4 ms·

I think the real benchmark is a large "C" project writen fully in Rust and to compare the issues on the long term, not sure it's safe to asume that Rust would f

by Thaxll 6y ago

I think the real benchmark is a large "C" project writen fully in Rust and to compare the issues on the long term, not sure it's safe to asume that Rust would fix all the security issues with all the unsafe code that would be? What a 1.5M LoC Rust low level kind of project looks like?

bluejekyll 6y ago
My favorite project to point people towards to understand how unsafety can be highly isolated is the work here: https://os.phil-opp.com/ https://os.phil-opp.com/ That very low level educational project can show how little unsafe is needed even at things running on bare metal.
MiroF 6y ago
Well, actix-web is a pretty large project written fully in Rust and it never really had any issues with lack of safety.
- 59nadir 6y ago
  The irony of this statement when the author was hounded tirelessly by the Memory Safety Mafia until he plain didn't want to work on it anymore...
  - MiroF 6y ago
    It was meant sarcastically.
nicoburns 6y ago
> I think the real benchmark is a large "C" project writen fully in Rust and to compare the issues on the long term, not sure it's safe to asume that Rust would fix all the security issues with all the unsafe code that would be? I think you overestimate how much unsafe would be required. Most code, even low-level code can be safe.
staticassertion 6y ago
Honestly, I think anyone who has written Rust, even low level Rust, intuitively understands that it wouldn't even be close. It's not really worth measuring - like measuring C vs Java, no one really needs to do it because it's so obvious that C will have many times more memory safety issues.
- nullc 6y ago
  Bad science. Rust code does have unsafe at times, so it can still have memory safety issues. It may not matter that your program is memory safe if it was written by people who don't understand the problem domain and doesn't work correctly. E.g. for qemu, it's perfectly possible to be absurdly vulnerable -- giving target code control of the host -- without any memory safety bug at all.
  - staticassertion 6y ago
    In fact it's not science at all. I didn't claim it was science, I claimed it was so obvious and intuitive that science was unnecessary. > without any memory safety bug at all. Most QEMU escapes I have seen are memory safety issues in emulated devices.
stefanha 6y ago
> not sure it's safe to asume that Rust would fix all the security issues with all the unsafe code that would be? Hi, Article author here. I am not assuming Rust will fix all security issues. Bugs are still possible even in safe code, plus there will be unsafe code as you mentioned. Unsafe code also worried me when evaluating Rust. Given the nature of Virtual Machine Monitors and emulators, isn't a lot of the program going to be unsafe? After studying existing Rust codebases and writing programs myself I found that it's still a significant improvement over C. Whether Rust is safe enough depends on your requirements. For the QEMU, I think the answer is yes. For writing the firmware for a pacemaker implant or control software for a nuclear powerplant, I don't know :).

by Thaxll 6y ago

bluejekyll 6y ago

My favorite project to point people towards to understand how unsafety can be highly isolated is the work here: https://os.phil-opp.com/ https://os.phil-opp.com/ That very low level educational project can show how little unsafe is needed even at things running on bare metal.

MiroF 6y ago

Well, actix-web is a pretty large project written fully in Rust and it never really had any issues with lack of safety.

59nadir 6y ago
The irony of this statement when the author was hounded tirelessly by the Memory Safety Mafia until he plain didn't want to work on it anymore...
- MiroF 6y ago
  It was meant sarcastically.

nicoburns 6y ago

> I think the real benchmark is a large "C" project writen fully in Rust and to compare the issues on the long term, not sure it's safe to asume that Rust would fix all the security issues with all the unsafe code that would be? I think you overestimate how much unsafe would be required. Most code, even low-level code can be safe.

staticassertion 6y ago

Honestly, I think anyone who has written Rust, even low level Rust, intuitively understands that it wouldn't even be close. It's not really worth measuring - like measuring C vs Java, no one really needs to do it because it's so obvious that C will have many times more memory safety issues.

nullc 6y ago
Bad science. Rust code does have unsafe at times, so it can still have memory safety issues. It may not matter that your program is memory safe if it was written by people who don't understand the problem domain and doesn't work correctly. E.g. for qemu, it's perfectly possible to be absurdly vulnerable -- giving target code control of the host -- without any memory safety bug at all.
- staticassertion 6y ago
  In fact it's not science at all. I didn't claim it was science, I claimed it was so obvious and intuitive that science was unnecessary. > without any memory safety bug at all. Most QEMU escapes I have seen are memory safety issues in emulated devices.

stefanha 6y ago

> not sure it's safe to asume that Rust would fix all the security issues with all the unsafe code that would be? Hi, Article author here. I am not assuming Rust will fix all security issues. Bugs are still possible even in safe code, plus there will be unsafe code as you mentioned. Unsafe code also worried me when evaluating Rust. Given the nature of Virtual Machine Monitors and emulators, isn't a lot of the program going to be unsafe? After studying existing Rust codebases and writing programs myself I found that it's still a significant improvement over C. Whether Rust is safe enough depends on your requirements. For the QEMU, I think the answer is yes. For writing the firmware for a pacemaker implant or control software for a nuclear powerplant, I don't know :).