3 ms·
It's two orders of magnitude less code, but I would be hesitant to say it's more than a linear decrease in vulnerability. Rust (or OCaml in the past) seem like
by kev009 10y ago
It's two orders of magnitude less code, but I would be hesitant to say it's more than a linear decrease in vulnerability. Rust (or OCaml in the past) seem like a match made in heaven for solving Heartbleed and Cloudbleed type of problems.
- nickpsecurity 10y agoIt's been done: https://github.com/mirleft/ocaml-tls https://github.com/mirleft/ocaml-tls https://usenix15.nqsb.io/ https://usenix15.nqsb.io/
- rst 10y agoIt certainly is possible to write Rust code that references uninitialized memory, and thus serves up whatever was left there on last use. This is one way to get "...bleed" type problems, in which malformed requests trigger responses that sample some stuff lying around on the heap. http://www.tedunangst.com/flak/post/heartbleed-in-rust http://www.tedunangst.com/flak/post/heartbleed-in-rust