6 ms·

You are comparing the number of CVEs in hundreds or thousands of low level code vs a few Rust libraries , you might want to wait until you have a few popular OS

You are comparing the number of CVEs in hundreds or thousands of low level code vs a few Rust libraries , you might want to wait until you have a few popular OSs, full browsers,drivers ,VMs made from scratch with Rust then compare or do a fair one to one comparisons. Just wanted to let you know that your comment feels very misleading because you present the large number of bugs in say web browsers and contrast it with no Rust bugs in web browsers because nobody uses a Rust browser(I know Firefox has some parts in Rust but those parts are new so you can't compare it with years old code that had time to accumulate bugs and people to find them)

anthk 7y ago
This. Let's see is Mozilla rebases the entire browser in Rust except some dependencies on FreeType and MESA and let's see how many bugs do rise. If Chrome did the same shit would happen, it's 20x more code in Chrom{e,ium} than the OpenBSD base with LLVM.
- saagarjha 7y ago
  Probably significantly fewer memory corruption vulnerabilities.
  - anthk 7y ago
    Then let's solve how Rust will save us from wasm running at full speed.
    - saagarjha 7y ago
      I’m having difficulty understanding your comment. Would you mind expanding on it? What’s the concern here?
      - anthk 7y ago
        Rust and WebAssembly implementations will clash somehow in a near future, if Mozilla tries to rebase almost al Firefox into Rust.
        saagarjha 7y ago
        How, and why would this have anything to do with memory corruption vulnerabilities?
  - simion314 7y ago
    Let's wait and see how "significant" will it be.
    - pjmlp 7y ago
      Easy, according to Microsoft and Google security reports on C related memory corruption exploits, 68% less. Applies to any memory safe programming language, not only Rust.
      - steveklabnik 7y ago
        The Microsoft report wasn't organized by language, it was organized by vulnerability class. It was memory unsafety, across projects, not C specifically.

anthk 7y ago

This. Let's see is Mozilla rebases the entire browser in Rust except some dependencies on FreeType and MESA and let's see how many bugs do rise. If Chrome did the same shit would happen, it's 20x more code in Chrom{e,ium} than the OpenBSD base with LLVM.

saagarjha 7y ago
Probably significantly fewer memory corruption vulnerabilities.
- anthk 7y ago
  Then let's solve how Rust will save us from wasm running at full speed.
  - saagarjha 7y ago
    I’m having difficulty understanding your comment. Would you mind expanding on it? What’s the concern here?
    - anthk 7y ago
      Rust and WebAssembly implementations will clash somehow in a near future, if Mozilla tries to rebase almost al Firefox into Rust.
      - saagarjha 7y ago
        How, and why would this have anything to do with memory corruption vulnerabilities?
- simion314 7y ago
  Let's wait and see how "significant" will it be.
  - pjmlp 7y ago
    Easy, according to Microsoft and Google security reports on C related memory corruption exploits, 68% less. Applies to any memory safe programming language, not only Rust.
    - steveklabnik 7y ago
      The Microsoft report wasn't organized by language, it was organized by vulnerability class. It was memory unsafety, across projects, not C specifically.