Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 15 Jun 2019 14:41:28 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs:
 OSS-Fuzz

On Sat, 15 Jun 2019, Alex Gaynor wrote:
>
> I think you're quite right that the central challenge here is the mismatch
> between how Linux distributions operate and what their claims/people's
> expectations are.

Within four years, most users will encounter updated software which 
includes the fixes, assuming that an available developer did produce a 
fix.

If you are interested in improving the software, I suggest rolling up 
your sleeves and getting involved with implementing fixes.  Indeed, 
only a small fraction of involved people are working on implementing 
fixes.

> PS: I'd be remiss if I didn't at least mention that basically all the bug
> classes we're discussing are induced by C/C++'s memory unsafety and better
> programming language prevent them outright.

The "better" programming languages may prevent some of these problems 
due to not allowing direct access to memory, but they introduce 
new/different types of problems which can also be serious.  Indeed 
some popular languages like Python, Perl, or Javascript seem more 
dangerous than C/C++ programs.

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.