Hacker News new | past | comments | ask | show | jobs | submit login

No it isn't, what?

Nothing he said discounts what you added. You should have just said "be careful with strings" and linked your link, rather than making some vague hand waving correction which wasn't...




It isn't a dumb and simple program. It does a lot of complicated stuff under the hood, and it is good to be aware of that.


It's not a complicated thing it does at all: it uses the standard system facilities for opening an object file to scan through the data section instead of the entire file. In the '80s, it used a.out format, which was dead simple. Today, GNU strings uses the GNU libbfd library, which is quite a bit more complicated, although the fundamental process of parsing an ELF file is also not that complicated.

The actual problem here is that such a dumb simple task as parsing an ELF file isn't something you'll do without vulnerabilities, if you're not paying attention to vulnerabilities. Run `man elf` on your favorite Linux system, and you'll see docs of <elf.h>, which you can use to read ELF files. Write something to just dump the text section -- it shouldn't take you more than like 30 lines of C. Then tell me how many integer overflows you managed to squeeze in those 30 lines. :)


It's simple in what it does, which is what the OP was going for. He never really made any claims of it being simple in how it does it.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: