I'm Daniel Stenberg, maintainer and lead developer in the curl project. I stream curl related stuff. Release presentations, curl development and related topics.
When you use the type system to make it impossible to generate invalid combinations of arguments, you also remove a lot of issues.
Unfortunately the focus currently is to talk about memory safety when arguing against C. I find type safety much more important and would claim that would fix more CVEs than memory safety.
Of course, no language enforces this, so it does require the designer of an API to enforce it. But C doesn't even allow it.
@pyte I managed to produce the release tarball with one of the files "broken". Just me messing up locally. I immediately realized why and how so I could just fix and rerun the scripts to make a second release of the day...
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •curlhacker - Twitch
Twitchdaniel:// stenberg://
in reply to daniel:// stenberg:// • • •We announce four new CVEs, none of them a "C mistake".
They are the top four ones in the table we provide here: curl.se/docs/security.html
curl - CVEs
curl.segigantos
in reply to daniel:// stenberg:// • • •depends what you mean by "C mistake".
When you use the type system to make it impossible to generate invalid combinations of arguments, you also remove a lot of issues.
Unfortunately the focus currently is to talk about memory safety when arguing against C. I find type safety much more important and would claim that would fix more CVEs than memory safety.
Of course, no language enforces this, so it does require the designer of an API to enforce it. But C doesn't even allow it.
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to daniel:// stenberg:// • • •Demian
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Demian • • •Natanael Copa
in reply to daniel:// stenberg:// • • •Styx
in reply to daniel:// stenberg:// • • •Never believe an X.X.0 release 😂 !
Great job and good luck on everything to come. You're a model to many, even in failure
Jim Fuller
in reply to daniel:// stenberg:// • • •daniel:// stenberg:// reshared this.