5 ms·

The reason for which I want to build my web stuff on Rust is safety. There are so many things that can go wrong on a server (especially on a server under attack

• joelbluminator 6y ago
  > there are very few languages I trust anymore to actually not explode in unpredictable manners Well, that's totally fine. To each his own. I push Ruby production code for 8 years now and I trust it.
  • Yoric 6y ago
    Absolutely, to each their own.
• Minor49er 6y ago
  You're going to hit a lot of other issues with a server before Rust's memory safety becomes a consideration. What's wrong with using Rails / Nginx behind a firewall?
  • Yoric 6y ago
    It's not just memory safety. I've had so many misadventures with JavaScript (and I'm part of the team that writes the Firefox JavaScript VM, so I'm supposed to know better) or Python, for instance, that the simple idea of maintaining an application written in either language brings me down. I fully realize that some people love these languages. I've written pretty sophisticated applications in these languages myself (including video games), and they're definitely great for exploring ideas. But at this stage of my career, for applications that matter to me, I value the time spent maintaining code more than the time spent writing it, and I find that the balance that works best for me is to use a strongly, statically-typed language such as Rust. YMMV
    • anonymousDan 6y ago
      Can you give some concrete examples of where rust is beneficial? Is it just the static typing? Why not use something like Java, C# or even Haskell if so?
      • couchand 6y ago
        Not the OP, but: Haskell's type system is great, and you can write a lot of functionality in not much code. It might be hard to find many developers who will feel confident picking it up. C# maybe, it's quite mature, and has the benefit of interop with F#. But both C# and Java suffer from the greatest indignity to programmers: null.
        • carlhjerpe 6y ago
          C# has non nullable reference types since C#8 which is a step in the right direction. https://devblogs.microsoft.com/dotnet/embracing-nullable-reference-types/ https://devblogs.microsoft.com/dotnet/embracing-nullable-ref...
      • Yoric 6y ago
        First, I want to clarify that I'm not advocating Rust for all use cases. It just happens so that Rust is pretty well matched for the kind of things I generally need. Now, Haskell or (modern) Java or C# are good languages, too, and they're by far not the only ones. If you wish examples of the kind of features I need: 1. I pretty systematically need to juggle with many threads; 2. I very often need to juggle with many processes, with non-trivial interactions (i.e. actual protocols); 3. I very often need to access the OS; 4. I pretty systematically need to juggle with sophisticated data structures and algorithms (think graph matching algorithms, or dynamic trees of dependencies between ongoing tasks); 5. I regularly need to handle distributed applications in which pieces interact through non-trivial protocols; 6. I pretty systematically need to ensure that the event loop remains responsive. 7. Whenever I interact with the rest of the world (either the OS or as a web client or server), I want to be sure of which piece of data is sanitized and which isn't. Of course, every single of these task can be achieved in any language. It just happens so that: 1. Rust has the best support for threads that I know in an industrial language. 2. and 5. Rust's type system is the best I know to express protocols among industrial languages. I hear that Ada's type system is just as good, but I don't know Ada, so I cannot compare. I hear that Haskell's type system is currently being extended with linear types, so I'll need to test-drive that, too. 3. While there are other languages that are at similar level as Rust for such things, I don't know anyone that is strictly better. 4. and 7. Any language with a strong, static type system is good here, including Rust and all your examples. 6. Great support for coroutines is really useful. Many languages have it these days, including Rust. Once again, to clarify, I'm not trying to convince everyone to switch to Rust. I'm just answering the assertion that the only reason to use Rust is performance. That's certainly not the case for me.
  • tlamponi 6y ago
    safety isn't "security safety", the things a firewall protect you from can also be an issue with rust. It's much more a safety that you do not crash, due to input, side effects, parallelism (locking) errors, mapping wrong types, derefercencing null in some edge case by accident, ... Rust gives you a lot of guarantees here, that it is extremely fast is just the cherry on top.
    • Minor49er 6y ago
      I didn't say it was security safety. What I'm saying that if you're running a web server, the problems that you face will most likely come from how you programmed and set up the server rather than which language you chose.
      • Yoric 6y ago
        I'm pretty sure that "which language you chose" can have a huge impact on "how you programmed [...] the server".
  • xorcist 6y ago
    What has a firewall to do with anything?
• coldtea 6y ago
  >The reason for which I want to build my web stuff on Rust is safety. Any GC language (Java e.g.) will give you that if you don't use C extensions. And if you do use them Rust wont fair any better (or if you use libraries that use unsafe).
  • Yoric 6y ago
    Any GC language will help, indeed. But there is much, much more to safety than deallocating memory.
    • _wldu 6y ago
      This sort of extremist view is typical of rust proponents and is also why rust has a bad reputation. Java, Go, C# are all extremely safe and performant languages.
      • pjmlp 6y ago
        On top of that, it is common to advocate features that Ada/SPARK or Wirth languages for systems programming have been doing for decades. Although I should make a point that those kind of remarks don't come from the core team.
      • Yoric 6y ago
        How is my remark extremist?
    • coldtea 6y ago
      >Any GC language will help, indeed. But there is much, much more to safety than deallocating memory. Yes, but that's the main allure of Rust. As for the rest (e.g. resource releasing, avoiding concurency issues, avoding not-exhastive mathces, injection, etc.), other languages have their own ways as well, including Java. If those are your main concerns (and not also top-speed) I don't think Rust is worth the extra cost (learning slope, slow compilation times, single implementation, fewer libs and developer tools, etc).
      • 6y ago
• tptacek 6y ago
  You're likely to lose safety implementing a vanilla CRUD app in Rust instead of Django. Rust is mostly buying you memory safety; the rest of its safety features are helpful when building new kinds of applications, but Django CRUD applications follow a well-worn pattern, and the Django developers have done really good work making sure that those patterns are easy to implement securely (usually by default). Meanwhile, safety in a web application is domain-specific, and there isn't much a language can do to protect you. There aren't really Rust features that directly prevent SSRF attacks, or HTTP desync. In fact, my experience assessing Rust (and Go) web applications is that they intend to reincarnate web vulnerabilities that went mostly extinct in Django applications years ago; for instance, I'm virtually never going to find SQLI in a Django application, but Rust web applications are somewhat likely to build their own SQL queries. This will shock and upset some Rust developers to hear (all the popular Rust SQL interfaces force parameterized queries! they're thinking), but it's true. I like Rust, and write more Rust than any other language lately. I'd say the same thing about practically any modern language compared to boring old Django, which is the Volvo of web frameworks. I have nothing much to say about reliability and do recognize that writing in Python or Ruby means that you're also writing ridiculous batteries of unit tests to verify basic things like whether your setters and getters work properly, because the language essentially makes you check your own typos. I'm only talking about security.
  • Yoric 6y ago
    I'm ok with that, I'm not writing CRUD :) Note that I'm not claiming that Rust is the solution to every problem under the sun. It just happens to be pretty much the sweet spot for problems I need to solve, which typically involve concurrency and/or distribution and/or new protocols and/or sophisticated graph algorithms and/or actual OS access.
    • tptacek 6y ago
      Rust is great. It's just really hard to outdo Django for the kinds of apps Django was designed for.
  • couchand 6y ago
    This may be the first time I've ever disagreed with a comment you've made, but here we go! > Meanwhile, safety in a web application is domain-specific, and there isn't much a language can do to protect you. There absolutely is. Rust's expressive type system is a more important feature than the memory-safety guarantees for general purpose programming. This has significant impact on the ability to express security constructs directly in the code. Witness, for instance, the widespread use of typing to distinguish unvalidated and validated user inputs, such as Rocket's RawStr type [0]. Applying that technique can mitigate SSRF attacks without even knowing the details. You can worry all you like about SQLI in Rust, but in the code I've seen it's no more a concern than any web app, and likewise it can be enforced in the type system in a way that sure seems superior to "hope the dev only writes boring Python". I'd agree with the general premise that, all things being equal, the security of something that looks exactly like everything else is higher than some novel construct. But I strongly disagree that there's nothing a language can do to help developers write secure applications, and I'd suggest it starts with an expressive type system. [0]: https://api.rocket.rs/v0.4/rocket/http/struct.RawStr.html https://api.rocket.rs/v0.4/rocket/http/struct.RawStr.html
• dnautics 6y ago
  If you care about web safety, there are a billion other things that can bite you that are not memory safety. Rust by itself will not protect you from an sql injection, timing attacks, rainbow attacks, poorly configured TLS, Unix path drilling. You might have coded an infinite loop that "zero-cost abstractions" has turned into a cpu hog so that a single malicious user can use to DDOS a node. Did you build in the ability to failover across nodes? Or will all of the tenants of that node get nuked when kubernetes misses it's health check and nukes it? So if you actually care about these things, rust might be really poor, because you are spending time fighting the borrow checker instead of thinking about the security surface area of your system, and the language is optimizing for speed in a domain where the bottleneck is usually the network.