Repeat after me: Rust is a machine that turns security incidents into downtime incidents
Uncategorized
10
Posts
4
Posters
10
Views
-
Repeat after me: Rust is a machine that turns security incidents into downtime incidents
-
Repeat after me: Rust is a machine that turns security incidents into downtime incidents
@mcc@mastodon.social the scary thing about this framing is that it rather highlights the fact that security issues don't tend to have (short term) cash flow implications, while downtime incidents do.
-
Repeat after me: Rust is a machine that turns security incidents into downtime incidents
@mcc isn't a DoS vulnerability (which boils down to "downtime") a type of security incident?
-
@mcc isn't a DoS vulnerability (which boils down to "downtime") a type of security incident?
@whitequark *thinks* Making sure I understand the question. You're suggesting someone will find a endpoint tickle that in mediocre C++ code would have resulted in a security incident and in mediocre Rust results in a program halt, and then call this endpoint tickle repeatedly as a DOS?
-
@whitequark *thinks* Making sure I understand the question. You're suggesting someone will find a endpoint tickle that in mediocre C++ code would have resulted in a security incident and in mediocre Rust results in a program halt, and then call this endpoint tickle repeatedly as a DOS?
@mcc @whitequark an example would be an out-of-bounds access that is benign in the actual compiled binary (e.g if due to luck it always returns zero, which is harmless in the context), which is reasonably common. so in that case you're escalating a code issue, that has no security relevance in the actual product, to a DoS which does.
-
@mcc @whitequark an example would be an out-of-bounds access that is benign in the actual compiled binary (e.g if due to luck it always returns zero, which is harmless in the context), which is reasonably common. so in that case you're escalating a code issue, that has no security relevance in the actual product, to a DoS which does.
@dotstdy @whitequark "i.e. due to luck it always returns zero"
I do not believe in this sort of luck. In my experience, this sort of "luck" has a tendency to evaporate on events like ABI changes or compiler upgrades.
-
@dotstdy @whitequark "i.e. due to luck it always returns zero"
I do not believe in this sort of luck. In my experience, this sort of "luck" has a tendency to evaporate on events like ABI changes or compiler upgrades.
@mcc @whitequark right, and I'm not suggesting it's a good security posture. but you are turning potentially benign issues into a denial of service CVE, in that case.
-
@mcc @whitequark right, and I'm not suggesting it's a good security posture. but you are turning potentially benign issues into a denial of service CVE, in that case.
@dotstdy @whitequark I decline to recognize "potentially benign" as a category
-
undefined oblomov@sociale.network shared this topic on
-
@dotstdy @whitequark I decline to recognize "potentially benign" as a category
@mcc @whitequark "not exploitable" is probably a better category anyway. issues which cannot be leveraged into a compromise.
-
@mcc @whitequark "not exploitable" is probably a better category anyway. issues which cannot be leveraged into a compromise.
@mcc @whitequark btw for a fun example of DoS being an "actual" compromise, you can consider matchmaking in video games. If you're losing and you have a way to kill the game server, you can trigger your denial of service to take out the game server as soon as it looks like you're losing. voila: 100% win-rate matchmaking exploit! (plus any kind of fail-open system can be bypassed with a DoS)
Gli ultimi otto messaggi ricevuti dalla Federazione
-
Proteggere i civili in Palestina
La Campagna chiamata FAZ3A (DARE FORZA), promossa e coordinata in Italia da AssoPace Palestina, alla quale hanno aderito diverse associazioni e movimenti, dei quali attivi Pax-Christi un Ponte per, Cospe e Cultura è libertà, ha visto a partire dal 2024 la presenza di più di 60 volontari italiani.
-
@adnan his, unfortunately...
-
@filippodb @sandropisano @spettacoli che dire? A me non è piaciuto neppure Pulp Fiction per lo stesso motivo. Girato da dio (10/10) fottendosene del resto. Eh sì, anche lì la colonna sonora era una bomba
-
@fucinafibonacci @spettacoli A me era piaciuto molto, certo non è un filmone.
La scena che mi ricordo di più, che mi è rimasta impressa tantissimo è quella della morte del bambino nella topaia dove si facevano.
Quelle urla mi sono arrivate all'anima.
-
@johannab@cosocial.ca oof! Are there no labs with lower waiting times? There's one near me that runs really really efficiently, and they power through their queue like no tomorrow, so I'm luckily able to just show up.
-
@sandropisano @fucinafibonacci @spettacoli no ma dai film imprescindibile degli anni 90 insieme a Pulp Fiction.
Non a caso entrambi con colonne sonore strepitose, ah che decennio per la musica!
A mio avviso il regista è stato molto sopravvalutato al tempo.
-
Dammit. My calendar runner over . And yet. YET. I still managed to miss a bloodwork appointment because for some reason despite all the hoops to jump through in scheduling with life labs, they managed to send no actual appointment invite, no reminders, and I received no SMS despite signing up for one.
-
@sandropisano @spettacoli non so. Mi ricordo qualche scena ma nulla più. A parte la colonna sonora clamorosa
