5 ms·

This is pretty much a judgment of Rust: Such ecosystems come with incredible costs. For instance, rust cannot even compile itself on i386 at present time

• staticassertion 6y ago
  > This is pretty much a judgment of Rust: I guess. It's really a judgment of Rust (specifically the compiler toolchain) for this one use case. > I would think that OpenBSD developers/users would care about security, Maybe. Again, I think "cat" and other system tools are really low on the list of priorities for anyone securing a system. Not to say that they don't represent attack surface, by any means, but there are just a lot of things to do before rewriting the utility entirely.
  • numbsafari 6y ago
    “cat” and related tools make perfectly interesting exploit targets on Unix systems that follow the Unix philosophy: https://www.cvedetails.com/cve/CVE-2014-9471/ https://www.cvedetails.com/cve/CVE-2014-9471/
    • staticassertion 6y ago
      There is a big difference between being having vulnerabilities and being valuable attack surface. Again, I am not saying that cat and others do not provide attack surface, or even valuable attack surface, only that step 1 is not "rewrite cat". Generally "cat" is not exposed to the internet, and if you're running a service and you said "I'm concerned about local attackers using cat" it's probably a lot easier to just put the service into some sort of environment (container, sandbox, user, whatever) that doesn't give access to cat.
      • numbsafari 6y ago
        > step 1 is not "rewrite cat" Totally agree on this point. In fact, I think it’s brash for the rust armada to think that the borrow checker alone is going to help replace 20+ years of maintenance on these kinds of tools, which often crufty, and gnarled by the sands and whims of generations that preceded us.
        • staticassertion 6y ago
          As a member of the Rust Armada I can tell you that I don't believe that rewriting cat in rust is something I consider a high priority.
    • anthk 6y ago
      That's not BSD cat, that's GNU cat. And I am using AWK and KSH + dcgi in my Gopher server with a chrooted root gopher hole, it works fine.
      • numbsafari 6y ago
        In fact, it’s neither, it’s coreutils (gnu, yes) `date`. My point is that seemingly innocuous system utilities do make for exploit targets, because folks shell to them. Yes, you can lock things down with jails/containers, but it’s a valid target. Defense in depth, and all that jazz.
• naasking 6y ago
  Bizarre that he thinks a language or compiler is doomed unless it can compile itself on each platform it supports. Microcontrollers and cross-compilation wouldn't exist if that were the case.
  • aidenn0 6y ago
    I think it was more the implication that requiring more than 2GB of RAM to compile itself was an indication of its profligate resource usage.
    • qppo 6y ago
      How much of that is Indicative of rustc vs llvm? The latter isn't exact a lightweight piece of software.
      • aidenn0 6y ago
        Until there is a rustc in production that doesn't use llvm to emit code in the backend, the point is moot, no?
        • adrianN 6y ago
          No, I don't think so. If LLVM is at fault then the issue is definitely not inherent to Rust the language or Rust the development culture.
          • kzrdude 6y ago
            Interesting point. Does anyone know how much memory is needed to compile llvm+clang? GCC?
            • anthk 6y ago
              IDK about compiling llvm/clang, but using clang/llvm needs far less memory than gcc. I've used clang in machines with less than 256mb of RAM.
• pnako 6y ago
  They do care about security. They just don't care about Rust.
  • staticassertion 6y ago
    They can not care about more than one thing.