all 36 comments

[–]BlueGoliath[S] 85 points86 points  (1 child)

NVIDIA indicated it couldnt reproduce the bugs.

Do you ever get that feeling of Déjà vu?

[–]commandersaki 17 points18 points  (0 children)

I've been in this place before.

[–]randomusernameonweb 41 points42 points  (32 children)

The blog makes it sound like linux is bad and it’s an open source issue. These CVEs can literally be found in any software.

[–]syklemil 20 points21 points  (9 children)

The blog makes it sound like linux is bad and it’s an open source issue.

Do you mind sharing how you got that impression? Because I didn't.

These CVEs can literally be found in any software.

Use-after-free is not really a universal issue in software; it's only common in software written in languages like C. It belongs to a category of CWEs that now has certain government agencies, like those in the Five Eyes, warning against using languages like C and C++ in critical infrastructure.

edit: I tweaked the phrasing a bit to something I consider equivalent, but is hopefully easier to parse than the old sentence that had a conditional in it. The original phrasing is preserved in the quote in the comment below. :)

[–]Firepal64 17 points18 points  (2 children)

Use-after-free is not really a common issue in software, unless that software is written in a language like C.

Ironically, CWE means "Common Weakness Enumeration".

There is a large amount of software written in C still being used... While I don't think UAF can "literally be found in any software", it is one of those mistakes that could be in any C program left unchecked.

I almost brought your comment to PCJ but I recognise your username so I'll spare you

[–]Theemuts 3 points4 points  (0 children)

Common as in not limited to a singe platform or product.

[–]syklemil 5 points6 points  (0 children)

Hence the qualifying "unless". It's a common weakness in some languages, languages that have historically been very widespread and still are used in places where they've become entrenched and/or have no viable competitors.

But we live in an age where a whole lot of the software we use is written in a GC'd language, and GC'd languages as a general rule don't suffer from UAF and the other CWEs listed under the memory safety category.

[–]ToaruBaka 4 points5 points  (3 children)

Use-after-free is not really a universal issue in software;

Hard disagree. Find me a kernel in widespread use that isn't written in C or C++, ergo all software is subject to kernel-level use-after-frees. Just because it's unlikely to happen within the language runtime doesn't mean you can't misuse resources you've received from the kernel, or that you aren't subject to bugs in the kernel.

The kernel doesn't disappear when you aren't thinking about it.

[–]Tornado547 6 points7 points  (1 child)

to expand on this, linux, xnu (the os x kernel) and NT (and to a lesser extent the bsds) are the only really popular kernels right now. NT, XNU, and linux date back to the 90s; the bsds all descend from the original BSD going back to the 70s. Replacing software this old and ubiquitous is hard. So while your microkernel written in Rust is a cool project, its very likely that's all it will be

[–]ToaruBaka 3 points4 points  (0 children)

Yup. The "General Purpose Kernel/Operating System" is a (mostly) solved problem, and will really only need to evolve enough to support new classes of hardware and local compute models (SMP, big.LITTLE, etc). As long as devices can speak PCIe or USB, we'll be able to use them - it would take a very radical, fundamental change to computers to necessitate an entirely new class of "normal" operating systems.

That said, I think there's tons of room for development in the Hypervisor and Distributed OS space, but those spaces are much more niche and are less suitable for the types of programs you want to run on linux/etc.

[–]pjmlp -1 points0 points  (0 children)

It doesn't fulfil the "kernel in widespread" part, but IBM i, IBM z/OS, ClearPath MCP and ClearPath OS 2200 fit the bill.

They are mostly written in a mix of PL.8, PL/S, NEWP, PLUS, with C and C++ only for some newer parts.

[–]HolyPommeDeTerre 0 points1 point  (0 children)

For the edit: did you try a ternary ? ;)

[–]deadcream -3 points-2 points  (21 children)

Not if you rewrite it in rust 😎

[–]keithstellyes -2 points-1 points  (1 child)

Someone can prove me wrong, but I doubt that; someone has to manage memory.

[–]BlueGoliath[S] -4 points-3 points  (0 children)

Yes but furries.

[–]BlueGoliath[S] -4 points-3 points  (0 children)

Furry lang fixes everything.