[HN Gopher] Why did the OpenSSL punycode vulnerability happen
       ___________________________________________________________________
        
       Why did the OpenSSL punycode vulnerability happen
        
       Author : stargrave
       Score  : 9 points
       Date   : 2022-11-02 18:06 UTC (4 hours ago)
        
 (HTM) web link (words.filippo.io)
 (TXT) w3m dump (words.filippo.io)
        
       | throwaway67743 wrote:
       | Why do people feel this need to attribute human error to C, as if
       | it's somehow supposed to know what to do, blah blah rust (you can
       | write garbage in rust too), flame away zealots!
        
         | jiggawatts wrote:
         | Some systems steer people into the pit of failure, others steer
         | people towards the pit of success.
        
         | KyeRussell wrote:
         | The answer to your question is in most if not all arguments
         | against the widespread use of C/C++ in something as high level
         | as OpenSSL. C and C++ ask a lot of developers, mostly in terms
         | of ensuring memory safety. It's possible to write crappy code
         | in Rust, sure, but the language design has taken the decades of
         | experience of knowing where C falls short and provides a more
         | safe natural path. The long-running rebuttal to this is "it's
         | as easy as using function x instead of function y!" with the
         | name of function x being some inscrutable derivative of the
         | name of function y. If it's so easy, why do C codebases keep
         | having the same issues? I'd seriously question the software
         | development experience of someone that doesn't see the value in
         | reducing developer cognitive load.
        
       ___________________________________________________________________
       (page generated 2022-11-02 23:01 UTC)