Re: Research to Create Automated Buffer Overflow Protection

From	Richard Heathfield <invalid@see.sig.invalid>
Organization	Oration Gains
Subject	Re: Research to Create Automated Buffer Overflow Protection
Newsgroups	comp.programming
References	<db154f8e-0682-46ec-97e0-14b371aa984e@googlegroups.com> <zpww562p925g.1objvtox5oy3s$.dlg@40tude.net>
Message-ID	<4i3Lv.231350$m41.167051@fx34.am4> (permalink)
Date	2014-08-26 18:16 +0100

Show all headers | View raw

Dmitry A. Kazakov wrote:

> On Tue, 26 Aug 2014 09:11:35 -0700 (PDT), Heidi Brayer wrote:
>

<snip>

>> This blog post describes my research on the Secure Coding
>> Initiative in the CERT Division of the Carnegie Mellon University
>> Software Engineering Institute to create automated buffer overflow
>> prevention.
>> 
>> To read more, please follow this link
>> http://blog.sei.cmu.edu/post.cfm/performance-compiler-assisted-memory-
safety-checking-237.
> 
> Would be much more helpful if they researched how to get rid of C, or at
> least, stopped teach students crappy languages and idiotic SW design
> techniques.

The problem is that C is popular even now because it is such a powerful 
language. You can't eliminate stupidity, but by reducing the scope for doing 
stupid things you also reduce the scope for doing clever things. Few people 
like to think of themselves as stupid (whatever the true facts of the 
matter), so they get this idea that they can avoid C's pitfalls whilst 
taking advantage of its power. And some of them, at least, are right.

The only ways to get rid of C, in decreasing order of severity are:

(a) catastrophic global war, pestilence, or famine;
(b) legislation of an alarmingly authoritarian nature;
(c) the provision of an even more powerful language that is even more prone 
to being abused.

If you add bounds-checking to C (which is what we're talking about, really), 
(a) you discover eventually that people have already done it, and (b) 
bounds-checking imposes a performance penalty that at least some people are 
not prepared to tolerate.

Note, too, that even if you consider C to be a "crappy language", that 
doesn't mean that the rest of the world agrees with you. Some consider C to 
be a powerful tool for writing fast programs. Powerful tools often have 
sharp edges. If you cut yourself, that doesn't mean the tool is crappy. It 
may just mean you don't know how to use the tool properly. And filing down 
the edges may leave you without any appropriate tool to use in a particular 
situation.

If you want Ada, you know where to find it.

-- 
Richard Heathfield
Email: rjh at cpax dot org dot uk
"Usenet is a strange place" - dmr 29 July 1999
Sig line 4 vacant - apply within

Thread

Research to Create Automated Buffer Overflow Protection Heidi Brayer <hap1026@gmail.com> - 2014-08-26 09:11 -0700
  Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-26 18:54 +0200
    Re: Research to Create Automated Buffer Overflow Protection Richard Heathfield <invalid@see.sig.invalid> - 2014-08-26 18:16 +0100
      Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-26 19:35 +0200
        Re: Research to Create Automated Buffer Overflow Protection Richard Heathfield <invalid@see.sig.invalid> - 2014-08-26 18:59 +0100
          Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-26 21:26 +0200
            Re: Research to Create Automated Buffer Overflow Protection Richard Heathfield <invalid@see.sig.invalid> - 2014-08-26 20:33 +0100
              Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-26 21:50 +0200
                Re: Research to Create Automated Buffer Overflow Protection Richard Heathfield <invalid@see.sig.invalid> - 2014-08-26 21:41 +0100
                Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-27 10:21 +0200
                Re: Research to Create Automated Buffer Overflow Protection "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-08-27 10:27 +0100
                Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-27 11:51 +0200
        Re: Research to Create Automated Buffer Overflow Protection Melzzzzz <mel@zzzzz.invalid> - 2014-08-26 20:39 +0200
          Re: Research to Create Automated Buffer Overflow Protection "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-08-26 20:13 +0100
          Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-26 21:38 +0200
            Re: Research to Create Automated Buffer Overflow Protection Melzzzzz <mel@zzzzz.com> - 2014-08-26 23:11 +0200
              Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-27 09:50 +0200
                Re: Research to Create Automated Buffer Overflow Protection "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-08-27 10:16 +0100
                Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-27 12:15 +0200
                Re: Research to Create Automated Buffer Overflow Protection Richard Heathfield <invalid@see.sig.invalid> - 2014-08-27 14:40 +0100
            Re: Research to Create Automated Buffer Overflow Protection "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-08-27 10:13 +0100
              Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-27 14:06 +0200
            Re: Research to Create Automated Buffer Overflow Protection "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-08-27 10:32 +0100
              Re: Research to Create Automated Buffer Overflow Protection "Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> - 2014-08-27 12:14 +0200
        Re: Research to Create Automated Buffer Overflow Protection "Chris M. Thomasson" <no@spam.invalid> - 2014-08-26 14:06 -0700
      Re: Research to Create Automated Buffer Overflow Protection Melzzzzz <mel@zzzzz.invalid> - 2014-08-26 20:16 +0200
        Re: Research to Create Automated Buffer Overflow Protection Öö Tiib <ootiib@hot.ee> - 2014-08-30 09:20 -0700
  Re: Research to Create Automated Buffer Overflow Protection Jongware <jongware@no-spam.plz> - 2014-09-15 10:47 +0200
    Re: Research to Create Automated Buffer Overflow Protection Richard Heathfield <invalid@see.sig.invalid> - 2014-09-15 10:46 +0100

csiph-web