"gcc -fanalyzer" will fundamentally change safety of C programs, such as Linux, GNOME, DQlite (distributed SQLite), Cython, Python, Crystal, Ruby, NIM, ZIG, Vala/Genie ... but also the C compiled version of PicoLisp ...
https://developers.redhat.com/blog/2020/03/26/static-analysis-in-gcc-10/ Plenty of proactive security patches are coming out now minutely, which vastly improve complete Linux environment. Sadly, Microsoft does _not profit_ from the magic abilities of that new flow analyzer in GCC. Windows, Office ... all written in C++! :-D Have fun! Am Dienstag, 28. April 2020 schrieb Edgaras Šeputis <dev...@gmail.com>: > Here is the thing, in consumer space, but not even there in a way "nobody > cares about security". Not in that nobody cares, but there are more > important things than security, like some particular ability, and for now > it USA stuff or severe hits in performance, or even nothing at all. Which > in such cases people will rightfully so take some security concerns over > not being able to do anything, or things that competitors are doing. For > now penetration of those technologies are super low, and it remains to be > seen where they will go. I also have hopes that someone will unseat if not > crush at least one company - Intel, but more for all the underhanded shit > they done to win "top dog" position in market. Also Linus makes some very > pragmatical valid points about security too: > https://www.cio.com/article/2434264/torvalds-calls-openbsd-group--masturbating-monkeys-.html , > which applies here full well. You can pipe all you want a bout this > insecure or that with backdoor no one will care until you deliver > competitive features, not with attitude like you shown sometimes. You go > this is shit that will be most amazing and thus don't use this. Well seems > people can not use 'that', so in a mean time they will keep using 'this'. > And 'that' will have to compete, and dropping potential allies cause today > they use 'this' is just stupid. Unless you think stuff can not be ported > later on. > > On Tue, Apr 28, 2020 at 1:44 PM Guido Stepken <gstep...@gmail.com> wrote: > >> I think, it's decided now, that China is going to remove US hardware, US >> software and US protocols. >> >> In fact, US software stacks, especially those Open Source by Apache, Linux, >> .. "Foundations" have become a *huge pile of shit*: >> >> *Billions lines of code, millions of bugs, thousands of NSA backdoors, >> hundreds of intentionally slowed down algorithms, sponsored mainly by >> Intel* >> >> Security Reviews? Impossible! Removing NSA contributed code, e.g. SELinux, >> backdoors even deeply sticking in Linux TCP/IP stack? Impossible! >> >> Removing Intel IME Spy Firmware Processor (MINIX) from all 2008 later >> motherboards (even in notebooks) - Impossible! >> >> To give you an idea, what's all running in parallel to your "Booted OS" of >> choice: >> >> >> https://www.intel.com/content/dam/www/public/us/en/security-advisory/documents/cve-2019-0090-whitepaper.pdf >> >> In fact, UEFI is an Operating System, that is running parallel to your own >> OS. You're booting Windows, Linux on a kind of Hypervisor, the underlying, >> hidden Minix OS (a tiny UNIX Clone living in North Bridge), has *full >> access* to. Means: Disk, memory, keyboard, network ... >> >> NSA can access all of your passwords, certificates, ... any time. Even when >> main processor is switched off, the Cortex-A15 core can activate power for >> e.g. SSD, network on its own, even when Intel main CPU is deactivated. >> >> And i fear, the little "US problem" with surveillance, spying on other >> countries industries to gain strategic advantage and control over forein >> industries, politicians, CEOs ... is much bigger than anybody can imagine
