33 ms·
Tor in a safer language: Network team update from Amsterdam
- deleted 10y ago[deleted]
- Gaelan 10y agoThis is either a horribly timed announcement or a joke written very seriously. I have no idea which.
- deleted 10y ago[deleted]
- danieka 10y agoHow so? I'm honestly wondering why.
- steveklabnik 10y agoToday is April Fool's Day.
- danieka 10y agoOh. So I get it is a joke, I just don't get why it is a joke. I program daily in Go and everytime I read about buffer overflows and a dozen other preventable security holes I'm glad I'm programming in Go. But maybe this joke is only funny to those who enjoy programming in C? :)
- masklinn 10y agoDoesn't seem to be a joke, the "meeting" was week-long and lasted from the 22nd to the 27th: https://trac.torproject.org/projects/tor/wiki/org/meetings/2017Amsterdam https://trac.torproject.org/projects/tor/wiki/org/meetings/2... It's just the ML recap mail which hit a rather poor timing.
- kbenson 10y agoThe email was time stamped as being prior to April 1st UTC, so it's actually less an issue of the recap email being poorly times and more an issue of the post to HN being during a confusing time period.
- Gaelan 10y agoI mean, the post could have been posted on April 1. We don't know that it was posted from a UTC area.
- masklinn 10y agoI believe Sebastian is German (or possibly Austrian), I think the CET date change was last week so we're in CEST (UTC+2) which means it was posted at 30 to midnight local, close enough that it could be just in time for April 1st local.
- deleted 10y ago[deleted]
- masklinn 10y agoSeems legit, the meeting/sprint where all that stuff was decided/announced and done was last week (22 to 27 of March), it seems to just be the ML update which was unfortunately timed and posted late on the 31st. Or Sebastian was very dedicated to the joke, but they seem to have posted a comment confirming it's serious on /r/rust: https://www.reddit.com/r/rust/comments/62o9rx/tordev_tor_in_a_safer_languagerust_network_team/dfolfqh/ https://www.reddit.com/r/rust/comments/62o9rx/tordev_tor_in_... Looking at their comment history, both the Tor membership and the interest in Rust are there, and Sebastian just tagged themselves on the relevant Tor issue: https://trac.torproject.org/projects/tor/ticket/11331 https://trac.torproject.org/projects/tor/ticket/11331
- Manishearth 10y agoIt's legit, Tor devs I know have been talking about it for a while.
- lucb1e 10y agoWell not everyone in every culture thinks no serious work can be done on April 1st.
- sfilargi 10y agoAs a mere average user of computer languages, every time I play around with Go I start wondering how a language like this became so popular. It feels like it was invented in a universe where Haskell, OCaml, Erlang, Smalltalk, Lisp and so many more languages and research in languages never happened.
- zem 10y agoit was also invented in a universe where haskell, ocaml, erlang, smalltalk, lisp and so many more languages never achieved mainstream adoption. go will never be all things to all people, but it's clearly popular in the niche it's targeting.
- fossuser 10y agoSometimes I think the syntactical difference of functional languages alone is the reason they're unpopular. Iterative languages seem to match more closely how people speak/think in verbal language.
- moomin 10y agoIt's a pity it's hard to be precise in verbal communication without resorting to talking like a functional programming language.
- donatj 10y agoI agree completely. I recently went to an Elm workshop and while I found it very interesting, the Haskell syntax just didn't agree with me. I want more enforced required clarity. I compared it at the time to writing English without any punctuation, you can do it but it makes comprehension much more difficult.
- rnhmjoj 10y agoIt may match more with the way we speak but not really the way we think, imho. When you ask someone to do something you usually just give him a general description of what the end result would be and then add more details if necessary. You don't tell him exactly what to do step by step from the start to the end, because you don't really care most of the time. Markup and declarative style are closer to the way we think.
- deleted 10y ago[deleted]
- najati83 10y agoThis is exciting not only because of the Tor project itself but because this will set an example for other projects to follow.
- wklm 10y agoThis creates also an opportunity to engage Mozilla into contributing
- duneroadrunner 10y agoIf any of the developers are reading this, converting the existing C code to SaferCPlusPlus[1] (a memory safe subset of C++) is probably a more expedient solution (if that's what they're looking for). (And speaking of contributing, an automatic translation (assistance) tool is in early development, and could maybe be functional in short order with a little extra motivated talent... :) [1] shameless plug: https://github.com/duneroadrunner/SaferCPlusPlus https://github.com/duneroadrunner/SaferCPlusPlus
- tjalfi 10y agoI would recommend updating your .gitignore for VS2015. The .vs directory and *.VC.db should both be excluded from the repo.
- duneroadrunner 10y agoThanks. I'll take all the git/github advice I can get. :)
- rebelwebmaster 10y agoNote that Mozilla is already working with Tor developers to get more of their patches upstreamed into Firefox to ease their maintenance burden. https://blog.torproject.org/blog/tor-heart-firefox https://blog.torproject.org/blog/tor-heart-firefox
- deleted 10y ago[deleted]
- bitexploder 10y agoI am curious why they were advised not to use Go. Probably not a safety concern. Edit: cgo != Go. Thanks for the responses. I have done a bit of Go, but just pure Go.
- nickpsecurity 10y agoHere's what I'd have told them: https://news.ycombinator.com/item?id=14013617 https://news.ycombinator.com/item?id=14013617
- m-j-fox 10y agoThey were advised against cgo. In my not so recent experience, it is a huge PITA.
- hannob 10y agoGo needs a garbage collector that needs to be set up. Using Go code within C code is possible, but it creates additional hurdles. Therefore a slow transition of rewriting parts of the code in a safer language and having the core still in C is much less feasible with Go. With Rust you can easier just compile some object files and link them into your application.
- 10y ago
- m-j-fox 10y agoI don't know much about Tor. But I hope I can route all of my home network traffic through it. That or route everything through VPN. I'll bet you can guess why I'm suddenly interested.
- seibelj 10y agoFounder of https://easyvpnrouter.com/ https://easyvpnrouter.com/ ask me anything or how to build one yourself if you want a project
- Tempest1981 10y agoWe use OpenDNS for safer kid surfing and logging. Can I get similar functionality? Your FAQ says you use "Private Internet Access’ custom DNS servers". Also, what about the Netflix issue?
- seibelj 10y agoYou cannot use Netflix with any non-self-hosted VPN service, they have put a lot of effort into getting around it. We use PIA's DNS for anonymity.
- Tempest1981 10y agoSo do you have a workaround? Can you bypass VPN routing for Netflix and other specific domains?
- seibelj 10y agoInteresting idea - adding whitelisted domains to bypass the VPN. We will investigate this. Currently we recommend running 2 routers simultaneously (which do not interfere because of automatic channel switching) with the VPN chained after the normal one. This allows you to choose when to use VPN. Basically the Easy VPN Router is designed to be super easy so that non-technical people don't mess anything up. Building one yourself is tricky, especially to cover edge cases like the VPN dropping, the internet going in and out, etc.
- searchfaster 10y agoWhen I read safer language, 'Rust' came into mind automatically.. Not sure if 'Rust' will ever be as popular as golang but certainly see a future with it popping up everywhere mission critical / super safe software is required.
- JepZ 10y agoI am afraid Rust will become much more popular than Go is atm. I think the C++ crowd will embrace it as soon as it will be mature. I am sure it is better than C++, but I still like the concepts and syntax of Go much better. But as C++ programmers obviously never care about readability and simplicity, I am pretty sure they will take Rust. After all, Rust is a decent language and as users, we will all benefit from the migration.
- 59nadir 10y ago> ... but I still like the concepts and syntax of Go much better The concept of not having features because someone on your team might use them? You subtly say that Rust is a worse language because it doesn't seem like it was designed in the 80's, when clearly as a language (together with the compiler), it's objectively better than Go.
- JepZ 10y agoI did not say that Rust is a worse language. I said I like Go better. I do not know exactly what it is, but I find rust code harder to read (e.g. I do not like the :: operator, which other languages have too). So this is my personal preference and should not offend any Rust fans. Besides the syntax, which reminds me too much of C++, I think Rust is a very good language. I do not know if it is 'objectively better than Go.'. Btw. restrictions are not always bad.
- vertex-four 10y agoI've... never had a problem reading Rust code. It's generally well-typed, and makes good use of "automatic" error handling constructs to ensure errors flow upwards without visually polluting the success case. Whereas with Go code, I have to filter out all the error handling (which often takes up 2/3rds of lines of code, even when it's just "if there's an error, return the error" which it almost always is), wade through the mass of functions that take interface{} and cast it to something internally, etc etc. I've tried programming in Go and I find it horrifying - I either get to ignore errors or spend ~80% of my code doing this, repeatedly, a few times per function: foo, err := bar() if err { return nil, err }
- generic_user 10y agoI'm disappointed they did not consider COBAL given its vast superiority and flawless track record for April first rewrites.
- kilotaras 10y agoFri Mar 31 21:23:27 UTC 2017
- generic_user 10y agoI believe there is a crate they can use to prevent date bound out of bounds fun leaks. (can't find the link atm)
- nickpsecurity 10y agoSince bitexploder asked, I'll add what I wrote on this on other forums. If it's about secrets or anonymity, make sure you always use a safe language that supports careful control and reasoning about both memory and CPU time. The reason is that this enables covert, channel analysis for vulnerabilities that leak secrets through storage and timing. It's why I wanted Freenet to ditch Java aside from the obvious reasons. It's also why GC languages such as Go are better not used. Although, memory management where programmer controls timing & it's simple to analyze might be used. Reference counting comes to mind. The other thing you want is proven, successful use in high-assurance systems. That is, systems that either didn't fail or provably couldn't in certain ways. These are almost all written in a subset of C or Ada/SPARK. The advantage of using those is you can combine them with a vast array of proprietary or open-source tooling to catch about any error you can think of if it's implementation. There's also formal specification and protocol analysis tools that combined with expert review can catch the rest. Rust, although a good choice for increased safety/security, doesn't have such tooling yet. That means they will get less correctness overall and over time vs MISRA-C or Ada/SPARK unless similar ecosystem in industry and CompSci emerges for Rust. That's why I recommend against it for high-assurance security for now. It does seem good for medium-assurance security where you want to knock out low hanging fruit in systems code. It will avoid serious errors in C while providing additional benefits with type system and other features. Ada 2012 + SPARK 2014 are the standard for safe systems since they systematically eliminate all kinds of errors with a consistent design and tooling with decades of field success. I haven't seen a direct comparison with Rust on each protection to see if it matches it already or not. The main advantages Rust has over them are its borrow-checker for temporal safety, more usable method for safe concurrency, and (best for last) highly-active community to provide libraries or help. Go has similar benefits if its GC works with your use case but a lower, learning curve & possibly lower efficiency. Due to ecosystem benefits, these are main two I'm recommending for medium assurance if Ada/SPARK are too much to learn.
- wyager 10y agoIt's unlikely that the cost of whole-program side channel resistance is worth it for an application like Tor. Side-channel-resistant cryptography is almost certainly sufficient for most reasonable threat/cost models.
- eternalban 10y agoNot sure why Ada is not taking off these days. It is mature and has all the safety and concurrency bells and whistles: http://www.adacore.com/uploads_gems/07_safe_secure_ada_2005_safe_memory_management.pdf http://www.adacore.com/uploads_gems/07_safe_secure_ada_2005_... https://en.wikibooks.org/wiki/Ada_Programming/Tasking https://en.wikibooks.org/wiki/Ada_Programming/Tasking http://courses.cs.vt.edu/cs5204/sp99/Overheads/6UP/6UPCSPandADA.pdf http://courses.cs.vt.edu/cs5204/sp99/Overheads/6UP/6UPCSPand...
- bitwize 10y ago+1 for Ada. Rust is basically hipster-compatible Ada, which explains why Rust will be adopted and Ada will not.
- the_mitsuhiko 10y agoRepeating this nonsense won't make it any more correct.
- COMPUTERLOSER 10y agoRust is basically hipster-compatible Ada, which explains why Rust will be adopted and Ada will not.
- SomeStupidPoint 10y agoI mean, isn't SPARK basically meant for high assurance things (like Tor should be)?
- nickpsecurity 10y agoCase in point: http://ironsides.martincarlisle.com/ http://ironsides.martincarlisle.com/ http://www.adacore.com/uploads/technical-papers/SPARKSkein_SBMF.pdf http://www.adacore.com/uploads/technical-papers/SPARKSkein_S... http://www.anthonyhall.org/c_by_c_secure_system.pdf http://www.anthonyhall.org/c_by_c_secure_system.pdf
- 10y ago
- z3t4 10y agowe all want to be safe. no one can say no to safety ...
- socmag 10y agoI live and love in Amsterdam and Golang seems to be the quintessential hipster language for this quintessentially hipster city. Booking.com's soup du jour if you will. Basically, if you aren't using JavaScript in a web shop, and you claim to be a "full-stack" "ninja", then probably you are using Go around here as a jobbing programmer. I know that sounds terribly cynical and obviously a massive generalization but that is my personal experience. I don't have a problem with Go per-se, but I do have a problem that a lot of people seem to go to extreme lengths to defend what someone else mentioned is frankly a pretty "mundane" language, citing memory safety, but more strangely portability and performance as its wonderful virtues. When I meet with the zealots of the Go community around here I often have to quickly excuse myself with good grace. Seriously, if that's what you want... go (pardon the pun) use C#, it is a saner and more expressive language, has a higher performance runtime and is way more portable with less vendor / career lock-in. Go... I just don't get it. Positives... Has a fairly nice package manager like npm. Isn't made by Microsoft if that's your thing. Oh and heaven forbid you don't have to think much... until you do because it is slow. For a project like Tor though, which is damn slow as it is, I think it is totally the wrong choice. Developers, please suck it up, get over it and learn C/C++ and some variation of Lisp. Fine, go play with different languages for fun stuff. Use python for ML, try serious meta-programming in D, or jump into Haskell for kicks. On the other hand modern C++ really can be a very safe language to work in if you can be bothered, and you are only deceiving yourself and your project going with something less sympathetic to the machine itself, especially if you are working on infrastructure level systems. Sorry if this offends anyone, and of course it is just one opinion, but I think I'm being fairly nice as compared to what Linus might have said in comparison. Basically stop it with the hobbyist shit. You are horrifying me and probably many others. You aren't writing a web page here, so please treat the project seriously. IMHO
- FiloSottile 10y agoYou do realize they didn't pick Go, yes?
- socmag 10y agoYes, but we got into a heated discussion about Go earlier in the thread. And it got my blood pressure up. :)
- omidraha 10y agoConcurrent thread for this safer language: https://news.ycombinator.com/item?id=14013444 https://news.ycombinator.com/item?id=14013444
- poland2 10y agoI hope Linus can develop a new language.
- viraptor 10y agoI like their approach of chipping away pieces instead of porting the whole system. It will result in better modularity and some generic libraries that can be used by other people. Seems like a win-win.
- muraiki 10y agoHow has this community reached the point where the vast majority of comments on this decision are arguing about Go, which isn't even the language that they picked?
- concede_pluto 10y agopg's early essays like http://www.paulgraham.com/avg.html http://www.paulgraham.com/avg.html and http://www.paulgraham.com/power.html http://www.paulgraham.com/power.html drew a crowd who want to see language design move in the polar opposite direction. From that viewpoint, Tor only barely dodged a bullet.
- dguido 10y agoLiterally none of this matters. None of the flaws exploited in Tor are memory corruption flaws. They are entirely architectural and design flaws. No attacker cares if they move to Rust. _NO ONE_.
- steveklabnik 10y ago> None of the flaws exploited in Tor are memory corruption flaws. http://www.cvedetails.com/product/5516/TOR-TOR.html?vendor_id=3132 http://www.cvedetails.com/product/5516/TOR-TOR.html?vendor_i... This list is full of memory safety issues.
- dguido 10y ago> None of the flaws exploited in Tor are memory corruption flaws _exploited_ is the operative word here. Show me the list where people wrote exploits for the bugs you point out, or where someone abused them to de-anonymize a Tor user? There aren't any.
- imron 10y agoRust is almost always going to win for any projects that take a 'gradually replace' approach, simply because it can interact so easily with C code in both directions (i.e. C calling Rust and Rust calling C) in a way that other languages can't, or can't without significant efforts/hassle. The Rust team showed great foresight for bringing about those changes before the initial 1.0 release and it will pay off in spades. It's a key step in removing barriers to entry: https://www.joelonsoftware.com/2000/06/03/strategy-letter-iii-let-me-go-back/ https://www.joelonsoftware.com/2000/06/03/strategy-letter-ii...