3 ms·
> The Rule Of 2 is: Pick no more than 2 of > * untrustworthy inputs; > * unsafe implementation language; and > * high privilege. > Security engineers in gen
by est31 7y ago
> The Rule Of 2 is: Pick no more than 2 of
> * untrustworthy inputs;
> * unsafe implementation language; and
> * high privilege.
> Security engineers in general, very much including Chrome Security Team, would like to advance the state of engineering to where memory safety issues are much more rare. Then, we could focus more attention on the application-semantic vulnerabilities. That would be a big improvement.
> Unsafe implementation languages are languages that lack memory safety, including at least C, C++, and assembly language. Memory-safe languages include Go, Rust, Python, Java, JavaScript, Kotlin, and Swift
Very nice. At the end of the process, Google might adopt Rust in Chromium. As much as I use and love Firefox, it's only realist to say that Chrome has higher chances of being around in 10 years.
I wonder why the list doesn't include their wuffs language.
- ufmace 7y agoWell it isn't meant to be an exhaustive list of languages that are memory-safe. I could complain that Ruby isn't in there, but it isn't very popular in the Google world right now. I think we all get the idea though.
- tyingq 7y ago"Memory-safe languages include Go, Rust, Python, Java, JavaScript, Kotlin, and Swift" An interesting list. They left out C# and PHP if it's supposed to be the most popular languages.
- amoitnga 7y agoIs Ruby memory-safe?
- tyingq 7y agoNo (direct) pointers or malloc, and garbage collected, so yeah.
- jillesvangurp 7y agoLots of native extensions though. So indirectly plenty of possibility for abuse. Some implementations are better at this than others.
- pjmlp 7y agoSelective view based on in house languages.
- jchw 7y agoI work at Google and as far as I know Rust is not really “in house” at Google, at least not any more than C#. Both languages exist in some form, Google does have some plugins for Unity and I believe Fuchsia has some Rust code. It is indeed unclear what criteria was used to select languages, though it’s really not very relevant to the primary point anyway. (Legal line noise: my opinions are not those of my employer.)
- lisper 7y agoAnd the original memory-safe language: Lisp.
- rectang 7y agoNo-thank-you to the gratuitous Firefox FUD.
- est31 7y agohttps://gs.statcounter.com/browser-market-share/desktop/worldwide/#monthly-200907-201907 https://gs.statcounter.com/browser-market-share/desktop/worl... https://data.firefox.com/dashboard/user-activity https://data.firefox.com/dashboard/user-activity If you check where Firefox was 10 years ago to where it's now you can see the trend. It still continues. In the last year, Firefox lost more than 10% of its market share. A component of this is probably Firefox not being able to capture growth of the entire market, but the trend also holds for the absolute number of users: 890 million YAUs in Jul 2018 vs 809 YAUs in Jul 2019. In the long term view, Firefox is dying.
- deleted 7y ago[deleted]
- eikenberry 7y agoNeither of those charts go back far enough because if they did you'd see this has all happened before, and even worse at one point. When IE was taking over the world FF fell to <5% of the market, yet it survived. It's not dead until its dead and with Chrome killing off ad-blockers I bet we'll see some reversal of the current trends when that ships.
- dtech 7y agoWhen IE had taken over the world (~2002) Firefox did not exist yet, unless you include Netscape or Mozilla Suite
- rectang 7y agoSo what? Is it your mission to threadjack every story and turn it into a conversation about Firefox market share? When you observe someone using Firefox do you interject, "You know that Firefox is dying, right?" When you participate in meetings, do you open with "I'd like to state for the record that Firefox is doomed, doomed I say"? At the coffee shop in the morning, do you order "Grande Mocha, hold the Firefox because all hope is lost"?