Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • The compiler is allowed to transform your code if it can prove that the result would interact with the outside world in exactly the same way as your original code would, right? You can optimize on "I already checked the value of X" if you can prove that nothing could have changed X.

    Well, it sounds like a lot of compilers are making unjustified assumptions about what the outside world is allowed to affect or observe. Maybe with the encouragement of specs, maybe not.

    by Hizonner
  • Compiler does what I tell it. Not the other way around.
    by fithisux
  • weird f*ing site. apparently doesn't like hn visitors and doesn't want me opening the console. i know when im not wanted
    by bmandale
  • Title should be "Your C compiler can undo your security checks".
    by Narishma
  • A key problem is that compilation operates on an implicit (compiler writers have this in the back of their heads) notion of correctness which is very roughly “preservation of observable behaviors” where “observable” is sequences of system calls and then return value. That is, the final output of a compiler should never add new sequences of observable behaviors.

    Security properties on the other hand are very often about the relationship between these sequences. For example we like to say that an external observer/attacker can’t distinguish internal state by the external observations (confidentiality) which requires that two observable traces given different hidden values don’t have different observations from the same starting observable state.

    If you’re an LTS nerd you know this difference as trace properties vs hyper properties. Compilers try to preserve the former but not the latter.

    Separately there is the problem of “what is observable?” For example, if you include timing in your observable behaviors suddenly the kinds of compiler passes that are able to preserve observations tends to zero rather quickly.

    by johnbender
  • Regarding compiler deleting memset, there are multiple memory-zeroing functions that are guaranteed not to be optimized away:

    https://cppreference.com/c/string/byte/memset (memset_s)

    https://cppreference.com/cpp/string/byte/memset (memset_explicit)

    Also see notes section for various other functions that people were using before memset_s became standard.

    by omoikane

Explore Birbla archives