DavidCooper wrote:I'll rephrase what I said before: ... to the point where it can dissassemble any program and work out exactly what it is indended to do in every aspect.
Sigh. That sounds great at the discussion table. Have you ever tried to make sense of raw machine code? Yes, you can see that numbers are shoved here and there, that there are increments and decrements and conditional branches. But to figure out what that code actually
does, on a
semantic level?
Of course you can write programs that can run forever and do unpredictable things, but to try to write a virus in such a way that your intention can be kept hidden within such a program is another matter entirely. How deep can a programmer think when trying to hide complex malicious code within mathematical algorithms which never halt?
You haven't gotten the larger picture. What the Halting problem says is that there is no way a software could figure out what some other software does without actually running it with its actual parameters.
Is it possible for a buffer overrun to happen without you making an error in calculating how much space the data coming in will take up? I'd assumed that any device bringing in data without feeding it through the processor would have a counter which you set first to tell it when to stop.
In theory, yes. You need to forget about that only once. Or you restructure your code and the part that does the check suddenly disappears from the execution path. Such things
happen.
I don't know about SQL injections either - do they just fire out machine code into random memory locations without you asking them to?
No, they execute arbitrary SQL commands because you forgot to sanitize your input. That could be a command to delete your database, to modify data or to introduce a subprogram.
It doesn't have to be intentional malware to cause damage. Simple human error is completely sufficient.
And if the protection mechanisms catch the problems, why bother to remove the bugs?
As I said, I know that argument. It was fielded for years by Amiga users to justify AmigaOS not having memory protection. Hell, I said so myself.
You know what?
I was wrong.
There are good reasons to make your software as bug-free as possible. User satisfaction, for one. But there is
no reason to take risks, to jeopardize your work of the last hour because the next time your mail program fetches mail it might croak and take the whole OS with it.
I don't like that mentality, and nor did the people who wrote all the stuff that runs on my Psion 5mx which I've been using heavily for years without a reboot.
My Amiga also ran long stretches without a reboot. Especially when it was running only a select few applications.
But I still wanted to have memory protection. It's a bad feeling, not really knowing whether your work might have been corrupted by an application crashing (and even on the Amiga, where the quality bar for software was quite high and people took pride in their work, apps crashed occassionally).
There are plenty of unimportant display bugs which can safely be left alone if they aren't too distracting (usually it requires extra code to clear them up), and no one can possibly exploit them to do harm on the machine.
Says you. How many experience do you have with malware? A good friend of mine works in the security department of a major German bank. He could tell you some things about how "unimportant display bugs" and such stuff can be exploited, which would make your hair stand on end.
Memory protection is easy.
I just have a feeling that it may disappear from machines in the future, so why design an OS to depend upon it?
I bet you a month's salary against a hamburger that won't happen within our lifetime.
But programs from trusted sources can also run in the same address space as the OS where they can be made a good bit simpler and a fraction faster.
You said you want to keep track which memory belongs to which application, and which memory areas are accessed by which app. You can't do that significantly "simpler" than through the MMU.
I haven't read up on HTML 5 yet. What is the code supposed to do, and what form does it take? I can't imagine that it would just inject machine code from any old site on the Net into your machine's memory and force you to run it.
The friend I was talking about has found (and reported) a bug in the
specification of HTML 5, that basically
requires a compliant browser to execute code embedded in a canvas object. And that's just one miniscule thing in a
very complex standard. (Just to prove that it's not only software errors. There are errors in hardware, there are errors in specifications. You cannot avoid that.)