5 ms·

It doesn’t. It’s one of the most annoying aspects of Rust that “Written in Rust” is considered an attractive quality. But, whatever. There’s no reason to be gr

by shawn 8y ago

It doesn’t. It’s one of the most annoying aspects of Rust that “Written in Rust” is considered an attractive quality. But, whatever. There’s no reason to be gratuitously negative. I’m just a bit salty that lesser known languages are often excluded on the basis that they’re lesser known.

pests 8y ago
It does matter. Not only for the reasons my sibling comment states but others as well. Such as the safety/security guarantees Rust makes by default. I would trust any binary decoder that is written in Rust more than the equivalent written in C.
- shawn 8y ago
  I’d trust Tarsnap with my life, and it’s written in C. You have to evaluate the merits of an individual project, not blindly put your faith in their security claims. I say this as a former pentester.
  - sullyj3 8y ago
    https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/daniel-kahneman-beware-the-inside-view https://www.mckinsey.com/business-functions/strategy-and-cor... In general, when you write C, there are a multitude of ways to introduce memory related vulnerabilities if you don't know what you're doing, and historically and empirically speaking, even if you do (heartbleed comes to mind, but I'm sure 5 minutes of research would turn up hundreds of examples). Safe rust prevents you from double freeing, dereferencing null, leaking memory, and a whole bunch of memory related bugs/potential vulnerabilities. Now, programmers are human. We make mistakes. Why, a priori, should anyone trust the programmers of one particular project to be superhuman and never screw up? That seems much more like blind faith to me than trusting a language which has been specifically designed to eliminate these kinds of errors.
    - shawn 8y ago
      This question reduces to "Why trust Tarsnap?" Colin is a renowned security expert and it's known how he handles vulnerabilities: http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-... After that incident, the probability goes way up that it won't happen again. Trust credibility, not tools. Also, Tarsnap has had a long-standing bug bounty program, which is another reason to trust it.
      - TheDong 8y ago
        Why can't I trust credibility and tools? I do trust tarsnap, but if Colin wrote tarsnap in safe rust, I'd trust it even more. Similarly, I can trust a library or program is less likely to exhibit crashes and memory issues if it's written in rust, and that allows the developers to be less renowned security experts while still producing usable code. Your argument that C programs can be trusted to be memory safe and contain minimal bugs IFF they're written by experts doesn't prove the point that language's are meaningless for gaining trust. I trust a combination of credibility and tools. If someone tells me they ran a fuzzer over their http server, I'll trust it more than if they say they didn't. That's not credibility, that's tools. Both credibility and tools have their place. This isn't some black and white issue like you're portraying it.
      - lifthrasiir 8y ago
        > Also, Tarsnap has had a long-standing bug bounty program, which is another reason to trust it. This is not necessarily a reason to trust Tarsnap. It is just an (rather weak) indication of the security-oriented process and nothing more. Probably you would want to say security track records (inferred from the bug bounty program), which would be a good reason to trust it.
  - pests 8y ago
    I trust taranap with my life as well. I did not claim C was unsafe or that safe programs could not or have not been written in C. I'd just trust it more if it was in Rust.
- leshow 8y ago
  You shouldn't, and I write Rust all the time. Don't implicitly trust it because it's written in Rust. There could still be errors, there could be uses of unsafe, etc.
  - pests 8y ago
    I just said more than C not an absolute trust level or trust just because it's Rust. I do know Rust very well myself. It does have some gotchas for those who think it means instant safety. For example the interface between safe and unsafe. If you change an established constraint that safe Rust depends on inside an unsafe block then all safe code has to be aware of this change and take it into account. In a way anything could be undefined behavior if you don't. Or the hole that allowed RAII guard subversion.
    - leshow 8y ago
      > Or the hole that allowed RAII guard subversion. ?

by shawn 8y ago

pests 8y ago

It does matter. Not only for the reasons my sibling comment states but others as well. Such as the safety/security guarantees Rust makes by default. I would trust any binary decoder that is written in Rust more than the equivalent written in C.

shawn 8y ago
I’d trust Tarsnap with my life, and it’s written in C. You have to evaluate the merits of an individual project, not blindly put your faith in their security claims. I say this as a former pentester.
- sullyj3 8y ago
  https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/daniel-kahneman-beware-the-inside-view https://www.mckinsey.com/business-functions/strategy-and-cor... In general, when you write C, there are a multitude of ways to introduce memory related vulnerabilities if you don't know what you're doing, and historically and empirically speaking, even if you do (heartbleed comes to mind, but I'm sure 5 minutes of research would turn up hundreds of examples). Safe rust prevents you from double freeing, dereferencing null, leaking memory, and a whole bunch of memory related bugs/potential vulnerabilities. Now, programmers are human. We make mistakes. Why, a priori, should anyone trust the programmers of one particular project to be superhuman and never screw up? That seems much more like blind faith to me than trusting a language which has been specifically designed to eliminate these kinds of errors.
  - shawn 8y ago
    This question reduces to "Why trust Tarsnap?" Colin is a renowned security expert and it's known how he handles vulnerabilities: http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-... After that incident, the probability goes way up that it won't happen again. Trust credibility, not tools. Also, Tarsnap has had a long-standing bug bounty program, which is another reason to trust it.
    - TheDong 8y ago
      Why can't I trust credibility and tools? I do trust tarsnap, but if Colin wrote tarsnap in safe rust, I'd trust it even more. Similarly, I can trust a library or program is less likely to exhibit crashes and memory issues if it's written in rust, and that allows the developers to be less renowned security experts while still producing usable code. Your argument that C programs can be trusted to be memory safe and contain minimal bugs IFF they're written by experts doesn't prove the point that language's are meaningless for gaining trust. I trust a combination of credibility and tools. If someone tells me they ran a fuzzer over their http server, I'll trust it more than if they say they didn't. That's not credibility, that's tools. Both credibility and tools have their place. This isn't some black and white issue like you're portraying it.
    - lifthrasiir 8y ago
      > Also, Tarsnap has had a long-standing bug bounty program, which is another reason to trust it. This is not necessarily a reason to trust Tarsnap. It is just an (rather weak) indication of the security-oriented process and nothing more. Probably you would want to say security track records (inferred from the bug bounty program), which would be a good reason to trust it.
- pests 8y ago
  I trust taranap with my life as well. I did not claim C was unsafe or that safe programs could not or have not been written in C. I'd just trust it more if it was in Rust.
leshow 8y ago
You shouldn't, and I write Rust all the time. Don't implicitly trust it because it's written in Rust. There could still be errors, there could be uses of unsafe, etc.
- pests 8y ago
  I just said more than C not an absolute trust level or trust just because it's Rust. I do know Rust very well myself. It does have some gotchas for those who think it means instant safety. For example the interface between safe and unsafe. If you change an established constraint that safe Rust depends on inside an unsafe block then all safe code has to be aware of this change and take it into account. In a way anything could be undefined behavior if you don't. Or the hole that allowed RAII guard subversion.
  - leshow 8y ago
    > Or the hole that allowed RAII guard subversion. ?