SoylentNews is people
SoylentNews
from the when-you-get-what-you-asked-for-only-to-learn-it-was-not-what-you-wanted dept.
Surprise! Copying Crummy Code from Stack Overflow Leads to Vulnerable GitHub Jobs:
In a research paper submitted to pre-print service ArXiv, six computer science boffins who hail from Shiraz University, Iran, Polytechnique Montreal University, Quebec, Canada, and Chamran University, Iran – Morteza Verdi, Ashkan Sami, Jafar Akhondali, Foutse Khomh, Gias Uddin, and Alireza Karami Motlagh – say that they looked at more than 72,000 C++ code snippets in 1,325 Stack Overflow posts and found 69 vulnerable snippets of 29 different types.
That's not a lot in absolute terms but those 69 vulnerable snippets show up in 2,589 GitHub projects. The researchers say they notified the authors of affected projects and some, but not all, chose to fix the flaws, which consist of known CWEs.
The paper, "An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples," is being reviewed for possible publication in the journal IEEE Transactions on Software Engineering.
[...]The research echoes an academic paper from 2017 that found 1,161 insecure code snippets posted on Stack Overflow had been copied and pasted into 1.3m Android applications available on Google Play.
The boffins relied on a Stack Overflow data set called SOTorrent data-set Version 2018-09-23. It covers posts from 2008 through 2018 and contains some duplicate code snippets.
The researchers chose to focus on C++ because it's popular, particularly for embedded, resource-constrained programs and large, distributed systems. Vulnerabilities in such systems, they contend, are likely to have a significant impact.
The most frequently found CWEs[1] were CWE-1006 (Bad Coding Practices, CWE-754 (Improper Check for Unusual or Exceptional Conditions), and CWE-20 (Improper Input Validation).
[...]the researchers developed a Chrome extension to help developers be more mindful of security when copying and pasting Stack Overflow code snippets. The extension checks copied code against the CWE database and throws up an alert if the snippet is flawed. Uddin said the plan is to release it when the paper is formally published.
[1] CWE: Common Weakness Enumeration
Do not deploy what you do not understand? Whodathunkit?
(Score: 3, Interesting) by Mojibake Tengu on Saturday October 05 2019, @10:10AM (4 children)
Primates are learning by imitation and failures. I consider stackoverflow be a generalized code injector.
Hard to say, most people do not understand how TV or car works inside, yet they use it daily.
Respect Authorities. Know your social status. Woke responsibly.
(Score: 1, Insightful) by Anonymous Coward on Saturday October 05 2019, @10:32AM
As operators, not TV repair men (remember those) or mechanics. TBF most TV repair men just used to swap out tubes and damaged caps until they got a set working and many pre-EMS mechanics did much the same thing. I doubt any of these repos are widely used projects, they're probably hacked-together hobbyist projects that no rando could compile let alone use.
(Score: 2) by hendrikboom on Saturday October 05 2019, @04:23PM
Back in the 60's I knew how my TV worked. Now I don't know how it works. I don't even know for sure what all the plugs and sockets in the back are for.
As for a new TV, which I dread the day I have to buy, I mostly know how it doesn't work; that is how it works for data spies.
(Score: 2) by Rupert Pupnick on Saturday October 05 2019, @04:26PM
Deployment and operation are different things— certainly with cars and TVs.
(Score: 2) by Freeman on Monday October 07 2019, @03:18PM
Yes, Do not Deploy what you do not understand. You want the Engineers that design your car to just throw something together that looks like it might work, but they have no understanding of how it works? Then, release their Frankenstein on the world. No, you don't, because you like to drive down the road and not have the engine fall out, because you hit a small pothole.
Sure, Engineers designing a car, have a greater responsibility for your immediate well-being. Yet, if random app x gets you hacked, your identity stolen, and back account emptied. That's sure to negatively affect you, just usually in a much different way.
Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"