the Linux man-pages as an educational tool

[Jeffrey Walton]

On Sun, Aug 2, 2026 at 5:35 PM Alejandro Colomar <alx@kernel.org> wrote:
>
> [...]
>
> Most programmers can live in the safe bubble of <string.h>: those
> functions always require a string as input, and always provide a string
> as output.  Plain and simple.  It's difficult to write bugs when using
> those.

I don't think it is simple to write safe (secure?) code using the
interfaces currently provided by libc.* Proof by counterexample:
CVE-2026-5358,
<https://sourceware.org/bugzilla/show_bug.cgi?id=34067>.  If the libc
maintainers can't write secure code using the existing interfaces,
then there's little hope for the rest of us.

[*] libc could provide safer interfaces, but it declined to provide
them.  Confer, the lack of support for Annex K and the safer string
functions.  (I'm aware of the politics and the past decisions by folks
like Ulrich Drepper).

Jeff