C mistakes among the vulnerabilities present in #curl code
(C mistakes are vulnerabilities that were caused by a mistake that "probably would not have been possible" had we not been using C for curl. Manually assessed for each case.)
⇧
Wolf480pl
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Wolf480pl • • •Wolf480pl
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Wolf480pl • • •daniel:// stenberg://
in reply to daniel:// stenberg:// • • •Wolf480pl
in reply to daniel:// stenberg:// • • •Wolf480pl
in reply to Wolf480pl • • •of course we can't know that the yellow line on the graph isn't lower than it is in reality.
But what I expected to see would be the yellow line flattening out in the last few years, due to new vulns not having the time to be found.
It didn't, which seems to suggest vulns are found pretty quickly.
Though I'm not a data analyst, my conclusions could be completely off...
daniel:// stenberg://
in reply to Wolf480pl • • •Wolf480pl
in reply to daniel:// stenberg:// • • •locnide
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to locnide • • •Julien W.
in reply to daniel:// stenberg:// • • •do you know how much time in average a flaw was present in releases?
@koalp
daniel:// stenberg://
in reply to Julien W. • • •varx/tech
in reply to daniel:// stenberg:// • • •@koalp Yeah, I strongly suspect that part of the graph will "fill in" with time.
It would be interesting to look at how this graph would have looked in, say, 2015 -- similar curve, or different?
daniel:// stenberg://
in reply to varx/tech • • •@varx @koalp quite This are renders of the same graph done as if it was 2015-01-01 and 2020-01-01.
The 2020 one is interestingly different and shows a much higher C mistake degree than today.
🪨
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to 🪨 • • •papush
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to papush • • •Oliver Schönrock
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Oliver Schönrock • • •Oliver Schönrock
in reply to daniel:// stenberg:// • • •Sure.
Seems the vulnerabilities plummeted, and specifically C-vulnerabilities collapses to almost nothing during that period.
Did you rewrite/retire tons of old code?
Or change your toolset/processes?
daniel:// stenberg://
in reply to Oliver Schönrock • • •Martin Uecker
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Martin Uecker • • •curl - CVEs
curl.seMartin Uecker
in reply to daniel:// stenberg:// • • •Martin Uecker
in reply to Martin Uecker • • •daniel:// stenberg://
in reply to Martin Uecker • • •Martin Uecker
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Martin Uecker • • •curl - macidn punycode buffer overread - CVE-2024-6874
curl.seMartin Uecker
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Martin Uecker • • •Martin Uecker
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Martin Uecker • • •Martin Uecker
in reply to daniel:// stenberg:// • • •Paul Hoffman
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Paul Hoffman • • •curl - CVEs
curl.setmaher
in reply to daniel:// stenberg:// • • •Alavi | علوی
in reply to daniel:// stenberg:// • • •Kris
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Kris • • •Jens Finkhäuser
in reply to daniel:// stenberg:// • • •@isotopp I'm poking at a wasp nest here, but just for the fun of it, "if only you'd been using C++"...
🤷♂️
For context, @bagder and I had a quick exchange on C++ in the cURL code base some years ago, with the result it wasn't desired, and for understandable reasons (TL;DR).
Of course it means I didn't get to submit some patches, which makes a a tiny bit sad still. Hence the, uh, let's call it a tongue in cheek comment 😊
daniel:// stenberg://
in reply to Jens Finkhäuser • • •Kris
in reply to daniel:// stenberg:// • • •