5 ms·

No, but not everything needs to be memory safe. That's what the kernel is there for. You can typically just restart the program. The classic program safety vs

No, but not everything needs to be memory safe. That's what the kernel is there for. You can typically just restart the program. The classic program safety vs programmer time tradeoff.

AaronFriel 10y ago
If your program isn't memory safe, it's very often the case that someone can make your program run their program, at which point the kernel doesn't know that your program didn't intend to modify itself. W^X/NX bits and other technologies don't totally obviate the issue, as ROP gadgets can be used to defeat it. And so on, there's a whole domain of computer science dedicated to that arms race and no evidence that it's stopping any time soon. On the other hand, a Rust program without unsafe should simply never execute code outside of its defined control flow, it's not possible to hijack any control flow on the stack or heap, and so a running program under arbitrary user input can only ever explore execution paths that exist in the absence of memory unsafety. No ROP gadgets or heap/stack smashing, no overflows leading to overwriting a function definition in memory, no overwriting the parameters of a function to cause impossible branches to be taken, and so on.
- cbhl 10y ago
  I recall that there was at least one shipping video game where "someone" was "my future self" -- they exploited a buffer overflow after-the-fact in a shipped video game (a EULA dialog?) in order to make it run an updater.
- randyrand 10y ago
  Not every program is intended to be connected to the internet or have user provided input. I agree, for many programs memory safety matters. But there are a large chunk of programs where it doesnt matter/is not worth the effort.
  - msbarnett 10y ago
    > Not every program is intended to be connected to the internet or have user provided input. While true, I think the vast majority of programs do do one of these two things (and increasingly, both), whereas the majority of programmers seem to think that what they work on "isn't a security issue". It's this disconnect that is giving us the Internet of Crap. Your phone apps, your fridge, your video games, your text editor -- every program I interact with every day -- it's all a security issue
pcwalton 10y ago
> No, but not everything needs to be memory safe. That's what the kernel is there for. The kernel doesn't automatically defend against RCE.
- randyrand 10y ago
  I should have specified more clearly by: > That's what the kernel is there for. I meant, you should still be able to easily restart your program and continue using it. It wont crash your computer. RCE is only a problem for computers that are connected to the internet and/or take user provided input.

No, but not everything needs to be memory safe. That's what the kernel is there for. You can typically just restart the program. The classic program safety vs programmer time tradeoff.

AaronFriel 10y ago

If your program isn't memory safe, it's very often the case that someone can make your program run their program, at which point the kernel doesn't know that your program didn't intend to modify itself. W^X/NX bits and other technologies don't totally obviate the issue, as ROP gadgets can be used to defeat it. And so on, there's a whole domain of computer science dedicated to that arms race and no evidence that it's stopping any time soon. On the other hand, a Rust program without unsafe should simply never execute code outside of its defined control flow, it's not possible to hijack any control flow on the stack or heap, and so a running program under arbitrary user input can only ever explore execution paths that exist in the absence of memory unsafety. No ROP gadgets or heap/stack smashing, no overflows leading to overwriting a function definition in memory, no overwriting the parameters of a function to cause impossible branches to be taken, and so on.

cbhl 10y ago
I recall that there was at least one shipping video game where "someone" was "my future self" -- they exploited a buffer overflow after-the-fact in a shipped video game (a EULA dialog?) in order to make it run an updater.
randyrand 10y ago
Not every program is intended to be connected to the internet or have user provided input. I agree, for many programs memory safety matters. But there are a large chunk of programs where it doesnt matter/is not worth the effort.
- msbarnett 10y ago
  > Not every program is intended to be connected to the internet or have user provided input. While true, I think the vast majority of programs do do one of these two things (and increasingly, both), whereas the majority of programmers seem to think that what they work on "isn't a security issue". It's this disconnect that is giving us the Internet of Crap. Your phone apps, your fridge, your video games, your text editor -- every program I interact with every day -- it's all a security issue

pcwalton 10y ago

> No, but not everything needs to be memory safe. That's what the kernel is there for. The kernel doesn't automatically defend against RCE.

randyrand 10y ago
I should have specified more clearly by: > That's what the kernel is there for. I meant, you should still be able to easily restart your program and continue using it. It wont crash your computer. RCE is only a problem for computers that are connected to the internet and/or take user provided input.