Top all-time · #2489
TrustInSoft
Company blog · trust-in-soft.comsecurityprogramming
TrustInSoft is the company blog at trust-in-soft.com, writing about security and programming. Since 2014, 30 different Hacker News readers have linked it 59 times, most often “GCC always assumes aligned pointer accesses”. No feed was found, so read it on the site itself.
TrustInSoft’s advanced exhaustive static analysis tools and services help secure C/C++/ Rust code. Mathematically prove software safety and cybersecurity with this source code analyzer.
Most-linked posts?
- /3 people · 10 mentions · first linked 2019-02-12
- /polarSSL_demo.pdf3 people · 3 mentions · first linked 2015-09-06
- GCC always assumes aligned pointer accesses3 people · 3 mentions · first linked 2020-04-06
- A dangling pointer is indeterminate3 people · 3 mentions · first linked 2015-04-21
- Detecting Strict Aliasing Violations in the Wild [pdf]3 people · 3 mentions · first linked 2017-02-14
- /industries/rail/2 people · 2 mentions · first linked 2018-07-12
- Ways C compilers break for objects larger than PTRDIFF_MAX bytes2 people · 2 mentions · first linked 2019-08-02
- A C SSL implementation without buffer overflows2 people · 2 mentions · first linked 2014-04-09
- /products/2 people · 2 mentions · first linked 2017-03-28
- /tis-interpreter/2 people · 2 mentions · first linked 2015-06-22
What Hacker News says?
ownme.ipredator.se http://trust-in-soft.com/polarSSL_demo.pdf
Comment linking /polarSSL_demo.pdf
on “How to C in 2016”Submitted Ways C compilers break for objects larger than PTRDIFF_MAX bytes as a story · 74 points
HN discussion> Here is the URL of the blog post that I had to write in preparation for the upcoming blog post about getting ourselves a Friendly C Compiler: https://trust-in-soft.com/blog/2020/04/06/gcc-always-assumes... . . I recommend you take a look, I think it is interesting in itself. So, it's definitely interesting -- I think a lot of odd stuff you can do should probably be undefined. Eliminating pointer accesses after a n…
Comment linking /blog/2020/04/06/gcc-always-assumes..
on “Tell HN: C Experts Panel – Ask us anything about C”Submitted GCC always assumes aligned pointer accesses as a story · 66 points
HN discussionI still want to write at least one sequel to that post, on the theme “Alright, can we make a Friendly C Compiler by disabling the annoying optimizations, then?”. Obviously the people who want a Friendly C Compiler do not want to disable all optimizations. This would be easy to do, but these users do not want the stupid 1+2+16 expressions in their C programs, generated through macro-expansion, to be compiled to two a…
Comment linking /blog/2020/04/06/gcc-always-assumes-aligned-pointers/
on “Tell HN: C Experts Panel – Ask us anything about C”Submitted Memcmp requires pointers to fully valid buffers as a story · 19 points
HN discussionYes and no. The thing I am describing is when you link a compilation unit using: struct internal_state { int dummy; } state; with another compilation unit that defined the same state differently: struct internal_state { int actual_meaningful_member_1; unsigned long actual_meaningful_member_2; } state; As far as I know, BSD socked do not do this. Zlib was doing this ( https://github.com/pascal-cuoq/zlib-fork/blob/a52…
Comment linking /wp-content/uploads/2017/01/vmcai.pdf
on “Tell HN: C Experts Panel – Ask us anything about C”Submitted Handling security bugs is not the open-source community’s strong point as a story · 5 points
HN discussionIt is possible to guarantee that a C program does not have any undefined behavior, which includes all the memory errors that are often also security vulnerabilities. “Static analysis” may be the wrong name to classify the tools that work in that area, because “static analysis” is usually used for purely automatic tools, whereas the tools used to guarantee the absence of undefined behaviors are not entirely automatic…
Comment linking /polarSSL_demo.pdf
on “Tell HN: C Experts Panel – Ask us anything about C”Submitted Printing a null pointer with %s is undefined behavior as a story · 3 points
HN discussionEven there it depends. 'Programming practices' is vague. Even C can be tamed, at great expense, using formal methods techniques. [0][1][2][3] Adoption of such methods can give a solid assurance of the lack of UB, like use of a safe language. Weaker measures, like adopting MISRA C, don't provide such strong assurances (although they can eliminate certain categories of errors), and as you indicate, their real value is…
Comment linking /
on “Linux Hardening Guide”Submitted How do you report bugs that you alone can see? as a story · 3 points
HN discussionSince I have it at hand, here is a list of examples of how compilers are broken if an array is larger than SIZE_MAX / 2 (which is called PTRDIFF_MAX in the post): http://trust-in-soft.com/objects-larger-than-ptrdiff_max-byt...
Comment linking /objects-larger-than-ptrdiff_max-bytes/
on “How to find size of an array in C without sizeof”Submitted Out-of-bounds pointers: a common pattern and how to avoid it as a story · 3 points
HN discussionThey don't, but others do. Sound static analysis tools like TrustInSoft ( https://trust-in-soft.com/ ) guarantee no undefined behavior (array overflow, use-after-free etc.).
Comment linking /
on “Announcing Rust 1.36.0”Submitted Tis-interpreter detects subtle bugs in C programs as a story · 3 points
HN discussion> we don’t know how to create a simpler memory safe low-level language. This may well be true, but using a memory-safe language is never, ever the goal. The goal is creating correct and secure programs -- that have as few bugs and security flaws as possible/required -- as cheaply as possible. While a memory safe language in the style of Rust is one means toward that end, that eliminates an important class of bugs at…
Comment linking /
on “Why Not Rust?”- ot · 2015-10-15
Submitted A dangling pointer is indeterminate as a story · 3 points
HN discussion Right, Frama-C can formally prove properties of C code. There are also proprietary solutions that do something similar: • https://www.eschertech.com/products/ecv.php • https://www.trust-in-soft.com/
Comment linking /
on “Nvidia Security Team: “What if we just stopped using C?” (2022)”Submitted A C SSL implementation without buffer overflows as a story · 3 points
HN discussionIt's also possible to formally verify C++, [0][1] but this isn't commonly done. I imagine it's very labour intensive. [0] https://www.eschertech.com/products/ecv.php [1] https://trust-in-soft.com/
Comment linking /
on “Why Zig when there is already C++, D, and Rust?”Submitted Outlining the language C programs should be written in as a story · 2 points
HN discussionAlso https://trust-in-soft.com/
Comment linking /
on “The memory safety problem isn't bad coders”Submitted Memcmp requires pointers to fully valid buffers as a story · 2 points
HN discussionIn the really simple cases (like accessing a float as a long, or similar), you're right. The problem is the interpretation that's been applied to aggregate types: struct a { int variant; }; struct b { int variant; long data; }; I have a pointer to a struct b - can I cast it to a pointer to struct a and still dereference 'variant'? It has the correct type and is guaranteed to live at the start of the struct in both c…
Comment linking /wp-content/uploads/2017/01/vmcai.pdf
on “I Do Not Know C: Short quiz on undefined behavior (2015)”Submitted Detecting Strict Aliasing Violations in the Wild [pdf] as a story · 2 points
HN discussionYou're right that you can't define a safe subset of C without making it impractical. MISRA C defines a C subset intended to help avoid C's footguns, but it still isn't actually a safe language. There are alternative approaches though: 1. Compile a safe language to C (whether a new language or an existing one) 2. Formal analysis of C, or of some practical subset of C, to prove the absence of undefined behaviour Work…
Comment linking /
on “ISO C became unusable for operating systems development”Submitted A dangling pointer is indeterminate (2014) as a story · 1 points
HN discussionYou might be interested in tis-interpreter: http://trust-in-soft.com/tis-interpreter/ It can’t prove a program is 100% conformant, but it can detect a much broader range of undefined behaviors than regular compilers, and does other things more strictly (like, IIRC, limiting the declarations exposed by standard library includes to what the standards guarantees they expose).
Comment linking /tis-interpreter/
on “An ode to pack: gzip’s forgotten decompressor”Submitted GCC always assumes aligned pointer accesses as a story · 1 points
HN discussion
