tbh I've considered simply banning math-operator-precedence in projects I work on, and requiring all mixed-operator code to use parenthesis or split to multiple statements. I do that myself, at least.
I've seen so many mistakes from it, and seen people spend so much pointless and avoidable time deciphering and verifying it, it really doesn't seem worth it (in most code) for the extremely minor character savings.
kstrauser 4 hours ago [-]
I think I’d generalize that rule to require parentheses in any situation where adding parentheses could change the interpretation. I think that’d leave int addition and multiplication, and I don’t think there’s anything else offhand. Other than those, require parentheses.
a - b - c
is order dependent, even if its deterministic and knowable. When I’m scanning the code to look for a pesky bug, I don’t wanna have to take extra seconds to convince myself that it’s doing what I expect. It steals time and my limited attention from more interesting sections of code.
masklinn 4 hours ago [-]
> I think that’d leave int addition and multiplication, and I don’t think there’s anything else offhand. Other than those, require parentheses.
At this point you just require every compound infix expression to be parenthesised, the terseness isn't worth the inconsistency. Especially as, as others have noted, these operations are only associative when working in some classes (notably not necessarily when dealing with floats).
And then you do automatic parens insertion in the LSP, so you write
a - b - c
and when you save the lsp fixed it up to
(a - b) - c
om2 6 hours ago [-]
- and + operators have the same precedence. And a similar bug is possible if the operators were the same (both -). So I’m not sure it’s right to blame this on operator precedence or mixed operators. It’s just that, ultimately, the “consume” needs to be subtracted, not added.
Groxx 6 hours ago [-]
Non-mixed always goes strictly left to right, regardless of the operator, which I haven't seen anywhere near as much struggling with.
But yes, I personally parenthesize `a-b-c` explicitly, because it's not worth it for me to read and wonder if parenthesizing order matters later. Costs less than a second to write, saves a second or ten each time I read it - that's an excellent tradeoff imo, and is a trivial pattern to follow.
(Associative operators are fine, obviously)
simonreiff 6 hours ago [-]
I agree with explicit parentheses but please be careful about assuming associativity! The risk when handling floating-point arithmetic in particular is that associativity breaks, and suddenly a + (b + c) does NOT equal (a + b) + c. Not only can these lead to unexpected and hard-to-trace failure patterns, but depending on the details, they also can introduce memory overflow/underflow vulnerabilities.
genxy 6 hours ago [-]
Didn't you just suffer from the same trap the parent was trying to avoid?
riffraff 3 hours ago [-]
Smalltalk didn't have math operator precedence, and I thought it was very annoying but I've come to believe it was a good idea.
rurban 1 hours ago [-]
That's what pony did also. Operator preceding rules are too arcane, such as the need for manual memory management.
Groxx 3 minutes ago [-]
[delayed]
0xbadcafebee 3 hours ago [-]
IIRC several industry and government coding standards don't permit evaluations in arguments to functions, as the compiler can end up doing wonky things, to say nothing of the likely human error. These are the kind of standards we should be adapting into a software building code to avoid security holes like this one.
Calif is just killing it these past couple months. Reminder that Calif is Thai Duong's new firm.
cryptbe 12 hours ago [-]
You're always super kind to me :)
tptacek 9 hours ago [-]
Everyone's got a list of people they're proud to have worked with, you're on mine.
dnw 5 hours ago [-]
A CVE for exeCVE()
jeffrallen 2 hours ago [-]
Puttin' the CVE in execve.
cyberpunk 13 hours ago [-]
This is from April 28th, it was patched in 15.0R-p7.
itsthefrank 13 hours ago [-]
-p8 is the current patch level for 15.0-RELEASE so if people have been keeping on top of patching this is already two reboots in the past.
loeg 13 hours ago [-]
Just yesterday, cperciva was bragging about the FreeBSD approach to security: https://news.ycombinator.com/item?id=48056853 You can certainly argue the response here was well-coordinated, but having an LPE in a nearly 50-year old core syscall like execve() isn't ideal from a security perspective. (That is: security response isn't the entire picture; culture and bug surface matter too.)
broken-kebab 13 hours ago [-]
Or in other words, the response is well-coordinated so cperciva's bragging is justified, isn't it?
cperciva 11 hours ago [-]
Indeed, I was thinking about this precise issue when I made the point that corresponding issues get handled much better in FreeBSD than in Linux.
tptacek 12 hours ago [-]
He was talking about managing disclosure and patch flow, and you're just taking it as an opportunity to dunk on him.
11 hours ago [-]
yjftsjthsd-h 12 hours ago [-]
I think cperciva may have been a touch overenthusiastic, but surely this is in fact proving his point? His claim was, as you note before trying to ignore it, about coordination. When one of the recent Linux LPEs broke, the fix wasn't in distro packages yet; there was a vulnerability that users couldn't practically do anything about. This is an LPE that is fixed in the binaries that have already shipped. If I was playing cheerleader, this is exactly the case I'd use to argue that FreeBSD being a single unified system is a win and that its approach to handing security problems is very on top of things.
bch 13 hours ago [-]
Its like rain on your wedding day - not actually ironic, just unfortunate.
stackghost 12 hours ago [-]
A not-insignificant chunk of the userbase of the various BSDs is there because they were turned off of Linux after controversial things like Gnome 3, systemd being shoved down users' throats despite being a broken mess, wayland (though nobody was as arrogant about wayland as Poettering was about systemd), etc.
All that to say, the BSD userbase as a sizeable subset that are there for countercultural reasons, rather than technical. These are the people who buy into, say, OpenBSD's vaunted security reputation, or believe that "linux bad because reasons", so you're always going to get people in here bragging, because "not using linux" has become part of their identity.
I run a mix of FreeBSD and Linux on my personal devices. The ground truth is that FreeBSD is yet another unix-like OS written in C, and thus not immune from the types of bugs that stem from that lineage. None of the BSD distros are materially more secure or better than a properly-configured and patched Linux.
applfanboysbgon 12 hours ago [-]
The person 'bragging' was not a countercultural user, but rather the FreeBSD engineering lead. They were, however, talking about FreeBSD's response to security vulnerabilities, in contrast to Linux's response.
> thus not immune from the types of bugs that stem from that lineage
They never claimed that FreeBSD didn't have vulnerabilities. I honestly have no idea why grandparent decided to bring up their comment when it exactly validates what the person they were criticising says. GP admits the response to the vulnerability was well-coordinated. The response to security vulnerabilities was the exact, and only, subject of the post they're calling out.
12 hours ago [-]
wolvoleo 12 hours ago [-]
I wouldn't call it countercultural. And Wayland actually runs on freebsd these days.
I use Linux as well but I really like FreeBSD for a number of technical reasons. Like the ports collection, the jails, the first-class citizen ZFS.
And Gnome 3 doesn't really have anything to do with Linux. It is also available for FreeBSD if you want it (I don't, I hate the minimalist opinionated design style so I use KDE, also on Linux).
But I use Linux on servers where I run docker for example. It's not about "not using linux".
skydhash 11 hours ago [-]
> And Gnome 3 doesn't really have anything to do with Linux.
There's a very hard push on getting Gnome 3 aligned to systemd. Gnome is actually my preferred DE on Linux when I choose to use one. But compatibility with Unix systems is becoming harder every day.
wolvoleo 10 hours ago [-]
Yes even KDE recently introduced a new display manager that is completely tied to systemd. For that reason it's not supported on FreeBSD. But sddm still works of course. But it is a worrying precedent.
From the gnome team this was to be expected because they are beholden to RedHat/IBM and the other big distros who push systemd heavily. But from the KDE team I didn't.
I've stopped my monthly KDE donations for this reason. Just to send a message that this isn't ok.
icedchai 12 hours ago [-]
I also use a mix. I moved to FreeBSD initially after a rough period w/Linux in the late 90's. Today, my FreeBSD machines are all VMs running on Linux hosts!
cyberpunk 12 hours ago [-]
Hah I'm your mirror version -- my linux machines are all VMs running on FreeBSD hosts!
icedchai 8 hours ago [-]
Is bhyve working well for you? Maybe I'll try that in my next rev of my home lab.
wolvoleo 12 hours ago [-]
Oh you use bhyve?
I've tried to use it but I dound it pretty difficult for systems that need a GUI. Maybe I should revisit.
cyberpunk 12 hours ago [-]
Yep, most of my linuxes are headless -- but I do have a VM which I pass a graphics card through to for games and ai stuff though -- works really well (as long as you don't reboot the VM, it has a hard time attaching to the gfx card the second time for some reason, not looked into it much)
sysutils/vm-bhyve makes it quite friendly.
I wouldn't use it for work, though, just personal. Work is all enterprisey kubernetes stuff.
Edit: there is a 'proxmox-like' for FreeBSD out [0] -- I did try it on a couple machines and couldn't get the network working, but consoles seemed to work.. Kinda.
Ah I don't really have a second GPU to dedicate to it though. A virtual console like in VMware or QEMU/KVM would be great. Thanks for the heads-up about sylve! I'll check it out.
For me it's all personal too. For work we still use VMWare a lot.
wolvoleo 12 hours ago [-]
Oof that's a pretty big one, I didn't realise but I had already updated anyway.
C code like this is why we can't have nice things. Arithmetic operation in the arguments of a dangerous function call with no explicit bounds check.
sethops1 9 hours ago [-]
"I just don't write bugs"
Yeah.
13 hours ago [-]
andrew_kwak 2 hours ago [-]
[flagged]
rvz 14 hours ago [-]
> IV. Workaround
> No workaround is available.
Oh dear.
itsthefrank 13 hours ago [-]
> V. Solution
> Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
and reboot the system.
Not everyone can just freebsd-update and reboot, so yes, "Oh dear." is a good response to this.
epcoa 13 hours ago [-]
Anyone relying on a 30+ year old monolith kernel written in C to not have some exploitable LPEs lurking should stay in basket weaving and out of sysadmin.
cyberpunk 13 hours ago [-]
Yep.
You should treat any system where non-admins regularly login as basically insecure/owned and rig your architecture appropriately.
TBH -- I don't have any of these kinds of boxes anymore. Who is really running anything like this in 2026 and for what purpose?
mrln 12 hours ago [-]
Not necessarily FreeBSD, but for Linux this applies to most universities with a CS program, I think.
The systems should be cut off from sensitive administrative data, but a malicious student would at the very least have access to the other students' data with an LPE.
bch 12 hours ago [-]
>> monolith kernel written in C
> Who is really running anything like this in 2026 and for what purpose?
Am I parsing your question correctly?
cyberpunk 12 hours ago [-]
No, I worded it badly. See below.
jmspring 13 hours ago [-]
Stability of ecosystem. No systemd. Native ZFS. Jails over Docker. Been using it for 20+ years and it’s my preferred server OS.
cyberpunk 13 hours ago [-]
No, I mean do you run FreeBSD boxes where users who should not ever assume root access actually login to do tasks?
My point is that if you do, you probably shouldn't run, for e.g applications which need production db credential, or hold sensitive data on these boxes, or .. whatever.
Edit: I use FreeBSD extensively, for various things -- but shell access to them is restricted to the sysadmins..
CoolCold 5 hours ago [-]
Hard to tell about FreeBSD, it's basically extincted, but think of webhosting servers, wordpress, cPanel/Plesk and alike.
often it's ssh'able with things like rbash and other restrictions and almost always you, well, can run something there (as you can edit php/other files right from web management ui).
Hordes of this (in Linux world).
icedchai 13 hours ago [-]
Same. I've been using it since 1996. Initially, we used it at an early ISP for DNS, SMTP, and POP3 for roughly 8K users, and it stuck with me.
tick_tock_tick 7 hours ago [-]
Free root for anyone for over 20 years too.
itsthefrank 13 hours ago [-]
Not sure why the snark but if people are running FreeBSD then they should be...basket weaving instead of using it? Yes, the correct solution is to patch and reboot but not everyone is in a place to jump and do that which is why a temp workaround, if possible, would be welcome
wswin 12 hours ago [-]
I think good system should be prepared to do a reboot in a short notice. Even some long running jobs can have a pause mechanism.
yjftsjthsd-h 12 hours ago [-]
...as opposed to what, exactly? Linux is a 34 y.o. monolithic kernel in C, the BSDs are all forked from the same base (386BSD) of around the same age, XNU is 29 years old (and also heavily based on BSD code while also throwing in mach code) in C and other languages,...
raddan 8 hours ago [-]
The 33 year old Windows NT kernel, duh.
skydhash 13 hours ago [-]
Why can't they? Upgrading and rebooting is kinda the standard response for most security issues. So I would expect something like Ansible's playbooks for this exact scenario. You might also have it setup as a staggered rollout.
paulddraper 12 hours ago [-]
What prevents it?
jeffrallen 2 hours ago [-]
IV. Workaround
Accept that everything is broken and terrible and yet somehow find a way to keep a sense of humor and smile about it.
tptacek 12 hours ago [-]
Does this vulnerability not rely on SUID binaries?
cperciva 12 hours ago [-]
I don't think so? It's a buffer overflow in the system call.
tptacek 11 hours ago [-]
I just read that it was spilling into argv or something and assumed the vector was somehow injecting arguments or something.
cperciva 10 hours ago [-]
The exploit is injecting environment variables, but yes, close enough. You need someone to call execve as root in order to become root, but you don't need a setuid binary.
cryptbe 4 hours ago [-]
[dead]
wolvoleo 12 hours ago [-]
Why? Just update.
ActorNightly 2 hours ago [-]
I really am starting to think that the level of technical understanding on HN is so low that when readers see an exploit like this, they imagine basically the cult classic movie "Hackers" in their heads where some guy hacks into any machine of their choosing.
doublerabbit 13 hours ago [-]
Linux is on their second and FreeBSD is on their first. How many is Windows on?
dwattttt 13 hours ago [-]
If you think Linux is on their first or second, I'm not sure how or what you're counting.
doublerabbit 13 hours ago [-]
> I'm not sure how or what you're counting.
The recent two. FailCopy and DirtyFrag and FreeBSD with Execve.
2 - Linux
1 - FreeBSD.
Of course, all OS have had past-time exploits. Three now have made the news.
Plenty, Microsoft has security teams whose job is to attack Windows.
Naturally they don't do blog posts about what they find.
murderfs 12 hours ago [-]
Local privilege escalation is largely irrelevant on Windows because basically no one uses it in a multi-user system, and application sandboxing is effectively nonexistent.
TZubiri 10 hours ago [-]
I get that multiple human users on a same machine is rare nowadays, and that per-app users were never a thing.
But windows still has a root and a lower privilege user. You typically need to click on "run as admin" to elevate privileges to, for example, alter system binaries.
murderfs 6 hours ago [-]
Sure, but that's mostly academic: compromise of the user account is game over for any real user. Not actually being Administrator isn't much consolation when the regular user account can extract your cookie jar, record all of your keystrokes and mouse movements, record all desktop video (except for DRM-protected content, heh) etc.
asveikau 10 hours ago [-]
I know that Chrome on Windows tries to lower its privileges to mitigate exploits, and although it's not very popular, the MS Store app platform does try to do full isolation of apps. So actually, per-app separation of users kinda does happen, or is attempted on Windows.
2 hours ago [-]
hnlmorg 13 hours ago [-]
You talk as if Windows is the only OS that has red teams attacking the system when clearly that isn’t even remotely true.
pjmlp 5 hours ago [-]
I talk about that because it is public, and the OP mentioned Windows.
It he talked about Android, I would have mentioned Project Zero.
Don't twist the meaning of posts.
asveikau 11 hours ago [-]
No, they're saying security work happens in the Windows world but not as much in the open, due to the closed source nature.
Rendered at 10:17:15 GMT+0000 (Coordinated Universal Time) with Vercel.
I've seen so many mistakes from it, and seen people spend so much pointless and avoidable time deciphering and verifying it, it really doesn't seem worth it (in most code) for the extremely minor character savings.
At this point you just require every compound infix expression to be parenthesised, the terseness isn't worth the inconsistency. Especially as, as others have noted, these operations are only associative when working in some classes (notably not necessarily when dealing with floats).
And then you do automatic parens insertion in the LSP, so you write
and when you save the lsp fixed it up toBut yes, I personally parenthesize `a-b-c` explicitly, because it's not worth it for me to read and wonder if parenthesizing order matters later. Costs less than a second to write, saves a second or ten each time I read it - that's an excellent tradeoff imo, and is a trivial pattern to follow.
(Associative operators are fine, obviously)
Check out our blog post for a fun walkthrough: https://blog.calif.io/p/cve-2026-7270-how-i-get-root-on-free...
AI-generated working exploit, write-up and prompts: https://github.com/califio/publications/tree/main/MADBugs/fr...
All that to say, the BSD userbase as a sizeable subset that are there for countercultural reasons, rather than technical. These are the people who buy into, say, OpenBSD's vaunted security reputation, or believe that "linux bad because reasons", so you're always going to get people in here bragging, because "not using linux" has become part of their identity.
I run a mix of FreeBSD and Linux on my personal devices. The ground truth is that FreeBSD is yet another unix-like OS written in C, and thus not immune from the types of bugs that stem from that lineage. None of the BSD distros are materially more secure or better than a properly-configured and patched Linux.
> thus not immune from the types of bugs that stem from that lineage
They never claimed that FreeBSD didn't have vulnerabilities. I honestly have no idea why grandparent decided to bring up their comment when it exactly validates what the person they were criticising says. GP admits the response to the vulnerability was well-coordinated. The response to security vulnerabilities was the exact, and only, subject of the post they're calling out.
I use Linux as well but I really like FreeBSD for a number of technical reasons. Like the ports collection, the jails, the first-class citizen ZFS.
And Gnome 3 doesn't really have anything to do with Linux. It is also available for FreeBSD if you want it (I don't, I hate the minimalist opinionated design style so I use KDE, also on Linux).
But I use Linux on servers where I run docker for example. It's not about "not using linux".
There's a very hard push on getting Gnome 3 aligned to systemd. Gnome is actually my preferred DE on Linux when I choose to use one. But compatibility with Unix systems is becoming harder every day.
From the gnome team this was to be expected because they are beholden to RedHat/IBM and the other big distros who push systemd heavily. But from the KDE team I didn't.
I've stopped my monthly KDE donations for this reason. Just to send a message that this isn't ok.
I've tried to use it but I dound it pretty difficult for systems that need a GUI. Maybe I should revisit.
sysutils/vm-bhyve makes it quite friendly.
I wouldn't use it for work, though, just personal. Work is all enterprisey kubernetes stuff.
Edit: there is a 'proxmox-like' for FreeBSD out [0] -- I did try it on a couple machines and couldn't get the network working, but consoles seemed to work.. Kinda.
0: https://sylve.io
For me it's all personal too. For work we still use VMWare a lot.
Yeah.
> No workaround is available.
Oh dear.
> Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date, and reboot the system.
Not everyone can just freebsd-update and reboot, so yes, "Oh dear." is a good response to this.
You should treat any system where non-admins regularly login as basically insecure/owned and rig your architecture appropriately.
TBH -- I don't have any of these kinds of boxes anymore. Who is really running anything like this in 2026 and for what purpose?
The systems should be cut off from sensitive administrative data, but a malicious student would at the very least have access to the other students' data with an LPE.
> Who is really running anything like this in 2026 and for what purpose?
Am I parsing your question correctly?
My point is that if you do, you probably shouldn't run, for e.g applications which need production db credential, or hold sensitive data on these boxes, or .. whatever.
Edit: I use FreeBSD extensively, for various things -- but shell access to them is restricted to the sysadmins..
often it's ssh'able with things like rbash and other restrictions and almost always you, well, can run something there (as you can edit php/other files right from web management ui).
Hordes of this (in Linux world).
Accept that everything is broken and terrible and yet somehow find a way to keep a sense of humor and smile about it.
The recent two. FailCopy and DirtyFrag and FreeBSD with Execve.
2 - Linux 1 - FreeBSD.
Of course, all OS have had past-time exploits. Three now have made the news.
Three. I don't know if this has a name yet... https://news.ycombinator.com/item?id=48067734
Naturally they don't do blog posts about what they find.
But windows still has a root and a lower privilege user. You typically need to click on "run as admin" to elevate privileges to, for example, alter system binaries.
It he talked about Android, I would have mentioned Project Zero.
Don't twist the meaning of posts.