4 ms·

The historic data related to memory access is really damning, 70% of CVE's are memory access related, and that hasn't changed significantly over the years chart

The historic data related to memory access is really damning, 70% of CVE's are memory access related, and that hasn't changed significantly over the years charted, 2004 to 2018. What's annoying in this article is that it doesn't come right out and say that MS is considering offering a full Windows SDK with a Rust API. The closest I see the article come to mentioning this is: "Exploring the use of a memory-safe language such as Rust would provide an alternative to creating safer Microsoft apps. But Thomas also argues that third-party developers should also be looking into memory-safe languages as well. He cites reasons such as the time and effort developers put into learning how to debug the memory-related security flaws that crop up in their C++ apps." It would be interesting to know if a Rust native API is something being actively worked on at MS. BTW, MS does ship Rust in a product today, the VSCode editor/ide uses ripgrep for search, which the article fails to mention as well.

lmkg 7y ago
> it doesn't come right out and say that MS is considering > offering a full Windows SDK with a Rust API It's possible that the Security Response Team doesn't have the authority to dictate the priority of new products for the dev tools teams.
ChrisSD 7y ago
> What's annoying in this article is that it doesn't come right out and say that MS is considering offering a full Windows SDK with a Rust API. The closest I see the article come to mentioning this is: "Exploring the use of a memory-safe language such as Rust would provide an alternative to creating safer Microsoft apps. Creating a fully Rustified Windows API interface would be a massive task. The WinApi is vast and parts of it are ancient. It's practically a living history of Windows. And that's before you get to the more modern COM and UWP stuff. What they might offer is a more focused subset.
- bluejekyll 7y ago
  A subset is all I was thinking really. Perhaps starting with the kernel.
- contextfree 7y ago
  We (primarily Patrick Reisert, I'm trying to contribute a bit) have been working on WinRT support for Rust. It is a work in progress but is already usable now, with some missing capabilities such as UI support. https://github.com/contextfree/winrt-rust https://github.com/contextfree/winrt-rust

lmkg 7y ago

> it doesn't come right out and say that MS is considering > offering a full Windows SDK with a Rust API It's possible that the Security Response Team doesn't have the authority to dictate the priority of new products for the dev tools teams.

ChrisSD 7y ago

> What's annoying in this article is that it doesn't come right out and say that MS is considering offering a full Windows SDK with a Rust API. The closest I see the article come to mentioning this is: "Exploring the use of a memory-safe language such as Rust would provide an alternative to creating safer Microsoft apps. Creating a fully Rustified Windows API interface would be a massive task. The WinApi is vast and parts of it are ancient. It's practically a living history of Windows. And that's before you get to the more modern COM and UWP stuff. What they might offer is a more focused subset.

bluejekyll 7y ago
A subset is all I was thinking really. Perhaps starting with the kernel.
contextfree 7y ago
We (primarily Patrick Reisert, I'm trying to contribute a bit) have been working on WinRT support for Rust. It is a work in progress but is already usable now, with some missing capabilities such as UI support. https://github.com/contextfree/winrt-rust https://github.com/contextfree/winrt-rust