But what about buffer overflows? Buffers overflow when a fixed size buffer is allocated, some data is copied to the buffer and the idiot who wrote the code didn't check to see if the data was too big for the buffer!
Researchers have found memory corruption flaws in both Daniel J. Bernstein and Wietse Venema's code. You want to try this "de-myth-ification" thing again?
You can be a phd mathematician and still do arithmetic wrong. And for my next trick I'll argue the semantics and usage of "idiot" in the quoted passage (exercise left for reader).
You can also apparently be two world-class experts at secure C programming and do this arithmetic wrong. But don't worry, you won't make those same mistakes! Only idiots make those mistakes!
If you aren't deliberately trying to miss the point, TFA claimed "only idiots make buffer overflow error" and the OP is implying it's not just the idiots, but very smart people(look up the names) who make buffer overflow errors as well.
> It is a simple rule. Never trust user input, the issue has been known for decades and everybody should be aware of it by now.
It's a simple rule. Don't write buggy code. The issue has been known for decades and everybody should be aware of it by now.
/s
I am trying to find the buffer overflow in DJB's code. I am more interested in the fact if it was a simple error(give too long an input and it goes kaboom), or a complicated one. My intuition is it is the complicated kind. DJB is known to actively use his own implementation of stdlib and strings which are coded from scratch to be secure than the standard counterparts.
Here's a chance for you to improve your standpoint; I'd recommend taking two minutes aside, typing both names into Google and reading a bit about both people first. You might learn something ;)
They are both smart mathematicians, but if you trust user code and don't check for conditions that are that well known, or have set up some automatic system to catch these issues (ala GCCs automatic warning if you use gets()) then yes, you are an idiot.
If you get owned by something that isn't well known, by a bug in the CPU, by a corrupt compiler, by a cross site script attack ten years ago, fine, but not something that everybody should know is dangerous.
Comments
But what about buffer overflows? Buffers overflow when a fixed size buffer is allocated, some data is copied to the buffer and the idiot who wrote the code didn't check to see if the data was too big for the buffer!
Researchers have found memory corruption flaws in both Daniel J. Bernstein and Wietse Venema's code. You want to try this "de-myth-ification" thing again?
You can be a phd mathematician and still do arithmetic wrong. And for my next trick I'll argue the semantics and usage of "idiot" in the quoted passage (exercise left for reader).
You can also apparently be two world-class experts at secure C programming and do this arithmetic wrong. But don't worry, you won't make those same mistakes! Only idiots make those mistakes!
Only one of those sets of flaws is significant.
Why? These two people are clearly idiots.
It is a simple rule. Never trust user input, the issue has been known for decades and everybody should be aware of it by now.
> Why? These two people are clearly idiots.
If you aren't deliberately trying to miss the point, TFA claimed "only idiots make buffer overflow error" and the OP is implying it's not just the idiots, but very smart people(look up the names) who make buffer overflow errors as well.
> It is a simple rule. Never trust user input, the issue has been known for decades and everybody should be aware of it by now.
It's a simple rule. Don't write buggy code. The issue has been known for decades and everybody should be aware of it by now.
/s
I am trying to find the buffer overflow in DJB's code. I am more interested in the fact if it was a simple error(give too long an input and it goes kaboom), or a complicated one. My intuition is it is the complicated kind. DJB is known to actively use his own implementation of stdlib and strings which are coded from scratch to be secure than the standard counterparts.
Your post's parent post is a joke.
How do you know that? I see no indication that it is a joke.
Now that he replied again I think I might have been wrong.
Why? These two people are clearly idiots.
Here's a chance for you to improve your standpoint; I'd recommend taking two minutes aside, typing both names into Google and reading a bit about both people first. You might learn something ;)
They are both smart mathematicians, but if you trust user code and don't check for conditions that are that well known, or have set up some automatic system to catch these issues (ala GCCs automatic warning if you use gets()) then yes, you are an idiot.
If you get owned by something that isn't well known, by a bug in the CPU, by a corrupt compiler, by a cross site script attack ten years ago, fine, but not something that everybody should know is dangerous.
You did look into the actual bug that tripped up djb? It's a bit more complex than you seem to think.
The parent was joking.
There are many idiots who would write that without joking though. Absent the /s sarcasm tag, we don't know.