5 ms·

Looking forward to enough Rust adoption that people stop seeing it as a magic bullet. Once it's in large scale use and there are still errors that lead to secur

Looking forward to enough Rust adoption that people stop seeing it as a magic bullet. Once it's in large scale use and there are still errors that lead to security problems maybe people will get over themselves.

roca 7y ago
Nothing's ever perfect but there is empirical evidence that Rust code is far less vulnerable than C or C++ code. For example this list of bugs found via fuzzing: https://github.com/rust-fuzz/trophy-case https://github.com/rust-fuzz/trophy-case Almost none of those bugs were security-sensitive. Compare to similar lists for C and C++ projects, e.g. http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/.
- youdontknowtho 7y ago
  I get it. Languages are where major security gains are going to be made. Everyone knows that. That being said, the proselytizing is obnoxious.
  - roca 7y ago
    That's fair. I'm probably guilty of that sometimes. Personally, I find it obnoxious when people start new projects in C code because they're comfortable with the language and unwilling to learn something better, and those projects contribute to the toxic cesspool of vulnerable software that is undermining civilization.
    - youdontknowtho 7y ago
      Sure, but the toxic cesspool that is undermining civilization has less to do with software and more to do with the way that we have organized civilization. I can understand what you mean, though. It's really lame to hear "that's how we've always done it". My personal opinion, however, is that language's like Rust are still taking the wrong approach because we should be making the computers manage the memory for us. Much of the guarantees from Rust's type system could also be gained by more advanced garbage collection or designing hardware in conjunction with garbage collectors to get around some of the thornier issues in that field. If you could take out the perceived drawbacks of garbage collection, then there isn't a reason to do manual memory management. That's my personal soapbox, though, and I could go on. Cheers.
      - steveklabnik 7y ago
        One of the key differences here is that there are resources other than memory. GCs can help you manage memory, but not other kinds of resources that also need managed.
        youdontknowtho 7y ago
        I don't mean to sound dense, but couldn't all resource management be automated to a large degree? It's not my area, so I am really asking, not trying to be a smart a.
        steveklabnik 7y ago
        That's what languages like Rust are trying to accomplish, yes. But it attempts to do so by unifying the systems used to manage these resources; what you're advocating is using GC for memory, which means you need two systems now: the GC for memory, and something for everything else. Languages like Rust say "that's too complex, let's use one system for all things."
        youdontknowtho 7y ago
        I get that, but why couldn't you use something like GC for resource management. Maybe I sound stupid here, but it seems like the kind of task that machines would be better at than humans.
        steveklabnik 7y ago
        You can! The performance is not as good. For many applications, you don't have to care about performance. Rust is specifically designed to get maximum performance, so it can't be the default mechanism. (Swift basically does what you're talking about, for example)
        youdontknowtho 7y ago
    - dmitrygr 7y ago
      > I find it obnoxious when people start new projects in C Indeed, how dare they spend their own free time doing things you find obnoxious? The scoundrels! > and unwilling to learn something better They also seem to not be willing to blindly accept your judgement instead of their own in terms of how best to implement things they wish to! How inconsiderate of them!
      - roca 7y ago
        > Indeed, how dare they spend their own free time doing things you find obnoxious? That's not the obnoxious part. The obnoxious part is where their vulnerable software gets deployed and subverted to harm to third parties. > They also seem to not be willing to blindly accept your judgement I certainly wouldn't ask anyone to blindly accept anyone else's judgement. The evidence is in.
        dmitrygr 7y ago
        Okay. Don't use their software. Unless somebody is making you? You are entirely free to write your own versions in whatever language you want. Speaking the way you do, though, you just sound like an ingrate. Take a moment to thank all those people writing that software you use, instead of telling them that they are being obnoxious.
        roca 7y ago
        When someone writes a buggy C library and someone deploys that library in some set of devices, which are compromised and used as part of a botnet that DDoSes my site, I'm hurt through no choice that I made. When I buy something from a shop and their database gets hacked via some bug and my data is extracted, I'm hurt even though I had minimal control over the situation. Vulnerable software is a negative externality, like air pollution.
        dmitrygr 7y ago
        You are free to not buy any product or use any service that uses code not written in the language of your choice.
- johnisgood 7y ago
  I am not exactly sure of the point of this comparison. The OP got it right. There is not enough adoption. Of course you will find less programs with bugs, because there are less programs written in Rust! That, and in case of rewrites, they are almost nowhere complete functionality-wise. I see that there is one use-after-free bug, and lots of out of range access bugs. How does that happen?
  - roca 7y ago
    Fuzz bugs in C and C++ code very often produce exploitable memory corruption. Fuzz bugs in Rust code very rarely produce exploitable memory corruption. This is independent of the absolute volume of code that you test or the total number of bugs that you collect. > I see that there is one use-after-free bug, and lots of out of range access bugs. How does that happen? The use-after-free bug was in explicitly unsafe Rust code (via the "unsafe" keyword). I assume that code was intended to be a performance optimization, but I haven't looked at the details. An "out of range" bug here is typically an array-index-out-of-bounds, which results in a panic (safe abort) at run-time. Panics aren't great but they're not exploitable.
  - steveklabnik 7y ago
    > I see that there is one use-after-free bug, and lots of out of range access bugs. How does that happen? The use after free [1] is because of unsafe code, specifically, a function that says "trust me, I know what the type of this is." I only checked a few of the "out of bounds" bugs, and they all are panics [2], which are not memory unsafe. Of course, someone could cause a real one with the use of unsafe. 1: https://github.com/shepmaster/sxd-document/issues/47#issuecomment-311688608 https://github.com/shepmaster/sxd-document/issues/47#issueco... 2: https://github.com/image-rs/image-tiff/issues/28 https://github.com/image-rs/image-tiff/issues/28
    - youdontknowtho 7y ago
      Someone else mentioned it in another thread, but the propagation of issues related to code in unsafe regions to other sections of code that are nominally safe is an ongoing research area. It sounds really cool, though. Would love to hear more about it.
pjmlp 7y ago
We are well aware that Rust isn't a magic bullet. Likewise we are also aware that 68% of Linux kernel exploits in 2018 were caused by memory corruption bugs easily preventable in any systems language with bounds checking enabled by default.
- youdontknowtho 7y ago
  I normally like your comments. And, sorry, we don't all know that it isn't a magic bullet. Thus the people who seem personally invested in this stuff like its a conspiracy and the one true thing is being kept down by the man. Again, I've seen your other comments. You know full well that it's a problem that other systems tackled with language and hardware support. Why is Rust the one true way when there are other approaches that have worked in the past? Did you see that other comment about using C as "a toxic cesspool that's undermining civilization"? That's a tad much, right? It's a type of technical myopia. Software isn't undermining civilization. We are, by having perverse incentives in multiple areas of life that make it more profitable to prioritize one thing over another. It's also the same kind of stupid that makes people think they are a freedom fighter because they use Debian. It's also boring. So, yeah. Thanks.
  - vardump 7y ago
    I might be biased, as I develop kernel drivers and other low level stuff that must just work. In C and C++. Sometimes some assembler. I've seen very little C/C++ code where I can't find tons of bugs. I've been in the business for over 25 years and gotten tired of this a long time ago. Enough is enough. Even the smartest people in business don't seem to be able to use C/C++ safely. (Yes, C++11 etc. did improve matters, but not enough). Personally I'm happy there's finally at least one language that is effectively runtimeless, C/C++ like performance, significantly more secure than C/C++, C ABI compatible and has reasonable momentum. Rust might be it. It doesn't need to be a silver bullet for everything, just give me more memory and concurrency safety. If it's Rust, fine. If it's something else realistic, fine. It's not cure all, but borrow checker is clearly a major improvement for low level safety.
  - pjmlp 7y ago

roca 7y ago

Nothing's ever perfect but there is empirical evidence that Rust code is far less vulnerable than C or C++ code. For example this list of bugs found via fuzzing: https://github.com/rust-fuzz/trophy-case https://github.com/rust-fuzz/trophy-case Almost none of those bugs were security-sensitive. Compare to similar lists for C and C++ projects, e.g. http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/.

youdontknowtho 7y ago
I get it. Languages are where major security gains are going to be made. Everyone knows that. That being said, the proselytizing is obnoxious.
- roca 7y ago
  That's fair. I'm probably guilty of that sometimes. Personally, I find it obnoxious when people start new projects in C code because they're comfortable with the language and unwilling to learn something better, and those projects contribute to the toxic cesspool of vulnerable software that is undermining civilization.
  - youdontknowtho 7y ago
    Sure, but the toxic cesspool that is undermining civilization has less to do with software and more to do with the way that we have organized civilization. I can understand what you mean, though. It's really lame to hear "that's how we've always done it". My personal opinion, however, is that language's like Rust are still taking the wrong approach because we should be making the computers manage the memory for us. Much of the guarantees from Rust's type system could also be gained by more advanced garbage collection or designing hardware in conjunction with garbage collectors to get around some of the thornier issues in that field. If you could take out the perceived drawbacks of garbage collection, then there isn't a reason to do manual memory management. That's my personal soapbox, though, and I could go on. Cheers.
    - steveklabnik 7y ago
      One of the key differences here is that there are resources other than memory. GCs can help you manage memory, but not other kinds of resources that also need managed.
      - youdontknowtho 7y ago
        I don't mean to sound dense, but couldn't all resource management be automated to a large degree? It's not my area, so I am really asking, not trying to be a smart a.
        steveklabnik 7y ago
        That's what languages like Rust are trying to accomplish, yes. But it attempts to do so by unifying the systems used to manage these resources; what you're advocating is using GC for memory, which means you need two systems now: the GC for memory, and something for everything else. Languages like Rust say "that's too complex, let's use one system for all things."
        youdontknowtho 7y ago
        I get that, but why couldn't you use something like GC for resource management. Maybe I sound stupid here, but it seems like the kind of task that machines would be better at than humans.
        steveklabnik 7y ago
        You can! The performance is not as good. For many applications, you don't have to care about performance. Rust is specifically designed to get maximum performance, so it can't be the default mechanism. (Swift basically does what you're talking about, for example)
        youdontknowtho 7y ago
  - dmitrygr 7y ago
    > I find it obnoxious when people start new projects in C Indeed, how dare they spend their own free time doing things you find obnoxious? The scoundrels! > and unwilling to learn something better They also seem to not be willing to blindly accept your judgement instead of their own in terms of how best to implement things they wish to! How inconsiderate of them!
    - roca 7y ago
      > Indeed, how dare they spend their own free time doing things you find obnoxious? That's not the obnoxious part. The obnoxious part is where their vulnerable software gets deployed and subverted to harm to third parties. > They also seem to not be willing to blindly accept your judgement I certainly wouldn't ask anyone to blindly accept anyone else's judgement. The evidence is in.
      - dmitrygr 7y ago
        Okay. Don't use their software. Unless somebody is making you? You are entirely free to write your own versions in whatever language you want. Speaking the way you do, though, you just sound like an ingrate. Take a moment to thank all those people writing that software you use, instead of telling them that they are being obnoxious.
        roca 7y ago
        When someone writes a buggy C library and someone deploys that library in some set of devices, which are compromised and used as part of a botnet that DDoSes my site, I'm hurt through no choice that I made. When I buy something from a shop and their database gets hacked via some bug and my data is extracted, I'm hurt even though I had minimal control over the situation. Vulnerable software is a negative externality, like air pollution.
        dmitrygr 7y ago
        You are free to not buy any product or use any service that uses code not written in the language of your choice.
johnisgood 7y ago
I am not exactly sure of the point of this comparison. The OP got it right. There is not enough adoption. Of course you will find less programs with bugs, because there are less programs written in Rust! That, and in case of rewrites, they are almost nowhere complete functionality-wise. I see that there is one use-after-free bug, and lots of out of range access bugs. How does that happen?
- roca 7y ago
  Fuzz bugs in C and C++ code very often produce exploitable memory corruption. Fuzz bugs in Rust code very rarely produce exploitable memory corruption. This is independent of the absolute volume of code that you test or the total number of bugs that you collect. > I see that there is one use-after-free bug, and lots of out of range access bugs. How does that happen? The use-after-free bug was in explicitly unsafe Rust code (via the "unsafe" keyword). I assume that code was intended to be a performance optimization, but I haven't looked at the details. An "out of range" bug here is typically an array-index-out-of-bounds, which results in a panic (safe abort) at run-time. Panics aren't great but they're not exploitable.
- steveklabnik 7y ago
  > I see that there is one use-after-free bug, and lots of out of range access bugs. How does that happen? The use after free [1] is because of unsafe code, specifically, a function that says "trust me, I know what the type of this is." I only checked a few of the "out of bounds" bugs, and they all are panics [2], which are not memory unsafe. Of course, someone could cause a real one with the use of unsafe. 1: https://github.com/shepmaster/sxd-document/issues/47#issuecomment-311688608 https://github.com/shepmaster/sxd-document/issues/47#issueco... 2: https://github.com/image-rs/image-tiff/issues/28 https://github.com/image-rs/image-tiff/issues/28
  - youdontknowtho 7y ago
    Someone else mentioned it in another thread, but the propagation of issues related to code in unsafe regions to other sections of code that are nominally safe is an ongoing research area. It sounds really cool, though. Would love to hear more about it.

pjmlp 7y ago

We are well aware that Rust isn't a magic bullet. Likewise we are also aware that 68% of Linux kernel exploits in 2018 were caused by memory corruption bugs easily preventable in any systems language with bounds checking enabled by default.

youdontknowtho 7y ago
I normally like your comments. And, sorry, we don't all know that it isn't a magic bullet. Thus the people who seem personally invested in this stuff like its a conspiracy and the one true thing is being kept down by the man. Again, I've seen your other comments. You know full well that it's a problem that other systems tackled with language and hardware support. Why is Rust the one true way when there are other approaches that have worked in the past? Did you see that other comment about using C as "a toxic cesspool that's undermining civilization"? That's a tad much, right? It's a type of technical myopia. Software isn't undermining civilization. We are, by having perverse incentives in multiple areas of life that make it more profitable to prioritize one thing over another. It's also the same kind of stupid that makes people think they are a freedom fighter because they use Debian. It's also boring. So, yeah. Thanks.
- vardump 7y ago
  I might be biased, as I develop kernel drivers and other low level stuff that must just work. In C and C++. Sometimes some assembler. I've seen very little C/C++ code where I can't find tons of bugs. I've been in the business for over 25 years and gotten tired of this a long time ago. Enough is enough. Even the smartest people in business don't seem to be able to use C/C++ safely. (Yes, C++11 etc. did improve matters, but not enough). Personally I'm happy there's finally at least one language that is effectively runtimeless, C/C++ like performance, significantly more secure than C/C++, C ABI compatible and has reasonable momentum. Rust might be it. It doesn't need to be a silver bullet for everything, just give me more memory and concurrency safety. If it's Rust, fine. If it's something else realistic, fine. It's not cure all, but borrow checker is clearly a major improvement for low level safety.
- pjmlp 7y ago