gets() - dangerous?

[Keith Thompson]

Don't hold your breath. Buffer overflow is not a c language topic.

Sure it is, but the discussion ends with the phrase "undefined
behavior".

 

[Joe Wright]

Lee said:




No, it's the linker that warns you, not the compiler.




By overwriting the stack, for example. On a typical machine, the program is
loaded from disk into memory before execution. During execution, it is
present in memory. And the thing about memory is that it can be overwritten
with new values.




Quite.

When was it that use of gets() became widely known as evil? I started C
fifteen or more years ago and it was evil then. Why are some now just
discovering it is evil? Is anyone listening?

 

[Richard Heathfield]

Randy Howard said:

Possibly, but I wonder how many hits you would find if you could
grep the source on all of sourceforge for gets(). I suspect
it's nonzero, and that represents a tiny portion of the software
out there that could contain it, outside of "student code".
(Yes, I know a lot of what is on sourceforge is student level,
at best)

If a program contains a call to gets(), it is broken. The fact that some
programs contain calls to gets() is not a good argument for continuing to
offer support for gets() in its present form.

If gets() is removed from the library or re-cast as something like
system("format c: /y") or system("rm -rf *") or whatever, then this will
not affect any well-written programs whatsoever. As for those programs it
does affect, we're better off without them.

 

[websnarf]

If you examine the study rather than news reports on it from seemingly
uninformed journos, you will find that Nature deliberately excluded
articles which might be subject to any contention, disagreement or
debate, ie anything in humanities, much of the science, politics, and
all biography. This eliminates virtually all of Wikipedia I suspect.

But it would eliminate all of Britanica too by the same reasoning.
Obviously they wanted to pick topics for which they could find real
authorities that could establish absolute truth on the topic. That's a
little hard to do with abortion.

And 33% more errors in the articles there is no debate about sounds
pretty dang poor to me.

Well as long as we are going to cite the actual data -- they found an
average of 3 errors per article in Britanica, and 4 in Wikipedia.
Personally I find anything above about 0.001 pretty unacceptable to me,
but if this is the best standard we have, then I just see it as a wash
-- Britanica and Wikipedia are roughly the same, and you need to go
beyond them for any serious research anyways.

As a side note, I've made about a half dozen significant contributions
to Wikipedia myself, and try very hard to steer away from anything that
isn't clearly true or which incorporates my personal bias. So when I
read that story, I was a little saddened to learn that the error rate
is so high (I really don't think my error rate on WikiPedia is anywhere
near that), but equally shocked that Britanica is not better in any way
that seriously matters.

What's poor is that there is an error rate in articles that is greater
than 1 per, let alone as bad as 3 or 4. Is the human race really that
pathetic that technical integrity is beyond our grasp? Britanica is
not relevantly better -- so the problem is not with Wikipedia but with
people's accuracy in general.

I always love this bullshit argument.
"Someone else wrote lies and/or misinformation but thats not their
fault, its yours for not spending your time fixing it."

No the problem is that these people spend their time yelling about the
inaccuracies at the top of their lungs instead of being part of the
solution, for which there is an obvious need.

Er, no. Its the fault of the person who was too lazy, biassed or
ignorant to get the facts right in the first place, and its the fault
of the maintainers of wikipedia for not applying better editorial
control.

This shows ignorance of how Wikipedia works. There *IS* no structured
editorial control outside the contributors themselves. And there is no
*fault* here. If you don't have the patience to be part of the
solution, your standing in decrying its problems are seriously
undermined and IMHO, have no value. You didn't pay for Wikipedia, and
you didn't put in any effort to make it better, and yet you are going
to complain about it rather than either marvelling at just how good it
is considering or helping make it better.

This just seems to me like seeing an deaf old lady trying to cross a
railroad track with a train coming, then pulling up a lawn chair and
saying "Wow, this accident is going to be good!"

And in whose interest is it to defend it, even when faced with a
glaring failure ?

Having a universally accessible, amazing large, somewhat accountable,
up to date, and free encyclopedia with an accuracy rate (which I have a
small role in assisting) similar to commercial offerings? See, unlike
some people, I actually see a lot of *value* in Wikipedia -- and I
think a lot of people do. If the effort I put into it is mirrored by
others, then it will mean that I should expect that level of content
and accuracy of the thing to be extremely high.

As an aside, I recently looked up information about Sucralose and
Aspartame -- I was just looking up basic information, and as
comparison, I was also googled for information on those two things.
The whole business about stability, how they are mixed with other sugar
substitutes, and the process by which they are made, and the safety
arguments for each comes across is a very clear and structured way in
the Wikipedia articles. I *learned* something from Wikipedia that I
just couldn't get from google searches, and that aren't going to be in
obsolete versions of Britanica, or sparse resources like Microsoft's
Encarta (the last two, which nobody seems to criticize with anywhere
near the volume we're seeing Wikipedia criticism.) Now if I want
*real* information about those sugar substitutes, I am going to have to
collect data myself from various FDA and equivalents from other
countries (since I don't really trust the american one.) That's a bit
of a research project considering I just wanted basic information.

So you can count me among the defenders.

 

[Richard Heathfield]

Joe Wright said:

When was it that use of gets() became widely known as evil?

1988, I think.

Is anyone listening?

Alas, no.

 

[Randy Howard]

Richard Heathfield wrote
(in article

Randy Howard said:


If a program contains a call to gets(), it is broken. The fact that some
programs contain calls to gets() is not a good argument for continuing to
offer support for gets() in its present form.

Which is why I wasn't arguing for continued support. I was
simply commenting about the idea that it was useful for teaching
purposes, which I'm not sold on.

If gets() is removed from the library or re-cast as something like
system("format c: /y") or system("rm -rf *") or whatever, then this will
not affect any well-written programs whatsoever.

Gee, that's likely.

As for those programs it does affect, we're better off without them.

Agreed.

 

[Randy Howard]

Joe Wright wrote

When was it that use of gets() became widely known as evil? I started C
fifteen or more years ago and it was evil then.

Sounds about right.

Why are some now just discovering it is evil? Is anyone listening?

For the same reason that "news" is considered recurring daily if
not hourly discussion of some missing girl in the caribbean six
months after it happened.

Tech "news" is limited to the latest cool video card for gaming.
What we need is a "slashdot" for actual programmers, rather
than a version aimed at those that wish to pretend to be
technical by discussing the latest gadget trends.

Usenet used to serve that purpose, but a very small percentage
of the tech community is involved in it today.

 

[Jordan Abel]

Joe Wright said:


1988, I think.

Why did it make it into the standard, then? Other things from the base
document [IIRC for the library it was the "/usr/group" proto-posix
standard] didn't make it in, or were changed

 

[Jordan Abel]

Richard Heathfield wrote
(in article


Which is why I wasn't arguing for continued support. I was
simply commenting about the idea that it was useful for teaching
purposes, which I'm not sold on.


Gee, that's likely.

A more likely change is to add a required diagnostic [some
implementations already provide such a diagnostic] and perhaps to allow
such programs to fail to translate.

 

[Richard Heathfield]

Randy Howard said:

I was
simply commenting about the idea that it was useful for teaching
purposes, which I'm not sold on.

Nobody has suggested that gets() is useful for teaching purposes, as far as
I'm aware. What somebody did suggest was that an overtly destructive
implementation of gets() would have educational value. I think it's called
aversion therapy.

 

[Mark McIntyre]

Joe Wright said:


1988, I think.

Why did it make it into the standard, then? Other things from the base
document [IIRC for the library it was the "/usr/group" proto-posix
standard] didn't make it in, or were changed

Most likely, lots of existing code using it already.

 

[Mark McIntyre]

But it would eliminate all of Britanica too by the same reasoning.

Incorrect: It would eliminate 50% less of Britannica.

Obviously they wanted to pick topics for which they could find real
authorities that could establish absolute truth on the topic. That's a
little hard to do with abortion.

Perhaps you should actually read the Nature article, instead of
guessing.

-- Britanica and Wikipedia are roughly the same, and you need to go
beyond them for any serious research anyways.

33% is significantly outside the statistical level of 'sameness' for
the article population they examined. Do you have any idea about
stats?

No the problem is that these people spend their time yelling

No, this isn't the problem. Trying to blame the people who spot the
errors is classic defensive behaviour of someone who knows they're
wrong by the way,

about the
inaccuracies at the top of their lungs instead of being part of the
solution, for which there is an obvious need.

I recommend you read the Register's excellent series of articles on
exactly what happens when one actually /does/ try to correct glaring
errors, omissions and falsehoods.

This shows ignorance of how Wikipedia works. There *IS* no structured
editorial control outside the contributors themselves.

This is precisely my point. There is no editorial control, so there
is nothing, nothing at all, to prevent complete lies, falsehoods,
misunderstandings and other mistakes.

If you don't have the patience to be part of the
solution,

Ah. I didn't realise I was talking to a cretinous utopian "the web is
god" lunatic.

So you can count me among the defenders.

I pity you.

 

[Gordon Burditt]

Whenever I use the gets() function, the gnu c compiler gives a

warning that it is dangerous to use gets(). Is this due to the
possibility of array overflow?

Yes, plus the inability to do ANYTHING to prevent it until
it's too late.

Is it correct that the program flow can
be altered by giving some specific calculated inputs to gets()?

Chances are, you can alter the program flow by simply giving gets()
a sufficiently long line without calculating much of anything. This
is particularly true if the input buffer for gets() is an auto
character array. (Although this is system-specific, it is likely
to amount to "scribbling on the return address in the stack frame",
causing a branch to, err, somewhere) The program will likely just
crash rather than send out tons of Viagra ads for you, but often
that's enough to do damage.

How
could anyone do so once the executable binary have been generated? I

Why don't you ask the FBI Computer Task Force?

have heard many of the security problems and other bugs are due to
array overflows.

Gordon L. Burditt

 

[Jack Klein]

<OT>
That's what crusty academics say because a new competitor has come along. Of
course they want people to rely on peer-reviewed literature where they are
the peers.

And your sentence, above, is what many uncredentialed individuals say
when they want their (opinions, theories, etc.) given full weight
without the necessity of making the effort to obtain the credentials.
Note that I am not saying this is so in your case, nor am I attempting
to insult you.

Quite a few problems have been documented with Wikipedia, several just
recently. One of the real problems with Wikipedia, mostly absent from
formal peer-review literature, is the anonymity and lack of
accountability of the contributors.

In fact something like 50% of scientific papers make conclusions which are
later refuted or challenged by further papers. (read Iohannis for a
peer-reviewed take on the subject).
No medium written by humans can guarantee complete accuracy, freedom form
bias, etc. Wikipedia is no different from any other source.

Wikipedia is very much different from many other sources. I made no
claims whatsoever about its quality, accuracy, or freedom from bias. I
merely responded to a line in an earlier post, which you snipped,
where a poster claimed that something was "well documented" followed
by a link to Wikipedia.

Based on recent well publicized events, I maintain that existence of a
Wikipedia article, by itself, does not guarantee that the atricle's
subject is well documented.

 

[Randy Howard]

Richard Heathfield wrote
(in article

Randy Howard said:


Nobody has suggested that gets() is useful for teaching purposes, as far as
I'm aware. What somebody did suggest was that an overtly destructive
implementation of gets() would have educational value. I think it's called
aversion therapy.

Ahh. I misunderstood then.

 

[Malcolm]

And your sentence, above, is what many uncredentialed individuals say
when they want their (opinions, theories, etc.) given full weight
without the necessity of making the effort to obtain the credentials.
Note that I am not saying this is so in your case, nor am I attempting
to insult you.

There's a fuss at our university about students referencing Wikipedia. The
fact is that the student obtains his knowledge from Wikipedia, because if
you want go from knowing nothing about a topic to having some level of
background, the easiest and legitimate way is to type "Jacobi decomposition"
into Wikipedia.

Quite a few problems have been documented with Wikipedia, several just
recently. One of the real problems with Wikipedia, mostly absent from
formal peer-review literature, is the anonymity and lack of
accountability of the contributors.

There is a case for ending the tradition of anonymity.

Wikipedia is very much different from many other sources. I made no
claims whatsoever about its quality, accuracy, or freedom from bias. I
merely responded to a line in an earlier post, which you snipped,
where a poster claimed that something was "well documented" followed
by a link to Wikipedia.

Based on recent well publicized events, I maintain that existence of a
Wikipedia article, by itself, does not guarantee that the atricle's
subject is well documented.

It's a new medium. It has its problems. So too do all other sources of
information. It must not be dismissed, but I agree that one mustn't accept
everything written as authoritative.

 

[Giannis Papadopoulos]

There's a fuss at our university about students referencing Wikipedia. The
fact is that the student obtains his knowledge from Wikipedia, because if
you want go from knowing nothing about a topic to having some level of
background, the easiest and legitimate way is to type "Jacobi decomposition"
into Wikipedia.

Yes, I have found it very useful to make a jump start on a new subject.
And I may reference it, but I cannot see how can any paper or anything
else rely entirely on wikipedia.

Maybe in some years, when Google or someone else will collect all human
written knowledge and research and post it on the Internet, wikipedia
may act as a central "knowledge hub"...

 

[websnarf]

There's a fuss at our university about students referencing Wikipedia. The
fact is that the student obtains his knowledge from Wikipedia, because if
you want go from knowing nothing about a topic to having some level of
background, the easiest and legitimate way is to type "Jacobi decomposition"
into Wikipedia.

But its not just that. You can also get up to date information that is
directly integrated into articles even of a historical nature (for
example if a FOIA request reveals some activity by the CIA from 50
years ago, and this has a previously unrealized perspective on history,
or whatever.) You can also get information from corporate insiders, or
from people who otherwise can distill really convoluted information
into simple short articles that would otherwise not find a normal
mainstream vehicle for being revealed. (Like details about Sucralose
and Aspartame.)

There is a case for ending the tradition of anonymity.

Yeah, and of course the people who are crying a river about it, don't
bother to notice that things *ARE* being done about this. (Only
registered users can author new articles, certain articles are blocked
from being editted except by credible wikipedians, etc.)

It's a new medium. It has its problems. So too do all other sources of
information. It must not be dismissed, but I agree that one mustn't accept
everything written as authoritative.

And that's the line of reasoning that just doesn't have play with the
naysayers. And I don't know why. This is the *OBVIOUS* most well
reasoned position to take -- its new, and its got growing pains, and is
otherwise quite remarkable given this situation. "A new technology is
not perfect" -- wow what impressive and deep criticism.

The vicious attacks on Wikipedia in the recent press about it are one
sided and completely out of proportion. Its as if there is some other
adgenda at work here but I don't quite understand it. Who would have
some innate hatred of the concept a large free and pervasive
encyclopedia whose quality is remarkable given the premise of being
built by random contributors? Is this campaign being waged by
Britanica? By historians or other intellectuals who don't like being
second guessed with a Wikipedia search? The news media who don't like
public dissemination of inconvenient truths and perspective to get in
the way of their editorial spin? I dunno -- those all seems a bit on
the conspiratorial side, but there's no denying the existence of a
concerted campaign against Wikipedia.

 

[Richard Heathfield]

Mark McIntyre said:

This is precisely my point. There is no editorial control, so there
is nothing, nothing at all, to prevent complete lies, falsehoods,
misunderstandings and other mistakes.

Or even simple partisanship. Wikipedia shows considerable dislike for C, but
is very positive about, say, C++, Python, and Lisp.

Encyclopaediae are supposed to be impartial. Whoever wrote the C bit did not
honour this tradition. Not sure why - for heaven's sake, it's only a
programming language! But take a look, and you'll see a "criticisms"
section - which is not something I noticed in the C++, Python or Lisp
sections. Does this mean those languages are beyond criticism? Or does it
simply mean the Wikids don't understand C very well?

 

[Richard Heathfield]

(e-mail address removed) said:

The vicious attacks on Wikipedia in the recent press about it are one
sided and completely out of proportion.

Who cares? What would the press know about it?

Its as if there is some other
adgenda at work here but I don't quite understand it.

I like C. I read the Wikipedia article on C. It's very anti-C, and clearly
written by someone who doesn't know C well enough to use it properly.

The Wikipedia attitude to C is like that of an amateur cook railing against
the dangers of carving knives, and recommending butter knives for all your
carving needs.

I also read some of the Wiki articles on other languages - C++, Python,
Lisp. No such anti-language sentiment there.

From a comp.lang.c perspective, then, Wikipedia sucks.