- jlokier 11mo ago
  One of the use-cases of Fil-C is to prevent security issues in old C code that's much older than Fil-C itself.
  - hulitu 11mo ago
    You mean i can compile an old program with Fil-C and my executable will be free of security issues ?
    - jlokier 10mo ago
      Obviously not, Fil-C doesn't prevent or claim to prevent all security issues in modern code either. But the issues Fil-C prevents, it prevents in very old programs compiled with it , if they compile, just as much as current programs. At compile time, certain patterns that are accepted in standard C are rejected by Fil-C, and the source code has to be changed if you still want to compile the program. At run time, Fil-C prevents memory-related security issues by reliably detecting invalid memory reads and writes that are usually part of an attack and producing deterministic behaviour, sometimes terminating the program, instead of letting the attacker take advantage of undefined behaviour that happens to compile to something the attacker can use. Both of those features work just as well with very old C programs as current ones.
- embedding-shape 11mo ago
  > Probably not seeing how the code for at least the 3rd was written in 1994, some 30 years before Fil-C existed. How is this possibly the most charitable reading of parents comment, and honestly, do you think that's what they meant? You can't read that in some other way, where maybe parent wasn't actually asking about time traveling but something else?
  - lotharcable 11mo ago
    Yes it was bit uncharitable, but I couldn't resist based on the way he phrased it. It was just a joke. "Preventing" the vulnerability would indeed require going back to 1994. Since it is a vulnerability that has existed in every display server released since then.
    - deleted 11mo ago
      [deleted]
    - sevg 11mo ago
      From HN guidelines: > Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. Perhaps next time, resist the urge :)
    - samtheprogram 11mo ago
      I meant it in the sense of continuing to run old C code like X.org in a safer way without unnecessary rewrites to memory safe languages. These vulnerabilities, like this one that's been in the wild as you say for 30 years uncaught, will continue to be found. Something like Fil-C is really useful in that context. I also said "would it have" -- I don't really care about timeline. Obviously Fil-C is a recent development, that doesn't make the question I asked any less interesting.
DonHopkins 11mo ago
[flagged]
easterncalculus 11mo ago
[flagged]
- pizlonator 11mo ago
  > Fil-C doesn't provably prevent anything. It does. I have lots of documentation to show exactly how and why. > It is a hobby project by a dilettante. Wow
- spookie 11mo ago
  > It is a hobby project by a dilettante. You could say the same about thousands of open source projects on which trillion dollar companies depend on. Maybe these kind souls deserve more respect, buddy.
pizlonator 11mo ago
By my reading, it would have prevented all of them.

Would Fil-C have prevented the first or third?

lotharcable 11mo ago

[flagged]

jlokier 11mo ago
One of the use-cases of Fil-C is to prevent security issues in old C code that's much older than Fil-C itself.
- hulitu 11mo ago
  You mean i can compile an old program with Fil-C and my executable will be free of security issues ?
  - jlokier 10mo ago
    Obviously not, Fil-C doesn't prevent or claim to prevent all security issues in modern code either. But the issues Fil-C prevents, it prevents in very old programs compiled with it , if they compile, just as much as current programs. At compile time, certain patterns that are accepted in standard C are rejected by Fil-C, and the source code has to be changed if you still want to compile the program. At run time, Fil-C prevents memory-related security issues by reliably detecting invalid memory reads and writes that are usually part of an attack and producing deterministic behaviour, sometimes terminating the program, instead of letting the attacker take advantage of undefined behaviour that happens to compile to something the attacker can use. Both of those features work just as well with very old C programs as current ones.
embedding-shape 11mo ago
> Probably not seeing how the code for at least the 3rd was written in 1994, some 30 years before Fil-C existed. How is this possibly the most charitable reading of parents comment, and honestly, do you think that's what they meant? You can't read that in some other way, where maybe parent wasn't actually asking about time traveling but something else?
- lotharcable 11mo ago
  Yes it was bit uncharitable, but I couldn't resist based on the way he phrased it. It was just a joke. "Preventing" the vulnerability would indeed require going back to 1994. Since it is a vulnerability that has existed in every display server released since then.
  - deleted 11mo ago
    [deleted]
  - sevg 11mo ago
    From HN guidelines: > Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. Perhaps next time, resist the urge :)
  - samtheprogram 11mo ago
    I meant it in the sense of continuing to run old C code like X.org in a safer way without unnecessary rewrites to memory safe languages. These vulnerabilities, like this one that's been in the wild as you say for 30 years uncaught, will continue to be found. Something like Fil-C is really useful in that context. I also said "would it have" -- I don't really care about timeline. Obviously Fil-C is a recent development, that doesn't make the question I asked any less interesting.

DonHopkins 11mo ago

[flagged]

easterncalculus 11mo ago

[flagged]

pizlonator 11mo ago
> Fil-C doesn't provably prevent anything. It does. I have lots of documentation to show exactly how and why. > It is a hobby project by a dilettante. Wow
spookie 11mo ago
> It is a hobby project by a dilettante. You could say the same about thousands of open source projects on which trillion dollar companies depend on. Maybe these kind souls deserve more respect, buddy.

pizlonator 11mo ago

By my reading, it would have prevented all of them.