Dailydave mailing list archives
Concurrency, deadlocks, security and unicode.
From: Dave Aitel <dave () immunitysec com>
Date: Sun, 27 Nov 2005 10:10:14 -0500
http://inside.eweeklabs.com/Labs/peter-coffee/92/I don't know who this guy is, but he's on the money when it comes to threading (and in particular deadlocks) being today's equivalent of assembly language - hard for the experts, impossible for novices. Concurrency in general is a tough cookie - and one that's not solved by virtual machines which solve so many other issues. As Theo would say "Any bug is a security bug", and I expect people to discover that you can manipulate the state machines that drive many web applications in weird ways using concurrency flaws. Has anyone on this list found this to be true yet?
The other fun issue is unicode, of course. Unicode with many character sets was a bad idea. We should have just defined w_char to be a 32 bit type, and then had one character set that included all languages. If for no other reason that to reduce the mental complexity of the system.
-dave
Current thread:
- Concurrency, deadlocks, security and unicode. Dave Aitel (Nov 27)
- Re: Concurrency, deadlocks, security and unicode. Andrew R. Reiter (Nov 27)
- <Possible follow-ups>
- Re: Concurrency, deadlocks, security and unicode. Steven M. Christey (Nov 27)
