4 ms·

I think I missed the correctness proof for the rust compiler and runtime.

• nickpsecurity 11y ago
  Exactly. It's same reason high assurance requires source-to-object code traceability even for SPARK Ada. Of course, it's nice the tooling helps with that. Rust needs same thing plus either proven or zero runtime target. Unless it has it already.
  • cmrx64 11y ago
    I have plans slated for doing proofs about Rust programs in 2017, if not sooner (I'm interning at Data61 on the seL4 verification team starting in two weeks, and if I don't get a chance to work on Rust verification then, I'll start after I'm done)
    • nickpsecurity 11y ago
      Oh hell, you going to be working with the top talent. You might learn some high assurance skills after all. That makes your project 2x as interesting. Good luck on the new job. :)
  • kibwen 11y ago
    Rust has long been capable of running without a runtime (that's how all OS development in Rust is expected to operate) and formal verification of the language spec is ongoing (though full verification is still probably years out, and who knows if the compiler will ever be formally verified).
    • nickpsecurity 11y ago
      Hell yeah! Appreciate the updates. My idea there was a runtime or overhead came from an early OS attempt in Rust where they couldnt get past real mode. Had to use non-Rust code for that and it was using too much space IIRC. They've gotten past those obstacles now?
      • steveklabnik 11y ago
        You need about 100 lines of assembly to get to a Rust kmain in long mode. Rust has effectively no runtime these days. Same amount as C or C++, basically.
        • nickpsecurity 11y ago
          That's great to hear. Thanks for chiming in with the good info as always.
          • steveklabnik 11y ago
            Any time. If you're interested in what exactly that code is, check out Phil's blog, linked upthread.
            • nickpsecurity 11y ago
              I'm guessing you mean this: http://os.phil-opp.com/entering-longmode.html http://os.phil-opp.com/entering-longmode.html Interesting stuff and seems like a good description of the code. Bookmarking it in case I do more in this area.
• wyldfire 11y ago
  pcwalton said a correctness proof of the type system is in-progress [1]. [1] https://news.ycombinator.com/item?id=7601944 https://news.ycombinator.com/item?id=7601944
  • pcwalton 11y ago
    It is. But that will still only prove whether the type system can correctly prevent memory safety problems. As many security people correctly point out, memory safety doesn't guarantee security of the programs you write in Rust. seL4 has a stronger security proof that can guarantee not only that seL4 doesn't have (for example) use-after-frees but that it also actually works right (for a formally-specified notion of "works right"). The reason you'd want to combine seL4 with Rust is to give confidence that (a) the core part of the system (microkernel) works right and that (b) the less core parts of the system (drivers, libc) are least free from nasty memory safety problems. To a first approximation, it's a compromise between a project like the OS in the "Writing an OS in Rust" series, which guarantees memory safety but doesn't guarantee that any part of the system actually does the right thing, and a hypothetical fully formally-verified OS, which is (with current technology) something that would be way too expensive and time-consuming to be practical.
    • nickpsecurity 11y ago
      Great explanation!