220 40352 article Path: news.gmane.org!.POSTED!not-for-mail From: Daniel Gutson Newsgroups: gmane.comp.lang.c++.isocpp.proposals Subject: Re: more security concerns Date: Sun, 7 Oct 2018 01:50:15 -0300 Lines: 222 Approved: news@gmane.org Message-ID: References: <94d79dd7-ba3b-4bf8-91ed-e5dc02b33670@isocpp.org> <1442c15c-6a58-4f3e-83cf-9f5554fb9981@isocpp.org> Reply-To: std-proposals@isocpp.org NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="000000000000439aa705779c3e4b" X-Trace: blaine.gmane.org 1538887702 24408 195.159.176.226 (7 Oct 2018 04:48:22 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Sun, 7 Oct 2018 04:48:22 +0000 (UTC) Cc: Florian Lemaitre To: std-proposals Original-X-From: std-proposals+bncBDE3NBMV6UFBBE5B43OQKGQEW66OU3A@isocpp.org Sun Oct 07 06:48:18 2018 Return-path: Envelope-to: gclcip-std-proposals@m.gmane.org Original-Received: from mail-lj1-f197.google.com ([209.85.208.197]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1g90zJ-0006FA-P7 for gclcip-std-proposals@m.gmane.org; Sun, 07 Oct 2018 06:48:17 +0200 Original-Received: by mail-lj1-f197.google.com with SMTP id v62-v6sf2835808lje.9 for ; Sat, 06 Oct 2018 21:50:28 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1538887828; cv=pass; d=google.com; s=arc-20160816; b=fmV20e4to92kg9QCsTjbC8USjPcYa2W6jgZJrUwD2XXcJRtp6YCyRRBs0BX+mWw7uf 1RrczbZkijV3ucszQkbV7Ov3t+nNMO3aoUDoV4DaDTIDPCFsmTqE/SU29eqk+MnSr3YG 3vLJOzf+VrkETFEbkcQkpCMBCxLw1wu0kzzToGRh5NySh7mhprc+nsCqWIEQqCG7vboK K2Ujg6ld56ie2gUh0fHuewK/CHIql1NgOZAReCRnAwF0P+J+zPk8V+3K0gEU4WHqL7Tv tfi9QuXOClQiuoZZ1A5sXy8IbiY2xq1xKSmCfGx3Wmq5f2FxoVSfMnv3SpsAtcK1yvBU cUag== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:dkim-signature; bh=fLutzuZ7XFXgWjx4ppqmm4PKz5+UmoQFWLrq2mXQuIc=; b=JREU5YrFNKDRCjkaSYBxFFo102EjwTRuwBv0IuqtdEsCMWC9xuaTX4OwuMz9nmKDN7 FIvr02/jkHl0rIJvGHeVO1WwAkHIG56cUBYIzGO8l8Fo90neQE+B7NB9Jj6A+Z8su3m+ /koqEXIg1SieNW+qT9NNAU+v2nAPr46mo8yW7Mde4NDi0blh4F5fpqjjukceVaOCb9/N QRhOan0/uNEGjXGabCSW/tTk+LefIwz+G+Yc4P3cw3LQfAJGu0qjd29iJreXQrMoFkQt cdXWueTAHN/Ha80fY2O3lQdJAEtly/MrAYiaxb0nvLRpp8cL78f5xUI2RLfExwmNKmpK Xxqg== ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=o9GC1mt4; spf=pass (google.com: domain of danielgutson@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=danielgutson@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=isocpp-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:x-original-sender:x-original-authentication-results:reply-to :precedence:mailing-list:list-id:list-post:list-help:list-archive :list-subscribe:list-unsubscribe; bh=fLutzuZ7XFXgWjx4ppqmm4PKz5+UmoQFWLrq2mXQuIc=; b=ORCIFV2lxNakCvkht0i78XPvDwKvFjEL2f+fnlncfpZ09NxVPdHMROEAsw6cqrXrZH KGLzYoc482krdRMUsLXFt4zb72GPoorFBA8hKkdY7yLQFNgYV3NtKVQLarLGjPP4X0jG CBmCMRHF7iqb+fav+jf0xdX1boRkv3NefHOG9MxpsUTkbHwMLGGsZspFp6lTWSZXWDJO s4tQQayVfQc7D8LBCdGoM7HgqLsDbEifhicVOTJ8nU5WalffVU0fr2tA8tNk2H3qosfi GqMGf0V6dZitXnFXKuVeRJuhuVEFWFTHOJqDl0VmoVg1KlHIUKnrW5VKgiJe4TL9TlH+ 5ISw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:x-original-sender :x-original-authentication-results:reply-to:precedence:mailing-list :list-id:x-spam-checked-in-group:list-post:list-help:list-archive :list-subscribe:list-unsubscribe; bh=fLutzuZ7XFXgWjx4ppqmm4PKz5+UmoQFWLrq2mXQuIc=; b=snGKJE+HlLK4hZDdcOPI+oUPPerL+7Na0n9GaMFr005VkKsjl5+92yDxKSz9d1Qh6J aOvgtGcNKXESUlwMRKnTkq7u4/B8jUcV7b3ScMK5DecI9Hay4vvXeXcIgujZqma/kjvG GvorThiLLdQRzycWooHcktIhK3vyfhwlqqTQee766EwfBF1+g9XBVPmCcIACk6I2gvPS IHa0QGbe/AJ22b/QUEEAAZ/8rZp3LeoTxx+JgdYH0NcSmAny/x5yaSRoEZbNQ6HlD0NH L1IaRrOTjN0DTL7Xv4D6/THWItNWAissclb97blrgJXuhdUALO5VeWdEylcXPF8Oh9F3 Dmww== X-Gm-Message-State: ABuFfojU7C5LT8jiu8Qk7CHcpT8zY/Q5vrfQ2x+sbuKZ67j3tdb+b6Fd GG9jJm3IIfhjxnT+HcAd7UBugw== X-Google-Smtp-Source: ACcGV63Sh4YMXoibRosVhGfPYyDhUgJnE/pfzUdVI9TOdK4fHLNxHCpJxuoie1EMKiPc/sUvtwecFA== X-Received: by 2002:a2e:9085:: with SMTP id l5-v6mr536884ljg.6.1538887828481; Sat, 06 Oct 2018 21:50:28 -0700 (PDT) X-BeenThere: std-proposals@isocpp.org Original-Received: by 2002:a19:c603:: with SMTP id w3-v6ls380391lff.72.gmail; Sat, 06 Oct 2018 21:50:27 -0700 (PDT) X-Received: by 2002:a19:428f:: with SMTP id p137-v6mr10464915lfa.2.1538887827422; Sat, 06 Oct 2018 21:50:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1538887827; cv=none; d=google.com; s=arc-20160816; b=CrUMZ7rEldnaoWhlwYYIWt0OS3g95yAXt1qmktE43XJgcqnsQ1DCYt/0lNiHcCW6/m 0wAm5ghG9vX9qpFrD4eS1pYRvVCBRhSirA9iYK3v0QxvB05SYxtKVyahoP93dZTg7izj YWLSCicDva3PFXgW8z7JHuKMUMccCUrAdyP/+0t6Jnw4tu+Jk61VYmVFySrh9O7MTVaT qZjDdOaEqR5YpOujWqx0h4juDP68rcjre9Dpgbpj8wf+kHnk7SxW1HJMxIQ/D9Ge4Oi8 T/uQaP7ub/IFzT3pcIs7FJVX+QRgkNrJ6j8GCmNthGUCxN3/lU+LU/pVAfZF/ahdAtuU xFug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=tuHaa5jlGvrg0vZpAdcMRn8eLW2j9lNQCJEp9mZNxIE=; b=r6FwbxZ1rwLaMHhYnwPivq7U+xyNMuTRQU2cvB4fcVtHzYVkG4BZQIXoJJd4Jumn0u 86p/YWoQjBHNTxFfU5o/U79xNpPjL8XvDzuIjvHoax6rzwCW6vBKSkGNfp9Put+jgwx1 A5l6KfK71u98u8BqPguB1n2PAEcqQrLyZq/K4jZlryVSPU7HEqbi8YM3M7izkif277JJ mQlKfo6syPH11SCYjj8pw4PRMKRuETwp/uDdVyQayXbimqEmx2+3l4KwUoBXmxWn34xS Qielk2CTypVHus900IzWTnSCU94BxkPSOK5M/IaBVSbJ4NNMIyU2JELRcLZWXNGKqA3P Tn8g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=o9GC1mt4; spf=pass (google.com: domain of danielgutson@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=danielgutson@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Original-Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id s19-v6sor3986499lfb.65.2018.10.06.21.50.27 for (Google Transport Security); Sat, 06 Oct 2018 21:50:27 -0700 (PDT) Received-SPF: pass (google.com: domain of danielgutson@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41; X-Received: by 2002:a19:d713:: with SMTP id o19-v6mr9752411lfg.114.1538887826773; Sat, 06 Oct 2018 21:50:26 -0700 (PDT) In-Reply-To: <1442c15c-6a58-4f3e-83cf-9f5554fb9981@isocpp.org> X-Original-Sender: danielgutson@gmail.com X-Original-Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=o9GC1mt4; spf=pass (google.com: domain of danielgutson@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=danielgutson@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Precedence: list Mailing-list: list std-proposals@isocpp.org; contact std-proposals+owners@isocpp.org List-ID: X-Spam-Checked-In-Group: std-proposals@isocpp.org X-Google-Group-Id: 399137483710 List-Post: , List-Help: , List-Archive: List-Subscribe: , List-Unsubscribe: , Xref: news.gmane.org gmane.comp.lang.c++.isocpp.proposals:40352 Archived-At: --000000000000439aa705779c3e4b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable El vie., 28 de sep. de 2018 a la(s) 19:22, Arthur O'Dwyer ( arthur.j.odwyer@gmail.com) escribi=C3=B3: > On Friday, September 28, 2018 at 7:14:20 AM UTC-7, floria...@gmail.com > wrote: >> >> I want to highlight that [[nodiscard]] on functions is not about forcing >> the compiler to keep the value, but instead to emit a warning if the use= r >> doesn't use the value. >> So meaning would be different. >> In that respect, another attribute name might be better. >> > > Right. The standard attribute [[nodiscard]] goes in a *library* and > instructs the compiler to kick* the user* if the user has *forgotten to > use* the result of some *library call*. > > Daniel, what you are asking for is an attribute that goes in *user code* > and instructs the compiler to kick *itself?* if the user has *forgotten > to use* the result of some *assignment expression*. > Let's see. First, I don't see a need to distinguish between user code and library code in this context (whereas it makes sense for [[nodiscard]] on functions). What I am asking for goes anywhere, either user or library code= .. Second, the attribute targets the compiler: is a tool that the programmer can use to tell the compiler "this statement should not be discarded". What the compiler does with that information is implementation defined: it can just ignore it, it can honor it and not discard the statement, or it can warn the user that it will discard it anyways (a warning), so the user can later decide what to do (for example, recode the snippet, use volatile, etc.). > > > Also, it is already possible (but cumbersome) to implement already withou= t >> volatile: >> void f() { >> int secret_int; >> float secret_float; >> /* ... */ >> secret_int =3D 0; >> secret_float =3D 0 >> asm volatile ("" ::"irm"(secret_int), "xm"(secret_float)); >> } >> > > This certainly seems to make sure that the write reaches L1 cache, but do > you know whether the write is guaranteed to have reached and overwritten > any copies of the data that might remain in L2 and main memory? > What about the swap partition? Are you worried that a copy of the secret > may have been swapped out to disk? (Reductio ad absurdum: What if it was > swapped out to removable media that has since been ejected?) > > Before you can start talking meaningfully about preventing the compiler > from eliminating your dead "=3D0" statements, you need to have a mental m= odel > that explains what good those "=3D0" statements are supposed to do in the > first place. > > HTH, > Arthur > > -- > You received this message because you are subscribed to the Google Groups > "ISO C++ Standard - Future Proposals" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to std-proposals+unsubscribe@isocpp.org. > To post to this group, send email to std-proposals@isocpp.org. > To view this discussion on the web visit > https://groups.google.com/a/isocpp.org/d/msgid/std-proposals/1442c15c-6a5= 8-4f3e-83cf-9f5554fb9981%40isocpp.org > > . > --=20 Who=E2=80=99s got the sweetest disposition? One guess, that=E2=80=99s who? Who=E2=80=99d never, ever start an argument? Who never shows a bit of temperament? Who's never wrong but always right? Who'd never dream of starting a fight? Who get stuck with all the bad luck? --=20 You received this message because you are subscribed to the Google Groups "= ISO C++ Standard - Future Proposals" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to std-proposals+unsubscribe@isocpp.org. To post to this group, send email to std-proposals@isocpp.org. To view this discussion on the web visit https://groups.google.com/a/isocpp= ..org/d/msgid/std-proposals/CAFdMc-2WAF_RZR_fTAXdhP842WaBJ-m27nbTaCXDK3me1Y6= 1tw%40mail.gmail.com. --000000000000439aa705779c3e4b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


El vie= .., 28 de sep. de 2018 a la(s) 19:22, Arthur O'Dwyer (arthur.j.odwyer@gmail.com) escribi=C3=B3:
On Friday, September= 28, 2018 at 7:14:20 AM UTC-7, floria...@gmail.com wrote:
I want to highlight that [[nodiscard]] on function= s is not about forcing the compiler to keep the value, but instead to emit = a warning if the user doesn't use the value.
So meaning would be dif= ferent.
In that respect, another attribute name might be better.

Right. The standard attribute [[nodiscar= d]] goes in a library and instructs the compiler to kick=C2=A0the= user if the user has=C2=A0forgotten to use=C2=A0the result of s= ome library call.

Daniel, what you are aski= ng for is an attribute that goes in user code and instructs the comp= iler to kick itself?=C2=A0if the user has forgotten to use=C2= =A0the result of some assignment expression.

Let's see. First, I don't see a need to distin= guish between user code and library code in this context (whereas it makes = sense for [[nodiscard]] on functions). What I am asking for goes anywhere, = either user or library code.
Second, the attribute targets the co= mpiler: is a tool that the programmer can use to tell the compiler "th= is statement should not be discarded". What the compiler does with tha= t information is implementation defined: it can just ignore it, it can hono= r it and not discard the statement, or it can warn the user that it will di= scard it anyways (a warning), so the user can later decide what to do (for = example, recode the snippet, use volatile, etc.).
=C2=A0


=
Also, it is alread= y possible (but cumbersome) to implement already without volatile:
vo= id f() = {
=C2=A0 int secre= t_int;<= br>=C2=A0 float secret_float;
=C2=A0 /* ... */
=C2=A0 secret_int =3D 0;
=C2=A0 secret_float =3D 0
=C2=A0 asm volatile<= span style=3D"color:#000"> ("" = ::"irm&qu= ot;(sec= ret_int), "xm"(secret_float));
}

This certainly seems to make sure that the write reaches L1 cache, b= ut do you know whether the write is guaranteed to have reached and overwrit= ten any copies of the data that might remain in L2 and main memory?
What about the swap partition? Are you worried that a copy of the secret= may have been swapped out to disk? =C2=A0(Reductio ad absurdum: What if it= was swapped out to removable media that has since been ejected?)

Before you can start talking meaningfully about preventing = the compiler from eliminating your dead "=3D0" statements, you ne= ed to have a mental model that explains what good those "=3D0" st= atements are supposed to do in the first place.

HT= H,
Arthur

--
You received this message because you are subscribed to the Google Groups &= quot;ISO C++ Standard - Future Proposals" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to std-proposals+unsubscribe@isocpp.org.
To post to this group, send email to std-proposals@isocpp.org.
To view this discussion on the web visit = https://groups.google.com/a/isocpp.org/d/msgid/std-proposals/1442c15c-6a58-= 4f3e-83cf-9f5554fb9981%40isocpp.org.


--
Who=E2=80=99s= got the sweetest disposition?
One guess, that=E2=80=99s who?
Who=E2= =80=99d never, ever start an argument?
Who never shows a bit of temperam= ent?
Who's never wrong but always right?
Who'd never dream of= starting a fight?
Who get stuck with all the bad luck?

--
You received this message because you are subscribed to the Google Groups &= quot;ISO C++ Standard - Future Proposals" group.
To unsubscribe from this group and stop receiving emails from it, send an e= mail to std-proposa= ls+unsubscribe@isocpp.org.
To post to this group, send email to std-proposals@isocpp.org.
To view this discussion on the web visit htt= ps://groups.google.com/a/isocpp.org/d/msgid/std-proposals/CAFdMc-2WAF_RZR_f= TAXdhP842WaBJ-m27nbTaCXDK3me1Y61tw%40mail.gmail.com.
--000000000000439aa705779c3e4b-- .