[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1906151433090.1813@freddy.simplesystems.org>
Date: Sat, 15 Jun 2019 14:41:28 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs:
OSS-Fuzz
On Sat, 15 Jun 2019, Alex Gaynor wrote:
>
> I think you're quite right that the central challenge here is the mismatch
> between how Linux distributions operate and what their claims/people's
> expectations are.
Within four years, most users will encounter updated software which
includes the fixes, assuming that an available developer did produce a
fix.
If you are interested in improving the software, I suggest rolling up
your sleeves and getting involved with implementing fixes. Indeed,
only a small fraction of involved people are working on implementing
fixes.
> PS: I'd be remiss if I didn't at least mention that basically all the bug
> classes we're discussing are induced by C/C++'s memory unsafety and better
> programming language prevent them outright.
The "better" programming languages may prevent some of these problems
due to not allowing direct access to memory, but they introduce
new/different types of problems which can also be serious. Indeed
some popular languages like Python, Perl, or Javascript seem more
dangerous than C/C++ programs.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
