5 ms·

Just a naive question probably but, is there any particular reason why security related executables like sudo aren't replaced with versions written with a bound

Just a naive question probably but, is there any particular reason why security related executables like sudo aren't replaced with versions written with a bounds checked language like say Go or Rust?

bsagdiyev 7y ago
Because this is a tired and tried question asked every time. You are welcome to do it yourself instead of forcing it upon others.
_-___________-_ 7y ago
Nobody's done it yet.
Jaxan 7y ago
Microsoft does this. They are reimplementing a lot of internet protocols using Fstar. So not only bounds checking, but also verified. But it’s a huge undertaking!
simion314 7y ago
There are people doing that, there is one or more kernles written in Rust but still even Rust evangelist are not using it daily but demand for people to waste time rewriting in Rust. A technical reason for GNU/Linux not to use Rust or Go is that C supports a lot more platforms so you can't replace core components at this moment, also I want to remind you that memory safe languages existed before Go and Rust and the only project I am aware to create a safe OS and utilities was Midori by Microsoft. Firefox and it's dependencies is not yet 100% Rust so I honestly expect a new browser started from scratch in a safe language to be done before Firefox is "ported".
- the8472 7y ago
  > I honestly expect a new browser started from scratch in a safe language to be done before Firefox is "ported". That is a gargantuan project considering all the standards you need to support to have a competitive web browser. Especially javascript engine, video codecs and webgl are attack surfaces that is difficult to replace with code written in a safe language.
  - simion314 7y ago
    >That is a gargantuan project I think is less work then pressuring existing projects to be rewritten in Rust. I would usggest Rust fans to pcik one of those dependencies like a codec and reimplementit in Rust or gather money to pay someone to do it, I think it would be faster and less hostile.
    - the8472 7y ago
      What do you think mozilla is doing? They're certainly not being pressured.
      - simion314 7y ago
        From what I read Mozilla fired one or more Rust developers related to the JIT or the interpreter and IMO the JIT should have been the first thing rewritten in Rust since that is one of the components that run arbitrary code. I really hope they can finish the port and I can't wait to see how many zero days will it have.
        khc 7y ago
        most of the JIT bugs were probably due to generating unsafe code instead of generating from unsafe code. Rewriting a new JIT will probably increase the number of zero days.
- _-___________-_ 7y ago
  Redox is a pretty impressive project. One could almost use it as a desktop OS already, except that it has no working USB input support yet.
  - Thaxll 7y ago
    Redox is probably more unsafe that Linux is. The 20% of unsafe stuff going in there had 0 review from serious security standpoint.
    - staticassertion 7y ago
      That's a ridiculous statement. Most of Linux isn't reviewed by security experts either... and the codebase for linux absolutely dwarfs redox, and every line of Linux is C.
      - techntoke 7y ago
        > Most of Linux isn't reviewed by security experts either Where are you getting your information from?
        deleted 7y ago
        [deleted]
        pjmlp 7y ago
        For starters from Google, with their Linux Kernel Self Preservation project, where an endless list of exploits have been fixed, starting by removal from all VLAs in the kernel source. Going forward, all Android devices on ARM are required to use ARM MTE, because the only way to keep C develoeprs on track is to have hardware control their pointer usage. https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html https://security.googleblog.com/2019/08/adopting-arm-memory-... And as of NDK 21, Fortify is enabled by default, https://android-developers.googleblog.com/2019/10/introducing-ndk-r21-our-first-long-term.html https://android-developers.googleblog.com/2019/10/introducin... Given that Linux kernel downstream on Qubes , ChromeOS and Android are the only ones with all of the security counter measured turned on, that speaks a lot for the standard Linux kernel on random distribution X.
deleted 7y ago
[deleted]
vortico 7y ago
Just thinking numbers, there might be 100 free software projects that you'd consider "security related", and each might take a couple person-years of development time to port on average. If you put a ballpark salary of $50k to that time, that's around $100,000*100 = $10M. And that's a conservative estimate because each of those factors are probably too low.
Gibbon1 7y ago
There have been efforts to create bounds checked compilers for C. And split stacks as well. Both of those solve 90% of these sorts of problems. I think the real problem is a) C and C++ need a divorce. Because the things that you would do to really fix C make it incompatible with C++. b) The senior maintainers of the gcc compiler need to be replaced with people willing to take these issues seriously. Right now they are focused on how fast their micro benchmarks run at the expense of everything else.
- pjmlp 7y ago
  C and C++ had already a dispute. C++ community mostly adopts ISO C libraries post C89 and everything that has safer alternatives in C++ has been left out. C style coding is discouraged in modern teaching materials for C++. Signed integer arithmetic has been partially fixed. Core guidelines are being pushed and for C++23 there are a couple of papers regarding improving the whole UB stuff.
- roca 7y ago
  > Both of those solve 90% of these sorts of problems. A lot less than 90% in the graphs at https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se.... Use-after-free and type-confusion bugs definitely aren't addressed by bounds-checking or split-stack approaches; many heap corruption bugs aren't either.

Just a naive question probably but, is there any particular reason why security related executables like sudo aren't replaced with versions written with a bounds checked language like say Go or Rust?

bsagdiyev 7y ago

Because this is a tired and tried question asked every time. You are welcome to do it yourself instead of forcing it upon others.

_-___________-_ 7y ago

Nobody's done it yet.

Jaxan 7y ago

Microsoft does this. They are reimplementing a lot of internet protocols using Fstar. So not only bounds checking, but also verified. But it’s a huge undertaking!

simion314 7y ago

There are people doing that, there is one or more kernles written in Rust but still even Rust evangelist are not using it daily but demand for people to waste time rewriting in Rust. A technical reason for GNU/Linux not to use Rust or Go is that C supports a lot more platforms so you can't replace core components at this moment, also I want to remind you that memory safe languages existed before Go and Rust and the only project I am aware to create a safe OS and utilities was Midori by Microsoft. Firefox and it's dependencies is not yet 100% Rust so I honestly expect a new browser started from scratch in a safe language to be done before Firefox is "ported".

the8472 7y ago
> I honestly expect a new browser started from scratch in a safe language to be done before Firefox is "ported". That is a gargantuan project considering all the standards you need to support to have a competitive web browser. Especially javascript engine, video codecs and webgl are attack surfaces that is difficult to replace with code written in a safe language.
- simion314 7y ago
  >That is a gargantuan project I think is less work then pressuring existing projects to be rewritten in Rust. I would usggest Rust fans to pcik one of those dependencies like a codec and reimplementit in Rust or gather money to pay someone to do it, I think it would be faster and less hostile.
  - the8472 7y ago
    What do you think mozilla is doing? They're certainly not being pressured.
    - simion314 7y ago
      From what I read Mozilla fired one or more Rust developers related to the JIT or the interpreter and IMO the JIT should have been the first thing rewritten in Rust since that is one of the components that run arbitrary code. I really hope they can finish the port and I can't wait to see how many zero days will it have.
      - khc 7y ago
        most of the JIT bugs were probably due to generating unsafe code instead of generating from unsafe code. Rewriting a new JIT will probably increase the number of zero days.
_-___________-_ 7y ago
Redox is a pretty impressive project. One could almost use it as a desktop OS already, except that it has no working USB input support yet.
- Thaxll 7y ago
  Redox is probably more unsafe that Linux is. The 20% of unsafe stuff going in there had 0 review from serious security standpoint.
  - staticassertion 7y ago
    That's a ridiculous statement. Most of Linux isn't reviewed by security experts either... and the codebase for linux absolutely dwarfs redox, and every line of Linux is C.
    - techntoke 7y ago
      > Most of Linux isn't reviewed by security experts either Where are you getting your information from?
      - deleted 7y ago
        [deleted]
      - pjmlp 7y ago
        For starters from Google, with their Linux Kernel Self Preservation project, where an endless list of exploits have been fixed, starting by removal from all VLAs in the kernel source. Going forward, all Android devices on ARM are required to use ARM MTE, because the only way to keep C develoeprs on track is to have hardware control their pointer usage. https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html https://security.googleblog.com/2019/08/adopting-arm-memory-... And as of NDK 21, Fortify is enabled by default, https://android-developers.googleblog.com/2019/10/introducing-ndk-r21-our-first-long-term.html https://android-developers.googleblog.com/2019/10/introducin... Given that Linux kernel downstream on Qubes , ChromeOS and Android are the only ones with all of the security counter measured turned on, that speaks a lot for the standard Linux kernel on random distribution X.

deleted 7y ago

[deleted]

vortico 7y ago

Just thinking numbers, there might be 100 free software projects that you'd consider "security related", and each might take a couple person-years of development time to port on average. If you put a ballpark salary of $50k to that time, that's around $100,000*100 = $10M. And that's a conservative estimate because each of those factors are probably too low.

Gibbon1 7y ago

There have been efforts to create bounds checked compilers for C. And split stacks as well. Both of those solve 90% of these sorts of problems. I think the real problem is a) C and C++ need a divorce. Because the things that you would do to really fix C make it incompatible with C++. b) The senior maintainers of the gcc compiler need to be replaced with people willing to take these issues seriously. Right now they are focused on how fast their micro benchmarks run at the expense of everything else.

pjmlp 7y ago
C and C++ had already a dispute. C++ community mostly adopts ISO C libraries post C89 and everything that has safer alternatives in C++ has been left out. C style coding is discouraged in modern teaching materials for C++. Signed integer arithmetic has been partially fixed. Core guidelines are being pushed and for C++23 there are a couple of papers regarding improving the whole UB stuff.
roca 7y ago
> Both of those solve 90% of these sorts of problems. A lot less than 90% in the graphs at https://www.zdnet.com/article/microsoft-70-percent-of-all-security-bugs-are-memory-safety-issues/ https://www.zdnet.com/article/microsoft-70-percent-of-all-se.... Use-after-free and type-confusion bugs definitely aren't addressed by bounds-checking or split-stack approaches; many heap corruption bugs aren't either.