4 ms·

> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rust https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rust Almost all of those are due to code in unsafe blo

> https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rust https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=rust Almost all of those are due to code in unsafe blocks. In other words, not safe rust. A few are cryptographic errors. No argument there, Rust won't save you from that. FWIW Rust does badly need a standardized unsafe-block auditing mechanism. Like "show me all the unsafe blocks in my code or any of the libraries it uses, except the standard library". If that list is too long to read, that's a bug in your project.

sitkack 6y ago
Related to what you are looking for is https://github.com/rust-secure-code/cargo-geiger https://github.com/rust-secure-code/cargo-geiger which analyzes the dependency tree for unsafe but afaik it doesn't actually show each individual block. The readme is quite good.
- octoberfranklin 6y ago
  Wow, yeah, that's exactly the technological aspect of what I had in mind. I guess all that's left is the socialogical aspect: packages' "geiger" status ought to be treated as being as important as their dependencies. In other words, lib.rs/docs.rs/crates.io ought to display these data in all the sorts of places where they list the dependencies of a package. It would also be great if this tool were made a standard part of cargo. I think it's important enough to deserve that status.
  - sitkack 6y ago
    I think this would be a docs.rs or lib.rs feature, I used to think crates.io was that place but it is not. I could see there being all kinds of scans of dependencies, like enforcing test coverage, builds and tests passing on certain platforms (risc-v, wasi, etc).
    - octoberfranklin 6y ago
      No, see, my point is that this is as important as dependencies. Anything that tracks dependencies ought to be tracking transitive unsafeness. That's the mindset shift the Rust world needs. Otherwise we're going to keep getting these (in some sense valid) complaints about how Rust isn't memory-safe because it has unsafe-blocks.
      - sitkack 6y ago
        Safety is top of mind for a large percentage of the Rust community. There was major political drama when the fastest http framework liberally used unsafe. That framework was almost universally shunned because of it and now the vast majority of the use of unsafe in that project have been removed. I think we are in a good position, but there could be in effect, a Sybil attack against norms where if unsafe was an Ok thing to do for perf or expediency that the value of Rust would be largely obliterated. My personal hope is that lib.rs and docs.rs replace crates.io and that safety, code coverage, perf and other dimensions of quality are prominently displayed and queryable. Crates.io as it is now has outlived its usefulness. I believe you and I agree on this issue completely.
Icathian 6y ago
Does this meet the need you're describing? I've been looking for a good project to get my feet wet in rust and your idea sounds like a perfect one, but a quick Google search makes it seem like a solved problem. I'd like to understand what's still left that I might add. Thanks!! https://www.reddit.com/r/rust/comments/8ssjv2/cargogeiger_yet_another_unsafe_rust_finder/?utm_source=amp&utm_medium=&utm_content=post_body https://www.reddit.com/r/rust/comments/8ssjv2/cargogeiger_ye...

sitkack 6y ago

Related to what you are looking for is https://github.com/rust-secure-code/cargo-geiger https://github.com/rust-secure-code/cargo-geiger which analyzes the dependency tree for unsafe but afaik it doesn't actually show each individual block. The readme is quite good.

octoberfranklin 6y ago
Wow, yeah, that's exactly the technological aspect of what I had in mind. I guess all that's left is the socialogical aspect: packages' "geiger" status ought to be treated as being as important as their dependencies. In other words, lib.rs/docs.rs/crates.io ought to display these data in all the sorts of places where they list the dependencies of a package. It would also be great if this tool were made a standard part of cargo. I think it's important enough to deserve that status.
- sitkack 6y ago
  I think this would be a docs.rs or lib.rs feature, I used to think crates.io was that place but it is not. I could see there being all kinds of scans of dependencies, like enforcing test coverage, builds and tests passing on certain platforms (risc-v, wasi, etc).
  - octoberfranklin 6y ago
    No, see, my point is that this is as important as dependencies. Anything that tracks dependencies ought to be tracking transitive unsafeness. That's the mindset shift the Rust world needs. Otherwise we're going to keep getting these (in some sense valid) complaints about how Rust isn't memory-safe because it has unsafe-blocks.
    - sitkack 6y ago
      Safety is top of mind for a large percentage of the Rust community. There was major political drama when the fastest http framework liberally used unsafe. That framework was almost universally shunned because of it and now the vast majority of the use of unsafe in that project have been removed. I think we are in a good position, but there could be in effect, a Sybil attack against norms where if unsafe was an Ok thing to do for perf or expediency that the value of Rust would be largely obliterated. My personal hope is that lib.rs and docs.rs replace crates.io and that safety, code coverage, perf and other dimensions of quality are prominently displayed and queryable. Crates.io as it is now has outlived its usefulness. I believe you and I agree on this issue completely.

Icathian 6y ago

Does this meet the need you're describing? I've been looking for a good project to get my feet wet in rust and your idea sounds like a perfect one, but a quick Google search makes it seem like a solved problem. I'd like to understand what's still left that I might add. Thanks!! https://www.reddit.com/r/rust/comments/8ssjv2/cargogeiger_yet_another_unsafe_rust_finder/?utm_source=amp&utm_medium=&utm_content=post_body https://www.reddit.com/r/rust/comments/8ssjv2/cargogeiger_ye...