4 ms·

Are there any large programs like BIND written in Rust? If so, what is their actual security record?

by xmiller 8y ago

pjmlp 8y ago
There is a whole OS, good enough?
- sethammons 8y ago
  Depends on popularity and use.
  - pjmlp 8y ago
    The question was about an example for a large program like BIND.
- sureaboutthis 8y ago
  Which one?
- gbw 8y ago
  If you mean Redox, that is hardly a production OS (yet). People don't have infinite time and only search for security issues in software that's actually in use. Which is one of the reasons that C/C++ appear more often in CVEs.
  - pjmlp 8y ago
    The OP asked for an example of a large program like BIND, I gave him/her an OS, which naturally also contains something like BIND, but apparently we now move the goal posts for how much users it has. I love how people hand have the fact that even projects like the Linux kernel, with their stringent processes aren't able to avoid CVEs, to the point it became the major focus of Linux Kernel Security Summit 2018. Yet we all know that only newbies do major errors in C. /s
jcranmer 8y ago
Several bits of Firefox are written in Rust now. Looking through the bug reports, there has yet to be any CVE in any of the Rust-rewritten components.
nickpsecurity 8y ago
TrustDNS is one in that space. We won't know for a while what actual, security record is. We do have some evidence from fuzzing where it led to panics vs worse effects in C. I think an objective test would compare effects of fuzzing Rust and C libraries to see how often Rust just panicked. The study should use different types of libraries that use the language in different ways. If Rust's claims are true, most problems will involve 3rd-party libraries that aren't Rust, unsafe Rust, and/or compiler errors that break safety. People doing the study could just grab popular C apps vs similar stuff in Rust on Github that's actually maintained. Also, look at amateurish and unmaintained stuff to see if those still have minimal vulnerabilities. That's how I'd do it anyway.

Are there any large programs like BIND written in Rust? If so, what is their actual security record?

pjmlp 8y ago

There is a whole OS, good enough?

sethammons 8y ago
Depends on popularity and use.
- pjmlp 8y ago
  The question was about an example for a large program like BIND.
sureaboutthis 8y ago
Which one?
gbw 8y ago
If you mean Redox, that is hardly a production OS (yet). People don't have infinite time and only search for security issues in software that's actually in use. Which is one of the reasons that C/C++ appear more often in CVEs.
- pjmlp 8y ago
  The OP asked for an example of a large program like BIND, I gave him/her an OS, which naturally also contains something like BIND, but apparently we now move the goal posts for how much users it has. I love how people hand have the fact that even projects like the Linux kernel, with their stringent processes aren't able to avoid CVEs, to the point it became the major focus of Linux Kernel Security Summit 2018. Yet we all know that only newbies do major errors in C. /s

jcranmer 8y ago

Several bits of Firefox are written in Rust now. Looking through the bug reports, there has yet to be any CVE in any of the Rust-rewritten components.

nickpsecurity 8y ago

TrustDNS is one in that space. We won't know for a while what actual, security record is. We do have some evidence from fuzzing where it led to panics vs worse effects in C. I think an objective test would compare effects of fuzzing Rust and C libraries to see how often Rust just panicked. The study should use different types of libraries that use the language in different ways. If Rust's claims are true, most problems will involve 3rd-party libraries that aren't Rust, unsafe Rust, and/or compiler errors that break safety. People doing the study could just grab popular C apps vs similar stuff in Rust on Github that's actually maintained. Also, look at amateurish and unmaintained stuff to see if those still have minimal vulnerabilities. That's how I'd do it anyway.