2 comments

  • ori_b 8 hours ago
    OpenBSD has removed the format specifier that makes this possible, for hopefully obvious reasons.
    • josefx 5 hours ago
      Was the thought process: "Anything involving C string handling is fundamentally security hostile, lets fix it by breaking %n!"
      • tom_ 3 hours ago
        It is the only one that actually writes to memory. It's occasionally convenient, but it's also largely unnecessary: the caller can typically make multiple calls to printf, for example, noting the return value for each one. Or use strlen and fputs. And so on.

        The C11 printf_s functions don't support it at all, so it's clearly already on the naughty list even from the standard's perspective.

      • trashb 4 hours ago
        Can you elaborate on the statement "Anything involving C string handling is fundamentally security hostile"?
        • lou1306 2 hours ago
          As soon as you forget (or your adversary manages to delete) an \0 at the end of any string, you may induce buffer overflows, get the application to leak secrets, and so on. Several standard library functions related to strings are prone to timing attacks, or have weird semantics that may expose you to attack. If you roll your own security-related functions (typical example: a scrubber for strings that hold secrets), you need to make sure these do not get optimised away by the compiler.

          There's an awful lot of pitfalls and footguns in there.

          • trashb 12 minutes ago
            I thought you meant a hello world or similar program only handling strings would be fundamentally insecure but rather you mean that it is hard to write secure code with C strings.

            There are indeed a lot of pitfalls and footguns in C in general but I would argue that has more to do with c's memory focused design. I always feel like C strings are a bit of an afterthought but it does confirm well with the C design. Perhaps it is more so a syntax issue where the memory handling of strings is quite abstracted and not very clear to the programmer.

        • draw_down 53 minutes ago
          [dead]
  • gnabgib 4 days ago
    Discussion at the time (181 points, 39 comments) https://news.ycombinator.com/item?id=7389623