site banner

Friday Fun Thread for January 31, 2025

Be advised: this thread is not for serious in-depth discussion of weighty topics (we have a link for that), this thread is not for anything Culture War related. This thread is for Fun. You got jokes? Share 'em. You got silly questions? Ask 'em.

2
Jump in the discussion.

No email address required.

I think that argument just isn't supported by the evidence of 40 years of computers more or less working just fine.

Just looking at the last 40 days of computers is enough to support "less" rather than "more". My favorite from quickly skimming reports from the last month or two would probably be Rsync contains six vulnerabilities: "When combined, the first two vulnerabilities (heap buffer overflow and information leak) allow a client to execute arbitrary code on a device that has an Rsync server running. The client requires only anonymous read-access to the server, such as public mirrors. Additionally, attackers can take control of a malicious server and read/write arbitrary files of any connected client. Sensitive data, such as SSH keys, can be extracted, and malicious code can be executed by overwriting files such as /.bashrc or /.popt."

The vulnerabilities are "present within versions 3.3.0 and below" of software that has been heavily used for nearly 30 years now. I'll agree with you that this is "thanks to the internet", but can we really call it "suddenly" now that the internet is four decades old, especially for cases like this where the software was specifically written to make use of the internet? I'm sympathetic with (and a perpetrator of) mistakes of the form "Joe writes a program that reads a file, and expects it to be used by very clever people reading only files that they and their personally-known friends/coworkers created, but then it becomes more popular and now every nescient email user who double-clicks strange attachments is one JoesInstaller away from putting a backdoor on their computer." But for web browsers, mass-market software, servers listening for arbitrary TCP connections, etc., surely there's a better solution to e.g. heap buffer overflows than expecting every software author to finally Git Gud.