• 0 Posts
  • 55 Comments
Joined 1 year ago
cake
Cake day: July 9th, 2023

help-circle





  • Weird how this notion of “personal responsibility” applies to every person except for those people who choose to intentionally misrepresenting the product by branding it in ways that are misleading. The people running this company aren’t responsible for their role in misleading the public, just because the fine print happens to indicate that the product isn’t actually what it’s marketed as?

    Now you’ll probably say something to the effect of “I never said that! You’re putting words in my mouth!” except what other motivation can you have to jump to the defense of the liar and blame people for being misled, except that you want to put all the responsibility on individuals for being misled and not on the company that is systematically and intentionally misleading them? Maybe you just manage to derive a smug sense of superiority thinking of yourself as someone who is invulnerable to this kind of tactic so blaming the victims lets you feel good about yourself.














  • The entire problem with cmd.exe was not known and so obviously not documented when the Rust standard library developers were implementing the API, and the same goes for the standard library developers of every other language. Rust was among the first to fix this problem in their API, with many other languages opting to just document the issues instead of actually protecting users from it.

    To take all this information and distill it down to trumpeting “Rust has a CVSS level 10 security vulnerability!!” without context is stupidity at best and maliciously disingenuous at worst.

    Nitpicking whether the statement can be construed as true within a certain framing just demonstrates malicious intent when the reality is that users of Go, Python, and Java, whose standard libraries have taken a position of Won’t Fix, are in a FAR more dangerous position than Rust users who are actually in the safest position of anyone in any language ecosystem besides perhaps Haskell.


  • Because this is the status of the bug across the standard libraries of various languages, per this article and others:

    • Erlang (documentation update)
    • Go (documentation update)
    • Haskell (patch available)
    • Java (won’t fix)
    • Node.js (patch will be available)
    • PHP (patch will be available)
    • Python (documentation update)
    • Ruby (documentation update)

    Notably C and C++ are missing from this list because their standard libraries don’t even offer this capability. Half of these standard libraries are responding to the issue by just warning you about it in the function documentation. Rust is one of the few that actually prevents the attack from happening.

    The original BatBadBut bug report used JavaScript to illustrate the vulnerability.