security alerts in busybox

[Tim Tassonis]

Hi Robbie

On 4/25/26 17:48, Roberto A. Foglietta wrote:
> On Sat, 25 Apr 2026 at 17:26, Tim Tassonis via busybox
> <busybox at busybox.net> wrote:
>>
>>
>>
>> On 4/24/26 16:40, Roberto A. Foglietta via busybox wrote:
>>> Hi,
>>>
>>> Using a static code analyser, I found:
>>>
>>> Open potentially alerts by severity/class in branch `main`:
>>>
>>> - **security**: 103 critical, 96 high, 4 medium, **203 total**
>>>
>>> Alerts above are related to C-language code, none otherwise.
> 
> And that corner cases are altering the static internal ctime() buffer
> and reading it isn't an atomic operation. Something  that busybox
> developers were aware about because of the comments that they left in
> the code and how they use multiple printf instead of single with
> multiple ctime calls.

Every idiot with more than two months of coding in C has found out the 
hard way about that..

> 
> Curiously, people who are involved in this debate wish to impose their
> standard to others but they would accept that there are already
> standards out there. In many industries those standards aren't
> optional but mandatory. While your judgment is totally arbitrary, my
> dear Me Tassonis especially because you are not forced to use busybox
> from my repository.

No, boy, I do not with to impose any standards on anybody, it is 
actually you that tries to do that here. I didn't ask for any change in 
busybox, I'm fine with the current standards used in  ar.c

And don't worry about me using code from your repository, I was just 
wondering what all the fuss here was actually about.

> 
> Conclusion: your opinion has no value, altogether. Even if the busybox
> is compiled static and used in a single process constraint mode. Mine
> is very well founded into a single principle: some out there need that
> code be cleaned by "corner case, even almost impossible". Written by
> one person that solved a "corner case near impossible" that was
> forcing rebooting and destroying the filesystem into a freshly
> installed industrial line production by a great company and supported
> by a great consultancy company.

I missed that scene in Independence Day, was that before or after they 
uploaded that virus into Windows 3.11 computer that controlled the 
alien's mothership?

And hey: if your great company supported that by a great consultancy 
company decides to integrate code from busybox (just using busybox would 
not cause the mother-ship to crash) and are either to greedy or stupid 
to hire a half-decent programmer to first cleanup the code for safe use 
in their multi-threaded, corner-case-driven industrial line production: 
that would make me sooooo happy, even happier than Craig being able to 
call Kyle's mother a dirty fat jewish bitch. Very happy, indeed.

Respectfully
Tim