5 ms·

How about this - every time a problem like this is found, the affected component is rewritten in Rust. Kinda like how a bug should ideally be fixed by reproduc

How about this - every time a problem like this is found, the affected component is rewritten in Rust. Kinda like how a bug should ideally be fixed by reproducing the issue with a unit test first - the test ensures that particular problem won't come back. AFAIK that's possible for C - a project can be rewritten in Rust one function at a time - but I acknowledge it may not be possible or practical for C++ or other languages. Thing is, there's going to be tons of old C in Windows that is perfectly safe. That code doesn't need to be changed - and with this model, it wouldn't be. What needs to be changed is components like SMB which has been the source of a few high profile vulnerabilities before.

muricula 7y ago
When Rust calls into C code it completely loses almost all of its safety guarantees. Having a codebase which is half C and half Rust sounds worse to read and reason about than all either. Additionally, most Windows code is C++ with Windows specific language extensions (COM, Structured Exception Handling, and others). I think most C++ code should be rewritten in Rust library by library, but most software is not properly constructed as a series of libraries. And asking a business to rewrite working code in a brand new language instead of fixing a buffer overflow is a difficult ask.
- pjmlp 7y ago
  Microsoft is already had an internal Rust summit, https://twitter.com/ryan_levick/status/1225837057186000896?s=19 https://twitter.com/ryan_levick/status/1225837057186000896?s... and are doing other experiences as well, https://www.infoq.com/news/2019/11/microsoft-exploring-rust-safety/ https://www.infoq.com/news/2019/11/microsoft-exploring-rust-... https://msrc-blog.microsoft.com/2019/11/07/using-rust-in-windows/ https://msrc-blog.microsoft.com/2019/11/07/using-rust-in-win... Kenny Kerr, the original author of C++/Winrt, which replaced C++/CX, has now turned into Rust. https://kennykerr.ca/2020/02/22/rust-winrt-coming-soon/ https://kennykerr.ca/2020/02/22/rust-winrt-coming-soon/ They are also motivated to actually make C safer, with Checked C project, something that ISO C doesn't seem to care that much. https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/ As per MSRC advisory, new code should be a mix of .NET, Rust or Core Guidelines compliant C++, depending on the use case.
  - ldeangelis 7y ago
    There's also Project Verona [0], a research project inspired by Rust, Cyclone and Pony. [0]: https://github.com/microsoft/verona https://github.com/microsoft/verona
- Const-me 7y ago
  COM is not windows specific, and it doesn’t require any language extensions. You can implement and consume these objects with GCC on ARM Linux just fine: https://github.com/Const-me/ComLightInterop https://github.com/Const-me/ComLightInterop
- cyphar 7y ago
  > When Rust calls into C code it completely loses almost all of its safety guarantees. Not really, it means that if there is a memory safety bug it must be either in an unsafe block or foreign C code (which also must be called in an unsafe block). While technically any C code could completely invalidate Rust's memory model, in practice that is almost always a C bug which you can debug more easily if much less of your codebase is in C (or equivalently, unsafe Rust). > Having a codebase which is half C and half Rust sounds worse to read and reason about than all either. I think that really depends how it's structured. You would probably want to avoid something like Rust calling C calling Rust calling C (calling Rust calling ... etc), but if the codebase is already separated into modules or even separate libraries you could rewrite a library or module while maintaining the same C API (and that Rust or C module can be read independently from the rest of the codebase).
de_watcher 7y ago
What I need is a seamless interop between C++ and Rust structures. The closest is maybe what the WebAssembly can do. That way functions written in both languages can be mixed.

muricula 7y ago

When Rust calls into C code it completely loses almost all of its safety guarantees. Having a codebase which is half C and half Rust sounds worse to read and reason about than all either. Additionally, most Windows code is C++ with Windows specific language extensions (COM, Structured Exception Handling, and others). I think most C++ code should be rewritten in Rust library by library, but most software is not properly constructed as a series of libraries. And asking a business to rewrite working code in a brand new language instead of fixing a buffer overflow is a difficult ask.

pjmlp 7y ago
Microsoft is already had an internal Rust summit, https://twitter.com/ryan_levick/status/1225837057186000896?s=19 https://twitter.com/ryan_levick/status/1225837057186000896?s... and are doing other experiences as well, https://www.infoq.com/news/2019/11/microsoft-exploring-rust-safety/ https://www.infoq.com/news/2019/11/microsoft-exploring-rust-... https://msrc-blog.microsoft.com/2019/11/07/using-rust-in-windows/ https://msrc-blog.microsoft.com/2019/11/07/using-rust-in-win... Kenny Kerr, the original author of C++/Winrt, which replaced C++/CX, has now turned into Rust. https://kennykerr.ca/2020/02/22/rust-winrt-coming-soon/ https://kennykerr.ca/2020/02/22/rust-winrt-coming-soon/ They are also motivated to actually make C safer, with Checked C project, something that ISO C doesn't seem to care that much. https://www.microsoft.com/en-us/research/project/checked-c/ https://www.microsoft.com/en-us/research/project/checked-c/ As per MSRC advisory, new code should be a mix of .NET, Rust or Core Guidelines compliant C++, depending on the use case.
- ldeangelis 7y ago
  There's also Project Verona [0], a research project inspired by Rust, Cyclone and Pony. [0]: https://github.com/microsoft/verona https://github.com/microsoft/verona
Const-me 7y ago
COM is not windows specific, and it doesn’t require any language extensions. You can implement and consume these objects with GCC on ARM Linux just fine: https://github.com/Const-me/ComLightInterop https://github.com/Const-me/ComLightInterop
cyphar 7y ago
> When Rust calls into C code it completely loses almost all of its safety guarantees. Not really, it means that if there is a memory safety bug it must be either in an unsafe block or foreign C code (which also must be called in an unsafe block). While technically any C code could completely invalidate Rust's memory model, in practice that is almost always a C bug which you can debug more easily if much less of your codebase is in C (or equivalently, unsafe Rust). > Having a codebase which is half C and half Rust sounds worse to read and reason about than all either. I think that really depends how it's structured. You would probably want to avoid something like Rust calling C calling Rust calling C (calling Rust calling ... etc), but if the codebase is already separated into modules or even separate libraries you could rewrite a library or module while maintaining the same C API (and that Rust or C module can be read independently from the rest of the codebase).

de_watcher 7y ago

What I need is a seamless interop between C++ and Rust structures. The closest is maybe what the WebAssembly can do. That way functions written in both languages can be mixed.