this post was submitted on 20 Jul 2024
421 points (97.9% liked)

Programmer Humor

19441 readers
122 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

founded 1 year ago
MODERATORS
 
you are viewing a single comment's thread
view the rest of the comments
[–] lseif@sopuli.xyz 17 points 3 months ago (1 children)

a kernel module should not be written in Go

[–] 5C5C5C@programming.dev 4 points 3 months ago (2 children)
[–] technom@programming.dev 8 points 3 months ago (1 children)

I don't think that rust would have prevented this one, since this isn't a compile time error (for the code loader).The address dereferencing would have been inside an unsafe block. What was missing was a validity check of the CI build artifacts and payload check on the client side.

I do however, think that the 'fingers-crossed' approach to memory safety in C and C++ must stop. Rust is a great fit for this use case.

[–] Valmond@lemmy.world 2 points 3 months ago

Well, modern c++ with smartpointers is quite good IMO.

C on the ither hand is like swimming with sharks, with a nosebleed.

[–] Mikina@programming.dev 1 points 3 months ago (1 children)

I might be wrong, but from how I understand it it probably wouldn't help. Kernel drivers have a rigorous QA and cert by Microsoft if you want to get them signed, which is a process that may take a long time - longer than you can afford when pushing updates to AV/EDR to catch emerging threats. What Crowdstrike does to bypass this requirement is that the CS Falcon is just an engine, that loads, interprets and executes code from definition files. The kernel driver code then doesn't need to change, so no need for new MS cert, and they can just push new definition files. So, they kind of have to deal with unsafe in this case, since you are executing a new code.

[–] zaphod@sopuli.xyz 3 points 3 months ago

What Crowdstrike does to bypass this requirement is that the CS Falcon is just an engine, that loads, interprets and executes code from definition files.

If Microsoft really has "rigorous QA and cert" for kernel drivers then they shouldn't have certified this, because now it's a certified bypass for the certification.