Language Selection

English French German Italian Portuguese Spanish

Insecurity blues: What I learned from my buggy code

Filed under
Software

It hasn't been a good month for my code. Samba, the project I'm responsible for, has had to announce several security flaws. Unfortunately some of them were in code I wrote. I always do a large amount of soul-searching whenever that happens. There's nothing worse than finding out something you were responsible for is the cause of many thousands of people having to waste their time rolling out patches. It always makes me wonder if the time has come to give up this programming lark and end my days peacefully in management, messing up other people's code instead of creating my own.

It's very educational however to look at the causes of the flaws, and try and learn what we can from the bugs and also our reactions to them. Samba is an old program. The initial code was originally written 15 years ago. At that time, modern security problems such as integer wrap (where adding two numbers together can end up with a number smaller than both of them, due to the fixed sizes of integers that processors deal with), or heap overflow vulnerabilities (where overwriting unallocated memory on the program heap can allow a clever attacker to seize control of a program) were unheard of. We knew about buffer overruns (where reading more data into a buffer than was originally allocated for it can cause a security breach) and denial of service attacks, but 1992 was a simpler, less hostile time for network software development. Most initial deployments of Samba were on networks isolated from the main Internet, by technically advanced administrators who knew how to download the source code from the Internet.

More here




More in Tux Machines

Why Good Linux Sysadmins Use Markdown

The Markdown markup language is perfect for writing system administrator documentation: it is lightweight, versatile, and easy to learn, so you spend your time writing instead of fighting with formatting. The life of a Linux system administrator is complex and varied, and you know that documenting your work is a big time-saver. A documentation web server shared by you and your colleagues is a wonderful productivity tool. Most of us know simple HTML, and can whack up a web page as easily as writing plain text. But using Markdown is better. Read more

Purism’s next product could be a smartphone that runs Linux/free software

Purism is a company that’s been developing laptops and tablets that run Linux-based, free and open source software for a few years. Now Purism is considering building a smartphone and the company is soliciting feedback from potential customers. The idea would be to release a Librem Phone that runs GNU/Linux rather than Android, and which offers security and privacy features to help set it apart from most other phones on the market. Read more

Cinnamon 3.2 in Linux Mint 18.1 Supports Vertical Panels, Better Accelerometers

After informing the community a few days ago about the Mintbox Mini Pro PC and the upcoming improvements and new features shipping with the XApps software projects in Linux Mint 18.1, Clement Lefebvre just published the monthly Linux Mint newsletter. Read more

Blender 2.78 Open-Source 3D Graphics Software Released with Spherical Stereo VR

Today, September 30, 2016, the Blender Foundation is proud to release Blender 2.78, the latest stable and most advanced version of the popular, open-source, free, and cross-platform Blender 3D modelling software. Blender 2.78 comes six months after the release of Blender 2.77, and it's a major update that adds numerous new features and improvements, among which we can mention rendering of spherical stereo images for VR (Virtual Reality), viewport rendering improvements, as well as brand new freehand curves drawing over surfaces. Moreover, the Grease Pencil received awesome improvements and it now doubles as both an animation and drawing tool, powerful new options have been added for B-Bones, it's now possible to import and export basic operators in the Alembic support, and the Cloth Physics feature received new Simulation Speed option and Dynamic Base Mesh support. Read more