Le 20/05/2024 à 00:33, kc-devuan@??? a écrit :
> 19 May 2024 22:26:41 Antony Stone <Antony.Stone@???>:
>
>> Details please?
>>
>> What do you have against C (which, amongst plenty of other things, is what the
>> Linux kernel is written in)?
> apt originally downloaded as root. Now it uses another user which means an exploit initially results in a shell of that users permissions ideally with limited system execution access to raise privileges.
>
> As for C well I thought it was obvious how many exploits are caused by it's lack of protections despite good practice efforts in Chrome etc. or the Linux kernel Netfilter or wifi scanning.
>
> If you use Ada, Go, Rust or even a limited set of C++ etc.  then you will only get a denial of service and not an exploit assuming they are not using c libraries or wget etc..
>
    I wouldn't include C++ in a list of secure languages: it cumulates
C weaknesses with its own. Dunno Go but I tend to agree for the two others.

    But I'm curious to know how apt can download and install packages
in root-owned directories without the root piviledge -- please take it
well, I sincerely would like to know.

--     Didier