3 ms·
> That sort of behavior has been the cause of so many network exploits No, the thing that caused those issues was not that memory wasn't zeroed, but that the l
by TheDong 9y ago
> That sort of behavior has been the cause of so many network exploits
No, the thing that caused those issues was not that memory wasn't zeroed, but that the language was memory unsafe and the dirty memory was accessible again later due to a buffer overrun or other pointer messup.
Rust tackled the problem of memory unsafety thoroughly, so there's no reason to worry about it.
You don't hear people complain about Java or python not zeroing out memory as much since those languages, like rust, are memory safe.
There are places where you do need memory to be zeroed (cryptographic operations where secrets should not live in memory longer than needed for fear or local attackers), but network attackers / because there might be buffer-overruns is not one.
- viraptor 9y agoThat's not exactly true. I've dealt multiple times with situations in python where I wanted a guarantee that the stored value is cleared. As in actually overwritten, because it was used for temporarily holding certificate keys. This is doable, but usually via a native extensions. The problem being avoided here is not that python will fail. It's that openssl will get heartbleed and start leaking "freed" python contents from the same process. This very much applies to network attackers as well.