Re: SLFS

On Tue, 30 Dec 2003 13:06:21 -0500 (EST)
Bill's LFS Login <[email protected]> wrote:

> 
> Right on all counts! Unfortunately, "good coding practice" is ignored
> in the assessment of risk of vulnerability. The "weaknesses" in these
> flagged procedures existed long before the 'net and hacker onslaught.

Cobblers.

Bad coders existed before the 'hacker onslaught' too.

You wouldnt use a pair of pliers to tighten a wheelnut, just as you
wouldnt use strcpy to copy a string of indeterminate size.

The fact that replacing strcpy() with strncpy() may increase 'hardness'
is a red herring, as when you hit the strcpy, you need to then add code
to determine the buffer size anyway, which stands as much chance of
being buggy as the original.

-- 
Spyros lair: http://www.mnementh.co.uk/   ||||   Maintainer: arm26 linux

Do not meddle in the affairs of Dragons, for you are tasty and good with
ketchup.
-- 
http://linuxfromscratch.org/mailman/listinfo/lfs-security
FAQ: http://www.linuxfromscratch.org/faq/
Unsubscribe: See the above information page