== Link: "The History of a Security Hole" (in various *BSD kernels)

To yank my words from Twitter, Michal Necasek's [[The History of a
Security Hole http://www.os2museum.com/wp/the-history-of-a-security-hole/]]
is a fascinating exploration of both the arcana of the x86 and what
C can innocently do to you. Watching the code train barrel down the
tracks towards its doom was decidedly compelling. There are also
some useful lessons for long term software development that can be
extracted here, since many of the mistakes made were entirely natural
ones.

I often find this sort of stuff fascinating, so I really liked
reading this entry and found I couldn't look away once things got
going and mistakes piled up on top of misunderstandings. By the
way, don't read this as a slam on the *BSDs; this sort of cascading
misunderstanding can happen in any software, and undoubtedly has
happened in non-BSD kernels as well in spots. It's simply easy to
miss things in large, complex software (see [[eg
../linux/PortingKernelCodeChallenging]]).

([[My tweet
https://twitter.com/thatcks/status/1035743689254100992]]. I'm
not sure where I got this from, but see [[HN
https://news.ycombinator.com/item?id=17891591]], which mentions
an interesting additional detail.)