Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

C is far from a non-safe language; it's the language of choice for NASA systems that lives depend on after all.

I'm not sure what you're trying to point out with those links. How is this related to openssl?



Because NASA has used C means this guy writes code for the shuttle?

Read the code. Dig through the commit logs. This is the wrong choice on about every level. The best encryption won't save you when you have code like this.

What did we not learn about OpenSSL?


You're talking complete nonsense. Constructive criticism please.


the only thing I'm seeing from your posts is "I'm a fucking idiot who doesn't understand that C is safer than any interpreted pretend-you're-safe language"


When have you heard of a JavaScript dangling pointer problem? Buffer overrun? Segfault?


The only hope to make Tox less insecure would be to run it under emscripten or http://zerovm.org/


Comparing C to Javascript makes no sense, and Javascript is NOT a safe language. Those issues you mentioned are due to programmer incompetence. Bad programmers will make bad code no matter what language they program in. Security should not rely on a language hand-holding bad programmers.


The classes of problems that one encounters in Ada, Haskell, OCaml, Rust, D or Go are vastly different than in languages w/o memory safety.

Writing secure network code in an non-safe language is something that shouldn't be taken lightly. Given the nature of the commits it is hard to comprehend that this product will ever achieve its stated aims.

It is secure by side effect, not proof.


No one is taking this project lightly and I don't know why you would suggest otherwise. You keep vaguely alluding to "the nature of the commits" but still have yet to give a single concrete example of what you have issue with. I take it that you don't actually know any C and are just repeating what you've read somewhere else.

I have extensive C experience, and I have looked through the code. While there have been plenty of bug fixes in the commit log - as is to be expected for a project of this scope in its pre-alpha/alpha stages - I have not seen anything that resembles a security threat, much less something as serious as the heartbleed bug that you keep bringing up for some reason.

At this point I have to conclude that you're either a troll with too much time on your hands, or being paid to spread FUD.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: