John Viega

CEO of Crash Override. GCM-AES. Gnu Mailman. Building Secure Software, OpenSSL book, ...

[John Viega @viega]

I knew I had a post about C varargs in me, but it wasn't clear how many. https://t.co/ydd9k2gvIZ

[John Viega @viega]

@dominos It's not acceptable to start prepping my food 2 hours ago, never have it leave the store, and not pick up the phone for 45 minutes. Bad communication is just bad business.

[John Viega @viega]

"This sidebar on counting C macro args needs to go deeper to help people understand."

3 weeks later...

"Here's why <10 lines of code to count at comp time requires advanced degree," My cost? 10k words and my sanity.

Recursive macros in C, demystified: https://t.co/7lRMc7GpCS

[John Viega @viega]

Security tools often make performance problems worse; Concurrency is hard, and a "Collect all the data!" philosophy makes it worse. Better to act like a human under load and drop what you can't handle, which is much easier than it was last week: https://t.co/b8rZ0qwZqj

[John Viega @viega]

In other words, "Learn a heap about zero... mapped memory." 🥁

[Crash Override @crashappsec]

It turns out computational complexity is... complex? (The 🤯 truth about heap memory!) https://t.co/rAjaE1LyIt

[John Viega @viega]

This is amazing! Sophos' transparency should be lauded; pretty much all big security vendors have swept things like this under the rug, but this shows the industry could be driving a lot more value if vendors were just willing to be accountable.

https://t.co/rJO4h4j56O

[John Viega @viega]

I very much enjoyed talking to Amanda and Tim about some of the things we've been working on!

[Timothy Chen @tnachen]

@crashappsec is building the open source project (https://t.co/uZHhe3gr0m) that is able to create a watermark for your projects to ensure app integrity through out the app lifecycle.

Check out @amanda_robs and I interview with @viega (ex-CTO of McAfee, CEO of Capsule8) about the motivation and story behind the company and project!

[Dino A. Dai Zovi @dinodaizovi]

Just to spice things up a bit, I'm pretty sure the amazing feat below would not have been possible without memory *unsafety* :)

[John Viega @viega]

@jduck @PeteMarkowsky @eatonphil @chrisrohlf Lol, yeah read it first, then I'm happy to discuss.

[John Viega @viega]

@jduck @PeteMarkowsky @eatonphil @chrisrohlf I don't say mitigations "save the day" by any stretch. Only that the 'black/white' view is too simple. And with embedded, the whole point is that it *is* the 90's in that space, so it's be folly for any one person to re-invent the world to put a product out.

[Daniel Cuthbert @dcuthbert]

That being said, when I had the chance to review the preview of @viega's 'C isn’t a Hangover; Rust isn’t a Hangover Cure' blog, I loved the arguments he introduced

https://t.co/0iJoIJBmw5

[Daniel Cuthbert @dcuthbert]

Use a memory-safe language.

This is a statement we've heard for a while now, I've said it, but as much as I enjoy my journey into learning Rust (she's a tough lover that Rust), it's also not something many are in a position to quickly adapt, especially with legacy everywhere

[Daniel Cuthbert @dcuthbert]

Overall this is one of the best articles on the subject of 'use a memory safe language' and it's detailed and worthy of a read by all interested

https://t.co/0iJoIJBmw5

[John Viega @viega]

@PeteMarkowsky Thanks, Pete!!

[John Viega @viega]

@daveaitel Thanks, Dave!

[Dave Aitel @daveaitel]

This is a very good essay. Worth a read. (Long and with technical bits but still necessary for policy ppl)

[Rodrigo Branco @bsdaemon]

This write-up covers all my arguments on the discussion around memory safe languages in a better way than I would ever be able to cover.

[John Viega @viega]

@chrisrohlf I've been wanting to find the time to write this ever since the discussion we had at the Linux Foundation / CISA.

[John Viega @viega]

I just published C isn’t a Hangover; Rust isn’t a Hangover Cure https://t.co/CyDpCwGMJy

[Phil Eaton @eatonphil]

This is an extremely well written post, covering history of memory safety to provide context for the language decisions we may make today.

Take your time and enjoy John sharing his extensive experience and ideas.