5 ms·

Quiche – An implementation of the QUIC transport protocol in Rust

177 points by jgrahamc 8y ago

aboutruby 8y ago
I thought they were doing Go whenever possible.
- rapsey 8y ago
  They have quite a bit of Rust as well. At least where they require integration with a C/C++ codebase like this Rust is a very good choice.
- jgrahamc 8y ago
  We do have a lot of Go but we are not religious about languages as that would be silly. Rust has some interesting properties and compiles readily to WebAssembly. We'll continue to use Go and Rust for projects. We also have lots of Lua, PHP and C++ in production. Plus lots of Python and other languages.
marceloneil 8y ago
Why use BoringSSL? I was under the impression that it was not recommended for third-party use.
- rapsey 8y ago
  BoringSSL is nevertheless used very widely.
  - marceloneil 8y ago
    I see, thank you :)
    - johnisgood 8y ago
      Your question still has not been answered though.
      - afiori 8y ago
        Implicitly it was, "because it is not an issue in practice"
- ocdtrekkie 8y ago
  Extended opinion on this by someone formerly Google and currently Cloudflare: https://github.com/sandstorm-io/sandstorm/issues/3036#issuecomment-366792583 https://github.com/sandstorm-io/sandstorm/issues/3036#issuec... tl;dr is that Google is not supporting features in BoringSSL that Google doesn't need, but it's probably adequate for a lot of other projects.
  - tialaramex 8y ago
    Really we should learn to expect that "I don't support that" is the default unless somebody's _actual_ business is supporting you doing whatever it is. Which it rarely is these days. This obviously matters most for security, but it's true everywhere. Another security example is that a tremendous amount of stuff ultimately decides whether to trust a certificate based on Mozilla's root trust programme. That seems fine right? Well, kinda. It's definitely better than "I found this file named CA_TRUST.Z on an old Solaris machine in 1997 and so that'll have to do" as a policy. But it's different from two things you or end users might expect you're achieving. 1. This isn't "You know, the same Certificate Authorities trusted everywhere". There is no such thing. The big root trust programmes have a fair amount of commonality, which is fine if you're out to obtain a certificate for a web site (pick anyone in the common set) but they aren't even close to mirrors. Mozilla's list is significantly different from Apple's which is likewise different from Microsoft's. 2. This also isn't "Like in Firefox". This problem is more subtle, after all the Firefox build process consumes the same file, ultimately, as your code does. But, Firefox has a long list of extra rules beyond whether or not something is in Mozilla's published trust store and your application would need lots of extra work to implement all those rules and track updates to them. Did you do that work? No you did not. This probably won't bite you, and likewise relying on bits of BoringSSL that Google doesn't care about probably won't cause massive security problems in your code. But only probably.
- gpm 8y ago
  What I'm curious about is why is it depending on both BoringSSL and ring, the latter being a rust fork/wrapper of BoringSSL.
dochtman 8y ago
I still don't quite understand why Cloudflare is going their own way rather than joining our Rust implementation (https://github.com/djc/quinn https://github.com/djc/quinn). So far the primary maintainer told me "I quite like how quiche has turned out, and we already started integrating into internal stuff", which I haven't found very satisfying. Perhaps they just want to strategically own their own stack, but it seems to me aligning with the broader Rust ecosystem and getting features for free from the community would also bring some value. Initially I thought it was mainly about integrating with BoringSSL rather than ring and rustls, but even the promise of pluggable crypto didn't seem to affect their decision. Would be nice to have more clarity on this. (Previously they were happy enough to use Quinn for their Noise experiment, although without crediting our project explicitly in the resulting paper.)
- tobz 8y ago
  This. We need more community/company interaction in Rust, especially in the networking space, instead of parallel implementations.
  - zinclozenge 8y ago
    Disagree. This happened with tokio, the most used crate that provides an execution runtime for futures for async programming, and it's fucking awful to use. But, the community rallied behind it and is now stuck with it for better or for worse. There's been barely any effort to provide any documentation, even recently the main developer pawned it off to be crowdsourced and it really shows. So yea, give me choices.
  - woah 8y ago
    I used to think that as well, but sometimes different projects have different priorities or philosophies. In that case, you can either be the jerk who complains about free open source code you didn't pay for, try to bend the project to your will and probably fail, or roll your own.
- barkingcat 8y ago
  I certainly don't think anyone is required to join another implementation.
funkythings 8y ago
I hope rust becomes more mainstream in companies. At the moment it seems like a lot of smaller components are implemented in rust, to allow employees to get familiar with it.
- pornel 8y ago
  Rust is mainstream at Cloudflare. It's used for many new projects. New projects naturally start small. There are millions of lines of existing production code in other languages, but they won't get rewritten. Even if they would be better in Rust, there's a high opportunity cost of rewriting existing code that works, instead of spending the effort on adding value elsewhere.

177 points by jgrahamc 8y ago

aboutruby 8y ago

I thought they were doing Go whenever possible.

rapsey 8y ago
They have quite a bit of Rust as well. At least where they require integration with a C/C++ codebase like this Rust is a very good choice.
jgrahamc 8y ago
We do have a lot of Go but we are not religious about languages as that would be silly. Rust has some interesting properties and compiles readily to WebAssembly. We'll continue to use Go and Rust for projects. We also have lots of Lua, PHP and C++ in production. Plus lots of Python and other languages.

marceloneil 8y ago

Why use BoringSSL? I was under the impression that it was not recommended for third-party use.

rapsey 8y ago
BoringSSL is nevertheless used very widely.
- marceloneil 8y ago
  I see, thank you :)
  - johnisgood 8y ago
    Your question still has not been answered though.
    - afiori 8y ago
      Implicitly it was, "because it is not an issue in practice"
ocdtrekkie 8y ago
Extended opinion on this by someone formerly Google and currently Cloudflare: https://github.com/sandstorm-io/sandstorm/issues/3036#issuecomment-366792583 https://github.com/sandstorm-io/sandstorm/issues/3036#issuec... tl;dr is that Google is not supporting features in BoringSSL that Google doesn't need, but it's probably adequate for a lot of other projects.
- tialaramex 8y ago
  Really we should learn to expect that "I don't support that" is the default unless somebody's _actual_ business is supporting you doing whatever it is. Which it rarely is these days. This obviously matters most for security, but it's true everywhere. Another security example is that a tremendous amount of stuff ultimately decides whether to trust a certificate based on Mozilla's root trust programme. That seems fine right? Well, kinda. It's definitely better than "I found this file named CA_TRUST.Z on an old Solaris machine in 1997 and so that'll have to do" as a policy. But it's different from two things you or end users might expect you're achieving. 1. This isn't "You know, the same Certificate Authorities trusted everywhere". There is no such thing. The big root trust programmes have a fair amount of commonality, which is fine if you're out to obtain a certificate for a web site (pick anyone in the common set) but they aren't even close to mirrors. Mozilla's list is significantly different from Apple's which is likewise different from Microsoft's. 2. This also isn't "Like in Firefox". This problem is more subtle, after all the Firefox build process consumes the same file, ultimately, as your code does. But, Firefox has a long list of extra rules beyond whether or not something is in Mozilla's published trust store and your application would need lots of extra work to implement all those rules and track updates to them. Did you do that work? No you did not. This probably won't bite you, and likewise relying on bits of BoringSSL that Google doesn't care about probably won't cause massive security problems in your code. But only probably.
gpm 8y ago
What I'm curious about is why is it depending on both BoringSSL and ring, the latter being a rust fork/wrapper of BoringSSL.

dochtman 8y ago

I still don't quite understand why Cloudflare is going their own way rather than joining our Rust implementation (https://github.com/djc/quinn https://github.com/djc/quinn). So far the primary maintainer told me "I quite like how quiche has turned out, and we already started integrating into internal stuff", which I haven't found very satisfying. Perhaps they just want to strategically own their own stack, but it seems to me aligning with the broader Rust ecosystem and getting features for free from the community would also bring some value. Initially I thought it was mainly about integrating with BoringSSL rather than ring and rustls, but even the promise of pluggable crypto didn't seem to affect their decision. Would be nice to have more clarity on this. (Previously they were happy enough to use Quinn for their Noise experiment, although without crediting our project explicitly in the resulting paper.)

tobz 8y ago
This. We need more community/company interaction in Rust, especially in the networking space, instead of parallel implementations.
- zinclozenge 8y ago
  Disagree. This happened with tokio, the most used crate that provides an execution runtime for futures for async programming, and it's fucking awful to use. But, the community rallied behind it and is now stuck with it for better or for worse. There's been barely any effort to provide any documentation, even recently the main developer pawned it off to be crowdsourced and it really shows. So yea, give me choices.
- woah 8y ago
  I used to think that as well, but sometimes different projects have different priorities or philosophies. In that case, you can either be the jerk who complains about free open source code you didn't pay for, try to bend the project to your will and probably fail, or roll your own.
barkingcat 8y ago
I certainly don't think anyone is required to join another implementation.

funkythings 8y ago

I hope rust becomes more mainstream in companies. At the moment it seems like a lot of smaller components are implemented in rust, to allow employees to get familiar with it.

pornel 8y ago
Rust is mainstream at Cloudflare. It's used for many new projects. New projects naturally start small. There are millions of lines of existing production code in other languages, but they won't get rewritten. Even if they would be better in Rust, there's a high opportunity cost of rewriting existing code that works, instead of spending the effort on adding value elsewhere.