5

BSD sockets API was released in 1983.

As it was implemented 3 decades ago and still being widely used, is it secure in today's scenario where every software has to be actively protected against being hacked.

Is it secure enough to be used in a production-level code?

I am writing a client-server application which does use encryption at both ends, but are there any pitfalls in sockets that can be taken advantage by a hacker?

Note:
1. I am writing the application in linux.
2. I don't have anything against the guys who developed this api, they have done a brilliant job.

9

Your question contains a category error.

BSD sockets aren't a thing. They are an API to the kernel, comprised of a set of system calls. In theory, the code in the kernel, like all other code in the kernel, could have a security bug. However, the statement about 1983 does not reflect actual history. The only thing that dates from 1983 is the specification. The kernel code has been continuously maintained and frequently reimplemented over the history of the Linux kernel.

In any case, you have no choice. Sockets are the API to the internet on Linux. If you want a userland program to have a connection to the internet, you will be programming to the socket API (unless you want to learn TLI, which has is just another interface to the very same kernel implementation).

  • i am sorry, i did not know that. thank you for the information. should i edit my question? – user2555595 Sep 28 '14 at 17:47
  • 1
    I don't see why. You got an answer. – bmargulies Sep 28 '14 at 18:14
  • Besides TLI another alternative is to directly interact with the network device and implement the transport layer yourself. Arguably a much less secure alternative though. – PlasmaHH Sep 28 '14 at 20:30
  • @PlasmaHH is there a non-root-access device for that? I was not aware. – bmargulies Sep 29 '14 at 0:59
  • @bmargulies: there are various ways to set this up, from tun interfaces through raw sockets to mmapping the hardware registers and buffers. All of this can be setup to not require root. – PlasmaHH Sep 29 '14 at 9:01
4

BSD sockets is a tool. How secure is a hammer? It is as secure as you use it. BSD sockets is used in many (I would say major) critical applications. So, the only danger I see is when developers don't read the docs or the buggy system. I've never heart about any critical issue in sockets on linux.

Hmm, what else to say? Maybe.... BSD sockets is a simple and easy to use and understand tool and due to its simplicity, it is "more difficult" to make bugs and so it should be easier to use it securely.

  • BSD Sockets isn't even a hammer. It's a description of how hard and heavy the part of the hammer that hits the nail is, and how durable the nail head is. – david Dec 5 '14 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.