Another use after free... I'm on board with cisa on this one. If you add new code to a sw project in c or c++ that should be a solid case for negligence when your customers sue for losses.
> If you add new code to a sw project in c or c++ that should be a solid case for negligence when your customers sue for losses.
Sure, as long as you are ok being similarly sued next time you install or use windows, macos, or linux on some box you administer. Those are all written in C. I guess you're OS-less until you write one in something safe. Ditto for web browsers and bootloaders.
> next time you install or use windows, macos, or linux on some box you administer.
I don't administer other people's boxes, I provide them with programs written in safe languages (as a bootable unikernel if they want). If they choose to run them on a buggy OS that's on them.
Moreover, a significant fraction of JS vulnerabilities are logic errors in the JIT, so even if the JIT itself is memory safe, that doesn't make the resulting code free of vulnerabilities.
reply