Исходное сообщение
"Локальная уязвимость в сетевой подсистеме ядра Linux" Отправлено Аноним, 22-Сен-23 20:48
гугл, собрав свою статистику по си/плюсовым проектам, заявляет, что использование разных техник программирования, всевозможных анализаторов и фаззинг-тестирования не очень помогает: "...We continue to invest in tools to improve the safety of our C/C++. Over the past few releases we’ve introduced the Scudo hardened allocator, HWASAN, GWP-ASAN, and KFENCE on production Android devices. We’ve also increased our fuzzing coverage on our existing code base. Vulnerabilities found using these tools contributed both to prevention of vulnerabilities in new code as well as vulnerabilities found in old code that are included in the above evaluation. These are important tools, and critically important for our C/C++ code. However, these alone do not account for the large shift in vulnerabilities that we’re seeing, and other projects that have deployed these technologies have not seen a major shift in their vulnerability composition. We believe Android’s ongoing shift from memory-unsafe to memory-safe languages is a major factor... " Отсюда: "Memory Safe Languages in Android 13" https://security.googleblog.com/2022/12/memory-safe-language... гуглу я доверяю в _этом_ вопросе гораздо больше, чем тебе, брат аноним.